bisecting cause commit starting from 7ddd09fc4b745fb1d8942f95389583e08412e0cd building syzkaller on e30cbdae48129d22c125435cb72fc20447c7a0e2 testing commit 7ddd09fc4b745fb1d8942f95389583e08412e0cd with gcc (GCC) 8.1.0 kernel signature: fbac915afa97bb49c2462f3b03576a7ba6b6cb70 run #0: crashed: WARNING: ODEBUG bug in io_sqe_files_unregister run #1: crashed: WARNING in percpu_ref_exit run #2: crashed: WARNING in percpu_ref_exit run #3: crashed: WARNING in percpu_ref_exit run #4: crashed: WARNING: ODEBUG bug in io_sqe_files_unregister run #5: crashed: WARNING in percpu_ref_exit run #6: crashed: WARNING in percpu_ref_exit run #7: crashed: WARNING in percpu_ref_exit run #8: crashed: WARNING in percpu_ref_exit run #9: crashed: WARNING: ODEBUG bug in io_sqe_files_unregister testing release v5.4 testing commit 219d54332a09e8d8741c1e1982f5eae56099de85 with gcc (GCC) 8.1.0 kernel signature: eac52914ab9321567542097b52e85c8f2beb4717 all runs: OK # git bisect start 7ddd09fc4b745fb1d8942f95389583e08412e0cd 219d54332a09e8d8741c1e1982f5eae56099de85 Bisecting: 9519 revisions left to test after this (roughly 13 steps) [ddebe839c6013ab42f376bdeaaaf66bd0c0d68d6] Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux testing commit ddebe839c6013ab42f376bdeaaaf66bd0c0d68d6 with gcc (GCC) 8.1.0 kernel signature: a1e7c7fe61a54289ddb059fff846f338be742cd6 all runs: OK # git bisect good ddebe839c6013ab42f376bdeaaaf66bd0c0d68d6 Bisecting: 4770 revisions left to test after this (roughly 12 steps) [9bd7eaa8e6e729307781b9f19cf514a2977c7832] Merge remote-tracking branch 'kbuild/for-next' testing commit 9bd7eaa8e6e729307781b9f19cf514a2977c7832 with gcc (GCC) 8.1.0 kernel signature: 64eba04df176753655c62548621908ac0252c3de all runs: OK # git bisect good 9bd7eaa8e6e729307781b9f19cf514a2977c7832 Bisecting: 2154 revisions left to test after this (roughly 11 steps) [58d1cf12662cdc07057a90ae6b9ecf7f1409b0f9] Merge remote-tracking branch 'drm/drm-next' testing commit 58d1cf12662cdc07057a90ae6b9ecf7f1409b0f9 with gcc (GCC) 8.1.0 kernel signature: d03769d1d7eba0a51982ce8a6a51da377f926b06 all runs: OK # git bisect good 58d1cf12662cdc07057a90ae6b9ecf7f1409b0f9 Bisecting: 1077 revisions left to test after this (roughly 10 steps) [a6874cba62db51cc00ecea752b6fc6a799498730] Merge remote-tracking branch 'battery/for-next' testing commit a6874cba62db51cc00ecea752b6fc6a799498730 with gcc (GCC) 8.1.0 kernel signature: 8439ed08fc55e8fc319aeb181dd27c8338ad81ee run #0: crashed: WARNING: ODEBUG bug in io_sqe_files_unregister run #1: crashed: WARNING in percpu_ref_exit run #2: crashed: WARNING in percpu_ref_exit run #3: crashed: WARNING in percpu_ref_exit run #4: crashed: WARNING in percpu_ref_exit run #5: crashed: WARNING in percpu_ref_exit run #6: crashed: WARNING in percpu_ref_exit run #7: crashed: WARNING: ODEBUG bug in io_sqe_files_unregister run #8: crashed: WARNING in percpu_ref_exit run #9: crashed: WARNING: ODEBUG bug in io_sqe_files_unregister # git bisect bad a6874cba62db51cc00ecea752b6fc6a799498730 Bisecting: 512 revisions left to test after this (roughly 9 steps) [dadf05112e514305c7bf901f9d15ecf3bc54a465] Merge remote-tracking branch 'drm-intel/for-linux-next' testing commit dadf05112e514305c7bf901f9d15ecf3bc54a465 with gcc (GCC) 8.1.0 kernel signature: 493b458d37a95b7bb76223137ae476841c9b7859 all runs: OK # git bisect good dadf05112e514305c7bf901f9d15ecf3bc54a465 Bisecting: 276 revisions left to test after this (roughly 8 steps) [76fc7298494407ab00cffbd9466dd739aead864f] Merge remote-tracking branch 'sound/for-next' testing commit 76fc7298494407ab00cffbd9466dd739aead864f with gcc (GCC) 8.1.0 kernel signature: 5ea295409c19a264aa57cc6603b5fa319ae7db5b run #0: basic kernel testing failed: failed to copy test binary to VM: failed to run ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "BatchMode=yes" "-o" "IdentitiesOnly=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-i" "/syzkaller/jobs/linux/workdir/image/key" "/tmp/syz-executor258999481" "root@10.128.0.199:./syz-executor258999481"]: exit status 1 ssh: connect to host 10.128.0.199 port 22: Connection timed out lost connection run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: crashed: WARNING: ODEBUG bug in netdev_freemem # git bisect bad 76fc7298494407ab00cffbd9466dd739aead864f Bisecting: 117 revisions left to test after this (roughly 7 steps) [1b97a87f44d848253d1249f0bcbe804ed677edc4] ALSA: ice1712: Support PCM sync_stop testing commit 1b97a87f44d848253d1249f0bcbe804ed677edc4 with gcc (GCC) 8.1.0 kernel signature: 8b5304482f39d556a529f46b5f62c38758a36871 all runs: OK # git bisect good 1b97a87f44d848253d1249f0bcbe804ed677edc4 Bisecting: 58 revisions left to test after this (roughly 6 steps) [24f03be4aa7922ef5c6067d2809c5d90dfe275c9] drm/gem-fb-helper: convert to drm device based logging testing commit 24f03be4aa7922ef5c6067d2809c5d90dfe275c9 with gcc (GCC) 8.1.0 kernel signature: 6ce324b83deaa8c51bc189009c4520132c799979 all runs: OK # git bisect good 24f03be4aa7922ef5c6067d2809c5d90dfe275c9 Bisecting: 29 revisions left to test after this (roughly 5 steps) [271213ef4d0d3a3b80d4cf95c5f2bebb5643e666] ALSA: pcxhr: Support PCM sync_stop testing commit 271213ef4d0d3a3b80d4cf95c5f2bebb5643e666 with gcc (GCC) 8.1.0 kernel signature: 895dacf7852283cdfed1f9c9f2556defac4bf8d5 all runs: OK # git bisect good 271213ef4d0d3a3b80d4cf95c5f2bebb5643e666 Bisecting: 19 revisions left to test after this (roughly 4 steps) [d8cac6207ec1abd3c85cff2625dd3898d59c4df5] ALSA: cmipci: Allow disabling MPU port via module option testing commit d8cac6207ec1abd3c85cff2625dd3898d59c4df5 with gcc (GCC) 8.1.0 kernel signature: d0f760201eabdae2465dd0c3048be492af1b6fa8 run #0: basic kernel testing failed: failed to copy test binary to VM: failed to run ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "BatchMode=yes" "-o" "IdentitiesOnly=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-i" "/syzkaller/jobs/linux/workdir/image/key" "/tmp/syz-executor159614309" "root@10.128.10.48:./syz-executor159614309"]: exit status 1 ssh: connect to host 10.128.10.48 port 22: Connection timed out lost connection run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect good d8cac6207ec1abd3c85cff2625dd3898d59c4df5 Bisecting: 9 revisions left to test after this (roughly 3 steps) [df1d6ea05a75104b8e7dc642cc5d3f9c4b80d58b] Merge tag 'y2038-alsa-v8-signed' of git://git.kernel.org:/pub/scm/linux/kernel/git/arnd/playground into for-next testing commit df1d6ea05a75104b8e7dc642cc5d3f9c4b80d58b with gcc (GCC) 8.1.0 kernel signature: d8d07f747b5f2d2fbf9e4885f24a69869421af9f all runs: OK # git bisect good df1d6ea05a75104b8e7dc642cc5d3f9c4b80d58b Bisecting: 4 revisions left to test after this (roughly 2 steps) [e8ded3ff74751e588278ccd2ef360f87168e6227] Merge remote-tracking branch 'mali-dp/for-upstream/mali-dp' testing commit e8ded3ff74751e588278ccd2ef360f87168e6227 with gcc (GCC) 8.1.0 kernel signature: 19f5b2a81714de71fcb1ccaac9575cd83ebae716 all runs: OK # git bisect good e8ded3ff74751e588278ccd2ef360f87168e6227 Bisecting: 2 revisions left to test after this (roughly 1 step) [a032ff0e8065668e672eb2e223e265b7808f35a3] Merge branch 'for-linus' into for-next testing commit a032ff0e8065668e672eb2e223e265b7808f35a3 with gcc (GCC) 8.1.0 kernel signature: 459a7f680475244126b8b1fb64516fb540f6727b all runs: OK # git bisect good a032ff0e8065668e672eb2e223e265b7808f35a3 Bisecting: 0 revisions left to test after this (roughly 1 step) [fd6e1cbfdf3e82d12e99122acd83e86c2bb2983f] Merge remote-tracking branch 'etnaviv/etnaviv/next' testing commit fd6e1cbfdf3e82d12e99122acd83e86c2bb2983f with gcc (GCC) 8.1.0 kernel signature: 95d567511e244aef8aeb0340d22fe2c74875b678 all runs: OK # git bisect good fd6e1cbfdf3e82d12e99122acd83e86c2bb2983f 76fc7298494407ab00cffbd9466dd739aead864f is the first bad commit commit 76fc7298494407ab00cffbd9466dd739aead864f Merge: fd6e1cbfdf3e a032ff0e8065 Author: Stephen Rothwell Date: Fri Dec 20 11:15:50 2019 +1100 Merge remote-tracking branch 'sound/for-next' Documentation/sound/alsa-configuration.rst | 3 +- include/sound/hda_codec.h | 1 - include/sound/hdaudio.h | 2 + include/sound/pcm.h | 74 ++++++-- include/sound/soc-component.h | 4 +- include/sound/timer.h | 4 +- include/uapi/sound/asound.h | 145 +++++++++++++-- sound/aoa/soundbus/i2sbus/pcm.c | 13 +- sound/arm/aaci.c | 42 ++--- sound/arm/pxa2xx-ac97.c | 1 - sound/atmel/ac97c.c | 22 +-- sound/core/pcm.c | 12 +- sound/core/pcm_compat.c | 282 +++++++---------------------- sound/core/pcm_lib.c | 39 ++-- sound/core/pcm_native.c | 226 ++++++++++++++++++++--- sound/core/rawmidi.c | 132 +++++++++++--- sound/core/rawmidi_compat.c | 87 +++------ sound/core/timer.c | 230 +++++++++++++++++------ sound/core/timer_compat.c | 62 +------ sound/drivers/aloop.c | 15 +- sound/drivers/dummy.c | 16 +- sound/drivers/ml403-ac97cr.c | 31 +--- sound/drivers/pcsp/pcsp_lib.c | 18 +- sound/drivers/vx/vx_pcm.c | 29 +-- sound/firewire/bebob/bebob_pcm.c | 13 +- sound/firewire/dice/dice-pcm.c | 15 +- sound/firewire/digi00x/digi00x-pcm.c | 13 +- sound/firewire/fireface/ff-pcm.c | 13 +- sound/firewire/fireworks/fireworks_pcm.c | 13 +- sound/firewire/isight.c | 11 +- sound/firewire/motu/motu-pcm.c | 13 +- sound/firewire/oxfw/oxfw-pcm.c | 21 +-- sound/firewire/tascam/tascam-pcm.c | 13 +- sound/hda/hdac_bus.c | 1 + sound/hda/hdac_controller.c | 29 ++- sound/isa/ad1816a/ad1816a_lib.c | 23 +-- sound/isa/cmi8330.c | 5 +- sound/isa/es1688/es1688_lib.c | 29 +-- sound/isa/es18xx.c | 27 +-- sound/isa/gus/gus_main.c | 1 + sound/isa/gus/gus_pcm.c | 30 +-- sound/isa/gus/gusmax.c | 3 +- sound/isa/gus/interwave.c | 1 + sound/isa/msnd/msnd.c | 2 - sound/isa/msnd/msnd_pinnacle.c | 1 + sound/isa/opl3sa2.c | 1 + sound/isa/opti9xx/opti92x-ad1848.c | 1 + sound/isa/sb/emu8000_pcm.c | 1 - sound/isa/sb/sb16_main.c | 23 +-- sound/isa/sb/sb8_main.c | 23 +-- sound/isa/sb/sb_common.c | 1 + sound/isa/wavefront/wavefront.c | 1 + sound/isa/wss/wss_lib.c | 26 +-- sound/mips/hal2.c | 27 +-- sound/mips/sgio2audio.c | 23 +-- sound/parisc/harmony.c | 20 +- sound/pci/ad1889.c | 28 +-- sound/pci/ali5451/ali5451.c | 37 +--- sound/pci/als300.c | 27 +-- sound/pci/als4000.c | 25 +-- sound/pci/asihpi/asihpi.c | 27 +-- sound/pci/atiixp.c | 19 +- sound/pci/atiixp_modem.c | 13 +- sound/pci/au88x0/au88x0.c | 1 + sound/pci/au88x0/au88x0_pcm.c | 16 +- sound/pci/aw2/aw2-alsa.c | 48 ++--- sound/pci/azt3328.c | 35 +--- sound/pci/bt87x.c | 17 +- sound/pci/ca0106/ca0106_main.c | 65 +------ sound/pci/cmipci.c | 47 ++--- sound/pci/cs4281.c | 27 +-- sound/pci/cs46xx/cs46xx_lib.c | 11 +- sound/pci/cs5535audio/cs5535audio.c | 2 +- sound/pci/cs5535audio/cs5535audio_pcm.c | 14 +- sound/pci/ctxfi/cthw20k1.c | 4 +- sound/pci/ctxfi/cthw20k2.c | 1 + sound/pci/ctxfi/ctpcm.c | 17 +- sound/pci/echoaudio/echoaudio.c | 26 +-- sound/pci/emu10k1/emu10k1_main.c | 1 + sound/pci/emu10k1/emu10k1x.c | 18 +- sound/pci/emu10k1/emupcm.c | 47 +---- sound/pci/emu10k1/p16v.c | 50 +---- sound/pci/ens1370.c | 34 +--- sound/pci/es1938.c | 33 +--- sound/pci/es1968.c | 5 +- sound/pci/fm801.c | 23 +-- sound/pci/hda/hda_controller.c | 74 ++------ sound/pci/hda/hda_intel.c | 6 +- sound/pci/hda/hda_tegra.c | 7 +- sound/pci/hda/patch_ca0110.c | 2 +- sound/pci/hda/patch_sigmatel.c | 2 +- sound/pci/ice1712/ice1712.c | 49 +---- sound/pci/ice1712/ice1724.c | 32 +--- sound/pci/intel8x0.c | 27 +-- sound/pci/intel8x0m.c | 28 +-- sound/pci/korg1212/korg1212.c | 1 + sound/pci/lola/lola.c | 2 +- sound/pci/lola/lola_pcm.c | 12 +- sound/pci/lx6464es/lx6464es.c | 17 +- sound/pci/maestro3.c | 12 +- sound/pci/mixart/mixart.c | 17 +- sound/pci/nm256/nm256.c | 4 +- sound/pci/oxygen/oxygen_lib.c | 2 +- sound/pci/oxygen/oxygen_pcm.c | 58 +++--- sound/pci/pcxhr/pcxhr.c | 33 +--- sound/pci/riptide/riptide.c | 13 +- sound/pci/rme32.c | 44 +---- sound/pci/rme96.c | 5 +- sound/pci/rme9652/hdsp.c | 1 + sound/pci/rme9652/hdspm.c | 1 + sound/pci/rme9652/rme9652.c | 1 + sound/pci/sis7019.c | 28 +-- sound/pci/sonicvibes.c | 23 +-- sound/pci/trident/trident_main.c | 81 ++------- sound/pci/via82xx.c | 53 ++---- sound/pci/via82xx_modem.c | 14 +- sound/pci/vx222/vx222.c | 1 + sound/pci/ymfpci/ymfpci_main.c | 39 +--- sound/pcmcia/pdaudiocf/pdaudiocf.c | 1 + sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c | 26 +-- sound/pcmcia/vx/vxpocket.c | 1 + sound/ppc/pmac.c | 30 +-- sound/ppc/snd_ps3.c | 29 +-- sound/sh/aica.c | 30 +-- sound/sh/sh_dac_audio.c | 21 +-- sound/soc/intel/skylake/skl-pcm.c | 4 +- sound/sparc/amd7930.c | 22 +-- sound/sparc/cs4231.c | 19 +- sound/sparc/dbri.c | 14 +- sound/spi/at73c213.c | 12 +- sound/usb/6fire/pcm.c | 18 +- sound/usb/caiaq/audio.c | 14 +- sound/usb/hiface/pcm.c | 19 +- sound/usb/line6/capture.c | 1 - sound/usb/line6/pcm.c | 13 +- sound/usb/line6/playback.c | 1 - sound/usb/misc/ua101.c | 25 +-- sound/usb/pcm.c | 58 +++--- sound/usb/usx2y/usX2Yhwdep.c | 2 +- sound/usb/usx2y/usbusx2yaudio.c | 27 +-- sound/usb/usx2y/usx2yhwdeppcm.c | 19 +- sound/x86/intel_hdmi_audio.c | 17 +- sound/xen/xen_snd_front_alsa.c | 2 - 143 files changed, 1369 insertions(+), 2377 deletions(-) revisions tested: 16, total time: 4h22m36.542221389s (build: 1h36m47.273448555s, test: 2h44m23.61463629s) first bad commit: 76fc7298494407ab00cffbd9466dd739aead864f Merge remote-tracking branch 'sound/for-next' cc: ["sfr@canb.auug.org.au"] crash: WARNING: ODEBUG bug in netdev_freemem bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): Released all slaves ------------[ cut here ]------------ ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x90 arch/x86/include/asm/paravirt.h:752 WARNING: CPU: 0 PID: 43 at lib/debugobjects.c:484 debug_print_object+0x168/0x210 lib/debugobjects.c:481 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 43 Comm: kworker/u4:2 Not tainted 5.5.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: netns cleanup_net Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x12d/0x187 lib/dump_stack.c:118 panic+0x22a/0x4e3 kernel/panic.c:221 __warn.cold.10+0x25/0x2a kernel/panic.c:582 report_bug+0x1b0/0x270 lib/bug.c:195 fixup_bug arch/x86/kernel/traps.c:174 [inline] do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:267 do_invalid_op+0x36/0x40 arch/x86/kernel/traps.c:286 invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1027 RIP: 0010:debug_print_object+0x168/0x210 lib/debugobjects.c:481 Code: cc 87 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 92 00 00 00 48 8b 14 dd 20 5c cc 87 4c 89 fe 48 c7 c7 80 51 cc 87 e8 60 77 f0 fd <0f> 0b 83 05 93 f3 5f 06 01 48 83 c4 18 5b 41 5c 41 5d 41 5e 41 5f RSP: 0018:ffffc90000f37850 EFLAGS: 00010086 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000007 RDI: ffffffff8a928560 RBP: ffffc90000f37890 R08: ffffed1015d445c9 R09: ffffed1015d445c9 R10: ffffed1015d445c8 R11: ffff8880aea22e43 R12: 0000000000000001 R13: ffffffff88da8860 R14: ffffffff815b35d0 R15: ffffffff87cc5880 __debug_check_no_obj_freed lib/debugobjects.c:963 [inline] debug_check_no_obj_freed+0x2db/0x436 lib/debugobjects.c:994 kfree+0xf6/0x2c0 mm/slab.c:3756 kvfree+0x2c/0x30 mm/util.c:603 netdev_freemem+0x47/0x60 net/core/dev.c:9700 netdev_release+0x6c/0x90 net/core/net-sysfs.c:1644 device_release+0x6a/0x1c0 drivers/base/core.c:1358 kobject_cleanup lib/kobject.c:693 [inline] kobject_release lib/kobject.c:722 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put.cold.13+0x209/0x252 lib/kobject.c:739 netdev_run_todo+0x453/0x6b0 net/core/dev.c:9605 rtnl_unlock+0x9/0x10 net/core/rtnetlink.c:112 default_device_exit_batch+0x2f8/0x3e0 net/core/dev.c:10396 ops_exit_list.isra.6+0xdf/0x130 net/core/net_namespace.c:175 cleanup_net+0x499/0x9c0 net/core/net_namespace.c:597 process_one_work+0x856/0x1630 kernel/workqueue.c:2264 worker_thread+0x85/0xb60 kernel/workqueue.c:2410 kthread+0x331/0x3f0 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Kernel Offset: disabled Rebooting in 86400 seconds..