bisecting cause commit starting from b14a260e33ddb4536088a799f24f321593201a64
building syzkaller on f62e1e85cf54ccfa990868a402eca32bf4513b21
testing commit b14a260e33ddb4536088a799f24f321593201a64 with gcc (GCC) 8.1.0
all runs: crashed: WARNING in static_key_slow_try_dec
testing release v5.1
testing commit e93c9c99a629c61837d5a7fc2120cd2b6c70dbdd with gcc (GCC) 8.1.0
all runs: OK
# git bisect start b14a260e33ddb4536088a799f24f321593201a64 v5.1
Bisecting: 8582 revisions left to test after this (roughly 13 steps)
[055128ee008b00fba14e3638e7e84fc2cff8d77d] Merge tag 'dmaengine-5.2-rc1' of git://git.infradead.org/users/vkoul/slave-dma
testing commit 055128ee008b00fba14e3638e7e84fc2cff8d77d with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 055128ee008b00fba14e3638e7e84fc2cff8d77d
Bisecting: 4291 revisions left to test after this (roughly 12 steps)
[1d49ce1e05f804d9238eda66d6010eb492668a37] net/mlx5: Fix mlx5_core_destroy_cq() error flow
testing commit 1d49ce1e05f804d9238eda66d6010eb492668a37 with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 1d49ce1e05f804d9238eda66d6010eb492668a37
Bisecting: 2145 revisions left to test after this (roughly 11 steps)
[3c91f25c2f72ba6001775a5932857c1d2131c531] bnx2x: Prevent ptp_task to be rescheduled indefinitely
testing commit 3c91f25c2f72ba6001775a5932857c1d2131c531 with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 3c91f25c2f72ba6001775a5932857c1d2131c531
Bisecting: 1073 revisions left to test after this (roughly 10 steps)
[497ad9f5b2dc86b733761b9afa44ecfa2f17be65] page_pool: fix compile warning when CONFIG_PAGE_POOL is disabled
testing commit 497ad9f5b2dc86b733761b9afa44ecfa2f17be65 with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 497ad9f5b2dc86b733761b9afa44ecfa2f17be65
Bisecting: 542 revisions left to test after this (roughly 9 steps)
[e2c746944e26609f63661cedb7c7c31f0578c58f] net: ethernet: mediatek: Fix overlapping capability bits.
testing commit e2c746944e26609f63661cedb7c7c31f0578c58f with gcc (GCC) 8.1.0
all runs: OK
# git bisect good e2c746944e26609f63661cedb7c7c31f0578c58f
Bisecting: 251 revisions left to test after this (roughly 8 steps)
[437fde6cda74bb31705a9f37f14d481cdd431ad8] Merge tag 'wireless-drivers-next-for-davem-2019-07-06' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next
testing commit 437fde6cda74bb31705a9f37f14d481cdd431ad8 with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 437fde6cda74bb31705a9f37f14d481cdd431ad8
Bisecting: 119 revisions left to test after this (roughly 7 steps)
[17ccf9e31e0d650b36fdc06eb7b09757523111c7] Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
testing commit 17ccf9e31e0d650b36fdc06eb7b09757523111c7 with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 17ccf9e31e0d650b36fdc06eb7b09757523111c7
Bisecting: 61 revisions left to test after this (roughly 6 steps)
[9d1bc24b52fb8c5d859f9a47084bf1179470e04c] bonding: validate ip header before check IPPROTO_IGMP
testing commit 9d1bc24b52fb8c5d859f9a47084bf1179470e04c with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 9d1bc24b52fb8c5d859f9a47084bf1179470e04c
Bisecting: 30 revisions left to test after this (roughly 5 steps)
[e858faf556d4e14c750ba1e8852783c6f9520a0e] tcp: Reset bytes_acked and bytes_received when disconnecting
testing commit e858faf556d4e14c750ba1e8852783c6f9520a0e with gcc (GCC) 8.1.0
run #0: crashed: general protection fault in send_hsr_supervision_frame
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
# git bisect bad e858faf556d4e14c750ba1e8852783c6f9520a0e
Bisecting: 15 revisions left to test after this (roughly 4 steps)
[13aecb17acabc2a92187d08f7ca93bb8aad62c6f] net/tls: fix poll ignoring partially copied records
testing commit 13aecb17acabc2a92187d08f7ca93bb8aad62c6f with gcc (GCC) 8.1.0
run #0: crashed: general protection fault in send_hsr_supervision_frame
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
# git bisect bad 13aecb17acabc2a92187d08f7ca93bb8aad62c6f
Bisecting: 7 revisions left to test after this (roughly 3 steps)
[56c5ee1a5823e9cf5288b84ae6364cb4112f8225] xfrm interface: fix memory leak on creation
testing commit 56c5ee1a5823e9cf5288b84ae6364cb4112f8225 with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 56c5ee1a5823e9cf5288b84ae6364cb4112f8225
Bisecting: 3 revisions left to test after this (roughly 2 steps)
[edf070a0fb45ac845f534baf172fbadbeb5048c6] hsr: fix a NULL pointer deref in hsr_dev_xmit()
testing commit edf070a0fb45ac845f534baf172fbadbeb5048c6 with gcc (GCC) 8.1.0
all runs: OK
# git bisect good edf070a0fb45ac845f534baf172fbadbeb5048c6
Bisecting: 1 revision left to test after this (roughly 1 step)
[ffa9fec30ca0ceb7d5156a1649b9576058756616] r8152: set RTL8152_UNPLUG only for real disconnection
testing commit ffa9fec30ca0ceb7d5156a1649b9576058756616 with gcc (GCC) 8.1.0
run #0: crashed: general protection fault in send_hsr_supervision_frame
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
# git bisect bad ffa9fec30ca0ceb7d5156a1649b9576058756616
Bisecting: 0 revisions left to test after this (roughly 0 steps)
[fa8043017cf83427c7e3d7d8defe2c2133edffea] Merge branch 'hsr-bug-fixes'
testing commit fa8043017cf83427c7e3d7d8defe2c2133edffea with gcc (GCC) 8.1.0
run #0: crashed: general protection fault in send_hsr_supervision_frame
run #1: crashed: general protection fault in send_hsr_supervision_frame
run #2: crashed: general protection fault in send_hsr_supervision_frame
run #3: crashed: general protection fault in send_hsr_supervision_frame
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
# git bisect bad fa8043017cf83427c7e3d7d8defe2c2133edffea
fa8043017cf83427c7e3d7d8defe2c2133edffea is the first bad commit
revisions tested: 16, total time: 4h35m52.210527446s (build: 1h30m40.604093106s, test: 3h0m9.473210912s)
first bad commit: fa8043017cf83427c7e3d7d8defe2c2133edffea Merge branch 'hsr-bug-fixes'
cc: ["davem@davemloft.net" "xiyou.wangcong@gmail.com"]
crash: general protection fault in send_hsr_supervision_frame
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.2.0-rc6+ #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:send_hsr_supervision_frame+0x30/0xf60 net/hsr/hsr_device.c:255
Code: 89 e5 41 57 41 56 41 55 49 89 fd 41 54 41 89 d4 48 89 c2 53 48 c1 ea 03 48 83 ec 50 48 89 45 d0 48 b8 00 00 00 00 00 fc ff df <80> 3c 02 00 89 75 c8 0f 85 83 0c 00 00 48 b8 00 00 00 00 00 fc ff
RSP: 0018:ffff8880aeb09c68 EFLAGS: 00010282
RAX: dffffc0000000000 RBX: ffff888095ceb500 RCX: 1ffff110128dbc94
RDX: 0000000000000002 RSI: 0000000000000017 RDI: 0000000000000000
RBP: ffff8880aeb09ce0 R08: ffffed1015d66c70 R09: ffffed1015d66c6f
R10: ffffed1015d66c6f R11: ffff8880aeb3637b R12: 0000000000000000
R13: 0000000000000000 R14: ffff8880aeb09db8 R15: ffff8880aeb24b80
FS:  0000000000000000(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004bf708 CR3: 000000000826d000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 hsr_announce+0xd9/0x2b0 net/hsr/hsr_device.c:339
 call_timer_fn+0x14d/0x510 kernel/time/timer.c:1322
 expire_timers kernel/time/timer.c:1366 [inline]
 __run_timers kernel/time/timer.c:1685 [inline]
 run_timer_softirq+0xc6f/0x1330 kernel/time/timer.c:1698
 __do_softirq+0x260/0x958 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x17f/0x1c0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0x13e/0x540 arch/x86/kernel/apic/apic.c:1068
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:806
 </IRQ>
RIP: 0010:native_safe_halt+0x12/0x20 arch/x86/include/asm/irqflags.h:61
Code: 11 ff ff ff 4c 89 e7 e8 cc d0 f4 fa eb 97 90 90 90 90 90 90 90 90 90 90 55 48 89 e5 e9 07 00 00 00 0f 00 2d b0 1f 64 00 fb f4 <5d> c3 66 90 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 e9 07 00 00
RSP: 0018:ffff8880a98e7d70 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13
RAX: dffffc0000000000 RBX: ffff8880a98d4340 RCX: 0000000000000000
RDX: 1ffffffff10643e1 RSI: 0000000000000006 RDI: ffffffff88321f08
RBP: ffff8880a98e7d70 R08: 0000000000000006 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
R13: ffffffff88321ef8 R14: 0000000000000001 R15: ffffffff88f685b8
 arch_safe_halt arch/x86/include/asm/paravirt.h:156 [inline]
 default_idle+0x51/0x310 arch/x86/kernel/process.c:580
 arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:571
 default_idle_call+0x6d/0x90 kernel/sched/idle.c:94
 cpuidle_idle_call kernel/sched/idle.c:154 [inline]
 do_idle+0x3e4/0x590 kernel/sched/idle.c:263
 cpu_startup_entry+0x18/0x20 kernel/sched/idle.c:354
 start_secondary+0x367/0x4b0 arch/x86/kernel/smpboot.c:265
 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243
Modules linked in:
---[ end trace 4f820e61088afad8 ]---
RIP: 0010:send_hsr_supervision_frame+0x30/0xf60 net/hsr/hsr_device.c:255
Code: 89 e5 41 57 41 56 41 55 49 89 fd 41 54 41 89 d4 48 89 c2 53 48 c1 ea 03 48 83 ec 50 48 89 45 d0 48 b8 00 00 00 00 00 fc ff df <80> 3c 02 00 89 75 c8 0f 85 83 0c 00 00 48 b8 00 00 00 00 00 fc ff
RSP: 0018:ffff8880aeb09c68 EFLAGS: 00010282
RAX: dffffc0000000000 RBX: ffff888095ceb500 RCX: 1ffff110128dbc94
RDX: 0000000000000002 RSI: 0000000000000017 RDI: 0000000000000000
RBP: ffff8880aeb09ce0 R08: ffffed1015d66c70 R09: ffffed1015d66c6f
R10: ffffed1015d66c6f R11: ffff8880aeb3637b R12: 0000000000000000
R13: 0000000000000000 R14: ffff8880aeb09db8 R15: ffff8880aeb24b80
FS:  0000000000000000(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004bf708 CR3: 000000000826d000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400