bisecting cause commit starting from 9f4ad9e425a1d3b6a34617b8ea226d56a119a717 building syzkaller on 2a82f1b39f0c4d6c8c45fe4baf7cdd555c9e4af8 testing commit 9f4ad9e425a1d3b6a34617b8ea226d56a119a717 with gcc (GCC) 10.2.1 20210217 kernel signature: 6d40b6f5a7f53d09bcc7ad172c8408bec51ae18bb9bd92c662d0f974261d6325 all runs: crashed: KASAN: null-ptr-deref Write in rhashtable_free_and_destroy testing release v5.11 testing commit f40ddce88593482919761f74910f42f4b84c004b with gcc (GCC) 10.2.1 20210217 kernel signature: 293e6579f0d65cbda46b2d20e15f30555f6e4ea292502f9356c74a1affb84b2f all runs: crashed: KASAN: null-ptr-deref Write in rhashtable_free_and_destroy testing release v5.10 testing commit 2c85ebc57b3e1817b6ce1a6b703928e113a90442 with gcc (GCC) 10.2.1 20210217 kernel signature: aa5dbcb7b6350e128566df7b79649d445731318f591bef7c95206222f351bb67 all runs: crashed: KASAN: null-ptr-deref Write in rhashtable_free_and_destroy testing release v5.9 testing commit bbf5c979011a099af5dc76498918ed7df445635b with gcc (GCC) 10.2.1 20210217 kernel signature: 5c24f3f4b62492843caa7e7e852285d332e09df8819536e003a2c6149fac4abc run #0: crashed: KASAN: invalid-free in ieee80211_mesh_init_sdata run #1: crashed: KASAN: invalid-free in ieee80211_mesh_init_sdata run #2: crashed: KASAN: invalid-free in ieee80211_mesh_init_sdata run #3: crashed: KASAN: invalid-free in ieee80211_mesh_init_sdata run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK reproducer seems to be flaky testing release v5.8 testing commit bcf876870b95592b52519ed4aafcf9d95999bc9c with gcc (GCC) 8.4.1 20210217 kernel signature: e064f1b90e3cfa434cb136ae367ce886a75f83b37d3f635477c7b19461094f39 run #0: crashed: KASAN: invalid-free in create_cache run #1: crashed: WARNING in rhashtable_free_and_destroy run #2: crashed: KASAN: invalid-free in create_cache run #3: crashed: WARNING in rhashtable_free_and_destroy run #4: crashed: WARNING in rhashtable_free_and_destroy run #5: crashed: KASAN: invalid-free in create_cache run #6: crashed: KASAN: invalid-free in create_cache run #7: crashed: KASAN: invalid-free in create_cache run #8: crashed: WARNING in rhashtable_free_and_destroy run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK testing release v5.7 testing commit 3d77e6a8804abcc0504c904bd6e5cdf3a5cf8162 with gcc (GCC) 8.4.1 20210217 kernel signature: 0c3b42a2623ff57e7e764989f96f47d87aded95e87d9e48275f1a3c8bd52969b run #0: crashed: WARNING in rhashtable_free_and_destroy run #1: crashed: WARNING in rhashtable_free_and_destroy run #2: crashed: WARNING in rhashtable_free_and_destroy run #3: crashed: WARNING in rhashtable_free_and_destroy run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK testing release v5.6 testing commit 7111951b8d4973bda27ff663f2cf18b663d15b48 with gcc (GCC) 8.4.1 20210217 kernel signature: d9f64012349e0d74c7c908ab911c6276e4b0f83458da87d57127cd8708aa9c37 run #0: crashed: WARNING in rhashtable_free_and_destroy run #1: crashed: WARNING in rhashtable_free_and_destroy run #2: crashed: WARNING in rhashtable_free_and_destroy run #3: crashed: WARNING in rhashtable_free_and_destroy run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK testing release v5.5 testing commit d5226fa6dbae0569ee43ecfc08bdcd6770fc4755 with gcc (GCC) 8.4.1 20210217 kernel signature: ba676d29733da0c4728588193fbc641be89b273270ae57d0f4d0c16812a703ca run #0: crashed: WARNING in rhashtable_free_and_destroy run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK testing release v5.4 testing commit 219d54332a09e8d8741c1e1982f5eae56099de85 with gcc (GCC) 8.4.1 20210217 kernel signature: 949001b74ebcba9a4ee8693b8e891d0971c58010c6cfc40dc44eae5156602299 all runs: OK # git bisect start d5226fa6dbae0569ee43ecfc08bdcd6770fc4755 219d54332a09e8d8741c1e1982f5eae56099de85 Bisecting: 8639 revisions left to test after this (roughly 13 steps) [8c39f71ee2019e77ee14f88b1321b2348db51820] Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net testing commit 8c39f71ee2019e77ee14f88b1321b2348db51820 with gcc (GCC) 8.4.1 20210217 kernel signature: 859172da38d8b6201158320751a6da06eca898c6f6a581727a78e978b9053886 all runs: OK # git bisect good 8c39f71ee2019e77ee14f88b1321b2348db51820 Bisecting: 4316 revisions left to test after this (roughly 12 steps) [76bb8b05960c3d1668e6bee7624ed886cbd135ba] Merge tag 'kbuild-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild testing commit 76bb8b05960c3d1668e6bee7624ed886cbd135ba with gcc (GCC) 8.4.1 20210217 kernel signature: bbba1ebea866b2860df25b7e72aa597d7bca9ec4e7f18c8e66bb81472cf32ef6 run #0: crashed: KASAN: null-ptr-deref Write in rhashtable_free_and_destroy run #1: basic kernel testing failed: failed to copy test binary to VM: failed to run ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "BatchMode=yes" "-o" "IdentitiesOnly=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "/tmp/syz-executor090428402" "root@10.128.10.50:./syz-executor090428402"]: exit status 1 Connection timed out during banner exchange Connection to 10.128.10.50 port 22 timed out lost connection run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK # git bisect bad 76bb8b05960c3d1668e6bee7624ed886cbd135ba Bisecting: 2146 revisions left to test after this (roughly 11 steps) [21b26d2679584c6a60e861aa3e5ca09a6bab0633] Merge tag '5.5-rc-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 testing commit 21b26d2679584c6a60e861aa3e5ca09a6bab0633 with gcc (GCC) 8.4.1 20210217 kernel signature: 19436062c8c70d675a8eeab1ffc65528611078887f01ef8fe662aac017e92e5b run #0: crashed: WARNING in rhashtable_free_and_destroy run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK # git bisect bad 21b26d2679584c6a60e861aa3e5ca09a6bab0633 Bisecting: 1076 revisions left to test after this (roughly 10 steps) [3275a71e76fac5bc276f0d60e027b18c2e8d7a5b] Merge tag 'drm-next-5.5-2019-10-09' of git://people.freedesktop.org/~agd5f/linux into drm-next testing commit 3275a71e76fac5bc276f0d60e027b18c2e8d7a5b with gcc (GCC) 8.4.1 20210217 kernel signature: d06067776dba4afa7912c2c80b23fe0ccfe8bb7096e4ad2c142ec456bd8a469e run #0: crashed: WARNING in rhashtable_free_and_destroy run #1: crashed: WARNING in rhashtable_free_and_destroy run #2: crashed: WARNING in rhashtable_free_and_destroy run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK # git bisect bad 3275a71e76fac5bc276f0d60e027b18c2e8d7a5b Bisecting: 549 revisions left to test after this (roughly 9 steps) [86db9f28224e8f6089b80e1391bdda0eabdf473b] dt-bindings: display: renesas: lvds: Document r8a774b1 bindings testing commit 86db9f28224e8f6089b80e1391bdda0eabdf473b with gcc (GCC) 8.4.1 20210217 kernel signature: 221ce02047615e4912f60a3615ef21a9b9ee3feb6519ebf49c0fe8bc69df6038 all runs: OK # git bisect good 86db9f28224e8f6089b80e1391bdda0eabdf473b Bisecting: 274 revisions left to test after this (roughly 8 steps) [0e94b5640bb764cf223f9dec18bed139e8e17f4c] drm/amdkfd: use navi12 specific family id for navi12 code path testing commit 0e94b5640bb764cf223f9dec18bed139e8e17f4c with gcc (GCC) 8.4.1 20210217 kernel signature: ed2aa21e2179103407f76fa03362b33902538d0d0adfacfb4fa018ec6dde61b3 all runs: OK # git bisect good 0e94b5640bb764cf223f9dec18bed139e8e17f4c Bisecting: 137 revisions left to test after this (roughly 7 steps) [49e0ed3848d0e3ef22c3a458ded8847cbf08330e] drm/i915: Nuke 'realloc_pipes' testing commit 49e0ed3848d0e3ef22c3a458ded8847cbf08330e with gcc (GCC) 8.4.1 20210217 kernel signature: 221ce02047615e4912f60a3615ef21a9b9ee3feb6519ebf49c0fe8bc69df6038 run #0: crashed: WARNING in rhashtable_free_and_destroy run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK # git bisect bad 49e0ed3848d0e3ef22c3a458ded8847cbf08330e Bisecting: 68 revisions left to test after this (roughly 6 steps) [3c00660db18371c632adae4836ed2b2d3d78ecb6] drm/i915/execlists: Assert tasklet is locked for process_csb() testing commit 3c00660db18371c632adae4836ed2b2d3d78ecb6 with gcc (GCC) 8.4.1 20210217 kernel signature: 1a943554dcffd5ac641c0049076fdff545ef32dec6ab4d17c7616c82ca0a8f10 all runs: OK # git bisect good 3c00660db18371c632adae4836ed2b2d3d78ecb6 Bisecting: 34 revisions left to test after this (roughly 5 steps) [2229adc81380c46908d46a91f05a6c1650456769] drm/i915/execlist: Trim immediate timeslice expiry testing commit 2229adc81380c46908d46a91f05a6c1650456769 with gcc (GCC) 8.4.1 20210217 kernel signature: 221ce02047615e4912f60a3615ef21a9b9ee3feb6519ebf49c0fe8bc69df6038 all runs: OK # git bisect good 2229adc81380c46908d46a91f05a6c1650456769 Bisecting: 17 revisions left to test after this (roughly 4 steps) [493065e24eb13cf1e974ef9fc0185d6266d16067] drm/i915: Add microcontrollers documentation section testing commit 493065e24eb13cf1e974ef9fc0185d6266d16067 with gcc (GCC) 8.4.1 20210217 kernel signature: 221ce02047615e4912f60a3615ef21a9b9ee3feb6519ebf49c0fe8bc69df6038 run #0: crashed: WARNING in rhashtable_free_and_destroy run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK # git bisect bad 493065e24eb13cf1e974ef9fc0185d6266d16067 Bisecting: 8 revisions left to test after this (roughly 3 steps) [3b05c4f832fa9beeb8da4bafb3c2d115b77a8d5b] drm/i915/selftests: Teach guc to take intel_gt as its argument testing commit 3b05c4f832fa9beeb8da4bafb3c2d115b77a8d5b with gcc (GCC) 8.4.1 20210217 kernel signature: 221ce02047615e4912f60a3615ef21a9b9ee3feb6519ebf49c0fe8bc69df6038 run #0: crashed: WARNING in rhashtable_free_and_destroy run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK # git bisect bad 3b05c4f832fa9beeb8da4bafb3c2d115b77a8d5b Bisecting: 3 revisions left to test after this (roughly 2 steps) [3abe897787c2445fb1aa955ac229bdfe2ac786c2] drm/i915: Prepare the mode readout for hw vs. uapi state split testing commit 3abe897787c2445fb1aa955ac229bdfe2ac786c2 with gcc (GCC) 8.4.1 20210217 kernel signature: 221ce02047615e4912f60a3615ef21a9b9ee3feb6519ebf49c0fe8bc69df6038 run #0: crashed: WARNING in rhashtable_free_and_destroy run #1: crashed: WARNING in rhashtable_free_and_destroy run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK # git bisect bad 3abe897787c2445fb1aa955ac229bdfe2ac786c2 Bisecting: 1 revision left to test after this (roughly 1 step) [4078c983feb930bc2a3e3f8ffa6fa65fdf466c8f] drm/i915: Switch intel_legacy_cursor_update() to intel_ types testing commit 4078c983feb930bc2a3e3f8ffa6fa65fdf466c8f with gcc (GCC) 8.4.1 20210217 kernel signature: 221ce02047615e4912f60a3615ef21a9b9ee3feb6519ebf49c0fe8bc69df6038 run #0: crashed: WARNING in rhashtable_free_and_destroy run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK # git bisect bad 4078c983feb930bc2a3e3f8ffa6fa65fdf466c8f Bisecting: 0 revisions left to test after this (roughly 0 steps) [993254292b9e0be97555cd3475bcdb946c558381] drm/i915: Refactor timestamping constants update testing commit 993254292b9e0be97555cd3475bcdb946c558381 with gcc (GCC) 8.4.1 20210217 kernel signature: 221ce02047615e4912f60a3615ef21a9b9ee3feb6519ebf49c0fe8bc69df6038 all runs: OK # git bisect good 993254292b9e0be97555cd3475bcdb946c558381 4078c983feb930bc2a3e3f8ffa6fa65fdf466c8f is the first bad commit commit 4078c983feb930bc2a3e3f8ffa6fa65fdf466c8f Author: Ville Syrjälä Date: Fri Sep 27 16:14:27 2019 +0300 drm/i915: Switch intel_legacy_cursor_update() to intel_ types Prefer the intel_ types in intel_legacy_cursor_update() over the drm_ types. Should make it easier to adapt this to the uapi vs. hw state split. Signed-off-by: Ville Syrjälä Signed-off-by: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/20190927131432.15978-1-ville.syrjala@linux.intel.com drivers/gpu/drm/i915/display/intel_display.c | 84 ++++++++++++++-------------- 1 file changed, 42 insertions(+), 42 deletions(-) culprit signature: 221ce02047615e4912f60a3615ef21a9b9ee3feb6519ebf49c0fe8bc69df6038 parent signature: 221ce02047615e4912f60a3615ef21a9b9ee3feb6519ebf49c0fe8bc69df6038 Reproducer flagged being flaky revisions tested: 23, total time: 6h44m49.45187944s (build: 2h32m56.901321736s, test: 4h8m13.100606396s) first bad commit: 4078c983feb930bc2a3e3f8ffa6fa65fdf466c8f drm/i915: Switch intel_legacy_cursor_update() to intel_ types recipients (to): ["airlied@linux.ie" "daniel@ffwll.ch" "dri-devel@lists.freedesktop.org" "intel-gfx@lists.freedesktop.org" "jani.nikula@linux.intel.com" "joonas.lahtinen@linux.intel.com" "maarten.lankhorst@linux.intel.com" "rodrigo.vivi@intel.com" "ville.syrjala@linux.intel.com"] recipients (cc): ["linux-kernel@vger.kernel.org"] crash: WARNING in rhashtable_free_and_destroy RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 00000000004665f9 RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000003 RBP: 00007ff957bcb1d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 R13: 00007ffe805318af R14: 00007ff957bcb300 R15: 0000000000022000 ------------[ cut here ]------------ WARNING: CPU: 1 PID: 11575 at kernel/workqueue.c:3031 arch___set_bit arch/x86/include/asm/bitops.h:68 [inline] WARNING: CPU: 1 PID: 11575 at kernel/workqueue.c:3031 __set_bit include/asm-generic/bitops-instrumented.h:44 [inline] WARNING: CPU: 1 PID: 11575 at kernel/workqueue.c:3031 insert_wq_barrier kernel/workqueue.c:2676 [inline] WARNING: CPU: 1 PID: 11575 at kernel/workqueue.c:3031 start_flush_work kernel/workqueue.c:2999 [inline] WARNING: CPU: 1 PID: 11575 at kernel/workqueue.c:3031 __flush_work+0x752/0x930 kernel/workqueue.c:3039 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 11575 Comm: syz-executor.5 Not tainted 5.4.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x86/0xca lib/dump_stack.c:113 panic+0x29a/0x523 kernel/panic.c:220 __warn.cold.10+0x25/0x25 kernel/panic.c:581 report_bug+0x1ad/0x270 lib/bug.c:195 fixup_bug arch/x86/kernel/traps.c:179 [inline] fixup_bug arch/x86/kernel/traps.c:174 [inline] do_error_trap+0x125/0x1d0 arch/x86/kernel/traps.c:272 do_invalid_op+0x36/0x40 arch/x86/kernel/traps.c:291 invalid_op+0x2d/0x40 arch/x86/entry/entry_64.S:1028 RIP: 0010:__flush_work+0x752/0x930 kernel/workqueue.c:3031 Code: 89 df 48 89 95 e0 fe ff ff e8 fa 8c 5c 00 41 83 e5 08 48 0f ba 2b 03 41 81 cd e0 01 00 00 48 8b 95 e0 fe ff ff e9 67 fb ff ff <0f> 0b c6 85 f3 fe ff ff 00 e9 d6 fc ff ff e8 4b 37 15 00 84 c0 0f RSP: 0018:ffff8880a0e6f0e8 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffff8880a8e5a300 RCX: 1ffff110141cde22 RDX: 1ffff110151cb463 RSI: 0000000000000001 RDI: ffff8880a8e5a300 RBP: ffff8880a0e6f218 R08: 0000000000000006 R09: fffffbfff1a35b38 R10: fffffbfff1a35b37 R11: ffffffff8d1ad9bf R12: ffff8880a8e5a318 R13: ffff8880a0e6f1f0 R14: ffff8880a8e5a300 R15: 0000000000000000 __cancel_work_timer+0x29d/0x3a0 kernel/workqueue.c:3127 cancel_work_sync+0xb/0x10 kernel/workqueue.c:3163 rhashtable_free_and_destroy+0x25/0x6b0 lib/rhashtable.c:1130 mesh_table_free net/mac80211/mesh_pathtbl.c:69 [inline] mesh_pathtbl_init+0xb4/0xe0 net/mac80211/mesh_pathtbl.c:786 ieee80211_mesh_init_sdata+0x183/0x3e0 net/mac80211/mesh.c:1529 ieee80211_setup_sdata+0xb5c/0xf20 net/mac80211/iface.c:1454 ieee80211_if_add+0xc6a/0x1760 net/mac80211/iface.c:1866 ieee80211_add_iface+0x7a/0xf0 net/mac80211/cfg.c:126 rdev_add_virtual_intf net/wireless/rdev-ops.h:45 [inline] nl80211_new_interface+0x3f5/0xfc0 net/wireless/nl80211.c:3617 genl_family_rcv_msg+0x61d/0x12f0 net/netlink/genetlink.c:629 genl_rcv_msg+0xb1/0x160 net/netlink/genetlink.c:654 netlink_rcv_skb+0x13c/0x380 net/netlink/af_netlink.c:2477 genl_rcv+0x23/0x40 net/netlink/genetlink.c:665 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] netlink_unicast+0x43b/0x640 net/netlink/af_netlink.c:1328 netlink_sendmsg+0x79e/0xc40 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:637 [inline] sock_sendmsg+0xb5/0xf0 net/socket.c:657 ___sys_sendmsg+0x653/0x950 net/socket.c:2311 __sys_sendmsg+0xd9/0x180 net/socket.c:2356 __do_sys_sendmsg net/socket.c:2365 [inline] __se_sys_sendmsg net/socket.c:2363 [inline] __x64_sys_sendmsg+0x73/0xb0 net/socket.c:2363 do_syscall_64+0x9d/0x550 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4665f9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ff957bcb188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 00000000004665f9 RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000003 RBP: 00007ff957bcb1d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 R13: 00007ffe805318af R14: 00007ff957bcb300 R15: 0000000000022000 Kernel Offset: disabled Rebooting in 86400 seconds..