bisecting cause commit starting from 9455d25f4e3b3d009fa1b810862e5b06229530e4
building syzkaller on 1508f45368a309a3b1196a342b3d64ce7be4cc43
testing commit 9455d25f4e3b3d009fa1b810862e5b06229530e4 with gcc (GCC) 8.1.0
kernel signature: 6d348d53404581389a5c2d10644025224ac58d21
run #0: crashed: KASAN: use-after-free Write in release_tty
run #1: crashed: KASAN: use-after-free Write in release_tty
run #2: crashed: KASAN: use-after-free Write in release_tty
run #3: crashed: KASAN: use-after-free Write in release_tty
run #4: crashed: KASAN: use-after-free Write in release_tty
run #5: crashed: KASAN: use-after-free Write in release_tty
run #6: crashed: KASAN: use-after-free Write in release_tty
run #7: crashed: KASAN: use-after-free Write in release_tty
run #8: crashed: KASAN: use-after-free Write in release_tty
run #9: crashed: KASAN: use-after-free Read in tty_buffer_cancel_work
testing release v5.4
testing commit 219d54332a09e8d8741c1e1982f5eae56099de85 with gcc (GCC) 8.1.0
kernel signature: 3f18134cd986479fdf5d30276d1cec1eebf5c991
all runs: crashed: KASAN: use-after-free Write in release_tty
testing release v5.3
testing commit 4d856f72c10ecb060868ed10ff1b1453943fc6c8 with gcc (GCC) 8.1.0
kernel signature: 199c81ad5951b45baa33ce4b8f78d38836e37a8b
all runs: crashed: KASAN: use-after-free Write in release_tty
testing release v5.2
testing commit 0ecfebd2b52404ae0c54a878c872bb93363ada36 with gcc (GCC) 8.1.0
kernel signature: 7eaa1c0d565bfbb5256754e7d49fa625fc5cbf70
all runs: crashed: KASAN: use-after-free Write in release_tty
testing release v5.1
testing commit e93c9c99a629c61837d5a7fc2120cd2b6c70dbdd with gcc (GCC) 8.1.0
kernel signature: 34a96662fd215bee1747c6cbceaeef5dd06658a4
all runs: crashed: KASAN: use-after-free Write in release_tty
testing release v5.0
testing commit 1c163f4c7b3f621efff9b28a47abb36f7378d783 with gcc (GCC) 8.1.0
kernel signature: 8adba566a44feece22443d8f9bf82192565af5b0
all runs: crashed: KASAN: use-after-free Write in release_tty
testing release v4.20
testing commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be with gcc (GCC) 8.1.0
kernel signature: 4afdb44feca1eca484ebeb7028fe3811a22df8bf
all runs: crashed: KASAN: use-after-free Write in release_tty
testing release v4.19
testing commit 84df9525b0c27f3ebc2ebb1864fa62a97fdedb7d with gcc (GCC) 8.1.0
kernel signature: e16a75952cc8080780a867265cdcc51a395ad04b
all runs: crashed: KASAN: use-after-free Write in release_tty
testing release v4.18
testing commit 94710cac0ef4ee177a63b5227664b38c95bbf703 with gcc (GCC) 8.1.0
kernel signature: 978d4c2a81d21da9cdb9272d891eec3ec1048857
all runs: crashed: KASAN: use-after-free Write in release_tty
testing release v4.17
testing commit 29dcea88779c856c7dc92040a0c01233263101d4 with gcc (GCC) 8.1.0
kernel signature: 1d9aa3dd582a5fcc0c2410754a510ba04e8e6c6d
run #0: crashed: KASAN: use-after-free Write in release_tty
run #1: crashed: KASAN: use-after-free Read in get_work_pool
run #2: crashed: KASAN: use-after-free Write in release_tty
run #3: crashed: KASAN: use-after-free Write in release_tty
run #4: crashed: KASAN: use-after-free Write in release_tty
run #5: crashed: KASAN: use-after-free Write in release_tty
run #6: crashed: KASAN: use-after-free Write in release_tty
run #7: crashed: KASAN: use-after-free Write in release_tty
run #8: crashed: KASAN: use-after-free Write in release_tty
run #9: crashed: KASAN: use-after-free Write in release_tty
testing release v4.16
testing commit 0adb32858b0bddf4ada5f364a84ed60b196dbcda with gcc (GCC) 8.1.0
kernel signature: d548ac6a30d90dfa8c825fd737d2b95d5bd81e01
all runs: crashed: KASAN: use-after-free Write in release_tty
testing release v4.15
testing commit d8a5b80568a9cb66810e75b182018e9edb68e8ff with gcc (GCC) 8.1.0
kernel signature: 056e6c0203f6b1e3db8d29867bfaa4ed73f3d2ce
all runs: crashed: KASAN: use-after-free Write in release_tty
testing release v4.14
testing commit bebc6082da0a9f5d47a1ea2edc099bf671058bd4 with gcc (GCC) 8.1.0
kernel signature: 6d1453c55ad08786d6f52b2517800b9aa363cb6b
all runs: crashed: KASAN: use-after-free Write in release_tty
testing release v4.13
testing commit 569dbb88e80deb68974ef6fdd6a13edb9d686261 with gcc (GCC) 8.1.0
kernel signature: e56097b13b277e0f1c96a985d9cb69d0c06faa7f
all runs: crashed: KASAN: use-after-free Write in release_tty
testing release v4.12
testing commit 6f7da290413ba713f0cdd9ff1a2a9bb129ef4f6c with gcc (GCC) 8.1.0
kernel signature: 7c0bbdc1b37f12556138e3c38e3cabbec2c6b06b
all runs: crashed: KASAN: use-after-free Write in release_tty
testing release v4.11
testing commit a351e9b9fc24e982ec2f0e76379a49826036da12 with gcc (GCC) 7.3.0
kernel signature: 6ae97b34704ff722d7dbe1e6ee9456bc84eddc0f
run #0: crashed: KASAN: use-after-free Write in release_tty
run #1: crashed: KASAN: use-after-free Write in release_tty
run #2: crashed: KASAN: use-after-free Write in release_tty
run #3: crashed: KASAN: use-after-free Write in release_tty
run #4: crashed: KASAN: use-after-free Write in release_tty
run #5: crashed: KASAN: use-after-free Write in release_tty
run #6: crashed: KASAN: use-after-free Write in release_tty
run #7: crashed: KASAN: use-after-free Write in release_tty
run #8: crashed: KASAN: use-after-free Write in release_tty
run #9: crashed: KASAN: use-after-free Read in tty_buffer_cancel_work
testing release v4.10
testing commit c470abd4fde40ea6a0846a2beab642a578c0b8cd with gcc (GCC) 5.5.0
kernel signature: 0b8f9e5ab35bf2af3277710938f7dc33815d8387
all runs: crashed: KASAN: use-after-free Write in release_tty
testing release v4.9
testing commit 69973b830859bc6529a7a0468ba0d80ee5117826 with gcc (GCC) 5.5.0
kernel signature: 36426cbda68568ca026c72aa33310f1bf71d5b86
all runs: crashed: KASAN: use-after-free Write in release_tty
testing release v4.8
testing commit c8d2bc9bc39ebea8437fd974fdbc21847bb897a3 with gcc (GCC) 5.5.0
kernel signature: 81e9c2e98a3a992493cf68a0cc0a28fe7adafeb2
all runs: crashed: KASAN: use-after-free Write in release_tty
testing release v4.7
testing commit 523d939ef98fd712632d93a5a2b588e477a7565e with gcc (GCC) 5.5.0
kernel signature: 080a2b094d92f92f045bbe6977a3c55d5ba01870
all runs: crashed: KASAN: use-after-free Write in release_tty
testing release v4.6
testing commit 2dcd0af568b0cf583645c8a317dd12e344b1c72a with gcc (GCC) 5.5.0
kernel signature: 98d76be03148946564c44aabac392736af354f59
run #0: crashed: KASAN: use-after-free Write in release_tty
run #1: crashed: general protection fault in tty_buffer_cancel_work
run #2: crashed: KASAN: use-after-free Write in release_tty
run #3: crashed: KASAN: use-after-free Write in release_tty
run #4: crashed: KASAN: use-after-free Write in release_tty
run #5: crashed: KASAN: use-after-free Write in release_tty
run #6: crashed: KASAN: use-after-free Write in release_tty
run #7: crashed: general protection fault in get_work_pool
run #8: crashed: KASAN: use-after-free Write in release_tty
run #9: crashed: WARNING: locking bug in tty_buffer_cancel_work
testing release v4.5
testing commit b562e44f507e863c6792946e4e1b1449fbbac85d with gcc (GCC) 5.5.0
kernel signature: 58bcde6997ad18acea2b3f28718d6f5a0f1d1eb2
run #0: crashed: WARNING in __bfs
run #1: crashed: WARNING in __bfs
run #2: crashed: BUG: sleeping function called from invalid context in __do_page_fault
run #3: crashed: WARNING in __bfs
run #4: crashed: general protection fault in tty_buffer_cancel_work
run #5: crashed: WARNING in __bfs
run #6: crashed: general protection fault in tty_buffer_cancel_work
run #7: crashed: WARNING in __bfs
run #8: crashed: WARNING in __bfs
run #9: crashed: WARNING in __bfs
testing release v4.4
testing commit afd2ff9b7e1b367172f18ba7f693dfb62bdcb2dc with gcc (GCC) 5.5.0
kernel signature: ba6a5fedb0b101765936838395ebc73b66db945b
run #0: crashed: WARNING in __bfs
run #1: crashed: WARNING in __bfs
run #2: crashed: general protection fault in tty_buffer_cancel_work
run #3: crashed: WARNING in __bfs
run #4: crashed: WARNING in __bfs
run #5: crashed: general protection fault in tty_buffer_cancel_work
run #6: crashed: WARNING in __bfs
run #7: crashed: general protection fault in tty_buffer_cancel_work
run #8: crashed: WARNING in __bfs
run #9: crashed: WARNING in __bfs
testing release v4.3
testing commit 6a13feb9c82803e2b815eca72fa7a9f5561d7861 with gcc (GCC) 5.5.0
kernel signature: f0ada2c7fdd6961ef099c103da7a08f65ae5d242
run #0: crashed: WARNING in __bfs
run #1: crashed: WARNING in __bfs
run #2: crashed: WARNING in __bfs
run #3: crashed: WARNING in __bfs
run #4: crashed: WARNING in __bfs
run #5: crashed: general protection fault in release_tty
run #6: crashed: general protection fault in release_tty
run #7: crashed: general protection fault in release_tty
run #8: crashed: WARNING in __bfs
run #9: crashed: no output from test machine
testing release v4.2
testing commit 64291f7db5bd8150a74ad2036f1037e6a0428df2 with gcc (GCC) 5.5.0
kernel signature: 0e1447cfa73f79b952b196dd245d57d37b45e9ca
run #0: crashed: general protection fault in release_tty
run #1: crashed: general protection fault in release_tty
run #2: crashed: general protection fault in release_tty
run #3: crashed: general protection fault in release_tty
run #4: crashed: general protection fault in release_tty
run #5: crashed: BUG: sleeping function called from invalid context in corrupted
run #6: crashed: general protection fault in release_tty
run #7: crashed: general protection fault in release_tty
run #8: crashed: general protection fault in release_tty
run #9: crashed: no output from test machine
testing release v4.1
testing commit b953c0d234bc72e8489d3bf51a276c5c4ec85345 with gcc (GCC) 5.5.0
kernel signature: 0aaaa454b75b185d4ecec7c35bb9b09ddb4ed046
run #0: crashed: general protection fault in release_tty
run #1: crashed: INFO: trying to register non-static key in release_tty
run #2: crashed: general protection fault in release_tty
run #3: crashed: general protection fault in release_tty
run #4: crashed: general protection fault in release_tty
run #5: crashed: general protection fault in corrupted
run #6: crashed: general protection fault in release_tty
run #7: crashed: general protection fault in release_tty
run #8: crashed: general protection fault in corrupted
run #9: crashed: general protection fault in release_tty
revisions tested: 26, total time: 3h44m51.095475071s (build: 2h4m18.63854866s, test: 1h37m11.641594508s)
the crash already happened on the oldest tested release
commit msg: Linux 4.1
crash: general protection fault in release_tty
IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
general protection fault: 0000 [#1] PREEMPT SMP 
Modules linked in:
CPU: 1 PID: 6723 Comm: syz-executor.2 Not tainted 4.1.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8800ad060950 ti: ffff8800aaa40000 task.ti: ffff8800aaa40000
RIP: 0010:[<ffffffff811c403b>]  [<ffffffff811c403b>] atomic_inc arch/x86/include/asm/atomic.h:92 [inline]
RIP: 0010:[<ffffffff811c403b>]  [<ffffffff811c403b>] __lock_acquire+0x2db/0x1c70 kernel/locking/lockdep.c:3105
RSP: 0000:ffff8800aaa43b18  EFLAGS: 00010086
RAX: 0000000000000000 RBX: dead4ead00000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffff8800aaa43bd8 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
R13: 0000000000000000 R14: ffff8800ab788028 R15: ffff8800ad060950
FS:  00000000026ea940(0063) GS:ffff88012c100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000056458fa550b8 CR3: 00000000ad2c9000 CR4: 00000000001407e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 0000000000000001 ffff8800ad0611e0 ffff8800aaa43b38 ffffffff811e162d
 ffff8800aaa43c08 ffffffff00000000 0000000000000000 ffff880000000000
 ffff8800b649a8b8 ffffffff83d7e6c0 ffff8800ad0611e0 ffffffff00000000
Call Trace:
 [<ffffffff811c6496>] lock_acquire+0xe6/0x310 kernel/locking/lockdep.c:3623
 [<ffffffff8118af7a>] flush_work+0x3a/0x320 kernel/workqueue.c:2731
 [<ffffffff8118c9ca>] __cancel_work_timer+0xda/0x210 kernel/workqueue.c:2801
 [<ffffffff8118cb0b>] cancel_work_sync+0xb/0x10 kernel/workqueue.c:2836
 [<ffffffff81afbf6a>] release_tty+0x8a/0x120 drivers/tty/tty_io.c:1697
 [<ffffffff81afc3ea>] tty_release+0x3ea/0x570 drivers/tty/tty_io.c:1928
 [<ffffffff81300e2d>] __fput+0xed/0x250 fs/file_table.c:208
 [<ffffffff81300fd9>] ____fput+0x9/0x10 fs/file_table.c:244
 [<ffffffff81192564>] task_work_run+0xc4/0xf0 kernel/task_work.c:123
 [<ffffffff8107d238>] tracehook_notify_resume include/linux/tracehook.h:190 [inline]
 [<ffffffff8107d238>] do_notify_resume+0x68/0x70 arch/x86/kernel/signal.c:739
 [<ffffffff827a676b>] int_signal+0x12/0x17
Code: 49 81 3e 40 29 64 83 b8 00 00 00 00 44 0f 44 e0 41 83 fd 01 0f 87 aa fd ff ff 44 89 e8 49 8b 5c c6 08 48 85 db 0f 84 99 fd ff ff <f0> ff 83 98 01 00 00 8b 05 10 6c 11 03 41 8b 8f 60 08 00 00 85 
RIP  [<ffffffff811c403b>] __lock_acquire+0x2db/0x1c70 kernel/locking/lockdep.c:3100
 RSP <ffff8800aaa43b18>
---[ end trace 6fa09b6099d840b9 ]---