bisecting cause commit starting from 3e732ebf7316ac83e8562db7e64cc68aec390a18
building syzkaller on 975824663d2c65cf7a4d7829fa95f118b675c3be
testing commit 3e732ebf7316ac83e8562db7e64cc68aec390a18
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: a161dbfdf6900ffc82edb8e0f9ae2622a10e0df9879e95797858a1075dbb4093
run #0: crashed: KASAN: use-after-free Read in cfusbl_device_notify
run #1: crashed: KASAN: use-after-free Read in cfusbl_device_notify
run #2: crashed: KASAN: use-after-free Read in cfusbl_device_notify
run #3: crashed: KASAN: use-after-free Read in cfusbl_device_notify
run #4: crashed: KASAN: use-after-free Read in cfusbl_device_notify
run #5: crashed: KASAN: use-after-free Read in cfusbl_device_notify
run #6: crashed: KASAN: use-after-free Read in cfusbl_device_notify
run #7: crashed: KASAN: use-after-free Read in cfusbl_device_notify
run #8: crashed: KASAN: use-after-free Read in cfusbl_device_notify
run #9: crashed: KASAN: use-after-free Read in cfusbl_device_notify
run #10: crashed: KASAN: use-after-free Read in cfusbl_device_notify
run #11: crashed: KASAN: use-after-free Read in cfusbl_device_notify
run #12: crashed: KASAN: use-after-free Read in cfusbl_device_notify
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
testing release v5.17
testing commit f443e374ae131c168a065ea1748feac6b2e76613
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 8d47111bc2436b6e5d0a89d389c7c5f0811e38dde4a24df2fce136dda75e8ff2
all runs: OK
# git bisect start 3e732ebf7316ac83e8562db7e64cc68aec390a18 f443e374ae131c168a065ea1748feac6b2e76613
Bisecting: 6579 revisions left to test after this (roughly 13 steps)
[169e77764adc041b1dacba84ea90516a895d43b2] Merge tag 'net-next-5.18' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

testing commit 169e77764adc041b1dacba84ea90516a895d43b2
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 4bad07fdb12fce80ce8067c5b36ad61a0246010fcbd75bc6235e27183e5490bf
run #0: crashed: KASAN: use-after-free Read in cfusbl_device_notify
run #1: crashed: KASAN: use-after-free Read in cfusbl_device_notify
run #2: crashed: KASAN: use-after-free Read in cfusbl_device_notify
run #3: crashed: KASAN: use-after-free Read in cfusbl_device_notify
run #4: crashed: KASAN: use-after-free Read in cfusbl_device_notify
run #5: crashed: KASAN: use-after-free Read in cfusbl_device_notify
run #6: OK
run #7: OK
run #8: OK
run #9: OK
# git bisect bad 169e77764adc041b1dacba84ea90516a895d43b2
Bisecting: 3788 revisions left to test after this (roughly 12 steps)
[b4bc93bd76d4da32600795cd323c971f00a2e788] Merge tag 'arm-drivers-5.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

testing commit b4bc93bd76d4da32600795cd323c971f00a2e788
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: ad2304f3418991efdc646da91b53e13dd5399c9f676d8f647ace4d033852d478
run #0: OK
run #1: OK
run #2: OK
run #3: OK
run #4: crashed: unregister_netdevice: waiting for DEV to become free
run #5: OK
run #6: OK
run #7: crashed: unregister_netdevice: waiting for DEV to become free
run #8: OK
run #9: OK
reproducer seems to be flaky
# git bisect bad b4bc93bd76d4da32600795cd323c971f00a2e788
Bisecting: 1986 revisions left to test after this (roughly 11 steps)
[3fe2f7446f1e029b220f7f650df6d138f91651f2] Merge tag 'sched-core-2022-03-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

testing commit 3fe2f7446f1e029b220f7f650df6d138f91651f2
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 9cf8c3ed7cf0a3a209f27cec671977149e02e2b67069fb2ee775ed343d0ce55f
all runs: OK
# git bisect good 3fe2f7446f1e029b220f7f650df6d138f91651f2
Bisecting: 898 revisions left to test after this (roughly 10 steps)
[182966e1cd74ec0e326cd376de241803ee79741b] Merge tag 'media/v5.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

testing commit 182966e1cd74ec0e326cd376de241803ee79741b
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 9363ffe0847f886ea23927bb2d1fc4942eeb6707094d29bbc3cd87d8aeb596db
run #0: OK
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: crashed: unregister_netdevice: waiting for DEV to become free
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: crashed: unregister_netdevice: waiting for DEV to become free
run #18: OK
run #19: crashed: unregister_netdevice: waiting for DEV to become free
# git bisect bad 182966e1cd74ec0e326cd376de241803ee79741b
Bisecting: 561 revisions left to test after this (roughly 9 steps)
[d51b1b33c51d147b757f042b4d336603b699f362] Merge tag 'linux-kselftest-kunit-5.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest

testing commit d51b1b33c51d147b757f042b4d336603b699f362
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: a5abc3b096510dbaea9acd7a8cc9495267bce405dc624f26f93c6db2bc365eb4
run #0: OK
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: crashed: unregister_netdevice: waiting for DEV to become free
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
# git bisect bad d51b1b33c51d147b757f042b4d336603b699f362
Bisecting: 297 revisions left to test after this (roughly 8 steps)
[3bf03b9a0839c9fb06927ae53ebd0f960b19d408] Merge branch 'akpm' (patches from Andrew)

testing commit 3bf03b9a0839c9fb06927ae53ebd0f960b19d408
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 3fcb0811c0c65f0367b0b95bd873f51d03df7b6ef8e7697b638963a0276878b9
run #0: crashed: unregister_netdevice: waiting for DEV to become free
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: crashed: unregister_netdevice: waiting for DEV to become free
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
# git bisect bad 3bf03b9a0839c9fb06927ae53ebd0f960b19d408
Bisecting: 113 revisions left to test after this (roughly 7 steps)
[49775047cf52a92e41444d41a0584180ec2c256b] mm/memory-failure.c: rework the signaling logic in kill_proc

testing commit 49775047cf52a92e41444d41a0584180ec2c256b
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
mm/page_alloc.c:7631:20: error: 'free_area_init_memoryless_node' defined but not used [-Werror=unused-function]
# git bisect skip 49775047cf52a92e41444d41a0584180ec2c256b
Bisecting: 113 revisions left to test after this (roughly 7 steps)
[5abc1e37afa0335c52608d640fd30910b2eeda21] mm: list_lru: allocate list_lru_one only when needed

testing commit 5abc1e37afa0335c52608d640fd30910b2eeda21
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 5d0d15c24fdd9cfe1e2137ac193786b334e735d2792f795b3e100c39df413721
failed: failed to create VM pool: failed to create GCE image: create image operation failed: &{Code:PERMISSIONS_ERROR Location: Message:Required 'read' permission for 'disks/ci-upstream-kasan-gce-root-bisect-job-bisect-job-image.tar.gz' ForceSendFields:[] NullFields:[]}.
# git bisect skip 5abc1e37afa0335c52608d640fd30910b2eeda21
Bisecting: 113 revisions left to test after this (roughly 7 steps)
[77fe7f136a7312954b1b8b7eeb4bc91fc3c14a3f] mm/page_alloc: check high-order pages for corruption during PCP operations

testing commit 77fe7f136a7312954b1b8b7eeb4bc91fc3c14a3f
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
mm/page_alloc.c:7631:20: error: 'free_area_init_memoryless_node' defined but not used [-Werror=unused-function]
# git bisect skip 77fe7f136a7312954b1b8b7eeb4bc91fc3c14a3f
Bisecting: 113 revisions left to test after this (roughly 7 steps)
[7ea0d2d79da09d1f7d71c96a9c9bc1b5229360b5] drivers/base/memory: add memory block to memory group after registration succeeded

testing commit 7ea0d2d79da09d1f7d71c96a9c9bc1b5229360b5
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 4976a8ddd1b29b376c573ae41dc40b551450611112bfe6f2aed53187e2446d3e
run #0: OK
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: crashed: unregister_netdevice: waiting for DEV to become free
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
# git bisect bad 7ea0d2d79da09d1f7d71c96a9c9bc1b5229360b5
Bisecting: 84 revisions left to test after this (roughly 6 steps)
[690467c81b1a49de38a4b89eedc0ae85015f4c79] mm/vmalloc: Move draining areas out of caller context

testing commit 690467c81b1a49de38a4b89eedc0ae85015f4c79
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 8f42572bc253586115e65d6dd6db6de449ed717de710ceba7359deef63e02c0c
run #0: OK
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: crashed: unregister_netdevice: waiting for DEV to become free
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
# git bisect bad 690467c81b1a49de38a4b89eedc0ae85015f4c79
Bisecting: 42 revisions left to test after this (roughly 5 steps)
[2343e88d238f5de973d609d861c505890f94f22e] mm/memcg: disable threshold event handlers on PREEMPT_RT

testing commit 2343e88d238f5de973d609d861c505890f94f22e
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 5745870502f2745b644f01a2b4dcbcaa5cb93f8fc8ea376c3c9dce493005c8f1
all runs: OK
# git bisect good 2343e88d238f5de973d609d861c505890f94f22e
Bisecting: 20 revisions left to test after this (roughly 5 steps)
[16785bd7743104d57257a455001172b75afa7614] mm: merge pte_mkhuge() call into arch_make_huge_pte()

testing commit 16785bd7743104d57257a455001172b75afa7614
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 0ad2a382480a41d214e063efb3b7c5a5cd1b90b13ffe00449a17b1d9cdc938ab
run #0: OK
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: crashed: unregister_netdevice: waiting for DEV to become free
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
# git bisect bad 16785bd7743104d57257a455001172b75afa7614
Bisecting: 10 revisions left to test after this (roughly 4 steps)
[9bbdc0f324097f72b2354c2f8be4cdffd32679b6] xarray: use kmem_cache_alloc_lru to allocate xa_node

testing commit 9bbdc0f324097f72b2354c2f8be4cdffd32679b6
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 542ccc43cf489ec56eb627c6d20d42c8773bfe4b4de4264ebc7bbe1cc65ed943
all runs: OK
# git bisect good 9bbdc0f324097f72b2354c2f8be4cdffd32679b6
Bisecting: 4 revisions left to test after this (roughly 3 steps)
[be740503ed03ea04ca362330baf082e6a38fe462] mm: memcontrol: fix cannot alloc the maximum memcg ID

testing commit be740503ed03ea04ca362330baf082e6a38fe462
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 81480f89d24398cc30f4ea3d188e875dc1f8f2373e3761e997b75596ce99fb8f
run #0: OK
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: crashed: unregister_netdevice: waiting for DEV to become free
run #13: OK
run #14: OK
run #15: OK
run #16: crashed: unregister_netdevice: waiting for DEV to become free
run #17: OK
run #18: OK
run #19: OK
# git bisect bad be740503ed03ea04ca362330baf082e6a38fe462
Bisecting: 2 revisions left to test after this (roughly 2 steps)
[1f391eb270791359ee79031945dbe3afeaec6ce3] mm: list_lru: rename memcg_drain_all_list_lrus to memcg_reparent_list_lrus

testing commit 1f391eb270791359ee79031945dbe3afeaec6ce3
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 6437e6f88a68fa4bb656eb9909e795f305042516272bd0d8d6ef14663c118ff5
run #0: OK
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: crashed: unregister_netdevice: waiting for DEV to become free
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
# git bisect bad 1f391eb270791359ee79031945dbe3afeaec6ce3
Bisecting: 0 revisions left to test after this (roughly 1 step)
[da0efe30944476275c902c52fbac812db0541d87] mm: memcontrol: move memcg_online_kmem() to mem_cgroup_css_online()

testing commit da0efe30944476275c902c52fbac812db0541d87
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 93afadc1fbfab9ef41ddf87a8e09ac6f4ce1eee12c9fa6f432ac7ec2e05d0673
run #0: OK
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: crashed: unregister_netdevice: waiting for DEV to become free
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
# git bisect bad da0efe30944476275c902c52fbac812db0541d87
da0efe30944476275c902c52fbac812db0541d87 is the first bad commit
commit da0efe30944476275c902c52fbac812db0541d87
Author: Muchun Song <songmuchun@bytedance.com>
Date:   Tue Mar 22 14:41:15 2022 -0700

    mm: memcontrol: move memcg_online_kmem() to mem_cgroup_css_online()
    
    It will simplify the code if moving memcg_online_kmem() to
    mem_cgroup_css_online() and do not need to set ->kmemcg_id to -1 to
    indicate the memcg is offline.  In the next patch, ->kmemcg_id will be
    used to sync list lru reparenting which requires not to change
    ->kmemcg_id.
    
    Link: https://lkml.kernel.org/r/20220228122126.37293-10-songmuchun@bytedance.com
    Signed-off-by: Muchun Song <songmuchun@bytedance.com>
    Acked-by: Roman Gushchin <roman.gushchin@linux.dev>
    Cc: Alex Shi <alexs@kernel.org>
    Cc: Anna Schumaker <Anna.Schumaker@Netapp.com>
    Cc: Chao Yu <chao@kernel.org>
    Cc: Dave Chinner <david@fromorbit.com>
    Cc: Fam Zheng <fam.zheng@bytedance.com>
    Cc: Jaegeuk Kim <jaegeuk@kernel.org>
    Cc: Johannes Weiner <hannes@cmpxchg.org>
    Cc: Kari Argillander <kari.argillander@gmail.com>
    Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
    Cc: Michal Hocko <mhocko@kernel.org>
    Cc: Qi Zheng <zhengqi.arch@bytedance.com>
    Cc: Shakeel Butt <shakeelb@google.com>
    Cc: Theodore Ts'o <tytso@mit.edu>
    Cc: Trond Myklebust <trond.myklebust@hammerspace.com>
    Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
    Cc: Vlastimil Babka <vbabka@suse.cz>
    Cc: Wei Yang <richard.weiyang@gmail.com>
    Cc: Xiongchun Duan <duanxiongchun@bytedance.com>
    Cc: Yang Shi <shy828301@gmail.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

 mm/memcontrol.c | 37 ++++++++++++++++---------------------
 1 file changed, 16 insertions(+), 21 deletions(-)

culprit signature: 93afadc1fbfab9ef41ddf87a8e09ac6f4ce1eee12c9fa6f432ac7ec2e05d0673
parent  signature: 542ccc43cf489ec56eb627c6d20d42c8773bfe4b4de4264ebc7bbe1cc65ed943
Reproducer flagged being flaky
revisions tested: 17, total time: 3h20m3.658439791s (build: 1h49m37.188374839s, test: 1h28m57.552822674s)
first bad commit: da0efe30944476275c902c52fbac812db0541d87 mm: memcontrol: move memcg_online_kmem() to mem_cgroup_css_online()
recipients (to): ["akpm@linux-foundation.org" "roman.gushchin@linux.dev" "songmuchun@bytedance.com" "torvalds@linux-foundation.org"]
recipients (cc): []
crash: unregister_netdevice: waiting for DEV to become free
unregister_netdevice: waiting for virt_wifi0 to become free. Usage count = 2