bisecting cause commit starting from 1d4eb636f0abe9d796f9f2a386e2a6fecdee9466 building syzkaller on 92a4950507d9d15be9541491300b2201433f6814 testing commit 1d4eb636f0abe9d796f9f2a386e2a6fecdee9466 with gcc (GCC) 8.1.0 run #0: crashed: BUG: corrupted list in p9_fd_cancel run #1: crashed: BUG: corrupted list in p9_fd_cancel run #2: crashed: BUG: corrupted list in p9_fd_cancel run #3: crashed: BUG: corrupted list in p9_conn_cancel run #4: crashed: BUG: corrupted list in p9_fd_cancel run #5: crashed: KASAN: use-after-free Read in __queue_work run #6: crashed: BUG: corrupted list in p9_conn_cancel run #7: crashed: BUG: corrupted list in p9_fd_cancel run #8: crashed: KASAN: use-after-free Read in __queue_work run #9: crashed: BUG: corrupted list in p9_fd_cancel testing release v4.17 testing commit 29dcea88779c856c7dc92040a0c01233263101d4 with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in __queue_work run #1: crashed: KASAN: use-after-free Read in __queue_work run #2: crashed: KASAN: use-after-free Read in __queue_work run #3: crashed: KASAN: use-after-free Read in __queue_work run #4: crashed: KASAN: use-after-free Read in __queue_work run #5: crashed: WARNING: ODEBUG bug in p9_fd_close run #6: crashed: KASAN: use-after-free Read in __queue_work run #7: crashed: KASAN: use-after-free Read in __queue_work run #8: crashed: BUG: corrupted list in p9_conn_cancel run #9: crashed: KASAN: use-after-free Read in __queue_work testing release v4.16 testing commit 0adb32858b0bddf4ada5f364a84ed60b196dbcda with gcc (GCC) 8.1.0 run #0: crashed: WARNING: ODEBUG bug in __queue_work run #1: crashed: KASAN: use-after-free Read in p9_poll_workfn run #2: crashed: KASAN: use-after-free Read in __queue_work run #3: crashed: KASAN: use-after-free Read in __queue_work run #4: crashed: KASAN: use-after-free Read in __queue_work run #5: crashed: KASAN: use-after-free Read in __queue_work run #6: crashed: WARNING: ODEBUG bug in p9_fd_close run #7: crashed: KASAN: use-after-free Read in __queue_work run #8: crashed: KASAN: use-after-free Read in p9_poll_workfn run #9: crashed: KASAN: use-after-free Read in __queue_work testing release v4.15 testing commit d8a5b80568a9cb66810e75b182018e9edb68e8ff with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in p9_poll_workfn run #1: crashed: WARNING: ODEBUG bug in p9_fd_close run #2: crashed: WARNING: ODEBUG bug in p9_fd_close run #3: crashed: WARNING: ODEBUG bug in p9_fd_close run #4: crashed: KASAN: use-after-free Read in p9_poll_workfn run #5: crashed: WARNING: bad unlock balance detected! run #6: crashed: BUG: corrupted list in p9_fd_cancel run #7: crashed: WARNING: ODEBUG bug in p9_fd_close run #8: crashed: KASAN: use-after-free Read in p9_fd_poll run #9: OK testing release v4.14 testing commit bebc6082da0a9f5d47a1ea2edc099bf671058bd4 with gcc (GCC) 8.1.0 run #0: crashed: BUG: corrupted list in p9_fd_cancel run #1: crashed: WARNING: ODEBUG bug in p9_fd_close run #2: crashed: BUG: corrupted list in p9_fd_cancel run #3: crashed: BUG: corrupted list in p9_fd_cancel run #4: crashed: WARNING: ODEBUG bug in p9_fd_close run #5: crashed: BUG: corrupted list in p9_fd_cancel run #6: crashed: BUG: corrupted list in p9_fd_cancel run #7: crashed: BUG: corrupted list in p9_fd_cancel run #8: crashed: BUG: corrupted list in p9_fd_cancel run #9: crashed: KASAN: use-after-free Read in p9_poll_workfn testing release v4.13 testing commit 569dbb88e80deb68974ef6fdd6a13edb9d686261 with gcc (GCC) 8.1.0 run #0: OK run #1: crashed: BUG: corrupted list in p9_fd_cancel run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK testing release v4.12 testing commit 6f7da290413ba713f0cdd9ff1a2a9bb129ef4f6c with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in p9_poll_workfn run #1: crashed: KASAN: use-after-free Read in p9_poll_workfn run #2: crashed: KASAN: use-after-free Read in p9_poll_workfn run #3: crashed: BUG: corrupted list in p9_fd_cancel run #4: crashed: BUG: corrupted list in p9_conn_cancel run #5: crashed: BUG: corrupted list in p9_fd_cancel run #6: crashed: BUG: corrupted list in p9_conn_cancel run #7: crashed: BUG: corrupted list in p9_fd_cancel run #8: crashed: BUG: corrupted list in p9_fd_cancel run #9: crashed: BUG: corrupted list in p9_fd_cancel testing release v4.11 testing commit a351e9b9fc24e982ec2f0e76379a49826036da12 with gcc (GCC) 7.3.0 run #0: crashed: BUG: corrupted list in p9_conn_cancel run #1: crashed: BUG: corrupted list in p9_fd_cancel run #2: crashed: BUG: corrupted list in p9_conn_cancel run #3: crashed: general protection fault in p9_conn_cancel run #4: crashed: BUG: corrupted list in p9_fd_cancel run #5: crashed: BUG: corrupted list in p9_fd_cancel run #6: crashed: KASAN: use-after-free Read in __queue_work run #7: crashed: BUG: corrupted list in p9_fd_cancel run #8: crashed: BUG: corrupted list in p9_conn_cancel run #9: crashed: KASAN: use-after-free Read in p9_fd_poll testing release v4.10 testing commit c470abd4fde40ea6a0846a2beab642a578c0b8cd with gcc (GCC) 5.5.0 run #0: crashed: BUG: corrupted list in p9_conn_cancel run #1: crashed: BUG: corrupted list in p9_fd_cancel run #2: crashed: BUG: bad unlock balance detected! ] run #3: crashed: BUG: corrupted list in p9_fd_cancel run #4: crashed: BUG: corrupted list in p9_conn_cancel run #5: crashed: KASAN: use-after-free Read in p9_conn_cancel run #6: crashed: WARNING: ODEBUG bug in p9_fd_close run #7: crashed: BUG: corrupted list in p9_fd_cancel run #8: crashed: BUG: corrupted list in p9_fd_cancel run #9: OK testing release v4.9 testing commit 69973b830859bc6529a7a0468ba0d80ee5117826 with gcc (GCC) 5.5.0 run #0: crashed: WARNING in __list_del_entry run #1: crashed: WARNING in __list_del_entry run #2: crashed: KASAN: use-after-free Read in p9_poll_workfn run #3: crashed: WARNING in __list_del_entry run #4: crashed: WARNING in __list_del_entry run #5: crashed: WARNING in __list_del_entry run #6: crashed: WARNING in __list_del_entry run #7: crashed: WARNING in __list_del_entry run #8: OK run #9: OK testing release v4.8 testing commit c8d2bc9bc39ebea8437fd974fdbc21847bb897a3 with gcc (GCC) 5.5.0 run #0: crashed: WARNING in __list_del_entry run #1: crashed: BUG: bad unlock balance detected! ] run #2: crashed: WARNING in __list_del_entry run #3: crashed: WARNING in __list_del_entry run #4: crashed: WARNING in __list_del_entry run #5: crashed: WARNING in __list_del_entry run #6: crashed: WARNING in __list_del_entry run #7: crashed: WARNING in __list_del_entry run #8: OK run #9: OK testing release v4.7 testing commit 523d939ef98fd712632d93a5a2b588e477a7565e with gcc (GCC) 5.5.0 run #0: crashed: WARNING in __list_del_entry run #1: crashed: WARNING in __list_del_entry run #2: crashed: WARNING in __list_del_entry run #3: crashed: WARNING in __list_del_entry run #4: OK run #5: crashed: WARNING in __list_del_entry run #6: OK run #7: OK run #8: OK run #9: OK testing release v4.6 testing commit 2dcd0af568b0cf583645c8a317dd12e344b1c72a with gcc (GCC) 5.5.0 run #0: crashed: WARNING in __list_del_entry run #1: crashed: WARNING in __list_del_entry run #2: crashed: WARNING in __list_del_entry run #3: crashed: WARNING in __list_del_entry run #4: crashed: WARNING in __list_del_entry run #5: crashed: WARNING in __list_del_entry run #6: OK run #7: OK run #8: OK run #9: OK testing release v4.5 testing commit b562e44f507e863c6792946e4e1b1449fbbac85d with gcc (GCC) 5.5.0 run #0: crashed: WARNING in __list_del_entry run #1: crashed: WARNING in __list_del_entry run #2: crashed: WARNING in __list_del_entry run #3: crashed: WARNING in __list_del_entry run #4: crashed: BUG: unable to handle kernel NULL pointer dereference in p9_conn_cancel run #5: crashed: WARNING in __list_del_entry run #6: crashed: WARNING in __list_del_entry run #7: crashed: WARNING in __list_del_entry run #8: crashed: WARNING in __list_del_entry run #9: OK testing release v4.4 testing commit afd2ff9b7e1b367172f18ba7f693dfb62bdcb2dc with gcc (GCC) 5.5.0 run #0: crashed: WARNING in __list_del_entry run #1: crashed: WARNING in __list_del_entry run #2: crashed: WARNING in work_fixup_activate run #3: crashed: WARNING in work_fixup_activate run #4: crashed: BUG: bad unlock balance detected! ] run #5: crashed: BUG: unable to handle kernel NULL pointer dereference in p9_conn_cancel run #6: crashed: WARNING in __list_del_entry run #7: crashed: WARNING in __list_del_entry run #8: crashed: WARNING in work_fixup_activate run #9: crashed: WARNING in __list_del_entry testing release v4.3 testing commit 6a13feb9c82803e2b815eca72fa7a9f5561d7861 with gcc (GCC) 5.5.0 run #0: crashed: BUG: bad unlock balance detected! ] run #1: crashed: WARNING in __list_del_entry run #2: crashed: WARNING in work_fixup_activate run #3: crashed: WARNING in __list_del_entry run #4: crashed: WARNING in __list_del_entry run #5: crashed: WARNING in __list_del_entry run #6: crashed: WARNING in work_fixup_activate run #7: crashed: BUG: bad unlock balance detected! ] run #8: crashed: WARNING in __list_del_entry run #9: crashed: WARNING in __list_del_entry testing release v4.2 testing commit 64291f7db5bd8150a74ad2036f1037e6a0428df2 with gcc (GCC) 5.5.0 run #0: crashed: WARNING in __list_del_entry run #1: crashed: WARNING in __list_del_entry run #2: crashed: WARNING in work_fixup_activate run #3: crashed: BUG: bad unlock balance detected! ] run #4: crashed: WARNING in __list_del_entry run #5: crashed: BUG: bad unlock balance detected! ] run #6: crashed: WARNING in __list_del_entry run #7: crashed: WARNING in __list_del_entry run #8: crashed: WARNING in __list_del_entry run #9: crashed: BUG: unable to handle kernel NULL pointer dereference in p9_conn_cancel testing release v4.1 testing commit b953c0d234bc72e8489d3bf51a276c5c4ec85345 with gcc (GCC) 5.5.0 run #0: crashed: WARNING in __list_del_entry run #1: crashed: WARNING in __list_del_entry run #2: crashed: WARNING in __list_del_entry run #3: crashed: WARNING in __list_del_entry run #4: crashed: WARNING in __list_del_entry run #5: crashed: WARNING in work_fixup_activate run #6: crashed: BUG: unable to handle kernel NULL pointer dereference in p9_conn_cancel run #7: crashed: WARNING in __list_del_entry run #8: crashed: WARNING in work_fixup_activate run #9: crashed: WARNING in __list_del_entry revisions tested: 18, total time: 3h56m38.500439549s (build: 1h5m40.7663034s, test: 2h45m9.005730089s) the crash already happened on the oldest tested release crash: WARNING in __list_del_entry ------------[ cut here ]------------ WARNING: CPU: 0 PID: 12925 at lib/list_debug.c:53 __list_del_entry+0x70/0xe0 lib/list_debug.c:51() list_del corruption, ffff8800afb38028->next is LIST_POISON1 (dead000000100100) Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 12925 Comm: syz-executor3 Not tainted 4.1.0 #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffffffff82be6aea ffff8800afb379c8 ffffffff8246f079 0000000000000032 ffffffff82b8ea6e ffff8800afb37a48 ffffffff8246b33d 0000000000000000 ffffffff00000008 ffff8800afb37a58 ffff8800afb379f8 ffffffff8320bbc8 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0x4c/0x65 lib/dump_stack.c:50 [] panic+0xcd/0x211 kernel/panic.c:111 [] warn_slowpath_common+0xbb/0xc0 kernel/panic.c:442 [] warn_slowpath_fmt+0x41/0x50 kernel/panic.c:458 [] __list_del_entry+0x70/0xe0 lib/list_debug.c:51 [] list_del+0x11/0x40 lib/list_debug.c:77 [] p9_fd_cancel+0x4d/0x60 net/9p/trans_fd.c:696 [] p9_client_rpc+0x539/0x7f0 net/9p/client.c:777 [] p9_client_version net/9p/client.c:950 [inline] [] p9_client_create+0x266/0x700 net/9p/client.c:1043 [] v9fs_session_init+0xe5/0x720 fs/9p/v9fs.c:353 [] v9fs_mount+0x53/0x330 fs/9p/vfs_super.c:130 [] mount_fs+0x33/0x190 fs/super.c:1108 [] vfs_kern_mount+0x66/0x160 fs/namespace.c:937 [] do_new_mount fs/namespace.c:2368 [inline] [] do_mount+0x1f9/0xba0 fs/namespace.c:2684 [] SYSC_mount fs/namespace.c:2874 [inline] [] SyS_mount+0x8b/0xe0 fs/namespace.c:2852 [] system_call_fastpath+0x16/0x7a Kernel Offset: disabled