bisecting cause commit starting from 883d71a55e968371d1ff151249732466b5581f58
building syzkaller on b44001ce341058eacf27ece52df7cf35ca8b2f5a
testing commit 883d71a55e968371d1ff151249732466b5581f58
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1
kernel signature: 37122bc18ce9bd7e2b520e37d8a3d7298326ce91338c2071358447c21d42db76
run #0: crashed: possible deadlock in br_del_bridge
run #1: crashed: possible deadlock in br_ioctl_call
run #2: crashed: possible deadlock in br_ioctl_call
run #3: crashed: possible deadlock in br_ioctl_call
run #4: crashed: possible deadlock in br_del_bridge
run #5: crashed: possible deadlock in br_ioctl_call
run #6: crashed: possible deadlock in br_ioctl_call
run #7: crashed: possible deadlock in br_del_bridge
run #8: crashed: possible deadlock in br_ioctl_call
run #9: crashed: possible deadlock in br_ioctl_call
run #10: crashed: possible deadlock in br_ioctl_call
run #11: crashed: possible deadlock in br_del_bridge
run #12: crashed: possible deadlock in br_ioctl_call
run #13: crashed: possible deadlock in br_ioctl_call
run #14: crashed: possible deadlock in br_ioctl_call
run #15: crashed: possible deadlock in br_ioctl_call
run #16: crashed: possible deadlock in br_ioctl_call
run #17: crashed: possible deadlock in br_ioctl_call
run #18: crashed: possible deadlock in br_ioctl_call
run #19: crashed: possible deadlock in br_ioctl_call
testing release v5.13
testing commit 62fb9874f5da54fdb243003b386128037319b219
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1
kernel signature: 909f5b513362d755e99068620c19525cb2afd91ca8725228219fd46574a48866
all runs: OK
# git bisect start 883d71a55e968371d1ff151249732466b5581f58 62fb9874f5da54fdb243003b386128037319b219
Bisecting: 7303 revisions left to test after this (roughly 13 steps)
[e04360a2ea01bf42aa639b65aad81f502e896c7f] Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

testing commit e04360a2ea01bf42aa639b65aad81f502e896c7f
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1
kernel signature: 88661c1a78c1e9c59c54273183f496bfecad7252c6a597313cc3f626b95eb7b2
all runs: OK
# git bisect good e04360a2ea01bf42aa639b65aad81f502e896c7f
Bisecting: 3495 revisions left to test after this (roughly 12 steps)
[a16d8644bad461bb073b92e812080ea6715ddf2b] Merge tag 'staging-5.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

testing commit a16d8644bad461bb073b92e812080ea6715ddf2b
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1
kernel signature: 91435ea47ec99f40fb4b9abd9bcbebf717239adac3c25ec13e7e47ab74a0a66f
run #0: boot failed: kernel panic: VFS: Unable to mount root fs on unknown-block(0,0)
run #1: boot failed: kernel panic: VFS: Unable to mount root fs on unknown-block(0,0)
run #2: boot failed: kernel panic: VFS: Unable to mount root fs on unknown-block(0,0)
run #3: boot failed: possible deadlock in fs_reclaim_acquire
run #4: boot failed: kernel panic: VFS: Unable to mount root fs on unknown-block(0,0)
run #5: boot failed: kernel panic: VFS: Unable to mount root fs on unknown-block(0,0)
run #6: boot failed: kernel panic: VFS: Unable to mount root fs on unknown-block(0,0)
run #7: boot failed: kernel panic: VFS: Unable to mount root fs on unknown-block(0,0)
run #8: boot failed: kernel panic: VFS: Unable to mount root fs on unknown-block(0,0)
run #9: boot failed: kernel panic: VFS: Unable to mount root fs on unknown-block(0,0)
# git bisect skip a16d8644bad461bb073b92e812080ea6715ddf2b
Bisecting: 3495 revisions left to test after this (roughly 12 steps)
[1d9539ed2da86296de04173c413378459cf6eb32] rtc: palmas: convert to SPDX identifier

testing commit 1d9539ed2da86296de04173c413378459cf6eb32
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1
kernel signature: f27b781a0a49a7852f1c4f1d2d6e7fe5900f905ce600ea22e7c7dc39c8a88e0f
all runs: OK
# git bisect good 1d9539ed2da86296de04173c413378459cf6eb32
Bisecting: 3471 revisions left to test after this (roughly 12 steps)
[d836cb5fe045463cdab15ad6f278f7c7c194228f] can: m_can: Add support for transceiver as phy

testing commit d836cb5fe045463cdab15ad6f278f7c7c194228f
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1
kernel signature: 46873faa6533ad963e81cd4a02d27564fb5d8c3f6dbc3f034cd6808f545a577e
all runs: OK
# git bisect good d836cb5fe045463cdab15ad6f278f7c7c194228f
Bisecting: 90 revisions left to test after this (roughly 7 steps)
[e4252cb66637b846b916cca7c2cdb4ed22ab2fc3] openvswitch: update kdoc OVS_DP_ATTR_PER_CPU_PIDS

testing commit e4252cb66637b846b916cca7c2cdb4ed22ab2fc3
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1
kernel signature: e1f336c86a15dfb8fad29fd69e0624e7c2e0ea0facdc0bd3e8bc49f18d7807db
run #0: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
reproducer seems to be flaky
# git bisect bad e4252cb66637b846b916cca7c2cdb4ed22ab2fc3
Bisecting: 44 revisions left to test after this (roughly 6 steps)
[d20e5880fe9df149a9159673d9fec57aab43ac61] Merge tag 'linux-can-next-for-5.15-20210725' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next

testing commit d20e5880fe9df149a9159673d9fec57aab43ac61
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1
kernel signature: 62656d4b2822e5b1e19a68bf60ba7ea66e9d50e9e7722489591541965d797cec
all runs: OK
# git bisect good d20e5880fe9df149a9159673d9fec57aab43ac61
Bisecting: 21 revisions left to test after this (roughly 5 steps)
[19fa937a391e58f4bb74ea52a5cdb4f259e67db2] net: dsa: sja1105: deny more than one VLAN-aware bridge

testing commit 19fa937a391e58f4bb74ea52a5cdb4f259e67db2
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1
kernel signature: 4a6b2a6d7cda0541adba9eca1f0b399418b3d26ef76dcebf0e82c00c130bbd61
all runs: OK
# git bisect good 19fa937a391e58f4bb74ea52a5cdb4f259e67db2
Bisecting: 10 revisions left to test after this (roughly 4 steps)
[6321c7acb82872ef6576c520b0e178eaad3a25c0] ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs()

testing commit 6321c7acb82872ef6576c520b0e178eaad3a25c0
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1
kernel signature: 0387995f6ba3b062922276d0976a908a18f2633210d365e94244c859cba6844a
all runs: OK
# git bisect good 6321c7acb82872ef6576c520b0e178eaad3a25c0
Bisecting: 5 revisions left to test after this (roughly 3 steps)
[dc8f7e3924a99515d8c3d3dbd905ad1327ac37b6] net: ipa: set up the microcontroller earlier

testing commit dc8f7e3924a99515d8c3d3dbd905ad1327ac37b6
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1
kernel signature: de2715a4c08775c168ea28a7cbbb533ecc750ff84a2c4f9d96551fa2dccb60fa
all runs: OK
# git bisect good dc8f7e3924a99515d8c3d3dbd905ad1327ac37b6
Bisecting: 2 revisions left to test after this (roughly 2 steps)
[9b29a161ef38040f000dcf9ccf78e34495edfd55] ethtool: Fix rxnfc copy to user buffer overflow

testing commit 9b29a161ef38040f000dcf9ccf78e34495edfd55
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1
kernel signature: abddf25eda1ee42910a1f987f98cfd9ebc12c0a2ab6ec01f76eb77f80fbbb51e
run #0: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
# git bisect bad 9b29a161ef38040f000dcf9ccf78e34495edfd55
Bisecting: 0 revisions left to test after this (roughly 1 step)
[268ca4129d8da764fdf72916f762a1145c6ea743] Merge branch 'ipa-clock'

testing commit 268ca4129d8da764fdf72916f762a1145c6ea743
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1
kernel signature: de2715a4c08775c168ea28a7cbbb533ecc750ff84a2c4f9d96551fa2dccb60fa
run #0: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
# git bisect bad 268ca4129d8da764fdf72916f762a1145c6ea743
Bisecting: 0 revisions left to test after this (roughly 0 steps)
[e2f154e6b601fb25344ae244834de19881edb289] net: ipa: introduce ipa_uc_clock()

testing commit e2f154e6b601fb25344ae244834de19881edb289
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1
kernel signature: de2715a4c08775c168ea28a7cbbb533ecc750ff84a2c4f9d96551fa2dccb60fa
all runs: OK
# git bisect good e2f154e6b601fb25344ae244834de19881edb289
268ca4129d8da764fdf72916f762a1145c6ea743 is the first bad commit
commit 268ca4129d8da764fdf72916f762a1145c6ea743
Merge: 323e0cb473e2 e2f154e6b601
Author: David S. Miller <davem@davemloft.net>
Date:   Mon Jul 26 23:09:31 2021 +0100

    Merge branch 'ipa-clock'
    
    Alex Elder says:
    
    ====================
    net: ipa: defer taking uC proxy clock
    
    This series rearranges some of the IPA initialization code.
    
    The first patch gets rid of two trivial setup and teardown
    functions, open-coding them in their callers instead.
    
    The second patch has memory regions get configured before endpoints.
    
    IPA interrupts do not depend on GSI being initialized.  Therefore
    they can be initialized in the config phase rather than waiting for
    setup.  The third patch moves this initialization earlier; memory
    regions must already be defined, so it's done after memory config.
    
    The microcontroller also has no dependency on GSI, though it does
    require IPA interrupts to be configured.  The fourth patch moves
    microcontroller initialization so it too happens during the config
    phase rather than setup.
    
    Finally, we currently take a "proxy clock" for the microcontroller
    during the config phase, dropping it only after we learn the
    microcontroller is initialized.  But microcontroller initialization
    is started by the modem, so there's no point in taking that clock
    reference before we know the modem has booted.  So the last patch
    arranges to wait to take the "proxy clock" for the microcontroller
    until we know the modem is about to boot.
    ====================
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

 drivers/net/ipa/ipa.h           |  2 ++
 drivers/net/ipa/ipa_interrupt.c |  8 +++----
 drivers/net/ipa/ipa_interrupt.h |  8 +++----
 drivers/net/ipa/ipa_main.c      | 52 ++++++++++++++++++++++-------------------
 drivers/net/ipa/ipa_modem.c     | 12 ++--------
 drivers/net/ipa/ipa_modem.h     |  4 ----
 drivers/net/ipa/ipa_qmi.c       |  6 ++---
 drivers/net/ipa/ipa_qmi.h       | 19 +++++++++++++++
 drivers/net/ipa/ipa_uc.c        | 52 ++++++++++++++++++++++++-----------------
 drivers/net/ipa/ipa_uc.h        | 22 +++++++++++++----
 10 files changed, 110 insertions(+), 75 deletions(-)

Reproducer flagged being flaky
revisions tested: 14, total time: 3h38m47.645149611s (build: 1h33m34.033447721s, test: 2h3m44.261391711s)
first bad commit: 268ca4129d8da764fdf72916f762a1145c6ea743 Merge branch 'ipa-clock'
recipients (to): ["davem@davemloft.net"]
recipients (cc): []
crash: BUG: sleeping function called from invalid context in lock_sock_nested
BUG: sleeping function called from invalid context at net/core/sock.c:3161
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 8930, name: syz-executor.2
1 lock held by syz-executor.2/8930:
 #0: ffffffff8c4101c0 (hci_sk_list.lock){++++}-{2:2}, at: hci_sock_dev_event+0x374/0x5c0 net/bluetooth/hci_sock.c:763
Preemption disabled at:
[<0000000000000000>] 0x0
CPU: 0 PID: 8930 Comm: syz-executor.2 Not tainted 5.14.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x57/0x7d lib/dump_stack.c:105
 ___might_sleep.cold+0x1f1/0x237 kernel/sched/core.c:9154
 lock_sock_nested+0x1e/0xf0 net/core/sock.c:3161
 lock_sock include/net/sock.h:1613 [inline]
 hci_sock_dev_event+0x3ea/0x5c0 net/bluetooth/hci_sock.c:765
 hci_unregister_dev+0x29b/0xfb0 net/bluetooth/hci_core.c:4033
 vhci_release+0x62/0xd0 drivers/bluetooth/hci_vhci.c:340
 __fput+0x209/0x870 fs/file_table.c:280
 task_work_run+0xc0/0x160 kernel/task_work.c:164
 exit_task_work include/linux/task_work.h:32 [inline]
 do_exit+0x9fe/0x24e0 kernel/exit.c:825
 do_group_exit+0xe7/0x290 kernel/exit.c:922
 __do_sys_exit_group kernel/exit.c:933 [inline]
 __se_sys_exit_group kernel/exit.c:931 [inline]
 __x64_sys_exit_group+0x35/0x40 kernel/exit.c:931
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665e9
Code: Unable to access opcode bytes at RIP 0x4665bf.
RSP: 002b:00007fff4d90f488 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007fff4d90fc48 RCX: 00000000004665e9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000043
RBP: 0000000000000000 R08: 0000000000000025 R09: 00007fff4d90fc48
R10: 00000000ffffffff R11: 0000000000000246 R12: 00000000004bef74
R13: 0000000000000010 R14: 0000000000000000 R15: 0000000000400538

======================================================