bisecting cause commit starting from 059432495e209279bae12db3d2b0bc8c8fe987bb building syzkaller on 5dd8aee810424d4c1b06252f59ae59416fcacc55 testing commit 059432495e209279bae12db3d2b0bc8c8fe987bb with gcc (GCC) 8.1.0 kernel signature: dfeb574b9f55344f41de95b8ab5f40cbee14a05ea66e723c1400a66eade2e013 run #0: crashed: INFO: task hung in addrconf_dad_work run #1: crashed: INFO: task hung in addrconf_dad_work run #2: crashed: INFO: task hung in addrconf_dad_work run #3: crashed: INFO: task hung in cfg80211_event_work run #4: crashed: INFO: task hung in addrconf_dad_work run #5: crashed: INFO: task hung in tcindex_partial_destroy_work run #6: crashed: INFO: task hung in tcindex_partial_destroy_work run #7: crashed: INFO: task hung in addrconf_dad_work run #8: crashed: INFO: task hung in tcindex_partial_destroy_work run #9: crashed: INFO: task hung in linkwatch_event testing release v5.8 testing commit bcf876870b95592b52519ed4aafcf9d95999bc9c with gcc (GCC) 8.1.0 kernel signature: 698fe4424ff569496bb83855c0a4aa3d2c509e1af00eef32dbcd837c2505d06e all runs: OK # git bisect start 059432495e209279bae12db3d2b0bc8c8fe987bb bcf876870b95592b52519ed4aafcf9d95999bc9c Bisecting: 7363 revisions left to test after this (roughly 13 steps) [47ec5303d73ea344e84f46660fff693c57641386] Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next testing commit 47ec5303d73ea344e84f46660fff693c57641386 with gcc (GCC) 8.1.0 kernel signature: 66b4f3c3f4dd1a21b23c2040dc50be36ae6656c66d059471f1edf76b75907eda all runs: OK # git bisect good 47ec5303d73ea344e84f46660fff693c57641386 Bisecting: 3651 revisions left to test after this (roughly 12 steps) [9420f1ce01869409d78901c3e036b2c437cbc6b8] Merge tag 'pinctrl-v5.9-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl testing commit 9420f1ce01869409d78901c3e036b2c437cbc6b8 with gcc (GCC) 8.1.0 kernel signature: 3503a2d8ae420529ad5fcd1ebd6fb05f6738d9ed7b75f8648c70182aef8c122b all runs: OK # git bisect good 9420f1ce01869409d78901c3e036b2c437cbc6b8 Bisecting: 1820 revisions left to test after this (roughly 11 steps) [4cf7562190c795f1f95be6ee0d161107d0dc5d49] Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net testing commit 4cf7562190c795f1f95be6ee0d161107d0dc5d49 with gcc (GCC) 8.1.0 kernel signature: 794f849e93c541319b8de8a271ffcf33c92b47a8fa7631506c674d0f58108392 all runs: OK # git bisect good 4cf7562190c795f1f95be6ee0d161107d0dc5d49 Bisecting: 918 revisions left to test after this (roughly 10 steps) [cf85f5de83b19361c3d575fa0ea05d8194bb0d05] Merge tag 'drm-fixes-2020-09-04' of git://anongit.freedesktop.org/drm/drm testing commit cf85f5de83b19361c3d575fa0ea05d8194bb0d05 with gcc (GCC) 8.1.0 kernel signature: 6aceb1c75340c0b0bedd6586de6516e673083a604f8e9b1d8164859ac991e254 all runs: OK # git bisect good cf85f5de83b19361c3d575fa0ea05d8194bb0d05 Bisecting: 459 revisions left to test after this (roughly 9 steps) [1e484d388773b0a984236a181fb21e133630df42] Merge tag 'fixes-v5.9a' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security testing commit 1e484d388773b0a984236a181fb21e133630df42 with gcc (GCC) 8.1.0 kernel signature: 99b4c094fffc5d1b4996db732e6b03e6a03ffcd77d83f9bc04cf81de89e9e65f all runs: OK # git bisect good 1e484d388773b0a984236a181fb21e133630df42 Bisecting: 228 revisions left to test after this (roughly 8 steps) [0baca070068c58b95e342881d9da4840d5cf3bd1] Merge tag 'io_uring-5.9-2020-09-22' of git://git.kernel.dk/linux-block testing commit 0baca070068c58b95e342881d9da4840d5cf3bd1 with gcc (GCC) 8.1.0 kernel signature: b65be1f3c86965a97842c753e9192b3720f6554934aeccb2eac6c04b3ce1c56a all runs: OK # git bisect good 0baca070068c58b95e342881d9da4840d5cf3bd1 Bisecting: 114 revisions left to test after this (roughly 7 steps) [fd944dc24336922656a48f4608bfb41abdcdc4aa] net: dsa: microchip: ksz8795: really set the correct number of ports testing commit fd944dc24336922656a48f4608bfb41abdcdc4aa with gcc (GCC) 8.1.0 kernel signature: 28281f47ae8164d6cc6ada60f74aa62bd3d6d4f44c766a45f2b65d7aef522731 all runs: OK # git bisect good fd944dc24336922656a48f4608bfb41abdcdc4aa Bisecting: 61 revisions left to test after this (roughly 6 steps) [2b617c11d7c0791a18402407222ca9f2c343c47b] net: Update MAINTAINERS for MediaTek switch driver testing commit 2b617c11d7c0791a18402407222ca9f2c343c47b with gcc (GCC) 8.1.0 kernel signature: 09d3de65c8e081a91d9fdec06155a3bdbc93502e2b409e063e47775a201e3a1f all runs: OK # git bisect good 2b617c11d7c0791a18402407222ca9f2c343c47b Bisecting: 30 revisions left to test after this (roughly 5 steps) [f9317ae5523f99999fb54c513ebabbb2bc887ddf] net: lantiq: Add locking for TX DMA channel testing commit f9317ae5523f99999fb54c513ebabbb2bc887ddf with gcc (GCC) 8.1.0 kernel signature: 54730e5264009a87540b5d7328f7b0cf1284cb2e1cc626d20d646a14db5e2487 run #0: crashed: WARNING: ODEBUG bug in netdev_run_todo run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect bad f9317ae5523f99999fb54c513ebabbb2bc887ddf Bisecting: 15 revisions left to test after this (roughly 4 steps) [cb39ccc5cbe1011d8d21886b75e2468070ac672c] net/mlx5e: mlx5e_fec_in_caps() returns a boolean testing commit cb39ccc5cbe1011d8d21886b75e2468070ac672c with gcc (GCC) 8.1.0 kernel signature: 56079bb965d2927c0229cf6290b43ce124b6ecfbebc8e8e7bc1bca0009d7d17f all runs: OK # git bisect good cb39ccc5cbe1011d8d21886b75e2468070ac672c Bisecting: 7 revisions left to test after this (roughly 3 steps) [d3017135c43373b06eef1eb70dfeb948b8ae159f] Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net testing commit d3017135c43373b06eef1eb70dfeb948b8ae159f with gcc (GCC) 8.1.0 kernel signature: ea3debc7100ee4352dc9b54147892ec6a290ba0ac69c3e8c8d46253f0d05f4df all runs: OK # git bisect good d3017135c43373b06eef1eb70dfeb948b8ae159f Bisecting: 3 revisions left to test after this (roughly 2 steps) [805c6d3c19210c90c109107d189744e960eae025] Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs testing commit 805c6d3c19210c90c109107d189744e960eae025 with gcc (GCC) 8.1.0 kernel signature: 69947a80c3e4b2ffb0c8ec49e773f5848eb6fb4e2ec9449899aa36ae6e84bb87 all runs: OK # git bisect good 805c6d3c19210c90c109107d189744e960eae025 Bisecting: 1 revision left to test after this (roughly 1 step) [77972b55fb9d35d4a6b0abca99abffaa4ec6a85b] Revert "ravb: Fixed to be able to unload modules" testing commit 77972b55fb9d35d4a6b0abca99abffaa4ec6a85b with gcc (GCC) 8.1.0 kernel signature: 8779fe65300e16fb42a11d4d91dbf8bd2bf96ba4897450699ff7e5e53ca73d1a all runs: OK # git bisect good 77972b55fb9d35d4a6b0abca99abffaa4ec6a85b Bisecting: 0 revisions left to test after this (roughly 0 steps) [ea6754aef2449e2cadfeb28741a199d35da53e28] net: switchdev: Fixed kerneldoc warning testing commit ea6754aef2449e2cadfeb28741a199d35da53e28 with gcc (GCC) 8.1.0 kernel signature: 3554c9f93d217cbf5eec3ab427552553671044980789c4a0e19bde7551e17cbf all runs: OK # git bisect good ea6754aef2449e2cadfeb28741a199d35da53e28 f9317ae5523f99999fb54c513ebabbb2bc887ddf is the first bad commit commit f9317ae5523f99999fb54c513ebabbb2bc887ddf Author: Hauke Mehrtens Date: Tue Sep 22 23:41:12 2020 +0200 net: lantiq: Add locking for TX DMA channel The TX DMA channel data is accessed by the xrx200_start_xmit() and the xrx200_tx_housekeeping() function from different threads. Make sure the accesses are synchronized by acquiring the netif_tx_lock() in the xrx200_tx_housekeeping() function too. This lock is acquired by the kernel before calling xrx200_start_xmit(). Signed-off-by: Hauke Mehrtens Signed-off-by: David S. Miller drivers/net/ethernet/lantiq_xrx200.c | 2 ++ 1 file changed, 2 insertions(+) culprit signature: 54730e5264009a87540b5d7328f7b0cf1284cb2e1cc626d20d646a14db5e2487 parent signature: 3554c9f93d217cbf5eec3ab427552553671044980789c4a0e19bde7551e17cbf revisions tested: 16, total time: 4h12m49.789585341s (build: 1h24m40.015975737s, test: 2h46m31.551514599s) first bad commit: f9317ae5523f99999fb54c513ebabbb2bc887ddf net: lantiq: Add locking for TX DMA channel recipients (to): ["davem@davemloft.net" "davem@davemloft.net" "hauke@hauke-m.de" "hauke@hauke-m.de" "kuba@kernel.org" "netdev@vger.kernel.org"] recipients (cc): ["linux-kernel@vger.kernel.org"] crash: WARNING: ODEBUG bug in netdev_run_todo bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): Released all slaves ------------[ cut here ]------------ ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x10 arch/x86/include/asm/paravirt.h:770 WARNING: CPU: 0 PID: 2546 at lib/debugobjects.c:488 debug_print_object+0x71/0xc0 lib/debugobjects.c:485 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 2546 Comm: kworker/u4:4 Not tainted 5.9.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: netns cleanup_net Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xa3/0xcc lib/dump_stack.c:118 panic+0x16e/0x353 kernel/panic.c:231 __warn.cold.13+0x20/0x2c kernel/panic.c:600 report_bug+0xc0/0xf0 lib/bug.c:198 handle_bug+0x35/0x90 arch/x86/kernel/traps.c:234 exc_invalid_op+0x13/0x60 arch/x86/kernel/traps.c:254 asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536 RIP: 0010:debug_print_object+0x71/0xc0 lib/debugobjects.c:485 Code: 8b 5b 10 89 15 c4 8f 52 04 4c 8b 45 00 48 83 fb 05 77 31 48 8b 14 dd c0 b6 9a 83 4c 89 e6 48 c7 c7 70 22 14 84 e8 1a 52 3f ff <0f> 0b 83 05 c2 6c bc 02 01 48 83 c4 18 5b 5d 41 5c c3 83 05 b2 6c RSP: 0018:ffffc900057a7c30 EFLAGS: 00010086 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000001 RDX: 0000000080000001 RSI: ffffffff8424c946 RDI: 00000000ffffffff RBP: ffffffff8451de20 R08: 0000000000000001 R09: 0000000000000008 R10: ffff888127d8a140 R11: 16f081b9ba037397 R12: ffffffff8411fcb4 R13: ffff88811f627f00 R14: 0000000000000005 R15: ffffffff8451de20 __debug_check_no_obj_freed lib/debugobjects.c:967 [inline] debug_check_no_obj_freed+0x1bb/0x1dd lib/debugobjects.c:998 kfree+0xf9/0x290 mm/slab.c:3755 device_release+0x1f/0x70 drivers/base/core.c:1796 kobject_cleanup lib/kobject.c:705 [inline] kobject_release lib/kobject.c:736 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x5f/0xc0 lib/kobject.c:753 netdev_run_todo+0x1d9/0x290 net/core/dev.c:10113 default_device_exit_batch+0x150/0x170 net/core/dev.c:10913 cleanup_net+0x273/0x3d0 net/core/net_namespace.c:603 process_one_work+0x26a/0x5f0 kernel/workqueue.c:2269 worker_thread+0x38/0x380 kernel/workqueue.c:2415 kthread+0x148/0x170 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 Kernel Offset: disabled Rebooting in 86400 seconds..