bisecting cause commit starting from 86bbbebac1933e6e95e8234c4f7d220c5ddd38bc
building syzkaller on 676bd07e7e80f8a270af7f0276443c68f4a99e25
testing commit 86bbbebac1933e6e95e8234c4f7d220c5ddd38bc with gcc (GCC) 8.1.0
kernel signature: 8c292068505c2ff95a7de30a46e9750deafe7525
run #0: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #1: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #2: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #3: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #4: crashed: KASAN: use-after-free Read in rdma_listen
run #5: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #6: crashed: KASAN: use-after-free Read in rdma_listen
run #7: crashed: KASAN: use-after-free Read in rdma_listen
run #8: crashed: KASAN: use-after-free Read in rdma_listen
run #9: crashed: KASAN: use-after-free Read in cma_cancel_operation
testing release v4.16
testing commit 0adb32858b0bddf4ada5f364a84ed60b196dbcda with gcc (GCC) 8.1.0
kernel signature: e93f9b3f61476b623dbd45e1a79b814ff82b8139
run #0: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #1: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #2: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #3: crashed: KASAN: use-after-free Read in rdma_listen
run #4: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #5: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #6: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #7: crashed: KASAN: use-after-free Read in rdma_listen
run #8: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #9: crashed: KASAN: use-after-free Read in cma_cancel_operation
testing release v4.15
testing commit d8a5b80568a9cb66810e75b182018e9edb68e8ff with gcc (GCC) 8.1.0
kernel signature: 0ec8239469269b6e75c689ea76cf4dfa70feffb6
run #0: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #1: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #2: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #3: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #4: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #5: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #6: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #7: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #8: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #9: crashed: KASAN: use-after-free Read in rdma_listen
testing release v4.14
testing commit bebc6082da0a9f5d47a1ea2edc099bf671058bd4 with gcc (GCC) 8.1.0
kernel signature: 93d142c00d048befa3349b02dffbc8392a4c6061
run #0: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #1: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #2: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #3: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #4: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #5: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #6: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #7: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #8: crashed: KASAN: use-after-free Read in rdma_listen
run #9: crashed: KASAN: use-after-free Read in cma_cancel_operation
testing release v4.13
testing commit 569dbb88e80deb68974ef6fdd6a13edb9d686261 with gcc (GCC) 8.1.0
kernel signature: 0a34acc909d344680f83f17e918d178af6b149fe
all runs: crashed: KASAN: use-after-free Read in cma_cancel_operation
testing release v4.12
testing commit 6f7da290413ba713f0cdd9ff1a2a9bb129ef4f6c with gcc (GCC) 8.1.0
kernel signature: 42fc559366345a83be0d7f883dc555d5d23833e2
run #0: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #1: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #2: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #3: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #4: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #5: crashed: KASAN: use-after-free Read in rdma_listen
run #6: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #7: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #8: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #9: crashed: KASAN: use-after-free Read in cma_cancel_operation
testing release v4.11
testing commit a351e9b9fc24e982ec2f0e76379a49826036da12 with gcc (GCC) 7.3.0
kernel signature: aa55b60c5aa00d3a7b246d83d3d5495ac20e3353
run #0: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #1: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #2: crashed: KASAN: use-after-free Read in rdma_listen
run #3: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #4: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #5: crashed: KASAN: use-after-free Read in rdma_listen
run #6: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #7: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #8: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #9: crashed: KASAN: use-after-free Read in cma_cancel_operation
testing release v4.10
testing commit c470abd4fde40ea6a0846a2beab642a578c0b8cd with gcc (GCC) 5.5.0
kernel signature: 9a6880ddf22ec84ded9516a29c2af39fa829bad3
run #0: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #1: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #2: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #3: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #4: crashed: KASAN: use-after-free Read in rdma_listen
run #5: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #6: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #7: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #8: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #9: crashed: KASAN: use-after-free Read in cma_cancel_operation
testing release v4.9
testing commit 69973b830859bc6529a7a0468ba0d80ee5117826 with gcc (GCC) 5.5.0
kernel signature: f81b2d7769721d04bb2428583570b6ad8e3ac4a0
run #0: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #1: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #2: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #3: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #4: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #5: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #6: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #7: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #8: crashed: KASAN: use-after-free Read in rdma_listen
run #9: crashed: KASAN: use-after-free Read in rdma_listen
testing release v4.8
testing commit c8d2bc9bc39ebea8437fd974fdbc21847bb897a3 with gcc (GCC) 5.5.0
kernel signature: 699b50ca4a1fe29df35459cfb609e44183344b46
run #0: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #1: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #2: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #3: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #4: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #5: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #6: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #7: crashed: KASAN: use-after-free Read in rdma_listen
run #8: crashed: KASAN: use-after-free Read in rdma_listen
run #9: crashed: KASAN: use-after-free Read in cma_cancel_operation
testing release v4.7
testing commit 523d939ef98fd712632d93a5a2b588e477a7565e with gcc (GCC) 5.5.0
kernel signature: c95c98378ff061026060f34266308035483e705a
run #0: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #1: crashed: KASAN: use-after-free Read in rdma_listen
run #2: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #3: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #4: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #5: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #6: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #7: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #8: crashed: KASAN: use-after-free Read in rdma_listen
run #9: crashed: KASAN: use-after-free Read in cma_cancel_operation
testing release v4.6
testing commit 2dcd0af568b0cf583645c8a317dd12e344b1c72a with gcc (GCC) 5.5.0
kernel signature: d8d7a22f730a45105f6952321dac68aac3610a37
run #0: crashed: WARNING in cma_cancel_operation
run #1: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #2: crashed: WARNING in cma_cancel_operation
run #3: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #4: crashed: KASAN: out-of-bounds Read in cma_cancel_operation
run #5: crashed: KASAN: use-after-free Read in rdma_listen
run #6: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #7: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #8: crashed: KASAN: use-after-free Read in cma_cancel_operation
run #9: crashed: KASAN: use-after-free Read in rdma_listen
testing release v4.5
testing commit b562e44f507e863c6792946e4e1b1449fbbac85d with gcc (GCC) 5.5.0
kernel signature: e0ef71815209a73e53fe4cb22691b51846db366a
run #0: crashed: WARNING in cma_cancel_operation
run #1: crashed: WARNING in cma_cancel_operation
run #2: crashed: WARNING in cma_cancel_operation
run #3: crashed: WARNING in cma_cancel_operation
run #4: crashed: WARNING in cma_cancel_operation
run #5: crashed: WARNING in cma_cancel_operation
run #6: crashed: WARNING in cma_cancel_operation
run #7: crashed: WARNING in cma_cancel_operation
run #8: crashed: WARNING in cma_cancel_operation
run #9: crashed: WARNING in rdma_listen
testing release v4.4
testing commit afd2ff9b7e1b367172f18ba7f693dfb62bdcb2dc with gcc (GCC) 5.5.0
kernel signature: a5619ae605cdd61fab85912e0314065742deadb8
run #0: crashed: WARNING in rdma_listen
run #1: crashed: WARNING in cma_cancel_operation
run #2: crashed: WARNING in cma_cancel_operation
run #3: crashed: WARNING in rdma_listen
run #4: crashed: WARNING in cma_cancel_operation
run #5: crashed: WARNING in cma_cancel_operation
run #6: crashed: WARNING in rdma_listen
run #7: crashed: WARNING in rdma_listen
run #8: crashed: WARNING in cma_cancel_operation
run #9: crashed: WARNING in rdma_listen
testing release v4.3
testing commit 6a13feb9c82803e2b815eca72fa7a9f5561d7861 with gcc (GCC) 5.5.0
kernel signature: 2229a4b0e3de8b3d0ee4d743b451bb413f9605be
run #0: crashed: WARNING in cma_cancel_operation
run #1: crashed: WARNING in rdma_listen
run #2: crashed: WARNING in rdma_listen
run #3: crashed: WARNING in cma_cancel_operation
run #4: crashed: WARNING in cma_cancel_operation
run #5: crashed: WARNING in cma_cancel_operation
run #6: crashed: WARNING in rdma_listen
run #7: crashed: WARNING in cma_cancel_operation
run #8: crashed: WARNING in cma_cancel_operation
run #9: crashed: WARNING in cma_cancel_operation
testing release v4.2
testing commit 64291f7db5bd8150a74ad2036f1037e6a0428df2 with gcc (GCC) 5.5.0
kernel signature: 721ab760e7a853c2822f2b569ef9b014adfb7aea
run #0: crashed: WARNING in cma_cancel_operation
run #1: crashed: WARNING in cma_cancel_operation
run #2: crashed: WARNING in rdma_listen
run #3: crashed: WARNING in cma_cancel_operation
run #4: crashed: WARNING in cma_cancel_operation
run #5: crashed: WARNING in cma_cancel_operation
run #6: crashed: WARNING in cma_cancel_operation
run #7: crashed: WARNING in cma_cancel_operation
run #8: crashed: WARNING in cma_cancel_operation
run #9: crashed: no output from test machine
testing release v4.1
testing commit b953c0d234bc72e8489d3bf51a276c5c4ec85345 with gcc (GCC) 5.5.0
kernel signature: ff70ea9290e898fbd27336b2f42be1f6cd7aa760
run #0: crashed: WARNING in cma_cancel_operation
run #1: crashed: WARNING in rdma_listen
run #2: crashed: WARNING in cma_cancel_operation
run #3: crashed: WARNING in rdma_listen
run #4: crashed: WARNING in rdma_listen
run #5: crashed: WARNING in cma_cancel_operation
run #6: crashed: WARNING in cma_cancel_operation
run #7: crashed: WARNING in cma_cancel_operation
run #8: crashed: WARNING in cma_cancel_operation
run #9: crashed: WARNING in rdma_listen
revisions tested: 17, total time: 1h59m54.345027496s (build: 59m2.352801745s, test: 56m25.953734532s)
the crash already happened on the oldest tested release
commit msg: Linux 4.1
crash: WARNING in rdma_listen
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3883 at lib/list_debug.c:33 __list_add+0xa0/0xd0 lib/list_debug.c:30()
list_add corruption. prev->next should be next (ffffffff82f4f300), but was           (null). (prev=ffff8800b9c441c8).
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 3883 Comm: syz-executor Not tainted 4.1.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffffffff82bd399a ffff8800baca7c38 ffffffff82447d1b 0000000000000032
 ffffffff82b7d49e ffff8800baca7cb8 ffffffff82443f4d 0000000000000000
 ffffffff00000008 ffff8800baca7cc8 ffff8800baca7c68 0000000000000006
Call Trace:
 [<ffffffff82447d1b>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff82447d1b>] dump_stack+0x4c/0x65 lib/dump_stack.c:50
 [<ffffffff82443f4d>] panic+0xcd/0x211 kernel/panic.c:111
 [<ffffffff8116a93b>] warn_slowpath_common+0xbb/0xc0 kernel/panic.c:442
 [<ffffffff8116a981>] warn_slowpath_fmt+0x41/0x50 kernel/panic.c:458
 [<ffffffff8184a380>] __list_add+0xa0/0xd0 lib/list_debug.c:30
 [<ffffffff81e50688>] list_add_tail include/linux/list.h:77 [inline]
 [<ffffffff81e50688>] cma_listen_on_all drivers/infiniband/core/cma.c:1677 [inline]
 [<ffffffff81e50688>] rdma_listen+0x218/0x260 drivers/infiniband/core/cma.c:2573
 [<ffffffff81e603ce>] ucma_listen+0x6e/0x90 drivers/infiniband/core/ucma.c:965
 [<ffffffff81e5f6bd>] ucma_write+0x6d/0xc0 drivers/infiniband/core/ucma.c:1505
 [<ffffffff812eabf3>] __vfs_write+0x23/0xe0 fs/read_write.c:489
 [<ffffffff812eb591>] vfs_write+0xa1/0x1c0 fs/read_write.c:538
 [<ffffffff812ec234>] SYSC_write fs/read_write.c:585 [inline]
 [<ffffffff812ec234>] SyS_write+0x44/0xb0 fs/read_write.c:577
 [<ffffffff82458272>] system_call_fastpath+0x16/0x7a
Kernel Offset: disabled