bisecting cause commit starting from 596cf45cbf6e4fa7bcb0df33e373a7d062b644b5 building syzkaller on ab342da3f9aa45e3f2d9e872576ab5cd3e3c350b testing commit 596cf45cbf6e4fa7bcb0df33e373a7d062b644b5 with gcc (GCC) 8.1.0 kernel signature: 700f0be2d2d97d2cb3fd98ca42a5ae7df320d9ab all runs: crashed: KASAN: use-after-free Write in release_tty testing release v5.4 testing commit 219d54332a09e8d8741c1e1982f5eae56099de85 with gcc (GCC) 8.1.0 kernel signature: ef6988e23595b279a1b0328d3955c1eacd1c1689 run #0: crashed: KASAN: use-after-free Read in tty_open run #1: crashed: KASAN: use-after-free Read in tty_open run #2: crashed: KASAN: use-after-free Write in release_tty run #3: crashed: KASAN: use-after-free Write in release_tty run #4: crashed: KASAN: use-after-free Write in release_tty run #5: crashed: KASAN: use-after-free Write in release_tty run #6: crashed: KASAN: use-after-free Write in release_tty run #7: crashed: KASAN: use-after-free Write in release_tty run #8: crashed: KASAN: use-after-free Write in release_tty run #9: crashed: KASAN: use-after-free Write in release_tty testing release v5.3 testing commit 4d856f72c10ecb060868ed10ff1b1453943fc6c8 with gcc (GCC) 8.1.0 kernel signature: 9d18e60ace24454b7f89682c26f07ee3e2008881 run #0: crashed: KASAN: use-after-free Write in release_tty run #1: crashed: KASAN: use-after-free Write in release_tty run #2: crashed: KASAN: use-after-free Write in release_tty run #3: crashed: KASAN: use-after-free Read in tty_open run #4: crashed: KASAN: use-after-free Write in release_tty run #5: crashed: KASAN: use-after-free Write in release_tty run #6: crashed: KASAN: use-after-free Write in release_tty run #7: crashed: KASAN: use-after-free Write in release_tty run #8: crashed: KASAN: use-after-free Write in release_tty run #9: crashed: KASAN: use-after-free Write in release_tty testing release v5.2 testing commit 0ecfebd2b52404ae0c54a878c872bb93363ada36 with gcc (GCC) 8.1.0 kernel signature: cced9e4183d56f5900d4e9d8a4982c662343c101 all runs: crashed: KASAN: use-after-free Write in release_tty testing release v5.1 testing commit e93c9c99a629c61837d5a7fc2120cd2b6c70dbdd with gcc (GCC) 8.1.0 kernel signature: 09bb5345a368c2faefd4ba46ef8799f143d56608 run #0: crashed: KASAN: use-after-free Write in release_tty run #1: crashed: KASAN: use-after-free Read in tty_open run #2: crashed: KASAN: use-after-free Write in release_tty run #3: crashed: KASAN: use-after-free Write in release_tty run #4: crashed: KASAN: use-after-free Read in tty_open run #5: crashed: KASAN: use-after-free Write in release_tty run #6: crashed: KASAN: use-after-free Read in tty_open run #7: crashed: KASAN: use-after-free Write in release_tty run #8: crashed: KASAN: use-after-free Write in release_tty run #9: crashed: KASAN: use-after-free Write in release_tty testing release v5.0 testing commit 1c163f4c7b3f621efff9b28a47abb36f7378d783 with gcc (GCC) 8.1.0 kernel signature: 1a61a5b878aab46e1f649d6814422b082a2f5ecb run #0: crashed: KASAN: use-after-free Write in release_tty run #1: crashed: KASAN: use-after-free Write in release_tty run #2: crashed: KASAN: use-after-free Read in tty_open run #3: crashed: KASAN: use-after-free Write in release_tty run #4: crashed: KASAN: use-after-free Write in release_tty run #5: crashed: KASAN: use-after-free Write in release_tty run #6: crashed: KASAN: use-after-free Write in release_tty run #7: crashed: KASAN: use-after-free Read in tty_open run #8: crashed: KASAN: use-after-free Read in tty_open run #9: crashed: KASAN: use-after-free Write in release_tty testing release v4.20 testing commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be with gcc (GCC) 8.1.0 kernel signature: 48c43148dc6420ef277181e22d1727a68339d66a all runs: crashed: KASAN: use-after-free Write in release_tty testing release v4.19 testing commit 84df9525b0c27f3ebc2ebb1864fa62a97fdedb7d with gcc (GCC) 8.1.0 kernel signature: bcfa5ed939b117315ab4f9fc4f865d6fb2ff083e run #0: crashed: KASAN: use-after-free Write in release_tty run #1: crashed: KASAN: use-after-free Write in release_tty run #2: crashed: KASAN: use-after-free Write in release_tty run #3: crashed: KASAN: use-after-free Write in release_tty run #4: crashed: KASAN: use-after-free Write in release_tty run #5: crashed: KASAN: use-after-free Read in tty_open run #6: crashed: KASAN: use-after-free Write in release_tty run #7: crashed: KASAN: use-after-free Write in release_tty run #8: crashed: KASAN: use-after-free Read in tty_open run #9: crashed: KASAN: use-after-free Write in release_tty testing release v4.18 testing commit 94710cac0ef4ee177a63b5227664b38c95bbf703 with gcc (GCC) 8.1.0 kernel signature: 51f410d09833d1256d8dd6702bac48305655ed67 all runs: crashed: KASAN: use-after-free Write in release_tty testing release v4.17 testing commit 29dcea88779c856c7dc92040a0c01233263101d4 with gcc (GCC) 8.1.0 kernel signature: 0bb7f9c7fc88c118272a4374a61b33a8b9c8fd13 run #0: crashed: KASAN: use-after-free Write in release_tty run #1: crashed: KASAN: use-after-free Write in release_tty run #2: crashed: KASAN: use-after-free Write in release_tty run #3: crashed: KASAN: use-after-free Write in release_tty run #4: crashed: KASAN: use-after-free Read in tty_open run #5: crashed: KASAN: use-after-free Write in release_tty run #6: crashed: KASAN: use-after-free Write in release_tty run #7: crashed: KASAN: use-after-free Write in release_tty run #8: crashed: KASAN: use-after-free Write in release_tty run #9: crashed: KASAN: use-after-free Write in release_tty testing release v4.16 testing commit 0adb32858b0bddf4ada5f364a84ed60b196dbcda with gcc (GCC) 8.1.0 kernel signature: 63dbf4caf477ec64ce6fe409ce29cecb42610986 all runs: crashed: KASAN: use-after-free Write in release_tty testing release v4.15 testing commit d8a5b80568a9cb66810e75b182018e9edb68e8ff with gcc (GCC) 8.1.0 kernel signature: 0df88a5786ae8a988f76a7fd31cf247a46301fbc run #0: crashed: KASAN: use-after-free Write in release_tty run #1: crashed: KASAN: use-after-free Write in release_tty run #2: crashed: KASAN: use-after-free Write in release_tty run #3: crashed: KASAN: use-after-free Write in release_tty run #4: crashed: KASAN: use-after-free Read in tty_open run #5: crashed: KASAN: use-after-free Write in release_tty run #6: crashed: KASAN: use-after-free Write in release_tty run #7: crashed: KASAN: use-after-free Write in release_tty run #8: crashed: KASAN: use-after-free Write in release_tty run #9: crashed: KASAN: use-after-free Write in release_tty testing release v4.14 testing commit bebc6082da0a9f5d47a1ea2edc099bf671058bd4 with gcc (GCC) 8.1.0 kernel signature: 967229f869a8b5628a91ce17dec6025ed4abdc0e run #0: crashed: KASAN: use-after-free Write in release_tty run #1: crashed: KASAN: use-after-free Write in release_tty run #2: crashed: KASAN: use-after-free Write in release_tty run #3: crashed: KASAN: use-after-free Write in release_tty run #4: crashed: KASAN: use-after-free Read in tty_open run #5: crashed: KASAN: use-after-free Write in release_tty run #6: crashed: KASAN: use-after-free Write in release_tty run #7: crashed: KASAN: use-after-free Write in release_tty run #8: crashed: KASAN: use-after-free Read in tty_open run #9: crashed: KASAN: use-after-free Write in release_tty testing release v4.13 testing commit 569dbb88e80deb68974ef6fdd6a13edb9d686261 with gcc (GCC) 8.1.0 kernel signature: 4542b70df0c5de10d6d145800e7b10a52a1db7af all runs: crashed: KASAN: use-after-free Write in release_tty testing release v4.12 testing commit 6f7da290413ba713f0cdd9ff1a2a9bb129ef4f6c with gcc (GCC) 8.1.0 kernel signature: 461aea2ca1998a1ee39f1e6be1e0ae6975ccf8f2 all runs: crashed: KASAN: use-after-free Write in release_tty testing release v4.11 testing commit a351e9b9fc24e982ec2f0e76379a49826036da12 with gcc (GCC) 7.3.0 kernel signature: 001775862f4d96ef27e2317e3d0928563391d276 all runs: crashed: KASAN: use-after-free Write in release_tty testing release v4.10 testing commit c470abd4fde40ea6a0846a2beab642a578c0b8cd with gcc (GCC) 5.5.0 kernel signature: c0404ee82ecde10d2c29eb732ce90661af0f6bc7 all runs: crashed: KASAN: use-after-free Write in release_tty testing release v4.9 testing commit 69973b830859bc6529a7a0468ba0d80ee5117826 with gcc (GCC) 5.5.0 kernel signature: 3318baf8ab76a3ea95de87550411e1b310b002e4 all runs: crashed: KASAN: use-after-free Write in release_tty testing release v4.8 testing commit c8d2bc9bc39ebea8437fd974fdbc21847bb897a3 with gcc (GCC) 5.5.0 kernel signature: 2777996de5f496f78e5cf96984d2d5ae85fbfd95 all runs: crashed: KASAN: use-after-free Write in release_tty testing release v4.7 testing commit 523d939ef98fd712632d93a5a2b588e477a7565e with gcc (GCC) 5.5.0 kernel signature: b9497427b0a6dfdabc2f3d84711c9e652b7ec5e4 run #0: crashed: KASAN: use-after-free Write in release_tty run #1: crashed: KASAN: use-after-free Write in release_tty run #2: crashed: general protection fault in get_work_pool run #3: crashed: general protection fault in get_work_pool run #4: crashed: KASAN: use-after-free Write in release_tty run #5: crashed: KASAN: use-after-free Write in release_tty run #6: crashed: KASAN: use-after-free Write in release_tty run #7: crashed: KASAN: use-after-free Write in release_tty run #8: crashed: KASAN: use-after-free Write in release_tty run #9: crashed: KASAN: use-after-free Write in release_tty testing release v4.6 testing commit 2dcd0af568b0cf583645c8a317dd12e344b1c72a with gcc (GCC) 5.5.0 kernel signature: edcb8c1e555d027f01ca30b71f742d3e59e6127f run #0: crashed: KASAN: use-after-free Write in release_tty run #1: crashed: KASAN: use-after-free Write in release_tty run #2: crashed: KASAN: use-after-free Write in release_tty run #3: crashed: KASAN: use-after-free Write in release_tty run #4: crashed: general protection fault in get_work_pool run #5: crashed: KASAN: use-after-free Write in release_tty run #6: crashed: KASAN: use-after-free Write in release_tty run #7: crashed: general protection fault in tty_buffer_cancel_work run #8: crashed: KASAN: use-after-free Write in release_tty run #9: crashed: KASAN: use-after-free Write in release_tty testing release v4.5 testing commit b562e44f507e863c6792946e4e1b1449fbbac85d with gcc (GCC) 5.5.0 kernel signature: d571c0d11f1d0d0701dc2cbb063a64278a2ed251 run #0: crashed: BUG: sleeping function called from invalid context in __do_page_fault run #1: crashed: general protection fault in tty_buffer_cancel_work run #2: crashed: BUG: sleeping function called from invalid context in __do_page_fault run #3: crashed: BUG: sleeping function called from invalid context in __do_page_fault run #4: crashed: BUG: sleeping function called from invalid context in __do_page_fault run #5: crashed: BUG: sleeping function called from invalid context in __do_page_fault run #6: crashed: BUG: sleeping function called from invalid context in __do_page_fault run #7: crashed: BUG: sleeping function called from invalid context in __do_page_fault run #8: crashed: BUG: sleeping function called from invalid context in __do_page_fault run #9: crashed: BUG: sleeping function called from invalid context in __do_page_fault testing release v4.4 testing commit afd2ff9b7e1b367172f18ba7f693dfb62bdcb2dc with gcc (GCC) 5.5.0 kernel signature: 3d29c338092697ed748cb27189a7a379a55a83b5 all runs: crashed: BUG: sleeping function called from invalid context in __do_page_fault testing release v4.3 testing commit 6a13feb9c82803e2b815eca72fa7a9f5561d7861 with gcc (GCC) 5.5.0 kernel signature: cf3dae6bb25056ab8b33cf6e8ce6b9b25fe8b57a run #0: crashed: INFO: trying to register non-static key in release_tty run #1: crashed: BUG: sleeping function called from invalid context in __do_page_fault run #2: crashed: BUG: sleeping function called from invalid context in __do_page_fault run #3: crashed: BUG: sleeping function called from invalid context in __do_page_fault run #4: crashed: BUG: sleeping function called from invalid context in __do_page_fault run #5: crashed: BUG: sleeping function called from invalid context in __do_page_fault run #6: crashed: BUG: sleeping function called from invalid context in __do_page_fault run #7: crashed: BUG: sleeping function called from invalid context in __do_page_fault run #8: crashed: BUG: sleeping function called from invalid context in __do_page_fault run #9: crashed: BUG: sleeping function called from invalid context in __do_page_fault testing release v4.2 testing commit 64291f7db5bd8150a74ad2036f1037e6a0428df2 with gcc (GCC) 5.5.0 kernel signature: b1696fb7b25d59a5aaedadd7c92a11627582106d run #0: crashed: BUG: sleeping function called from invalid context in __do_page_fault run #1: crashed: general protection fault in release_tty run #2: crashed: BUG: sleeping function called from invalid context in __do_page_fault run #3: crashed: BUG: sleeping function called from invalid context in __do_page_fault run #4: crashed: BUG: sleeping function called from invalid context in __do_page_fault run #5: crashed: general protection fault in corrupted run #6: crashed: BUG: sleeping function called from invalid context in __do_page_fault run #7: crashed: BUG: sleeping function called from invalid context in __do_page_fault run #8: crashed: BUG: sleeping function called from invalid context in __do_page_fault run #9: crashed: general protection fault in release_tty testing release v4.1 testing commit b953c0d234bc72e8489d3bf51a276c5c4ec85345 with gcc (GCC) 5.5.0 kernel signature: 1d696bf35ec6a89ef98d00e952e3fce0edf0abcd run #0: crashed: INFO: trying to register non-static key in release_tty run #1: crashed: INFO: trying to register non-static key in release_tty run #2: crashed: INFO: trying to register non-static key in release_tty run #3: crashed: INFO: trying to register non-static key in release_tty run #4: crashed: general protection fault in corrupted run #5: crashed: general protection fault in release_tty run #6: crashed: INFO: trying to register non-static key in release_tty run #7: crashed: general protection fault in release_tty run #8: crashed: general protection fault in release_tty run #9: OK revisions tested: 26, total time: 3h55m22.283518533s (build: 2h1m10.735251003s, test: 1h47m23.174457576s) the crash already happened on the oldest tested release commit msg: Linux 4.1 crash: general protection fault in release_tty bridge0: port 2(bridge_slave_1) entered forwarding state bridge0: port 1(bridge_slave_0) entered forwarding state bridge0: port 2(bridge_slave_1) entered forwarding state general protection fault: 0000 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 16729 Comm: syz-executor467 Not tainted 4.1.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff88012abb0310 ti: ffff8800b4dcc000 task.ti: ffff8800b4dcc000 RIP: 0010:[] [] atomic_inc arch/x86/include/asm/atomic.h:92 [inline] RIP: 0010:[] [] __lock_acquire+0x2db/0x1c70 kernel/locking/lockdep.c:3105 RSP: 0018:ffff8800b4dcfa68 EFLAGS: 00010086 RAX: 0000000000000000 RBX: dead4ead00000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 RBP: ffff8800b4dcfb28 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001 R13: 0000000000000000 R14: ffff88012a1ca028 R15: ffff88012abb0310 FS: 0000000000000000(0000) GS:ffff88012c000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f307fdd0000 CR3: 00000000b97d1000 CR4: 00000000001407f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: ffff8800b4dcfae8 ffff88012abb0310 ffffffff827912bb ffff8800b8966410 0000000000000000 0000000000000000 ffff880000000000 ffffffff00000000 ffff88012c017fc0 ffff88012c017fc0 ffff8800b4dcfac8 ffffffff811c2bcd Call Trace: [] lock_acquire+0xe6/0x310 kernel/locking/lockdep.c:3623 [] flush_work+0x3a/0x320 kernel/workqueue.c:2731 [] __cancel_work_timer+0xda/0x210 kernel/workqueue.c:2801 [] cancel_work_sync+0xb/0x10 kernel/workqueue.c:2836 [] release_tty+0x8a/0x120 drivers/tty/tty_io.c:1697 [] tty_release+0x3ea/0x570 drivers/tty/tty_io.c:1928 [] __fput+0xed/0x250 fs/file_table.c:208 [] ____fput+0x9/0x10 fs/file_table.c:244 [] task_work_run+0xc4/0xf0 kernel/task_work.c:123 [] exit_task_work include/linux/task_work.h:21 [inline] [] do_exit+0x35e/0xca0 kernel/exit.c:746 [] do_group_exit+0x4b/0xc0 kernel/exit.c:874 [] SYSC_exit_group kernel/exit.c:885 [inline] [] SyS_exit_group+0xf/0x10 kernel/exit.c:883 [] system_call_fastpath+0x16/0x7a Code: 49 81 3e 40 f9 63 83 b8 00 00 00 00 44 0f 44 e0 41 83 fd 01 0f 87 aa fd ff ff 44 89 e8 49 8b 5c c6 08 48 85 db 0f 84 99 fd ff ff ff 83 98 01 00 00 8b 05 30 48 11 03 41 8b 8f 60 08 00 00 85 RIP [] __lock_acquire+0x2db/0x1c70 kernel/locking/lockdep.c:3100 RSP ---[ end trace cd85fd3a3b098d83 ]---