bisecting fixing commit since 7b6ae471e5415bc2bf4384a83ccb4c21de7824c0 building syzkaller on 29c3f20f99b6befe0395fe8e474b1e24240cac95 testing commit 7b6ae471e5415bc2bf4384a83ccb4c21de7824c0 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 5988f4234514afa725ad165bcc1a226ff36ef6524eb814d30e9c7c52ee589afd run #0: crashed: INFO: rcu detected stall in ieee80211_iface_work run #1: crashed: INFO: rcu detected stall in addrconf_rs_timer run #2: crashed: INFO: rcu detected stall in smp_call_function run #3: crashed: INFO: rcu detected stall in mac80211_hwsim_beacon run #4: crashed: INFO: rcu detected stall in ieee80211_iface_work run #5: crashed: INFO: rcu detected stall in netlink_release run #6: crashed: INFO: rcu detected stall in addrconf_rs_timer run #7: crashed: INFO: rcu detected stall in mac80211_hwsim_beacon run #8: crashed: INFO: rcu detected stall in mac80211_hwsim_beacon run #9: crashed: INFO: rcu detected stall in ip6_mc_input run #10: crashed: INFO: rcu detected stall in mac80211_hwsim_beacon run #11: crashed: INFO: rcu detected stall in mac80211_hwsim_beacon run #12: crashed: BUG: soft lockup in mac80211_hwsim_beacon run #13: crashed: INFO: rcu detected stall in mac80211_hwsim_beacon run #14: crashed: INFO: rcu detected stall in smp_call_function run #15: crashed: BUG: soft lockup in mac80211_hwsim_beacon run #16: crashed: INFO: rcu detected stall in mac80211_hwsim_beacon run #17: crashed: INFO: rcu detected stall in mac80211_hwsim_beacon run #18: crashed: INFO: rcu detected stall in smp_call_function run #19: crashed: INFO: rcu detected stall in worker_thread testing current HEAD f022814633e1c600507b3a99691b4d624c2813f0 testing commit f022814633e1c600507b3a99691b4d624c2813f0 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: d9299f22087ea02c9195ea8348504032a74556f1140b60ea03e0ff45441e21ea run #0: crashed: SYZFAIL: wrong response packet run #1: crashed: SYZFAIL: wrong response packet run #2: crashed: SYZFAIL: wrong response packet run #3: crashed: general protection fault in list_lru_add run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK reproducer seems to be flaky Reproducer flagged being flaky revisions tested: 2, total time: 31m21.397493313s (build: 12m25.421302205s, test: 18m1.013849402s) the crash still happens on HEAD commit msg: Merge tag 'trace-v5.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace crash: general protection fault in list_lru_add general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 3934 Comm: udevd Tainted: G W 5.17.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:list_add_tail include/linux/list.h:102 [inline] RIP: 0010:list_lru_add+0x209/0x4d0 mm/list_lru.c:129 Code: 80 3c 02 00 0f 85 d0 02 00 00 4c 03 75 00 4d 8d 7e 40 4c 89 fa 4d 8d 47 08 48 b8 00 00 00 00 00 fc ff df 4c 89 c1 48 c1 e9 03 <80> 3c 01 00 0f 85 7d 02 00 00 4d 8b 77 08 48 89 df 4c 89 0c 24 4c RSP: 0018:ffffc90003017c68 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff88823bc100f8 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8ca6cd50 RBP: ffff888017ac47f0 R08: 0000000000000008 R09: ffff888073a88000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 R13: ffff8880235d5280 R14: 0000000000000080 R15: 0000000000000000 FS: 00007fbba11ba840(0000) GS:ffff8880b9e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd91dd5e58 CR3: 000000007259a000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: d_lru_add fs/dcache.c:431 [inline] retain_dentry fs/dcache.c:685 [inline] dput+0x543/0xa00 fs/dcache.c:908 path_put+0x28/0x60 fs/namei.c:557 vfs_statx+0x1bd/0x2e0 fs/stat.c:238 vfs_fstatat+0x4f/0x70 fs/stat.c:255 __do_sys_newfstatat+0x72/0xd0 fs/stat.c:426 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fbba0d251da Code: 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 0b 00 00 00 66 2e 0f 1f 84 00 00 00 00 00 90 41 89 ca b8 06 01 00 00 0f 05 <3d> 00 f0 ff ff 77 07 31 c0 c3 0f 1f 40 00 48 8b 15 69 fc 0c 00 f7 RSP: 002b:00007ffd4f604e58 EFLAGS: 00000206 ORIG_RAX: 0000000000000106 RAX: ffffffffffffffda RBX: 000055caea586f70 RCX: 00007fbba0d251da RDX: 00007ffd4f604e68 RSI: 00007ffd4f604ef8 RDI: 00000000ffffff9c RBP: 000055cae859315e R08: 000055cae859315e R09: 0000000000000000 R10: 0000000000000100 R11: 0000000000000206 R12: 0000000000000000 R13: 000055caea587060 R14: 00007ffd4f604ef8 R15: 000055cae8592a7c Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:list_add_tail include/linux/list.h:102 [inline] RIP: 0010:list_lru_add+0x209/0x4d0 mm/list_lru.c:129 Code: 80 3c 02 00 0f 85 d0 02 00 00 4c 03 75 00 4d 8d 7e 40 4c 89 fa 4d 8d 47 08 48 b8 00 00 00 00 00 fc ff df 4c 89 c1 48 c1 e9 03 <80> 3c 01 00 0f 85 7d 02 00 00 4d 8b 77 08 48 89 df 4c 89 0c 24 4c RSP: 0018:ffffc90003017c68 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff88823bc100f8 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8ca6cd50 RBP: ffff888017ac47f0 R08: 0000000000000008 R09: ffff888073a88000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 R13: ffff8880235d5280 R14: 0000000000000080 R15: 0000000000000000 FS: 00007fbba11ba840(0000) GS:ffff8880b9e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd91dd5e58 CR3: 000000007259a000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) 4: 0f 85 d0 02 00 00 jne 0x2da a: 4c 03 75 00 add 0x0(%rbp),%r14 e: 4d 8d 7e 40 lea 0x40(%r14),%r15 12: 4c 89 fa mov %r15,%rdx 15: 4d 8d 47 08 lea 0x8(%r15),%r8 19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 20: fc ff df 23: 4c 89 c1 mov %r8,%rcx 26: 48 c1 e9 03 shr $0x3,%rcx * 2a: 80 3c 01 00 cmpb $0x0,(%rcx,%rax,1) <-- trapping instruction 2e: 0f 85 7d 02 00 00 jne 0x2b1 34: 4d 8b 77 08 mov 0x8(%r15),%r14 38: 48 89 df mov %rbx,%rdi 3b: 4c 89 0c 24 mov %r9,(%rsp) 3f: 4c rex.WR