bisecting fixing commit since 17a87580a8856170d59aab302226811a4ae69149 building syzkaller on e562dd8adff015d44bec3d7fd8e6608a3a031ff3 testing commit 17a87580a8856170d59aab302226811a4ae69149 with gcc (GCC) 8.1.0 kernel signature: 6498ec446ffd1d7f12b3c397e1dd7ac4869534dfcc6a779d22e91f7e5ee3ae33 all runs: crashed: general protection fault in rose_send_frame testing current HEAD 015e94d0e37b6860e4354ce3cac56bd7c39c8992 testing commit 015e94d0e37b6860e4354ce3cac56bd7c39c8992 with gcc (GCC) 8.1.0 kernel signature: 2e0e75759174d9a2b2b301e1bf9702b4c5aabbb306f24830dc59573092cc7eac all runs: crashed: general protection fault in rose_send_frame revisions tested: 2, total time: 23m35.876483582s (build: 17m1.450631035s, test: 5m59.125458493s) the crash still happens on HEAD commit msg: Linux 4.19.146 crash: general protection fault in rose_send_frame IPv6: ADDRCONF(NETDEV_UP): macsec0: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 7862 Comm: kworker/u4:5 Not tainted 4.19.146-syzkaller #0 batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:rose_send_frame+0x194/0x230 net/rose/rose_link.c:104 Code: 78 fb eb 93 80 3c 02 00 0f 85 84 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 4b 20 49 8d b9 58 03 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 6c 49 8b 91 58 03 00 00 e9 b4 fe ff ff e8 85 78 78 RSP: 0018:ffff8880aea07ab8 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff8882162dccc0 RCX: 0000000000000006 RDX: 000000000000006b RSI: ffffffff87cca5a0 RDI: 0000000000000358 RBP: ffff8880aea07ae8 R08: ffffed1011706d75 R09: 0000000000000000 R10: ffffed1011706d74 R11: ffff88808b836ba3 R12: ffff8882162dccc0 R13: 0000000000000078 R14: ffff88808ba9e640 R15: ffff88808ba9e640 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! FS: 0000000000000000(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe19bb7f98 CR3: 000000008c457000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rose_transmit_clear_request+0x1c7/0x280 net/rose/rose_link.c:258 batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 rose_rx_call_request+0x3a4/0x1c0e net/rose/af_rose.c:999 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! rose_loopback_timer+0x11f/0x430 net/rose/rose_loopback.c:103 call_timer_fn+0x14c/0x510 kernel/time/timer.c:1338 batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 expire_timers+0x255/0x3a0 kernel/time/timer.c:1375 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! __run_timers kernel/time/timer.c:1703 [inline] run_timer_softirq+0x1dc/0x570 kernel/time/timer.c:1716 batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 __do_softirq+0x25e/0x92d kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x17f/0x1c0 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:544 [inline] smp_apic_timer_interrupt+0x13e/0x540 arch/x86/kernel/apic/apic.c:1094 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline] RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0xaf/0xd0 kernel/locking/spinlock.c:184 Code: 88 05 52 88 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 28 48 83 3d c0 52 7b 01 00 74 15 48 89 df 57 9d <0f> 1f 44 00 00 eb ad e8 b0 a4 29 fa eb bb 0f 0b 0f 0b e8 ea 53 bb batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 RSP: 0018:ffff8880826e7d10 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13 RAX: dffffc0000000000 RBX: 0000000000000282 RCX: 0000000000000000 RDX: 1ffffffff10a40b1 RSI: 0000000000000001 RDI: 0000000000000282 RBP: ffff8880826e7d20 R08: fffffbfff146197a R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff8a30cbc8 R13: ffffffff8858c4c0 R14: ffff88808ba9f2a8 R15: 0000000000000001 debug_object_activate+0x1fd/0x4e0 lib/debugobjects.c:502 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! IPv6: ADDRCONF(NETDEV_UP): batadv_slave_0: link is not ready debug_rcu_head_queue kernel/rcu/rcu.h:193 [inline] __call_rcu.constprop.51+0x35/0x7f0 kernel/rcu/tree.c:2977 batman_adv: batadv0: Interface activated: batadv_slave_0 call_rcu+0x12/0x20 kernel/rcu/tree_plugin.h:786 __put_cred+0x18e/0x200 kernel/cred.c:153 put_cred include/linux/cred.h:276 [inline] commit_creds+0xae0/0xec0 kernel/cred.c:501 call_usermodehelper_exec_async+0x20a/0x5b0 kernel/umh.c:100 IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Modules linked in: IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready ---[ end trace 3e1b495a16c0f479 ]--- RIP: 0010:rose_send_frame+0x194/0x230 net/rose/rose_link.c:104 IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready Code: 78 fb eb 93 80 3c 02 00 0f 85 84 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 4b 20 49 8d b9 58 03 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 6c 49 8b 91 58 03 00 00 e9 b4 fe ff ff e8 85 78 78 RSP: 0018:ffff8880aea07ab8 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff8882162dccc0 RCX: 0000000000000006 RDX: 000000000000006b RSI: ffffffff87cca5a0 RDI: 0000000000000358 RBP: ffff8880aea07ae8 R08: ffffed1011706d75 R09: 0000000000000000 R10: ffffed1011706d74 R11: ffff88808b836ba3 R12: ffff8882162dccc0 R13: 0000000000000078 R14: ffff88808ba9e640 R15: ffff88808ba9e640 FS: 0000000000000000(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe19bb7f98 CR3: 000000008c457000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400