bisecting fixing commit since b98aebd298246df37b472c52a2ee1023256d02e3 building syzkaller on 04ca72cd45348daab9d896bbec8ea4c2d13455ac testing commit b98aebd298246df37b472c52a2ee1023256d02e3 with gcc (GCC) 8.1.0 kernel signature: a89d6282cdfa7a7ad5bd90d56f0a3b2eead8a3a09115f132422ab7a8c279e354 all runs: crashed: general protection fault in ip6_dst_destroy testing current HEAD e0f8b8a65a473a8baa439cf865a694bbeb83fe90 testing commit e0f8b8a65a473a8baa439cf865a694bbeb83fe90 with gcc (GCC) 8.1.0 kernel signature: cd5de12aaca3473ddd8f712708ca0e92de8899a29de8041e7f59a4f643380b53 all runs: crashed: general protection fault in ip6_dst_destroy revisions tested: 2, total time: 24m55.261503769s (build: 17m32.549005578s, test: 6m31.257602813s) the crash still happens on HEAD commit msg: Linux 4.14.170 crash: general protection fault in ip6_dst_destroy IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready general protection fault: 0000 [#1] PREEMPT SMP KASAN Modules linked in: CPU: 0 PID: 6493 Comm: udevd Not tainted 4.14.170-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff88809837e0c0 task.stack: ffff888082150000 RIP: 0010:__lock_acquire+0x1d5/0x4500 kernel/locking/lockdep.c:3365 RSP: 0018:ffff8880aee07b30 EFLAGS: 00010006 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000003 RSI: 0000000000000000 RDI: ffffffff879169c0 8021q: adding VLAN 0 to HW filter on device bond0 RBP: ffff8880aee07cf8 R08: 0000000000000001 R09: 0000000000000000 IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready R10: 0000000000000001 R11: ffff88809837e0c0 R12: 0000000000000018 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready FS: 00007f2b8ed8a7a0(0000) GS:ffff8880aee00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2b8ed91000 CR3: 0000000095604000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready lock_acquire+0x173/0x400 kernel/locking/lockdep.c:3994 8021q: adding VLAN 0 to HW filter on device team0 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline] _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:176 IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready spin_lock_bh include/linux/spinlock.h:322 [inline] rt6_uncached_list_del net/ipv6/route.c:144 [inline] ip6_dst_destroy+0x100/0x380 net/ipv6/route.c:402 dst_destroy+0xb2/0x2d0 net/core/dst.c:129 dst_destroy_rcu+0xd/0x10 net/core/dst.c:151 IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready __rcu_reclaim kernel/rcu/rcu.h:195 [inline] rcu_do_batch kernel/rcu/tree.c:2699 [inline] invoke_rcu_callbacks kernel/rcu/tree.c:2962 [inline] __rcu_process_callbacks kernel/rcu/tree.c:2929 [inline] rcu_process_callbacks+0x7e0/0x11e0 kernel/rcu/tree.c:2946 __do_softirq+0x246/0x9b0 kernel/softirq.c:288 invoke_softirq kernel/softirq.c:368 [inline] irq_exit+0x15f/0x1a0 kernel/softirq.c:409 exiting_irq arch/x86/include/asm/apic.h:648 [inline] smp_apic_timer_interrupt+0x149/0x5d0 arch/x86/kernel/apic/apic.c:1102 IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready apic_timer_interrupt+0x96/0xa0 arch/x86/entry/entry_64.S:792 IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready RIP: 0010:find_stack lib/stackdepot.c:173 [inline] RIP: 0010:depot_save_stack+0xea/0x43a lib/stackdepot.c:225 RSP: 0018:ffff888082157870 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff10 RAX: 00000000611229eb RBX: 00000000a5ddd175 RCX: 000000000000000a RDX: 00000000288818b9 RSI: 00000000014000c0 RDI: ffff8880821578c8 RBP: ffff8880821578b8 R08: ffff8880821578e0 R09: 0000000067d53064 R10: 0000000000000002 R11: 000000005bb28f5c R12: ffff8880821578c8 R13: ffff88809bcd2a88 R14: ffff888099db7350 R15: 00000000000dd175 save_stack+0xa9/0xd0 mm/kasan/kasan.c:453 IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready 8021q: adding VLAN 0 to HW filter on device batadv0 set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:551 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:489 slab_post_alloc_hook mm/slab.h:442 [inline] slab_alloc mm/slab.c:3390 [inline] kmem_cache_alloc+0x11b/0x790 mm/slab.c:3550 copy_sighand kernel/fork.c:1348 [inline] copy_process.part.37+0x36f5/0x66e0 kernel/fork.c:1765 copy_process kernel/fork.c:1586 [inline] _do_fork+0x155/0xbb0 kernel/fork.c:2070 SYSC_clone kernel/fork.c:2180 [inline] SyS_clone+0x14/0x20 kernel/fork.c:2174 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x7f2b8e46df46 RSP: 002b:00007ffc467e11e0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 RAX: ffffffffffffffda RBX: 00007ffc467e11e0 RCX: 00007f2b8e46df46 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 RBP: 00007ffc467e1240 R08: 000000000000195d R09: 000000000000195d R10: 00007f2b8ed8aa70 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc467e1200 R14: 0000000000000005 R15: 0000000000000005 Code: 00 00 00 00 8b 84 24 98 00 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 0f 85 f2 30 00 00 49 81 3c 24 e0 22 7b 88 0f 84 30 RIP: __lock_acquire+0x1d5/0x4500 kernel/locking/lockdep.c:3365 RSP: ffff8880aee07b30 ---[ end trace 016317fb26016c9f ]---