bisecting fixing commit since ba4f184e126b751d1bffad5897f263108befc780
building syzkaller on 9e1fa68ee1625a7f0ef03906ee1abb40cb987fbf
testing commit ba4f184e126b751d1bffad5897f263108befc780 with gcc (GCC) 8.1.0
kernel signature: 953ab6167e2d21bf2a08c2cdc499f67959f4fd526d10bacde278af119f8b2187
all runs: crashed: WARNING: refcount bug in qrtr_node_lookup
testing current HEAD 2ff90100ace886895e4fbb2850b8d5e49d931ed6
testing commit 2ff90100ace886895e4fbb2850b8d5e49d931ed6 with gcc (GCC) 8.1.0
kernel signature: 78c94895525c2dc2527049443ff5cb465bef8f0f082bc06c1f182576d42164b7
all runs: crashed: WARNING: refcount bug in qrtr_node_lookup
revisions tested: 2, total time: 24m3.774803569s (build: 10m22.642464185s, test: 13m0.781148901s)
the crash still happens on HEAD
commit msg: Merge tag 'hwmon-for-v5.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
crash: WARNING: refcount bug in qrtr_node_lookup
------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 0 PID: 51 at lib/refcount.c:25 refcount_warn_saturate+0xb4/0x130 lib/refcount.c:25
Modules linked in:
CPU: 0 PID: 51 Comm: kworker/u4:2 Not tainted 5.11.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: qrtr_ns_handler qrtr_ns_worker
RIP: 0010:refcount_warn_saturate+0xb4/0x130 lib/refcount.c:25
Code: 5b c3 0f b6 1d 0d bd 15 03 80 fb 01 0f 87 3f 5a 55 01 83 e3 01 75 91 48 c7 c7 28 f4 3f 84 c6 05 f1 bc 15 03 01 e8 60 64 4a 01 <0f> 0b 5b c3 0f b6 1d e3 bc 15 03 80 fb 01 0f 87 4f 5a 55 01 83 e3
RSP: 0018:ffffc9000019bcd0 EFLAGS: 00010086
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000002
RDX: 0000000080000002 RSI: ffffffff8450da1e RDI: 00000000ffffffff
RBP: 0000000000000282 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000001 R12: ffffc9000019bdb8
R13: ffffc9000019bd7c R14: 0000000000001000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000747918 CR3: 000000010b159005 CR4: 00000000001706f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __refcount_add include/linux/refcount.h:199 [inline]
 __refcount_inc include/linux/refcount.h:250 [inline]
 refcount_inc include/linux/refcount.h:267 [inline]
 kref_get include/linux/kref.h:45 [inline]
 qrtr_node_acquire net/qrtr/qrtr.c:201 [inline]
 qrtr_node_lookup+0x67/0x80 net/qrtr/qrtr.c:394
 qrtr_send_resume_tx net/qrtr/qrtr.c:1004 [inline]
 qrtr_recvmsg+0x134/0x1c0 net/qrtr/qrtr.c:1067
 qrtr_ns_worker+0xb2/0x9a0 net/qrtr/ns.c:684
 process_one_work+0x293/0x610 kernel/workqueue.c:2275
 worker_thread+0x38/0x380 kernel/workqueue.c:2421
 kthread+0x145/0x170 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296