bisecting fixing commit since 78d697fc93f98054e36a3ab76dca1a88802ba7be building syzkaller on 35f53e457420e79fa28e3260cdbbf9f37b9f97e4 testing commit 78d697fc93f98054e36a3ab76dca1a88802ba7be with gcc (GCC) 8.1.0 kernel signature: f55b23487c89f89b503344c6b2e1e6438002853e79652b240cd935c7c9bce605 run #0: crashed: WARNING: ODEBUG bug in batadv_nc_mesh_free run #1: crashed: WARNING: ODEBUG bug in batadv_nc_mesh_free run #2: crashed: WARNING: ODEBUG bug in batadv_nc_mesh_free run #3: crashed: WARNING in __alloc_pages_slowpath run #4: crashed: WARNING: ODEBUG bug in batadv_nc_mesh_free run #5: crashed: WARNING: ODEBUG bug in batadv_nc_mesh_free run #6: crashed: WARNING: ODEBUG bug in batadv_nc_mesh_free run #7: crashed: WARNING: ODEBUG bug in batadv_nc_mesh_free run #8: OK run #9: OK testing current HEAD 2f166cdcf8a92fcf85524f2b5526cb28e16f0a60 testing commit 2f166cdcf8a92fcf85524f2b5526cb28e16f0a60 with gcc (GCC) 8.1.0 kernel signature: 112be4a971cb5adb141b973201167e91511863f36cd7f8339decf53170795b8d run #0: crashed: WARNING in batadv_iv_send_outstanding_bat_ogm_packet run #1: crashed: WARNING: ODEBUG bug in batadv_nc_mesh_free run #2: OK run #3: crashed: WARNING: ODEBUG bug in batadv_nc_mesh_free run #4: crashed: WARNING: ODEBUG bug in batadv_nc_mesh_free run #5: crashed: WARNING: ODEBUG bug in batadv_nc_mesh_free run #6: crashed: WARNING: ODEBUG bug in batadv_nc_mesh_free run #7: crashed: WARNING: ODEBUG bug in batadv_nc_mesh_free run #8: OK run #9: OK revisions tested: 2, total time: 41m21.644984564s (build: 20m9.560603619s, test: 19m11.225307741s) the crash still happens on HEAD commit msg: Linux 4.14.196 crash: WARNING: ODEBUG bug in batadv_nc_mesh_free RBP: 000000000076bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 0000000000000365 R14: 00000000004c5a2e R15: 000000000076bf2c ODEBUG: assert_init not available (active state 0) object type: timer_list hint: (null) ------------[ cut here ]------------ WARNING: CPU: 1 PID: 10719 at lib/debugobjects.c:290 debug_print_object.cold.13+0xa7/0xdb lib/debugobjects.c:287 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 10719 Comm: syz-executor.0 Not tainted 4.14.196-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0xf7/0x13b lib/dump_stack.c:58 panic+0x1b0/0x358 kernel/panic.c:183 __warn.cold.8+0x25/0x2c kernel/panic.c:547 report_bug+0x1a4/0x1f3 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:177 [inline] do_error_trap+0x1bd/0x310 arch/x86/kernel/traps.c:295 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:314 invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:964 RIP: 0010:debug_print_object.cold.13+0xa7/0xdb lib/debugobjects.c:287 RSP: 0018:ffff88808a8cf038 EFLAGS: 00010082 RAX: 0000000000000061 RBX: 0000000000000005 RCX: 0000000000000000 RDX: 0000000000000061 RSI: ffffffff86cbf460 RDI: ffffed1011519dfe RBP: ffff88808a8cf060 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000028 R11: dffffc0000000000 R12: ffffffff86cba6a0 R13: 0000000000000000 R14: 0000000000000000 R15: ffffffff87f8f2a0 debug_object_assert_init+0x24d/0x370 lib/debugobjects.c:656 debug_timer_assert_init kernel/time/timer.c:708 [inline] debug_assert_init kernel/time/timer.c:756 [inline] del_timer+0x6c/0xf0 kernel/time/timer.c:1151 try_to_grab_pending+0x21a/0x590 kernel/workqueue.c:1225 __cancel_work_timer+0x93/0x420 kernel/workqueue.c:2923 cancel_delayed_work_sync+0xe/0x10 kernel/workqueue.c:3084 batadv_nc_mesh_free+0x3e/0x116 net/batman-adv/network-coding.c:1880 batadv_mesh_free+0x73/0x160 net/batman-adv/main.c:231 batadv_mesh_init+0x531/0x600 net/batman-adv/main.c:216 batadv_softif_init_late+0xa38/0xd00 net/batman-adv/soft-interface.c:856 register_netdevice+0x252/0xe50 net/core/dev.c:7589 warn_alloc_show_mem: 2 callbacks suppressed Mem-Info: rtnl_newlink+0x1158/0x13a0 net/core/rtnetlink.c:2742 active_anon:7325 inactive_anon:7355 isolated_anon:0 active_file:15 inactive_file:1276 isolated_file:0 unevictable:0 dirty:38 writeback:0 unstable:0 slab_reclaimable:11300 slab_unreclaimable:115298 mapped:1962 shmem:8292 pagetables:445 bounce:0 free:179658 free_pcp:697 free_cma:0 rtnetlink_rcv_msg+0x34c/0x9e0 net/core/rtnetlink.c:4316 netlink_rcv_skb+0x12f/0x3b0 net/netlink/af_netlink.c:2433 rtnetlink_rcv+0x10/0x20 net/core/rtnetlink.c:4328 netlink_unicast_kernel net/netlink/af_netlink.c:1287 [inline] netlink_unicast+0x40b/0x600 net/netlink/af_netlink.c:1313 Node 0 active_anon:28668kB inactive_anon:29416kB active_file:40kB inactive_file:5084kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:7848kB dirty:152kB writeback:0kB shmem:33164kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 6144kB writeback_tmp:0kB unstable:0kB all_unreclaimable? yes netlink_sendmsg+0x730/0xbd0 net/netlink/af_netlink.c:1878 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xb5/0xf0 net/socket.c:656 Node 1 active_anon:632kB inactive_anon:4kB active_file:20kB inactive_file:20kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:4kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB unstable:0kB all_unreclaimable? yes SYSC_sendto+0x1e3/0x2c0 net/socket.c:1763 Node 0 DMA free:10716kB min:216kB low:268kB high:320kB active_anon:8kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 SyS_sendto+0x9/0x10 net/socket.c:1731 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb 2570 RIP: 0033:0x4161a3 2570 RSP: 002b:00007fffaa410768 EFLAGS: 00000246 ORIG_RAX: 000000000000002c 2570 RAX: ffffffffffffffda RBX: 0000000000c82200 RCX: 00000000004161a3 RDX: 000000000000003c RSI: 0000000000c82250 RDI: 0000000000000003 2570 RBP: 0000000000000000 R08: 00007fffaa410770 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000c82250 R15: 0000000000000003 Kernel Offset: disabled Rebooting in 86400 seconds..