bisecting cause commit starting from ccda4af0f4b92f7b4c308d3acc262f4a7e3affad building syzkaller on 5f5f6d14e80b8bd6b42db961118e902387716bcb testing commit ccda4af0f4b92f7b4c308d3acc262f4a7e3affad with gcc (GCC) 8.1.0 all runs: crashed: KASAN: null-ptr-deref Read in refcount_sub_and_test_checked testing release v4.19 testing commit 84df9525b0c27f3ebc2ebb1864fa62a97fdedb7d with gcc (GCC) 8.1.0 all runs: crashed: KASAN: null-ptr-deref Read in refcount_sub_and_test_checked testing release v4.18 testing commit 94710cac0ef4ee177a63b5227664b38c95bbf703 with gcc (GCC) 8.1.0 all runs: crashed: KASAN: null-ptr-deref Read in refcount_sub_and_test testing release v4.17 testing commit 29dcea88779c856c7dc92040a0c01233263101d4 with gcc (GCC) 8.1.0 all runs: crashed: KASAN: null-ptr-deref Read in refcount_sub_and_test testing release v4.16 testing commit 0adb32858b0bddf4ada5f364a84ed60b196dbcda with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in refcount_sub_and_test testing release v4.15 testing commit d8a5b80568a9cb66810e75b182018e9edb68e8ff with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in refcount_sub_and_test testing release v4.14 testing commit bebc6082da0a9f5d47a1ea2edc099bf671058bd4 with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in refcount_sub_and_test testing release v4.13 testing commit 569dbb88e80deb68974ef6fdd6a13edb9d686261 with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in refcount_sub_and_test testing release v4.12 testing commit 6f7da290413ba713f0cdd9ff1a2a9bb129ef4f6c with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in refcount_sub_and_test testing release v4.11 testing commit a351e9b9fc24e982ec2f0e76379a49826036da12 with gcc (GCC) 7.3.0 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in vb2_vmalloc_put testing release v4.10 testing commit c470abd4fde40ea6a0846a2beab642a578c0b8cd with gcc (GCC) 5.5.0 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in vb2_vmalloc_put testing release v4.9 testing commit 69973b830859bc6529a7a0468ba0d80ee5117826 with gcc (GCC) 5.5.0 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in vb2_vmalloc_put testing release v4.8 testing commit c8d2bc9bc39ebea8437fd974fdbc21847bb897a3 with gcc (GCC) 5.5.0 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in vb2_vmalloc_put testing release v4.7 testing commit 523d939ef98fd712632d93a5a2b588e477a7565e with gcc (GCC) 5.5.0 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in vb2_vmalloc_put testing release v4.6 testing commit 2dcd0af568b0cf583645c8a317dd12e344b1c72a with gcc (GCC) 5.5.0 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in vb2_vmalloc_put testing release v4.5 testing commit b562e44f507e863c6792946e4e1b1449fbbac85d with gcc (GCC) 5.5.0 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in vb2_vmalloc_put testing release v4.4 testing commit afd2ff9b7e1b367172f18ba7f693dfb62bdcb2dc with gcc (GCC) 5.5.0 run #0: crashed: BUG: unable to handle kernel NULL pointer dereference in vb2_vmalloc_put run #1: crashed: BUG: unable to handle kernel NULL pointer dereference in vb2_vmalloc_put run #2: crashed: BUG: unable to handle kernel NULL pointer dereference in vb2_vmalloc_put run #3: crashed: BUG: unable to handle kernel NULL pointer dereference in vb2_vmalloc_put run #4: crashed: BUG: unable to handle kernel NULL pointer dereference in vb2_vmalloc_put run #5: crashed: BUG: unable to handle kernel NULL pointer dereference in vb2_vmalloc_put run #6: crashed: BUG: unable to handle kernel NULL pointer dereference in vb2_vmalloc_put run #7: crashed: BUG: unable to handle kernel NULL pointer dereference in vb2_vmalloc_put run #8: crashed: BUG: unable to handle kernel run #9: crashed: BUG: unable to handle kernel NULL pointer dereference in vb2_vmalloc_put testing release v4.3 testing commit 6a13feb9c82803e2b815eca72fa7a9f5561d7861 with gcc (GCC) 5.5.0 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in vb2_vmalloc_put testing release v4.2 testing commit 64291f7db5bd8150a74ad2036f1037e6a0428df2 with gcc (GCC) 5.5.0 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in vb2_vmalloc_put testing release v4.1 testing commit b953c0d234bc72e8489d3bf51a276c5c4ec85345 with gcc (GCC) 5.5.0 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in vb2_vmalloc_put revisions tested: 20, total time: 2h43m44.846735344s (build: 1h30m22.211725927s, test: 1h8m26.628198951s) the crash already happened on the oldest tested release crash: BUG: unable to handle kernel NULL pointer dereference in vb2_vmalloc_put IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready BUG: unable to handle kernel NULL pointer dereference at 000000000000002c IP: [] atomic_dec_and_test arch/x86/include/asm/atomic.h:118 [inline] IP: [] vb2_vmalloc_put+0x0/0x40 drivers/media/v4l2-core/videobuf2-vmalloc.c:68 PGD 73078067 PUD 7595c067 PMD 0 Oops: 0002 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 6694 Comm: syz-executor3 Not tainted 4.1.0 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 task: ffff880075aae7d0 ti: ffff880072b80000 task.ti: ffff880072b80000 RIP: 0010:[] [] atomic_dec_and_test arch/x86/include/asm/atomic.h:118 [inline] RIP: 0010:[] [] vb2_vmalloc_put+0x0/0x40 drivers/media/v4l2-core/videobuf2-vmalloc.c:68 RSP: 0018:ffff880072b83d50 EFLAGS: 00010286 RAX: ffffffff81e838f0 RBX: 0000000000000000 RCX: 0000000000000006 RDX: 0000000000000000 RSI: ffff880075aaf060 RDI: 0000000000000000 RBP: ffff880072b83d78 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff880072bb4c00 R14: 0000000000000009 R15: ffff88007a47a010 FS: 0000000001589940(0063) GS:ffff88007fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000002c CR3: 00000000731d1000 CR4: 00000000003407e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: ffffffff81e7da15 ffff880072b83d98 ffff880072bb4c00 ffff88007b59ddf0 ffff88007b59dda8 ffff880072b83dc8 ffffffff81e7f8b8 ffff88007b59dda8 000000207a47a010 ffff880072b83dc8 ffff88007b59dda8 ffff88007b59ddf0 Call Trace: [] __vb2_free_mem drivers/media/v4l2-core/videobuf2-core.c:425 [inline] [] __vb2_queue_free+0x228/0x280 drivers/media/v4l2-core/videobuf2-core.c:470 [] vb2_queue_release+0x33/0x40 drivers/media/v4l2-core/videobuf2-core.c:2738 [] _vb2_fop_release+0x8f/0xa0 drivers/media/v4l2-core/videobuf2-core.c:3416 [] vb2_fop_release+0x29/0x50 drivers/media/v4l2-core/videobuf2-core.c:3430 [] vivid_fop_release+0x92/0x230 drivers/media/platform/vivid/vivid-core.c:482 [] v4l2_release+0x30/0x80 drivers/media/v4l2-core/v4l2-dev.c:443 [] __fput+0xed/0x250 fs/file_table.c:208 [] ____fput+0x9/0x10 fs/file_table.c:244 [] task_work_run+0xc4/0xf0 kernel/task_work.c:123 [] tracehook_notify_resume include/linux/tracehook.h:190 [inline] [] do_notify_resume+0x68/0x70 arch/x86/kernel/signal.c:739 [] int_signal+0x12/0x17 Code: 48 c7 c7 58 a9 f3 82 e8 af a2 2e ff 48 83 c4 38 31 c0 5b 5d c3 66 0f 1f 44 00 00 31 c0 eb d2 66 90 66 2e 0f 1f 84 00 00 00 00 00 ff 4f 2c 74 0a c3 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 53 RIP [] vb2_vmalloc_put+0x0/0x40 drivers/media/v4l2-core/videobuf2-vmalloc.c:383 RSP CR2: 000000000000002c ---[ end trace 345e83a61c616434 ]---