bisecting fixing commit since de64d941a71a8421904c4474415ce7879596f313
building syzkaller on 8b277b8e2ac2f385eec24532a4786cc4ad12e9ae
testing commit de64d941a71a8421904c4474415ce7879596f313
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: d5fa140d7b1a2eeccff8452e55a730d42d60e2047c5c10f4b6bdcf7e3265de3c
run #0: crashed: BUG: corrupted list in insert_work
run #1: crashed: BUG: corrupted list in insert_work
run #2: crashed: BUG: corrupted list in insert_work
run #3: crashed: BUG: corrupted list in insert_work
run #4: crashed: general protection fault in ip6_pol_route
run #5: crashed: BUG: corrupted list in insert_work
run #6: crashed: BUG: corrupted list in insert_work
run #7: crashed: BUG: corrupted list in insert_work
run #8: crashed: BUG: corrupted list in insert_work
run #9: crashed: BUG: corrupted list in insert_work
run #10: crashed: BUG: corrupted list in insert_work
run #11: crashed: BUG: corrupted list in insert_work
run #12: crashed: BUG: corrupted list in insert_work
run #13: crashed: BUG: corrupted list in insert_work
run #14: crashed: BUG: corrupted list in insert_work
run #15: crashed: BUG: corrupted list in insert_work
run #16: crashed: KASAN: use-after-free Read in pids_release
run #17: crashed: BUG: corrupted list in insert_work
run #18: crashed: BUG: corrupted list in insert_work
run #19: crashed: BUG: corrupted list in insert_work
testing current HEAD fdd06dc6b0f832a9cd8033438cc3b01d253c3981
testing commit fdd06dc6b0f832a9cd8033438cc3b01d253c3981
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 2a97a061951042e873200664dd57252764d8d4c2a4d76be48b68e1d924aa23f0
all runs: crashed: BUG: corrupted list in insert_work
revisions tested: 2, total time: 16m40.421585493s (build: 8m56.735655157s, test: 7m18.862267664s)
the crash still happens on HEAD
commit msg: ANDROID: GKI: db845c: Update symbols list and ABI
crash: BUG: corrupted list in insert_work
list_add corruption. prev->next should be next (ffff8881f735c360), but was ffff88811dd60870. (prev=ffff88811dd60870).
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:26!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 0 Comm: swapper/1 Tainted: G W 5.10.117-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__list_add_valid.cold+0x3a/0x3c lib/list_debug.c:26
Code: 0b 48 89 f2 4c 89 e1 4c 89 ee 48 c7 c7 60 25 c0 84 e8 67 f1 fd ff 0f 0b 48 89 f1 48 c7 c7 e0 24 c0 84 4c 89 e6 e8 53 f1 fd ff <0f> 0b 4c 89 e6 48 c7 c7 80 26 c0 84 e8 42 f1 fd ff 0f 0b 4c 89 f2
RSP: 0018:ffffc90000160c68 EFLAGS: 00010086
RAX: 0000000000000075 RBX: ffff88811dd60868 RCX: 0000000000000000
RDX: 0000000000000103 RSI: ffffffff84c02320 RDI: fffff5200002c180
RBP: ffffc90000160c80 R08: 0000000000000075 R09: ffff8881f7353067
R10: ffffed103ee6a60c R11: 00000000000451b8 R12: ffff8881f735c360
R13: ffff88811dd60870 R14: ffff8881f735c360 R15: ffff8881f7355a40
FS: 0000000000000000(0000) GS:ffff8881f7300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555556515b78 CR3: 000000011b665000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__list_add include/linux/list.h:67 [inline]
list_add_tail include/linux/list.h:100 [inline]
insert_work+0xe6/0x380 kernel/workqueue.c:1352
__queue_work+0x42c/0xc30 kernel/workqueue.c:1514
queue_work_on+0x48/0x50 kernel/workqueue.c:1541
queue_work include/linux/workqueue.h:513 [inline]
css_release+0xb1/0x110 kernel/cgroup/cgroup.c:5161
percpu_ref_put_many include/linux/percpu-refcount.h:322 [inline]
percpu_ref_put include/linux/percpu-refcount.h:338 [inline]
percpu_ref_call_confirm_rcu lib/percpu-refcount.c:162 [inline]
percpu_ref_switch_to_atomic_rcu+0x2cf/0x470 lib/percpu-refcount.c:199
rcu_do_batch+0x355/0xbb0 kernel/rcu/tree.c:2485
rcu_core+0x46d/0xab0 kernel/rcu/tree.c:2726
rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2739
__do_softirq+0x1c6/0x61c kernel/softirq.c:305
asm_call_irq_on_stack+0xf/0x20
__run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
do_softirq_own_stack+0x61/0x80 arch/x86/kernel/irq_64.c:77
invoke_softirq kernel/softirq.c:402 [inline]
__irq_exit_rcu kernel/softirq.c:432 [inline]
irq_exit_rcu+0x95/0x170 kernel/softirq.c:444
sysvec_apic_timer_interrupt+0x3f/0xe0 arch/x86/kernel/apic/apic.c:1095
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0010:native_irq_disable arch/x86/include/asm/irqflags.h:49 [inline]
RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:89 [inline]
RIP: 0010:acpi_safe_halt drivers/acpi/processor_idle.c:114 [inline]
RIP: 0010:acpi_idle_do_entry+0x16a/0x1c0 drivers/acpi/processor_idle.c:558
Code: 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 75 62 49 8b 04 24 a8 08 75 c5 e9 07 00 00 00 0f 00 2d a8 e4 b4 00 fb f4 eb b4 4c 89 e7 e8 fb f6 ff ff 4c 8b 65 f8 c9 c3 e8 e0 f1 79 fd
RSP: 0018:ffffc900000f7cf0 EFLAGS: 00000246
RAX: 0000000000004000 RBX: ffff888105b9d865 RCX: ffffffff8411914d
RDX: 1ffff110200504e0 RSI: 0000000000000008 RDI: ffff888100282700
RBP: ffffc900000f7cf8 R08: 0000000000000000 R09: ffff888100282707
R10: ffffed10200504e0 R11: 0000000000000001 R12: ffff888100282700
R13: ffff8881041d4000 R14: ffff8881041d4004 R15: ffff888105b9d864
acpi_idle_enter+0x2c5/0x4b0 drivers/acpi/processor_idle.c:693
cpuidle_enter_state+0x19e/0x1070 drivers/cpuidle/cpuidle.c:249
cpuidle_enter+0x4a/0xa0 drivers/cpuidle/cpuidle.c:364
call_cpuidle kernel/sched/idle.c:160 [inline]
cpuidle_idle_call kernel/sched/idle.c:241 [inline]
do_idle+0x3f1/0x5a0 kernel/sched/idle.c:302
cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:398
start_secondary+0x1bb/0x230 arch/x86/kernel/smpboot.c:265
secondary_startup_64_no_verify+0xb0/0xbb
Modules linked in:
---[ end trace 9d9feaabe7274370 ]---
RIP: 0010:__list_add_valid.cold+0x3a/0x3c lib/list_debug.c:26
Code: 0b 48 89 f2 4c 89 e1 4c 89 ee 48 c7 c7 60 25 c0 84 e8 67 f1 fd ff 0f 0b 48 89 f1 48 c7 c7 e0 24 c0 84 4c 89 e6 e8 53 f1 fd ff <0f> 0b 4c 89 e6 48 c7 c7 80 26 c0 84 e8 42 f1 fd ff 0f 0b 4c 89 f2
RSP: 0018:ffffc90000160c68 EFLAGS: 00010086
RAX: 0000000000000075 RBX: ffff88811dd60868 RCX: 0000000000000000
RDX: 0000000000000103 RSI: ffffffff84c02320 RDI: fffff5200002c180
RBP: ffffc90000160c80 R08: 0000000000000075 R09: ffff8881f7353067
R10: ffffed103ee6a60c R11: 00000000000451b8 R12: ffff8881f735c360
R13: ffff88811dd60870 R14: ffff8881f735c360 R15: ffff8881f7355a40
FS: 0000000000000000(0000) GS:ffff8881f7300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555556515b78 CR3: 000000011b665000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
7: fc ff df
a: 48 c1 ea 03 shr $0x3,%rdx
e: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
12: 75 62 jne 0x76
14: 49 8b 04 24 mov (%r12),%rax
18: a8 08 test $0x8,%al
1a: 75 c5 jne 0xffffffe1
1c: e9 07 00 00 00 jmpq 0x28
21: 0f 00 2d a8 e4 b4 00 verw 0xb4e4a8(%rip) # 0xb4e4d0
28: fb sti
29: f4 hlt
* 2a: fa cli <-- trapping instruction
2b: eb b4 jmp 0xffffffe1
2d: 4c 89 e7 mov %r12,%rdi
30: e8 fb f6 ff ff callq 0xfffff730
35: 4c 8b 65 f8 mov -0x8(%rbp),%r12
39: c9 leaveq
3a: c3 retq
3b: e8 e0 f1 79 fd callq 0xfd79f220