bisecting cause commit starting from da5322e65940e4e8426613a8ff3d99a08b350a52 building syzkaller on f5e275d1d9ad023a25bb60af9011b452ad9cbaf9 testing commit da5322e65940e4e8426613a8ff3d99a08b350a52 with gcc (GCC) 8.1.0 run #0: crashed: general protection fault in rdma_listen run #1: crashed: general protection fault in rdma_listen run #2: crashed: general protection fault in rdma_listen run #3: crashed: general protection fault in rdma_listen run #4: crashed: general protection fault in rdma_listen run #5: crashed: general protection fault in rdma_listen run #6: crashed: general protection fault in corrupted run #7: crashed: general protection fault in rdma_listen run #8: crashed: general protection fault in rdma_listen run #9: crashed: general protection fault in rdma_listen testing release v4.19 testing commit 84df9525b0c27f3ebc2ebb1864fa62a97fdedb7d with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in rdma_listen testing release v4.18 testing commit 94710cac0ef4ee177a63b5227664b38c95bbf703 with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in rdma_listen testing release v4.17 testing commit 29dcea88779c856c7dc92040a0c01233263101d4 with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in rdma_listen testing release v4.16 testing commit 0adb32858b0bddf4ada5f364a84ed60b196dbcda with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in rdma_listen testing release v4.15 testing commit d8a5b80568a9cb66810e75b182018e9edb68e8ff with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in rdma_listen testing release v4.14 testing commit bebc6082da0a9f5d47a1ea2edc099bf671058bd4 with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in rdma_listen testing release v4.13 testing commit 569dbb88e80deb68974ef6fdd6a13edb9d686261 with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in rdma_listen testing release v4.12 testing commit 6f7da290413ba713f0cdd9ff1a2a9bb129ef4f6c with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in rdma_listen testing release v4.11 testing commit a351e9b9fc24e982ec2f0e76379a49826036da12 with gcc (GCC) 7.3.0 all runs: crashed: general protection fault in rdma_listen testing release v4.10 testing commit c470abd4fde40ea6a0846a2beab642a578c0b8cd with gcc (GCC) 5.5.0 all runs: crashed: general protection fault in rdma_listen testing release v4.9 testing commit 69973b830859bc6529a7a0468ba0d80ee5117826 with gcc (GCC) 5.5.0 run #0: crashed: general protection fault in rdma_listen run #1: crashed: general protection fault in rdma_listen run #2: crashed: general protection fault in rdma_listen run #3: crashed: general protection fault in rdma_listen run #4: crashed: general protection fault in rdma_listen run #5: crashed: general protection fault in rdma_listen run #6: crashed: general protection fault in rdma_listen run #7: crashed: general protection fault in rdma_listen run #8: crashed: general protection fault in rdma_listen run #9: crashed: general protection fault in corrupted testing release v4.8 testing commit c8d2bc9bc39ebea8437fd974fdbc21847bb897a3 with gcc (GCC) 5.5.0 all runs: crashed: general protection fault in rdma_listen testing release v4.7 testing commit 523d939ef98fd712632d93a5a2b588e477a7565e with gcc (GCC) 5.5.0 all runs: crashed: general protection fault in rdma_listen testing release v4.6 testing commit 2dcd0af568b0cf583645c8a317dd12e344b1c72a with gcc (GCC) 5.5.0 all runs: crashed: general protection fault in rdma_listen testing release v4.5 testing commit b562e44f507e863c6792946e4e1b1449fbbac85d with gcc (GCC) 5.5.0 run #0: crashed: BUG: unable to handle kernel NULL pointer dereference in rdma_listen run #1: crashed: BUG: unable to handle kernel NULL pointer dereference in rdma_listen run #2: crashed: BUG: unable to handle kernel NULL pointer dereference in rdma_listen run #3: crashed: BUG: unable to handle kernel NULL pointer dereference in rdma_listen run #4: crashed: BUG: unable to handle kernel run #5: crashed: BUG: unable to handle kernel NULL pointer dereference in rdma_listen run #6: crashed: BUG: unable to handle kernel NULL pointer dereference in rdma_listen run #7: crashed: BUG: unable to handle kernel NULL pointer dereference in rdma_listen run #8: crashed: BUG: unable to handle kernel NULL pointer dereference in rdma_listen run #9: crashed: BUG: unable to handle kernel NULL pointer dereference in rdma_listen testing release v4.4 testing commit afd2ff9b7e1b367172f18ba7f693dfb62bdcb2dc with gcc (GCC) 5.5.0 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in rdma_listen testing release v4.3 testing commit 6a13feb9c82803e2b815eca72fa7a9f5561d7861 with gcc (GCC) 5.5.0 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in rdma_listen testing release v4.2 testing commit 64291f7db5bd8150a74ad2036f1037e6a0428df2 with gcc (GCC) 5.5.0 run #0: crashed: BUG: unable to handle kernel NULL pointer dereference in rdma_listen run #1: crashed: BUG: unable to handle kernel NULL pointer dereference in rdma_listen run #2: crashed: BUG: unable to handle kernel run #3: crashed: BUG: unable to handle kernel run #4: crashed: BUG: unable to handle kernel NULL pointer dereference in rdma_listen run #5: crashed: BUG: unable to handle kernel NULL pointer dereference in rdma_listen run #6: crashed: BUG: unable to handle kernel NULL pointer dereference in rdma_listen run #7: crashed: BUG: unable to handle kernel NULL pointer dereference in rdma_listen run #8: crashed: BUG: unable to handle kernel NULL pointer dereference in rdma_listen run #9: crashed: BUG: unable to handle kernel NULL pointer dereference in rdma_listen testing release v4.1 testing commit b953c0d234bc72e8489d3bf51a276c5c4ec85345 with gcc (GCC) 5.5.0 run #0: crashed: BUG: unable to handle kernel NULL pointer dereference in rdma_listen run #1: crashed: BUG: unable to handle kernel NULL pointer dereference in rdma_listen run #2: crashed: BUG: unable to handle kernel NULL pointer dereference in rdma_listen run #3: crashed: BUG: unable to handle kernel NULL pointer dereference in rdma_listen run #4: crashed: BUG: unable to handle kernel NULL pointer dereference in rdma_listen run #5: crashed: BUG: unable to handle kernel NULL pointer dereference in rdma_listen run #6: crashed: BUG: unable to handle kernel NULL pointer dereference in rdma_listen run #7: crashed: BUG: unable to handle kernel run #8: crashed: BUG: unable to handle kernel NULL pointer dereference in rdma_listen run #9: crashed: BUG: unable to handle kernel NULL pointer dereference in rdma_listen revisions tested: 20, total time: 2h53m12.388664643s (build: 1h25m49.623557921s, test: 1h20m59.627778984s) the crash already happened on the oldest tested release crash: BUG: unable to handle kernel NULL pointer dereference in rdma_listen IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 IP: [] cma_bind_listen drivers/infiniband/core/cma.c:2436 [inline] IP: [] rdma_listen+0x16d/0x260 drivers/infiniband/core/cma.c:2550 PGD ba8e8067 [ 47.372560] kobject: 'loop5' (ffff8800baec18a0): kobject_uevent_env kobject: 'loop5' (ffff8800baec18a0): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop1' (ffff8800baded0a0): kobject_uevent_env kobject: 'loop1' (ffff8800baded0a0): fill_kobj_path: path = '/devices/virtual/block/loop1' kobject: 'loop4' (ffff8800bafef0a0): kobject_uevent_env kobject: 'loop4' (ffff8800bafef0a0): fill_kobj_path: path = '/devices/virtual/block/loop4' kobject: 'loop3' (ffff8800bb5448a0): kobject_uevent_env kobject: 'loop3' (ffff8800bb5448a0): fill_kobj_path: path = '/devices/virtual/block/loop3' kobject: 'loop2' (ffff8800bafef8a0): kobject_uevent_env kobject: 'loop2' (ffff8800bafef8a0): fill_kobj_path: path = '/devices/virtual/block/loop2' PUD b6f4e067 PMD 0 Oops: 0000 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 6662 Comm: syz-executor0 Not tainted 4.1.0 #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff88020ca6cb10 ti: ffff88020c420000 task.ti: ffff88020c420000 RIP: 0010:[] [] cma_bind_listen drivers/infiniband/core/cma.c:2436 [inline] RIP: 0010:[] [] rdma_listen+0x16d/0x260 drivers/infiniband/core/cma.c:2550 RSP: 0018:ffff88020c423d98 EFLAGS: 00010296 RAX: 0000000080000000 RBX: ffff8800b9c71c00 RCX: 0000000000000001 RDX: 0000000080000001 RSI: ffff88020ca6d378 RDI: 00000000ffffffff RBP: ffff88020c423db8 R08: ffff88020c423d38 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000400 R14: 0000000000000010 R15: 00000000ffffffff FS: 00007f3cf562a700(0000) GS:ffff88021fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 00000000b6fb2000 CR4: 00000000001407f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: ffffffff812ac027 0000000020000208 ffff8800bb5acc40 ffff88020caa2e00 ffff88020c423de8 ffffffff81fb16be ffffffff812ac027 0000000000000001 0000000020000200 0000000000000010 ffff88020c423e28 ffffffff81fb0a7d Call Trace: [] ucma_listen+0x6e/0x90 drivers/infiniband/core/ucma.c:965 [] ucma_write+0x6d/0xc0 drivers/infiniband/core/ucma.c:1505 [] __vfs_write+0x23/0x100 fs/read_write.c:489 [] vfs_write+0xa1/0x1c0 fs/read_write.c:538 [] SYSC_write fs/read_write.c:585 [inline] [] SyS_write+0x44/0xb0 fs/read_write.c:577 [] system_call_fastpath+0x16/0x7a Code: 41 89 c4 75 c1 31 c0 48 83 c4 08 5b 41 5c 41 5d 5d c3 0f 1f 40 00 4c 8b a3 b0 01 00 00 31 f6 48 c7 c7 20 3f 37 83 e8 13 85 67 00 <49> 8b 44 24 08 48 83 38 00 74 40 31 d2 4c 89 e7 48 89 de e8 2b RIP [] cma_bind_listen drivers/infiniband/core/cma.c:2435 [inline] RIP [] rdma_listen+0x16d/0x260 drivers/infiniband/core/cma.c:2550 RSP CR2: 0000000000000008 ---[ end trace 09557b44637c5880 ]---