bisecting fixing commit since 0c88e405c97ed1828443b67891e6d4bb6e56cd4e
building syzkaller on e34b696c0d7c04dbc824dee8b5123969bbca19b7
testing commit 0c88e405c97ed1828443b67891e6d4bb6e56cd4e with gcc (GCC) 8.1.0
kernel signature: 9aefef0201c8402d285f540c04587f98c855c54d420dad4d56cb34704fe1bef7
run #0: crashed: general protection fault in vgem_fence_attach_ioctl
run #1: crashed: general protection fault in vgem_fence_attach_ioctl
run #2: crashed: WARNING in mutex_destroy
run #3: crashed: WARNING in mutex_destroy
run #4: crashed: general protection fault in vgem_fence_attach_ioctl
run #5: crashed: WARNING in mutex_destroy
run #6: crashed: WARNING in mutex_destroy
run #7: crashed: WARNING in mutex_destroy
run #8: crashed: general protection fault in vgem_fence_attach_ioctl
run #9: crashed: general protection fault in vgem_fence_attach_ioctl
testing current HEAD 2263955bf7e71ca8419b64d7a60510aad29002f6
testing commit 2263955bf7e71ca8419b64d7a60510aad29002f6 with gcc (GCC) 8.1.0
kernel signature: 00407ef088c27f09af664d986c7dec95f4417d9ab78f0dc9c548bbe5fc3c6d55
run #0: crashed: WARNING in mutex_destroy
run #1: crashed: general protection fault in vgem_fence_attach_ioctl
run #2: crashed: general protection fault in vgem_fence_attach_ioctl
run #3: crashed: general protection fault in vgem_fence_attach_ioctl
run #4: crashed: general protection fault in vgem_fence_attach_ioctl
run #5: crashed: general protection fault in vgem_fence_attach_ioctl
run #6: crashed: WARNING in mutex_destroy
run #7: crashed: general protection fault in vgem_fence_attach_ioctl
run #8: crashed: KASAN: use-after-free Read in reservation_object_test_signaled_rcu
run #9: crashed: WARNING in mutex_destroy
revisions tested: 2, total time: 34m36.30244718s (build: 15m50.155998955s, test: 18m17.548917531s)
the crash still happens on HEAD
commit msg: Linux 4.19.170
crash: WARNING in mutex_destroy
bond0 (unregistering): Releasing backup interface bond_slave_1
bond0 (unregistering): Releasing backup interface bond_slave_0
bond0 (unregistering): Released all slaves
------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(mutex_is_locked(lock))
WARNING: CPU: 1 PID: 22475 at kernel/locking/mutex-debug.c:103 mutex_destroy+0xf3/0x130 kernel/locking/mutex-debug.c:103
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 22475 Comm: syz-executor199 Not tainted 4.19.170-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x17c/0x226 lib/dump_stack.c:118
 panic+0x1cd/0x375 kernel/panic.c:186
 __warn.cold.7+0x1b/0x36 kernel/panic.c:541
 report_bug+0x1a4/0x200 lib/bug.c:186
 fixup_bug arch/x86/kernel/traps.c:178 [inline]
 do_error_trap+0x200/0x350 arch/x86/kernel/traps.c:296
 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1038
RIP: 0010:mutex_destroy+0xf3/0x130 kernel/locking/mutex-debug.c:103
Code: 03 38 d0 7c 04 84 d2 75 49 8b 05 38 c2 7a 0a 85 c0 0f 85 63 ff ff ff 48 c7 c6 e0 5c 09 88 48 c7 c7 20 5d 09 88 e8 3c 5f 39 06 <0f> 0b e9 49 ff ff ff e8 e1 e0 45 00 e9 35 ff ff ff e8 97 e1 45 00
RSP: 0018:ffff8881d674fdb8 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff8881ce5d8f40 RCX: 0000000000000000
RDX: 1ffffffff1322461 RSI: 0000000000000004 RDI: 0000000000000286
RBP: ffff8881d674fdc0 R08: fffffbfff132e6f9 R09: fffffbfff132e6f8
R10: fffffbfff132e6f8 R11: ffffffff899737c3 R12: ffff8881ce5d8f40
R13: ffff8881ce5d8e90 R14: ffffffff8c54b280 R15: 0000000000000000
 ww_mutex_destroy include/linux/ww_mutex.h:358 [inline]
 reservation_object_fini include/linux/reservation.h:129 [inline]
 dma_buf_release+0x456/0x560 drivers/dma-buf/dma-buf.c:77
 __fput+0x249/0x7f0 fs/file_table.c:278
 ____fput+0x9/0x10 fs/file_table.c:309
 task_work_run+0x108/0x180 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:193 [inline]
 exit_to_usermode_loop+0x185/0x1e0 arch/x86/entry/common.c:167
 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
 do_syscall_64+0x413/0x4e0 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x44a6c9
Code: e8 0c e8 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb ca fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f3683f7edb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: 0000000000000000 RBX: 00000000006dbc68 RCX: 000000000044a6c9
RDX: 0000000020000040 RSI: 00000000c00464b4 RDI: 0000000000000005
RBP: 00000000006dbc60 R08: 00007f3683f7f700 R09: 0000000000000000
R10: 00007f3683f7f700 R11: 0000000000000246 R12: 00000000006dbc6c
R13: 00007fffa7bf2edf R14: 00007f3683f7f9c0 R15: 0000000000000001
Kernel Offset: disabled
Rebooting in 86400 seconds..