bisecting fixing commit since ff33472c282e209da54cbc0c7c1c06ddfcc93d33 building syzkaller on de453f342be9edcca7de5a41e153ced8ad7f1a70 testing commit ff33472c282e209da54cbc0c7c1c06ddfcc93d33 with gcc (GCC) 8.1.0 kernel signature: e28fbbf86b2bdaca07b31bac5be9d93ebf8ccaa2 run #0: crashed: KASAN: use-after-free Read in l2tp_session_create run #1: crashed: KASAN: use-after-free Read in l2tp_session_create run #2: crashed: WARNING: locking bug in do_ipv6_setsockopt run #3: crashed: KASAN: use-after-free Read in lock_sock_nested run #4: crashed: KASAN: use-after-free Read in l2tp_session_create run #5: crashed: KASAN: use-after-free Read in l2tp_session_create run #6: crashed: WARNING: locking bug in do_ipv6_setsockopt run #7: crashed: WARNING: locking bug in do_ipv6_setsockopt run #8: crashed: KASAN: use-after-free Read in lock_sock_nested run #9: crashed: KASAN: use-after-free Read in lock_sock_nested testing current HEAD c04fc6fa5c96ec57316527b2228fa31f26494abe testing commit c04fc6fa5c96ec57316527b2228fa31f26494abe with gcc (GCC) 8.1.0 kernel signature: 9aae41d90ad0e125677077e83b60b25a68217611 run #0: crashed: WARNING: locking bug in do_ipv6_setsockopt run #1: crashed: WARNING: locking bug in do_ipv6_setsockopt run #2: crashed: KASAN: use-after-free Read in l2tp_session_create run #3: crashed: WARNING: locking bug in do_ipv6_setsockopt run #4: crashed: KASAN: use-after-free Write in pppol2tp_connect run #5: crashed: WARNING: locking bug in do_ipv6_setsockopt run #6: crashed: WARNING: locking bug in do_ipv6_setsockopt run #7: crashed: WARNING: locking bug in do_ipv6_setsockopt run #8: crashed: KASAN: use-after-free Read in lock_sock_nested run #9: crashed: WARNING: locking bug in do_ipv6_setsockopt revisions tested: 2, total time: 30m18.008727943s (build: 16m16.749393119s, test: 13m8.793681911s) the crash still happens on HEAD commit msg: Linux 4.14.165 crash: WARNING: locking bug in do_ipv6_setsockopt l2tp_core: tunl 4: sockfd_lookup(fd=6) returned -9 ------------[ cut here ]------------ WARNING: CPU: 1 PID: 9806 at kernel/locking/lockdep.c:722 arch_local_save_flags arch/x86/include/asm/paravirt.h:774 [inline] WARNING: CPU: 1 PID: 9806 at kernel/locking/lockdep.c:722 look_up_lock_class kernel/locking/lockdep.c:713 [inline] WARNING: CPU: 1 PID: 9806 at kernel/locking/lockdep.c:722 register_lock_class+0xfb6/0x1cd0 kernel/locking/lockdep.c:756 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 9806 Comm: syz-executor.4 Not tainted 4.14.165-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 kobject: 'loop1' (ffff8880a49ef260): kobject_uevent_env Call Trace: kobject: 'loop1' (ffff8880a49ef260): fill_kobj_path: path = '/devices/virtual/block/loop1' __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0xf7/0x13b lib/dump_stack.c:58 panic+0x1b0/0x358 kernel/panic.c:183 __warn.cold.8+0x25/0x2c kernel/panic.c:547 kobject: 'loop1' (ffff8880a49ef260): kobject_uevent_env report_bug+0x1a4/0x1f3 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:177 [inline] do_error_trap+0x1bd/0x310 arch/x86/kernel/traps.c:295 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:314 invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:963 RIP: 0010:look_up_lock_class kernel/locking/lockdep.c:722 [inline] RIP: 0010:register_lock_class+0xfb6/0x1cd0 kernel/locking/lockdep.c:756 RSP: 0018:ffff88806fd8f590 EFLAGS: 00010087 kobject: 'loop1' (ffff8880a49ef260): fill_kobj_path: path = '/devices/virtual/block/loop1' RAX: dffffc0000000000 RBX: ffffffff88f00f20 RCX: 1ffff1100dfb1ebd RDX: 1ffff1100e3a7b1f RSI: 0000000000000000 RDI: ffff888071d3d8f8 RBP: ffff88806fd8f670 R08: ffff888071d3d8e0 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff89380840 R13: 1ffff1100dfb1ebd R14: ffffffff870dabc0 R15: ffffffff88f00f20 kobject: 'loop1' (ffff8880a49ef260): kobject_uevent_env __lock_acquire+0x14f/0x4500 kernel/locking/lockdep.c:3374 kobject: 'loop1' (ffff8880a49ef260): fill_kobj_path: path = '/devices/virtual/block/loop1' kobject: 'loop1' (ffff8880a49ef260): kobject_uevent_env kobject: 'loop1' (ffff8880a49ef260): fill_kobj_path: path = '/devices/virtual/block/loop1' lock_acquire+0x173/0x400 kernel/locking/lockdep.c:3994 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline] _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:176 spin_lock_bh include/linux/spinlock.h:322 [inline] lock_sock_nested+0x3a/0x100 net/core/sock.c:2762 lock_sock include/net/sock.h:1467 [inline] do_ipv6_setsockopt.isra.8+0x2e0/0x3270 net/ipv6/ipv6_sockglue.c:167 ipv6_setsockopt+0x6e/0xf0 net/ipv6/ipv6_sockglue.c:925 udpv6_setsockopt+0x16/0x30 net/ipv6/udp.c:1459 sock_common_setsockopt+0x73/0xf0 net/core/sock.c:2968 SYSC_setsockopt net/socket.c:1865 [inline] SyS_setsockopt+0x130/0x1f0 net/socket.c:1844 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x459829 RSP: 002b:00007fb8b87f0c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000459829 RDX: 0000000000000023 RSI: 0000000000000029 RDI: 0000000000000005 RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb8b87f16d4 R13: 00000000004ced30 R14: 00000000004dd678 R15: 00000000ffffffff Kernel Offset: disabled Rebooting in 86400 seconds..