bisecting cause commit starting from 1a323ea5356edbb3073dc59d51b9e6b86908857d building syzkaller on a34e2c332411388ed2b3f6f1a3acdc062feceb79 testing commit 1a323ea5356edbb3073dc59d51b9e6b86908857d with gcc (GCC) 8.1.0 kernel signature: 6bd4f3e80786dc1ba3816c532a628d4bf54311cea83192f5e522b71e3edb0ead all runs: crashed: kernel BUG at mm/hugetlb.c:LINE! testing release v5.6 testing commit 7111951b8d4973bda27ff663f2cf18b663d15b48 with gcc (GCC) 8.1.0 kernel signature: c09892425b4f7c3b91d4da9dad67b13bb0b54db7a382ad0a8eb9619e2bf421c4 all runs: crashed: kernel BUG at mm/hugetlb.c:LINE! testing release v5.5 testing commit d5226fa6dbae0569ee43ecfc08bdcd6770fc4755 with gcc (GCC) 8.1.0 kernel signature: 9219a60c37d8de55985c36f5ea7590da3b4a7df3f7a565f339581bca19b00362 all runs: crashed: kernel BUG at mm/hugetlb.c:LINE! testing release v5.4 testing commit 219d54332a09e8d8741c1e1982f5eae56099de85 with gcc (GCC) 8.1.0 kernel signature: e60648ad292ff5cfd8cc5cd9823c738c59972788de8809b20c135dde3afd50f1 all runs: crashed: kernel BUG at mm/hugetlb.c:LINE! testing release v5.3 testing commit 4d856f72c10ecb060868ed10ff1b1453943fc6c8 with gcc (GCC) 8.1.0 kernel signature: 6d819fee5d8065a07570a092c1e85e7b83d31180084f6d5198841d2844cbc194 all runs: crashed: kernel BUG at mm/hugetlb.c:LINE! testing release v5.2 testing commit 0ecfebd2b52404ae0c54a878c872bb93363ada36 with gcc (GCC) 8.1.0 kernel signature: 69598d1e3706a7a64e631ecf23bb08e7dafb3ecc4428ca6f5b8a5641e8b134b9 all runs: crashed: kernel BUG at mm/hugetlb.c:LINE! testing release v5.1 testing commit e93c9c99a629c61837d5a7fc2120cd2b6c70dbdd with gcc (GCC) 8.1.0 kernel signature: ee6e7497969e57e1a59e103b3bfa0cfbeb382bbfa5d6cc33d0f1fa312263f90f all runs: crashed: kernel BUG at mm/hugetlb.c:LINE! testing release v5.0 testing commit 1c163f4c7b3f621efff9b28a47abb36f7378d783 with gcc (GCC) 8.1.0 kernel signature: 38b6d57c16e4fc90cde94657ff1f9a5f88dc0898bdf433173e287553e6d54ad6 all runs: crashed: kernel BUG at mm/hugetlb.c:LINE! testing release v4.20 testing commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be with gcc (GCC) 8.1.0 kernel signature: 3eec4357e9765dd13db24952fbd64b755ca2b457cecda575c79772f30edca6f3 all runs: crashed: kernel BUG at mm/hugetlb.c:LINE! testing release v4.19 testing commit 84df9525b0c27f3ebc2ebb1864fa62a97fdedb7d with gcc (GCC) 8.1.0 kernel signature: 74ab287bcc36352f3257caccb95ae7a2ed4b48a6462e009592a89d104e7e40de all runs: crashed: kernel BUG at mm/hugetlb.c:LINE! testing release v4.18 testing commit 94710cac0ef4ee177a63b5227664b38c95bbf703 with gcc (GCC) 8.1.0 kernel signature: f528205dbb092ba51b4867cf5a669374b72700117960e08bc89d578102d3e429 all runs: OK # git bisect start 84df9525b0c27f3ebc2ebb1864fa62a97fdedb7d 94710cac0ef4ee177a63b5227664b38c95bbf703 Bisecting: 7596 revisions left to test after this (roughly 13 steps) [db06f826ec12bf0701ea7fc0a3c0aa00b84417c8] Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux testing commit db06f826ec12bf0701ea7fc0a3c0aa00b84417c8 with gcc (GCC) 8.1.0 kernel signature: 3cc37b28173be2e9e6d494c5d4e4d79607108f4520dbd1ad70033a0c5016550c all runs: crashed: BUG: corrupted list in inode_insert5 # git bisect bad db06f826ec12bf0701ea7fc0a3c0aa00b84417c8 Bisecting: 4493 revisions left to test after this (roughly 12 steps) [0a957467c5fd46142bc9c52758ffc552d4c5e2f7] x86: i8259: Add missing include file testing commit 0a957467c5fd46142bc9c52758ffc552d4c5e2f7 with gcc (GCC) 8.1.0 kernel signature: b1b4d9a7102c20f710937bf8b754b1c228d4d034cfe12ae79d6a3edcee751a68 all runs: crashed: BUG: corrupted list in inode_insert5 # git bisect bad 0a957467c5fd46142bc9c52758ffc552d4c5e2f7 Bisecting: 1595 revisions left to test after this (roughly 11 steps) [958f338e96f874a0d29442396d6adf9c1e17aa2d] Merge branch 'l1tf-final' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip testing commit 958f338e96f874a0d29442396d6adf9c1e17aa2d with gcc (GCC) 8.1.0 kernel signature: e130eaa84e2976235e87bbfe5b163533604f2f9a2c30f2d1bef05a95d2ccaa92 all runs: crashed: BUG: corrupted list in inode_insert5 # git bisect bad 958f338e96f874a0d29442396d6adf9c1e17aa2d Bisecting: 757 revisions left to test after this (roughly 10 steps) [85a0b791bc17f7a49280b33e2905d109c062a47b] Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux testing commit 85a0b791bc17f7a49280b33e2905d109c062a47b with gcc (GCC) 8.1.0 kernel signature: 11afc4b48953bfbf70e90d4ae5417d56e4fdd168653b03b181f27ad96ff2ef66 all runs: OK # git bisect good 85a0b791bc17f7a49280b33e2905d109c062a47b Bisecting: 324 revisions left to test after this (roughly 9 steps) [a1a4f841ec4585185c0e75bfae43a18b282dd316] Merge tag 'for-4.19-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux testing commit a1a4f841ec4585185c0e75bfae43a18b282dd316 with gcc (GCC) 8.1.0 kernel signature: e7b1e2f8e0709eeacf2188e4c4fa083b206f28dd7bfa76df6a29babd1293b990 all runs: crashed: BUG: corrupted list in inode_insert5 # git bisect bad a1a4f841ec4585185c0e75bfae43a18b282dd316 Bisecting: 221 revisions left to test after this (roughly 8 steps) [a66b4cd1e7163adb327838a3c81faaf6a9330d5a] Merge branch 'work.open3' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs testing commit a66b4cd1e7163adb327838a3c81faaf6a9330d5a with gcc (GCC) 8.1.0 kernel signature: 423f923fbd0d9efa35cf2787b03e5639633dc0a81867233b5fa8f1fa73efc654 all runs: OK # git bisect good a66b4cd1e7163adb327838a3c81faaf6a9330d5a Bisecting: 110 revisions left to test after this (roughly 7 steps) [ac8a866af17edc692b50cbdd2aec612de4205c8f] btrfs: qgroup: Drop root parameter from update_qgroup_limit_item testing commit ac8a866af17edc692b50cbdd2aec612de4205c8f with gcc (GCC) 8.1.0 kernel signature: d4c373d77e7c0c1e2025b258b68281c144eddbb4383b4fbfe9cb826f7f6b2399 all runs: OK # git bisect good ac8a866af17edc692b50cbdd2aec612de4205c8f Bisecting: 55 revisions left to test after this (roughly 6 steps) [6025c19fb208e93b99eafc304e7f16160e49fc88] btrfs: Remove fs_info from btrfs_add_root_ref testing commit 6025c19fb208e93b99eafc304e7f16160e49fc88 with gcc (GCC) 8.1.0 kernel signature: 91c05d76c229e24cf0cc1dc63f97e4fb593121a462a770b7a658eec1edbb49aa all runs: OK # git bisect good 6025c19fb208e93b99eafc304e7f16160e49fc88 Bisecting: 30 revisions left to test after this (roughly 5 steps) [f2be269897708700ed9b2a96f695348a10a003e8] Merge branch 'work.aio' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs testing commit f2be269897708700ed9b2a96f695348a10a003e8 with gcc (GCC) 8.1.0 kernel signature: 7117384e079f456f3ae6fae772819095548958c19761c99b27db676e264fc838 all runs: crashed: BUG: corrupted list in inode_insert5 # git bisect bad f2be269897708700ed9b2a96f695348a10a003e8 Bisecting: 12 revisions left to test after this (roughly 4 steps) [c7b15a8657da7f8d11269c7cc3d8beef10d26b43] jfs: don't bother with make_bad_inode() in ialloc() testing commit c7b15a8657da7f8d11269c7cc3d8beef10d26b43 with gcc (GCC) 8.1.0 kernel signature: 6ea1a6fbc8d52277efd0d5e51e08de323cf82cfa1286da26a25b505cbbc3dcae all runs: crashed: BUG: corrupted list in inode_insert5 # git bisect bad c7b15a8657da7f8d11269c7cc3d8beef10d26b43 Bisecting: 5 revisions left to test after this (roughly 3 steps) [5c1a68a358f94b9ac2e33183327bc04f207feed2] udf: switch to discard_new_inode() testing commit 5c1a68a358f94b9ac2e33183327bc04f207feed2 with gcc (GCC) 8.1.0 kernel signature: 57f8021f54df2a2318ca0ce862d2d2ff8df07edd78deecc85479538c55d1aae3 all runs: OK # git bisect good 5c1a68a358f94b9ac2e33183327bc04f207feed2 Bisecting: 2 revisions left to test after this (roughly 2 steps) [e950564b97fd0f541b02eb207685d0746f5ecf29] vfs: don't evict uninitialized inode testing commit e950564b97fd0f541b02eb207685d0746f5ecf29 with gcc (GCC) 8.1.0 kernel signature: dfe86f77203749311c1078b01d6ebf08673094584f03b29748fdd47146768332 all runs: crashed: BUG: corrupted list in inode_insert5 # git bisect bad e950564b97fd0f541b02eb207685d0746f5ecf29 Bisecting: 0 revisions left to test after this (roughly 1 step) [a6cbedfa8783b42b9272c05297865bdb501005cb] jfs: switch to discard_new_inode() testing commit a6cbedfa8783b42b9272c05297865bdb501005cb with gcc (GCC) 8.1.0 kernel signature: 3b7f9d7bb8ae11bc4080aa53c0ae30c2e4dd18052095c77eb7c2a3328cddff90 all runs: OK # git bisect good a6cbedfa8783b42b9272c05297865bdb501005cb e950564b97fd0f541b02eb207685d0746f5ecf29 is the first bad commit commit e950564b97fd0f541b02eb207685d0746f5ecf29 Author: Miklos Szeredi Date: Tue Jul 24 15:01:55 2018 +0200 vfs: don't evict uninitialized inode iput() ends up calling ->evict() on new inode, which is not yet initialized by owning fs. So use destroy_inode() instead. Add to sb->s_inodes list only if inode is not in I_CREATING state (meaning that it wasn't allocated with new_inode(), which already does the insertion). Reported-by: Al Viro Signed-off-by: Miklos Szeredi Fixes: 80ea09a002bf ("vfs: factor out inode_insert5()") Signed-off-by: Al Viro fs/inode.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) culprit signature: dfe86f77203749311c1078b01d6ebf08673094584f03b29748fdd47146768332 parent signature: 3b7f9d7bb8ae11bc4080aa53c0ae30c2e4dd18052095c77eb7c2a3328cddff90 revisions tested: 24, total time: 4h22m42.475462799s (build: 2h18m4.592956823s, test: 2h2m45.753976439s) first bad commit: e950564b97fd0f541b02eb207685d0746f5ecf29 vfs: don't evict uninitialized inode cc: ["linux-fsdevel@vger.kernel.org" "linux-kernel@vger.kernel.org" "mszeredi@redhat.com" "viro@zeniv.linux.org.uk"] crash: BUG: corrupted list in inode_insert5 IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready overlayfs: upper fs does not support tmpfile. overlayfs: upper fs does not support xattr, falling back to index=off. list_add double add: new=ffff8800741066f0, prev=ffff88008e955078, next=ffff8800741066f0. ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:31! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 7706 Comm: syz-executor.4 Not tainted 4.18.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__list_add_valid+0xaa/0xb0 lib/list_debug.c:29 Code: e8 eb a9 48 89 f7 48 89 75 e8 e8 81 e0 65 fe 48 8b 75 e8 eb bb 48 89 f2 48 89 d9 4c 89 e6 48 c7 c7 c0 fd 45 87 e8 85 4f 24 fe <0f> 0b 0f 1f 40 00 48 b8 00 00 00 00 00 fc ff df 55 48 89 e5 41 55 RSP: 0018:ffff880090baf4e0 EFLAGS: 00010282 RAX: 0000000000000058 RBX: ffff8800741066f0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8745fb80 RDI: ffffffff89f18be0 RBP: ffff880090baf4f8 R08: ffffed0015da4f99 R09: ffffed0015da4f98 R10: ffffed0015da4f98 R11: ffff8800aed27cc7 R12: ffff8800741066f0 R13: ffff880074106568 R14: ffff8800741066f0 R15: ffff8800741066f0 FS: 00007fab62b76700(0000) GS:ffff8800aed00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fff9b717b20 CR3: 000000008f434000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __list_add include/linux/list.h:60 [inline] list_add include/linux/list.h:79 [inline] inode_sb_list_add+0xa4/0x200 fs/inode.c:444 inode_insert5+0x233/0x3d0 fs/inode.c:1088 ovl_iget5 fs/overlayfs/inode.c:755 [inline] ovl_get_inode+0x22a/0xd57 fs/overlayfs/inode.c:788 ovl_instantiate+0x10b/0x250 fs/overlayfs/dir.c:260 ovl_create_upper fs/overlayfs/dir.c:318 [inline] ovl_create_or_link+0x4d9/0xe70 fs/overlayfs/dir.c:575 ovl_create_object+0x188/0x230 fs/overlayfs/dir.c:607 ovl_create+0x1e/0x20 fs/overlayfs/dir.c:621 lookup_open+0x113d/0x1c80 fs/namei.c:3220 do_last fs/namei.c:3311 [inline] path_openat+0xdac/0x3720 fs/namei.c:3540 do_filp_open+0x177/0x250 fs/namei.c:3574 do_sys_open+0x1dd/0x360 fs/open.c:1101 __do_sys_openat fs/open.c:1128 [inline] __se_sys_openat fs/open.c:1122 [inline] __x64_sys_openat+0x98/0xf0 fs/open.c:1122 do_syscall_64+0xd0/0x4d0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45c849 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fab62b75c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007fab62b766d4 RCX: 000000000045c849 RDX: 000000000000275a RSI: 0000000020000100 RDI: ffffffffffffff9c RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 000000000000078c R14: 00000000004ca3ee R15: 000000000076bf0c Modules linked in: ---[ end trace 60145228b5809573 ]--- RIP: 0010:__list_add_valid+0xaa/0xb0 lib/list_debug.c:29 Code: e8 eb a9 48 89 f7 48 89 75 e8 e8 81 e0 65 fe 48 8b 75 e8 eb bb 48 89 f2 48 89 d9 4c 89 e6 48 c7 c7 c0 fd 45 87 e8 85 4f 24 fe <0f> 0b 0f 1f 40 00 48 b8 00 00 00 00 00 fc ff df 55 48 89 e5 41 55 RSP: 0018:ffff880090baf4e0 EFLAGS: 00010282 RAX: 0000000000000058 RBX: ffff8800741066f0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8745fb80 RDI: ffffffff89f18be0 RBP: ffff880090baf4f8 R08: ffffed0015da4f99 R09: ffffed0015da4f98 R10: ffffed0015da4f98 R11: ffff8800aed27cc7 R12: ffff8800741066f0 R13: ffff880074106568 R14: ffff8800741066f0 R15: ffff8800741066f0 FS: 00007fab62b76700(0000) GS:ffff8800aed00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fff9b717b20 CR3: 000000008f434000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400