bisecting cause commit starting from 34d1d36073ea4d4c532e8c8345627a9702be799e building syzkaller on 0fc5c330fea4b4129567aaa44ea5a134cb850bbb testing commit 34d1d36073ea4d4c532e8c8345627a9702be799e compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 54523d3a490ee113c2190cdf4400f5c41c6e6f22fa86c30af4f85a8464c568c2 all runs: crashed: general protection fault in do_mpage_readpage testing release v5.18 testing commit 4b0986a3613c92f4ec1bdc7f60ec66fea135991f compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: b8fcb344fbd58b01408be984744d7237cf54a6f99aa221d59d390a53f5da44bd all runs: OK # git bisect start 34d1d36073ea4d4c532e8c8345627a9702be799e 4b0986a3613c92f4ec1bdc7f60ec66fea135991f Bisecting: 9729 revisions left to test after this (roughly 13 steps) [bf9095424d027e942e1d1ee74977e17b7df8e455] Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm testing commit bf9095424d027e942e1d1ee74977e17b7df8e455 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: b4f2eafa33e89a42a217ac5523f9ee6a143cc523bafe091a0637d8c072cb8a19 all runs: OK # git bisect good bf9095424d027e942e1d1ee74977e17b7df8e455 Bisecting: 4868 revisions left to test after this (roughly 12 steps) [6c0d09d9374c025f503d33bcef5f656e3f1dd349] Merge branch 'dt-bindings-dp83867-add-binding-for-io_impedance_ctrl-nvmem-cell' testing commit 6c0d09d9374c025f503d33bcef5f656e3f1dd349 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 6ec22c0637e522156ef4c37d993a09eba26c4fa684f548bd50bb5d3ea88ab0b6 all runs: OK # git bisect good 6c0d09d9374c025f503d33bcef5f656e3f1dd349 Bisecting: 2453 revisions left to test after this (roughly 11 steps) [3d76d093616b3dde3626ad2b910612dbb6c8b2b1] Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git testing commit 3d76d093616b3dde3626ad2b910612dbb6c8b2b1 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: cc1a341340ea242842580799d637349c026bafd9c62d2e83284a909408e542db run #0: basic kernel testing failed: BUG: program execution failed: executor NUM: failed to write control pipe: write |NUM: broken pipe run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect good 3d76d093616b3dde3626ad2b910612dbb6c8b2b1 Bisecting: 1224 revisions left to test after this (roughly 10 steps) [55a7c9596399b1f21d626cd1eed933e98b6a690f] Merge branch 'driver-core-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core.git testing commit 55a7c9596399b1f21d626cd1eed933e98b6a690f compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 7113e4d8534004f8503c073179efab5ab8f8aae9d9153ebc5e50c52cad652cdc run #0: basic kernel testing failed: BUG: program execution failed: executor NUM: failed to write control pipe: write |NUM: broken pipe run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect good 55a7c9596399b1f21d626cd1eed933e98b6a690f Bisecting: 608 revisions left to test after this (roughly 9 steps) [4074f61c3d5063e91c2675cbae26ac4bda897f8d] Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git testing commit 4074f61c3d5063e91c2675cbae26ac4bda897f8d compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: c4fd9f00f020a3bfbad2cb9280480aebc1d7d15d40cbf08126e61353a441b459 all runs: OK # git bisect good 4074f61c3d5063e91c2675cbae26ac4bda897f8d Bisecting: 306 revisions left to test after this (roughly 8 steps) [a2fa9869735edad0df54317d72667c0f27e55e20] Merge branch 'mm-stable' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm testing commit a2fa9869735edad0df54317d72667c0f27e55e20 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: cee63d6a1ce49fae9c6b1a6d2b975dc203994ab8c23aa2a475ab1815ab8a79d0 all runs: crashed: general protection fault in do_mpage_readpage # git bisect bad a2fa9869735edad0df54317d72667c0f27e55e20 Bisecting: 152 revisions left to test after this (roughly 7 steps) [1896689323449678ff1045b7b3ecca77a810bf0b] Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random.git testing commit 1896689323449678ff1045b7b3ecca77a810bf0b compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 518f19fead139786aae8938639f4763f91bc12d6baa1f89514099207bcc2d70b all runs: OK # git bisect good 1896689323449678ff1045b7b3ecca77a810bf0b Bisecting: 76 revisions left to test after this (roughly 6 steps) [a8a519aa8bf3cbc4dc95f68c0e513f2c7dec592d] mm/folio-compat: Remove migration compatibility functions testing commit a8a519aa8bf3cbc4dc95f68c0e513f2c7dec592d compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: b0ce5d8754cf50e38d45af1711e0150cb40379545de7a9fc336229408615f1f0 all runs: crashed: general protection fault in do_mpage_readpage # git bisect bad a8a519aa8bf3cbc4dc95f68c0e513f2c7dec592d Bisecting: 37 revisions left to test after this (roughly 5 steps) [20f75f987eadd9f96ad4145c0ee8c26084d33834] iomap: Remove test for folio error testing commit 20f75f987eadd9f96ad4145c0ee8c26084d33834 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 703afedf56ad0ed7d00dc5cc8cb192a771b614185c98ec3390f8562ffac8f2c9 all runs: crashed: general protection fault in do_mpage_readpage # git bisect bad 20f75f987eadd9f96ad4145c0ee8c26084d33834 Bisecting: 18 revisions left to test after this (roughly 4 steps) [30f5b4233793e0818d9d32c7792cc7644f819bc3] filemap: Move 'filler' case to the end of do_read_cache_folio() testing commit 30f5b4233793e0818d9d32c7792cc7644f819bc3 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 11f314657666eedb880db22d754befb3c9e552359a55bf55637595fe4efb7f2c all runs: crashed: general protection fault in do_mpage_readpage # git bisect bad 30f5b4233793e0818d9d32c7792cc7644f819bc3 Bisecting: 9 revisions left to test after this (roughly 3 steps) [6413b04f18557d78999dda4be0ca9fcdfe14df69] buffer: Convert clean_bdev_aliases() to use filemap_get_folios() testing commit 6413b04f18557d78999dda4be0ca9fcdfe14df69 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: d93882f58d84e9d9593519c783088d79cef5cbe5453943f03a1b3e96c2f8d8b9 all runs: crashed: general protection fault in do_mpage_readpage # git bisect bad 6413b04f18557d78999dda4be0ca9fcdfe14df69 Bisecting: 4 revisions left to test after this (roughly 2 steps) [4b3c772a8ca2aae118891ed781173566d4057266] filemap: Fix serialization adding transparent huge pages to page cache testing commit 4b3c772a8ca2aae118891ed781173566d4057266 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: dad0bff2691e6b280e873cab896bfa72c0c40b95134909a5fd626d579117e432 all runs: OK # git bisect good 4b3c772a8ca2aae118891ed781173566d4057266 Bisecting: 2 revisions left to test after this (roughly 1 step) [6058a318791fb17e2a9621f3cfe47b709224e516] hugetlb: Convert huge_add_to_page_cache() to use a folio testing commit 6058a318791fb17e2a9621f3cfe47b709224e516 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 9d2aa99584458a84fc219a0ab4f655a8ae0cf0f6b1411f3575ef0b2a09e40c23 all runs: crashed: general protection fault in do_mpage_readpage # git bisect bad 6058a318791fb17e2a9621f3cfe47b709224e516 Bisecting: 0 revisions left to test after this (roughly 0 steps) [4c27dc762d7b60fa23c6eab2309ca6fc625588dd] mpage: Convert do_mpage_readpage() to use a folio testing commit 4c27dc762d7b60fa23c6eab2309ca6fc625588dd compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: cdc9a15c60f1ae8cd2075ea398bb963dccb294b6247a70035bb7be8953d9f081 all runs: crashed: general protection fault in do_mpage_readpage # git bisect bad 4c27dc762d7b60fa23c6eab2309ca6fc625588dd 4c27dc762d7b60fa23c6eab2309ca6fc625588dd is the first bad commit commit 4c27dc762d7b60fa23c6eab2309ca6fc625588dd Author: Matthew Wilcox (Oracle) Date: Fri Jun 10 22:58:24 2022 -0400 mpage: Convert do_mpage_readpage() to use a folio Pass in a folio from mpage_readahead(). Also convert map_buffer_to_page() to map_buffer_to_folio(). There's still no support for large folios here; there are numerous places which depend on the folio being PAGE_SIZE. The VM_BUG_ON prevents anyone from thinking that it will work. Signed-off-by: Matthew Wilcox (Oracle) fs/mpage.c | 77 +++++++++++++++++++++++++++++++------------------------------- 1 file changed, 39 insertions(+), 38 deletions(-) culprit signature: cdc9a15c60f1ae8cd2075ea398bb963dccb294b6247a70035bb7be8953d9f081 parent signature: dad0bff2691e6b280e873cab896bfa72c0c40b95134909a5fd626d579117e432 revisions tested: 16, total time: 3h23m10.101142676s (build: 1h47m13.616009994s, test: 1h34m15.639807495s) first bad commit: 4c27dc762d7b60fa23c6eab2309ca6fc625588dd mpage: Convert do_mpage_readpage() to use a folio recipients (to): ["linux-kernel@vger.kernel.org" "willy@infradead.org"] recipients (cc): ["linux-fsdevel@vger.kernel.org" "viro@zeniv.linux.org.uk"] crash: general protection fault in do_mpage_readpage loop0: detected capacity change from 0 to 8191 ntfs3: loop0: Mark volume as dirty due to NTFS errors general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 4094 Comm: syz-executor.0 Not tainted 5.19.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:map_buffer_to_folio fs/mpage.c:107 [inline] RIP: 0010:do_mpage_readpage+0xdaa/0x1660 fs/mpage.c:228 Code: 48 8b 68 28 48 85 ed 0f 84 08 02 00 00 48 ba 00 00 00 00 00 fc ff df 49 89 ed 45 31 ff eb 26 49 8d 7d 08 48 89 f8 48 c1 e8 03 <80> 3c 10 00 0f 85 65 05 00 00 4d 8b 6d 08 41 83 c7 01 4c 39 ed 0f RSP: 0018:ffffc90002def7e0 EFLAGS: 00010202 RAX: 0000000000000001 RBX: 0000000000000002 RCX: 0000000000000000 RDX: dffffc0000000000 RSI: 0000000000000004 RDI: 0000000000000008 RBP: 0000000000000000 R08: 0000000000000000 R09: ffff8880732839eb R10: ffffed100e65073d R11: 0000000000000001 R12: ffffc90002def988 R13: 0000000000000000 R14: ffffc90002def9a8 R15: 0000000000000000 FS: 00007f9ce51ef700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9ce51f0000 CR3: 0000000024753000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mpage_read_folio+0x99/0x120 fs/mpage.c:378 do_read_cache_folio+0x1da/0x5b0 mm/filemap.c:3524 do_read_cache_page mm/filemap.c:3602 [inline] read_cache_page+0x48/0x1f0 mm/filemap.c:3611 read_mapping_page include/linux/pagemap.h:759 [inline] ntfs_map_page+0xf/0x500 fs/ntfs3/ntfs_fs.h:897 ntfs_fill_super+0x1f2e/0x2f90 fs/ntfs3/super.c:1142 get_tree_bdev+0x398/0x680 fs/super.c:1292 vfs_get_tree+0x7f/0x2c0 fs/super.c:1497 do_new_mount fs/namespace.c:3040 [inline] path_mount+0x7e8/0x1a40 fs/namespace.c:3370 do_mount fs/namespace.c:3383 [inline] __do_sys_mount fs/namespace.c:3591 [inline] __se_sys_mount fs/namespace.c:3568 [inline] __x64_sys_mount+0x1f5/0x260 fs/namespace.c:3568 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7f9ce408a63a Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f9ce51eef88 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 00007f9ce408a63a RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9ce51eefe0 RBP: 00007f9ce51ef020 R08: 00007f9ce51ef020 R09: 0000000020000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000000 R13: 0000000020000100 R14: 00007f9ce51eefe0 R15: 000000002007c8e0 Modules linked in: ---------------- Code disassembly (best guess): 0: 48 8b 68 28 mov 0x28(%rax),%rbp 4: 48 85 ed test %rbp,%rbp 7: 0f 84 08 02 00 00 je 0x215 d: 48 ba 00 00 00 00 00 movabs $0xdffffc0000000000,%rdx 14: fc ff df 17: 49 89 ed mov %rbp,%r13 1a: 45 31 ff xor %r15d,%r15d 1d: eb 26 jmp 0x45 1f: 49 8d 7d 08 lea 0x8(%r13),%rdi 23: 48 89 f8 mov %rdi,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 80 3c 10 00 cmpb $0x0,(%rax,%rdx,1) <-- trapping instruction 2e: 0f 85 65 05 00 00 jne 0x599 34: 4d 8b 6d 08 mov 0x8(%r13),%r13 38: 41 83 c7 01 add $0x1,%r15d 3c: 4c 39 ed cmp %r13,%rbp 3f: 0f .byte 0xf