bisecting fixing commit since 3f2ecb86cb909da0b9157fd2952ad79924cbe5ae building syzkaller on 04201c0669446145fd9c347c5538da0ca13ff29b testing commit 3f2ecb86cb909da0b9157fd2952ad79924cbe5ae with gcc (GCC) 8.4.1 20210217 kernel signature: 340f4b26c875c94698e31932b70d1e71bf97f6c2bdc3b34977fc83404e3d6b80 all runs: crashed: inconsistent lock state in free_huge_page testing current HEAD 3242aa3a635c0958671ee1e4b0958dcc7c4e5c79 testing commit 3242aa3a635c0958671ee1e4b0958dcc7c4e5c79 with gcc (GCC) 8.4.1 20210217 kernel signature: 0641dc6ef7daf097458e344872d7a0cc132ba55d9fd7598cd2ab031365006e3f all runs: crashed: inconsistent lock state in free_huge_page revisions tested: 2, total time: 22m20.196717258s (build: 15m3.595175977s, test: 6m16.111030369s) the crash still happens on HEAD commit msg: Linux 4.14.222 crash: inconsistent lock state in free_huge_page device veth0_macvtap entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): macvtap0: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1_macvtap: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready ================================ WARNING: inconsistent lock state 4.14.222-syzkaller #0 Not tainted -------------------------------- inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage. kworker/1:1/23 [HC1[1]:SC1[1]:HE0:SE0] takes: (hugetlb_lock){?.+.}, at: [] spin_lock include/linux/spinlock.h:317 [inline] (hugetlb_lock){?.+.}, at: [] free_huge_page mm/hugetlb.c:1290 [inline] (hugetlb_lock){?.+.}, at: [] free_huge_page+0x5a8/0x800 mm/hugetlb.c:1252 {HARDIRQ-ON-W} state was registered at: mark_irqflags kernel/locking/lockdep.c:3086 [inline] __lock_acquire+0xef4/0x42d0 kernel/locking/lockdep.c:3448 lock_acquire+0x17e/0x3e0 kernel/locking/lockdep.c:3998 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:152 spin_lock include/linux/spinlock.h:317 [inline] hugetlb_overcommit_handler+0x25d/0x4f0 mm/hugetlb.c:2991 proc_sys_call_handler.isra.20+0x162/0x1f0 fs/proc/proc_sysctl.c:598 proc_sys_write+0x37/0x60 fs/proc/proc_sysctl.c:616 __vfs_write+0xdb/0x840 fs/read_write.c:480 vfs_write+0x150/0x4f0 fs/read_write.c:544 SYSC_write fs/read_write.c:590 [inline] SyS_write+0x100/0x250 fs/read_write.c:582 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb irq event stamp: 95285 hardirqs last enabled at (95284): [] __do_softirq+0x1e1/0x9a2 kernel/softirq.c:272 hardirqs last disabled at (95285): [] common_interrupt+0x95/0x9a arch/x86/entry/entry_64.S:576 softirqs last enabled at (95258): [] rfc2863_policy+0x127/0x240 net/core/link_watch.c:75 softirqs last disabled at (95283): [] invoke_softirq kernel/softirq.c:368 [inline] softirqs last disabled at (95283): [] irq_exit+0x15f/0x1a0 kernel/softirq.c:409 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(hugetlb_lock); lock(hugetlb_lock); *** DEADLOCK *** 5 locks held by kworker/1:1/23: #0: ("events"){+.+.}, at: [] process_one_work+0x681/0x1620 kernel/workqueue.c:2087 #1: ((linkwatch_work).work){+.+.}, at: [] process_one_work+0x6b4/0x1620 kernel/workqueue.c:2091 #2: (rtnl_mutex){+.+.}, at: [] rtnl_lock+0x12/0x20 net/core/rtnetlink.c:72 #3: (console_lock){+.+.}, at: [] console_trylock_spinning kernel/printk/printk.c:1650 [inline] #3: (console_lock){+.+.}, at: [] vprintk_emit+0x1ab/0x4e0 kernel/printk/printk.c:1922 #4: (&(&virtscsi_vq->vq_lock)->rlock){-.-.}, at: [] virtscsi_vq_done+0x8d/0x120 drivers/scsi/virtio_scsi.c:219 stack backtrace: CPU: 1 PID: 23 Comm: kworker/1:1 Not tainted 4.14.222-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events linkwatch_event Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x14b/0x1e7 lib/dump_stack.c:58 print_usage_bug.cold.46+0x433/0x563 kernel/locking/lockdep.c:2589 valid_state kernel/locking/lockdep.c:2602 [inline] mark_lock_irq kernel/locking/lockdep.c:2796 [inline] mark_lock+0xc00/0x11a0 kernel/locking/lockdep.c:3194 mark_irqflags kernel/locking/lockdep.c:3069 [inline] __lock_acquire+0x1214/0x42d0 kernel/locking/lockdep.c:3448 lock_acquire+0x17e/0x3e0 kernel/locking/lockdep.c:3998 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:152 spin_lock include/linux/spinlock.h:317 [inline] free_huge_page mm/hugetlb.c:1290 [inline] free_huge_page+0x5a8/0x800 mm/hugetlb.c:1252 __put_compound_page+0x67/0xa0 mm/swap.c:95 __put_page+0x5d/0x280 mm/swap.c:111 put_page include/linux/mm.h:875 [inline] bio_check_pages_dirty+0x24d/0x470 block/bio.c:1794 dio_bio_complete+0x3d9/0x690 fs/direct-io.c:553 dio_bio_end_aio+0x41/0x430 fs/direct-io.c:358 bio_endio.part.11+0x23f/0x5d0 block/bio.c:1918 bio_endio+0x9/0x10 block/bio.c:1888 req_bio_endio block/blk-core.c:204 [inline] blk_update_request+0x284/0x9b0 block/blk-core.c:2765 scsi_end_request+0x74/0x940 drivers/scsi/scsi_lib.c:659 scsi_io_completion+0x99b/0x18c0 drivers/scsi/scsi_lib.c:885 scsi_finish_command+0x39d/0x560 drivers/scsi/scsi.c:248 scsi_softirq_done+0x2b2/0x360 drivers/scsi/scsi_lib.c:1671 __blk_mq_complete_request+0x2c6/0x640 block/blk-mq.c:571 blk_mq_complete_request+0x44/0x50 block/blk-mq.c:591 scsi_mq_done+0x61/0x260 drivers/scsi/scsi_lib.c:1979 virtscsi_complete_cmd+0x4eb/0x8d0 drivers/scsi/virtio_scsi.c:207 virtscsi_vq_done+0xa7/0x120 drivers/scsi/virtio_scsi.c:223 virtscsi_req_done+0xa1/0xc0 drivers/scsi/virtio_scsi.c:238 vring_interrupt+0x100/0x1c0 drivers/virtio/virtio_ring.c:954 __handle_irq_event_percpu+0xdc/0x6c0 kernel/irq/handle.c:147 handle_irq_event_percpu+0x64/0x120 kernel/irq/handle.c:187 handle_irq_event+0xa2/0x130 kernel/irq/handle.c:204 handle_edge_irq+0x206/0x780 kernel/irq/chip.c:770 generic_handle_irq_desc include/linux/irqdesc.h:159 [inline] handle_irq+0x37/0x50 arch/x86/kernel/irq_64.c:87 do_IRQ+0x98/0x1d0 arch/x86/kernel/irq.c:230 common_interrupt+0x9a/0x9a arch/x86/entry/entry_64.S:576 RIP: 0010:ffs arch/x86/include/asm/bitops.h:427 [inline] RIP: 0010:__do_softirq+0x20c/0x9a2 kernel/softirq.c:276 RSP: 0000:ffff8880ba707f28 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff6e RAX: 1ffffffff11e10bb RBX: ffff8880b562e600 RCX: 1ffff11016ac5de4 RDX: 0000000000000000 RSI: ffff8880b562ef00 RDI: ffff8880b562ee84 RBP: ffff8880ba707f98 R08: ffff8880b562ef20 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000 invoke_softirq kernel/softirq.c:368 [inline] irq_exit+0x15f/0x1a0 kernel/softirq.c:409 exiting_irq arch/x86/include/asm/apic.h:638 [inline] smp_apic_timer_interrupt+0x149/0x5d0 arch/x86/kernel/apic/apic.c:1106 apic_timer_interrupt+0x9a/0xa0 arch/x86/entry/entry_64.S:793 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline] RIP: 0010:console_unlock+0xabf/0xe50 kernel/printk/printk.c:2408 RSP: 0000:ffff8880b56478a0 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10 RAX: 1ffffffff11e10b9 RBX: 0000000000000200 RCX: 1ffff11016ac5de4 RDX: 0000000000000000 RSI: ffff8880b562ef00 RDI: 0000000000000286 RBP: ffff8880b5647918 R08: ffff8880b562ef20 R09: 0000000000000000 R10: 0000000000000000 R11: dffffc0000000000 R12: 0000000000000000 R13: 0000000000000000 R14: ffffffff8961cd00 R15: ffffffff8961ccd0 vprintk_emit+0x32f/0x4e0 kernel/printk/printk.c:1923 vprintk_default+0x1a/0x20 kernel/printk/printk.c:1963 vprintk_func+0x49/0x130 kernel/printk/printk_safe.c:401 printk+0x91/0xab kernel/printk/printk.c:1996 addrconf_notify.cold.49+0xce/0x138 net/ipv6/addrconf.c:3451 notifier_call_chain+0xd6/0x150 kernel/notifier.c:93 __raw_notifier_call_chain kernel/notifier.c:394 [inline] raw_notifier_call_chain+0x11/0x20 kernel/notifier.c:401 call_netdevice_notifiers_info+0x4b/0x60 net/core/dev.c:1667 netdev_state_change net/core/dev.c:1314 [inline] netdev_state_change+0xb5/0xe0 net/core/dev.c:1308 linkwatch_do_dev+0x72/0xc0 net/core/link_watch.c:164 __linkwatch_run_queue+0x23f/0x450 net/core/link_watch.c:202 linkwatch_event+0x3e/0x50 net/core/link_watch.c:237 process_one_work+0x74f/0x1620 kernel/workqueue.c:2116 worker_thread+0xcc/0xee0 kernel/workqueue.c:2250 kthread+0x338/0x400 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! IPv6: ADDRCONF(NETDEV_UP): batadv_slave_0: link is not ready batman_adv: batadv0: Interface activated: batadv_slave_0 device veth0_macvtap entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): macvtap0: link is not ready device veth1_macvtap entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): macsec0: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready batman_adv: batadv0: Interface activated: batadv_slave_1 Bluetooth: hci0 command 0x0419 tx timeout device veth1_macvtap entered promiscuous mode Bluetooth: hci3 command 0x0419 tx timeout device veth1_vlan entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): veth0_macvtap: link is not ready Bluetooth: hci5 command 0x0419 tx timeout IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready Bluetooth: hci1 command 0x0419 tx timeout Bluetooth: hci4 command 0x0419 tx timeout IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready Bluetooth: hci2 command 0x0419 tx timeout IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1_macvtap: link is not ready device veth0_macvtap entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): macvtap0: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! IPv6: ADDRCONF(NETDEV_UP): batadv_slave_0: link is not ready batman_adv: batadv0: Interface activated: batadv_slave_0 IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready device veth1_macvtap entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): macsec0: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready batman_adv: batadv0: Interface activated: batadv_slave_1 IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! IPv6: ADDRCONF(NETDEV_UP): batadv_slave_0: link is not ready batman_adv: batadv0: Interface activated: batadv_slave_0 IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready batman_adv: batadv0: Interface activated: batadv_slave_1 batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! IPv6: ADDRCONF(NETDEV_UP): batadv_slave_0: link is not ready batman_adv: batadv0: Interface activated: batadv_slave_0 IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready batman_adv: batadv0: Interface activated: batadv_slave_1 IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready