bisecting fixing commit since 811218eceeaa7618652e1b8d11caeff67ab42072 building syzkaller on 624dad51316f9973e1349b6c71e789737d1e00d9 testing commit 811218eceeaa7618652e1b8d11caeff67ab42072 with gcc (GCC) 8.4.1 20210217 kernel signature: 852f68674f24117c6d67dffe5fdebfb91dcf2c380b7ea8e2d091a043183130e2 run #0: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop2] run #1: crashed: kernel BUG in iput run #2: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop4] run #3: crashed: kernel BUG in corrupted run #4: crashed: kernel BUG in corrupted run #5: crashed: kernel BUG in iput run #6: crashed: kernel BUG in iput run #7: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop4] run #8: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop5] run #9: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop0] run #10: crashed: kernel BUG in iput run #11: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop3] run #12: crashed: kernel BUG in iput run #13: crashed: kernel BUG in corrupted run #14: crashed: kernel BUG in iput run #15: crashed: kernel BUG in corrupted run #16: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop3] run #17: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop1] run #18: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop1] run #19: crashed: kernel BUG in iput testing current HEAD 2034d6f0838e465dd8f120c4e946d8444b4bb5df testing commit 2034d6f0838e465dd8f120c4e946d8444b4bb5df with gcc (GCC) 8.4.1 20210217 kernel signature: 5c0a7950401219daaa8f83f2b91ac856463bf99b4061ef70844aa7feed21544f run #0: crashed: kernel BUG in iput run #1: crashed: kernel BUG in corrupted run #2: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop3] run #3: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop4] run #4: crashed: kernel BUG in iput run #5: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop4] run #6: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop1] run #7: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop1] run #8: crashed: kernel BUG in iput run #9: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop0] revisions tested: 2, total time: 31m0.148151352s (build: 23m33.14738927s, test: 6m47.738507079s) the crash still happens on HEAD commit msg: Linux 4.19.184 crash: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop0] RBP: 00007f09a6994040 R08: 00007f09a6994040 R09: 0000000020000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000000 R13: 0000000020000100 R14: 00007f09a6994000 R15: 0000000020000140 CPU: 1 PID: 10085 Comm: syz-executor.3 Not tainted 4.19.184-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 BUG: Dentry 000000002950163e{i=0,n=/} still in use (-128) [unmount of erofs loop0] Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x226 lib/dump_stack.c:118 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold.2+0x5/0xa lib/fault-inject.c:149 __should_failslab+0xba/0xf0 mm/failslab.c:32 should_failslab+0x9/0x20 mm/slab_common.c:1588 slab_pre_alloc_hook mm/slab.h:424 [inline] slab_alloc mm/slab.c:3383 [inline] kmem_cache_alloc+0x28e/0x390 mm/slab.c:3557 __d_alloc+0x28/0xa30 fs/dcache.c:1612 d_alloc_anon fs/dcache.c:1715 [inline] d_make_root+0x38/0x70 fs/dcache.c:1909 erofs_read_super drivers/staging/erofs/super.c:407 [inline] erofs_fill_super+0xf02/0x1168 drivers/staging/erofs/super.c:499 mount_bdev+0x26f/0x330 fs/super.c:1158 erofs_mount+0x6a/0x90 drivers/staging/erofs/super.c:512 mount_fs+0x7f/0x2b0 fs/super.c:1261 vfs_kern_mount.part.11+0x58/0x3d0 fs/namespace.c:961 vfs_kern_mount fs/namespace.c:951 [inline] do_new_mount fs/namespace.c:2469 [inline] do_mount+0x376/0x2710 fs/namespace.c:2799 ------------[ cut here ]------------ WARNING: CPU: 0 PID: 10086 at fs/dcache.c:1518 umount_check fs/dcache.c:1518 [inline] WARNING: CPU: 0 PID: 10086 at fs/dcache.c:1518 umount_check.cold.19+0xe0/0x149 fs/dcache.c:1499 ksys_mount+0xb1/0xd0 fs/namespace.c:3015 Kernel panic - not syncing: panic_on_warn set ... __do_sys_mount fs/namespace.c:3029 [inline] __se_sys_mount fs/namespace.c:3026 [inline] __x64_sys_mount+0xb9/0x150 fs/namespace.c:3026 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x46702a Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f75bd9c9fa8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 000000000046702a RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f75bd9ca000 RBP: 00007f75bd9ca040 R08: 00007f75bd9ca040 R09: 0000000020000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000000 R13: 0000000020000100 R14: 00007f75bd9ca000 R15: 0000000020000140 CPU: 0 PID: 10086 Comm: syz-executor.0 Not tainted 4.19.184-syzkaller #0 ------------[ cut here ]------------ Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 kernel BUG at fs/inode.c:1571! Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x226 lib/dump_stack.c:118 invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 10085 Comm: syz-executor.3 Not tainted 4.19.184-syzkaller #0 panic+0x1cd/0x375 kernel/panic.c:186 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 __warn.cold.7+0x1b/0x36 kernel/panic.c:541 RIP: 0010:iput+0x536/0x6b0 fs/inode.c:1571 Code: 48 b8 00 00 00 00 00 fc ff df 48 8b 55 c8 48 c1 ea 03 80 3c 02 00 0f 84 ac fd ff ff 48 8b 7d c8 e8 3f ac f0 ff e9 9e fd ff ff <0f> 0b 48 89 df e8 60 f9 ff ff 48 8b 7d d0 e8 57 28 09 06 e9 2a fe report_bug+0x1a1/0x200 lib/bug.c:186 RSP: 0018:ffff888080ccfa18 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff88808eb77918 RCX: 1ffff110126e6935 RDX: 1ffff11011d6ef3d RSI: ffff888093734988 RDI: ffff88808eb77918 fixup_bug arch/x86/kernel/traps.c:178 [inline] fixup_bug arch/x86/kernel/traps.c:173 [inline] do_error_trap+0x200/0x350 arch/x86/kernel/traps.c:296 RBP: ffff888080ccfa60 R08: ffff8880937349a8 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000000 R12: ffff88808eb77918 R13: ffff8880ab3d61c0 R14: 0000000000000000 R15: ffff8880ab3d6228 FS: 00007f75bd9ca700(0000) GS:ffff8880ba300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000001a05888 CR3: 00000000a15aa000 CR4: 00000000001406e0 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1038 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 RIP: 0010:umount_check fs/dcache.c:1518 [inline] RIP: 0010:umount_check.cold.19+0xe0/0x149 fs/dcache.c:1499 Call Trace: Code: 75 7f 49 8b 54 24 40 41 55 4d 89 f1 41 89 d8 48 89 f1 48 c7 c7 20 87 13 88 e8 b5 05 ff ff 48 c7 c7 60 86 13 88 e8 a9 05 ff ff <0f> 0b 58 e9 11 89 17 fa 48 89 75 d8 e8 bc 13 09 fa 48 8b 75 d8 e9 erofs_read_super drivers/staging/erofs/super.c:439 [inline] erofs_fill_super+0x10b4/0x1168 drivers/staging/erofs/super.c:499 RSP: 0018:ffff888080cd7a60 EFLAGS: 00010286 RAX: 0000000000000024 RBX: 00000000ffffff80 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8bad9720 RBP: ffff888080cd7a90 R08: ffffed1017443d03 R09: ffffed1017443d02 mount_bdev+0x26f/0x330 fs/super.c:1158 R10: ffffed1017443d02 R11: ffff8880ba21e817 R12: 0000000000000000 R13: ffff888092e45150 R14: ffffffff88d29b40 R15: ffff8880ae28d180 erofs_mount+0x6a/0x90 drivers/staging/erofs/super.c:512 d_walk.part.6+0x151/0x6e0 fs/dcache.c:1253 mount_fs+0x7f/0x2b0 fs/super.c:1261 d_walk fs/dcache.c:1246 [inline] do_one_tree+0x1f/0x40 fs/dcache.c:1525 vfs_kern_mount.part.11+0x58/0x3d0 fs/namespace.c:961 shrink_dcache_for_umount+0x56/0x120 fs/dcache.c:1541 vfs_kern_mount fs/namespace.c:951 [inline] do_new_mount fs/namespace.c:2469 [inline] do_mount+0x376/0x2710 fs/namespace.c:2799 generic_shutdown_super+0x61/0x330 fs/super.c:441 kill_block_super+0x96/0xe0 fs/super.c:1185 erofs_kill_sb+0x9/0x10 drivers/staging/erofs/super.c:518 deactivate_locked_super+0x77/0xd0 fs/super.c:329 mount_bdev+0x2cb/0x330 fs/super.c:1160 ksys_mount+0xb1/0xd0 fs/namespace.c:3015 __do_sys_mount fs/namespace.c:3029 [inline] __se_sys_mount fs/namespace.c:3026 [inline] __x64_sys_mount+0xb9/0x150 fs/namespace.c:3026 erofs_mount+0x6a/0x90 drivers/staging/erofs/super.c:512 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe mount_fs+0x7f/0x2b0 fs/super.c:1261 RIP: 0033:0x46702a vfs_kern_mount.part.11+0x58/0x3d0 fs/namespace.c:961 Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 vfs_kern_mount fs/namespace.c:951 [inline] do_new_mount fs/namespace.c:2469 [inline] do_mount+0x376/0x2710 fs/namespace.c:2799 RSP: 002b:00007f75bd9c9fa8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 000000000046702a RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f75bd9ca000 RBP: 00007f75bd9ca040 R08: 00007f75bd9ca040 R09: 0000000020000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000000 ksys_mount+0xb1/0xd0 fs/namespace.c:3015 R13: 0000000020000100 R14: 00007f75bd9ca000 R15: 0000000020000140 __do_sys_mount fs/namespace.c:3029 [inline] __se_sys_mount fs/namespace.c:3026 [inline] __x64_sys_mount+0xb9/0x150 fs/namespace.c:3026 Modules linked in: do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 ---[ end trace 0f72908126b51260 ]--- entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x46702a Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f09a6993fa8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 000000000046702a RIP: 0010:iput+0x536/0x6b0 fs/inode.c:1571 RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f09a6994000 RBP: 00007f09a6994040 R08: 00007f09a6994040 R09: 0000000020000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000000 R13: 0000000020000100 R14: 00007f09a6994000 R15: 0000000020000140 Kernel Offset: disabled Rebooting in 86400 seconds..