bisecting fixing commit since 811218eceeaa7618652e1b8d11caeff67ab42072 building syzkaller on 624dad51316f9973e1349b6c71e789737d1e00d9 testing commit 811218eceeaa7618652e1b8d11caeff67ab42072 with gcc (GCC) 8.4.1 20210217 kernel signature: 92f5ce85241921d86e07eff1cd2f9e0231cda4b2cd101da0344179f8535db022 run #0: crashed: kernel BUG in iput run #1: crashed: kernel BUG in iput run #2: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop4] run #3: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop5] run #4: crashed: kernel BUG in corrupted run #5: crashed: kernel BUG in iput run #6: crashed: kernel BUG in iput run #7: crashed: kernel BUG in iput run #8: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop0] run #9: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop0] run #10: crashed: kernel BUG in iput run #11: crashed: kernel BUG in corrupted run #12: crashed: kernel BUG in corrupted run #13: crashed: kernel BUG in iput run #14: crashed: kernel BUG in iput run #15: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop3] run #16: crashed: kernel BUG in iput run #17: crashed: kernel BUG in iput run #18: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop2] run #19: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop0] testing current HEAD 1722257b8ececec9b3b83a8b14058f8209d78071 testing commit 1722257b8ececec9b3b83a8b14058f8209d78071 with gcc (GCC) 8.4.1 20210217 kernel signature: 853f0ee41a5bd92c6a6e08c88e3868dd318b7fe96084089dda50b142d4826ccb run #0: crashed: kernel BUG in iput run #1: crashed: kernel BUG in iput run #2: crashed: kernel BUG in iput run #3: crashed: kernel BUG in iput run #4: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop4] run #5: crashed: kernel BUG in erofs_fill_super run #6: crashed: kernel BUG in iput run #7: crashed: kernel BUG in corrupted run #8: crashed: kernel BUG in corrupted run #9: crashed: kernel BUG in corrupted revisions tested: 2, total time: 27m5.408794951s (build: 19m38.070380264s, test: 6m58.848869282s) the crash still happens on HEAD commit msg: Linux 4.19.193 crash: kernel BUG in corrupted R13: 0000000020000100 R14: 00007f6e5efbc000 R15: 0000000020000140 CPU: 0 PID: 10049 Comm: syz-executor.0 Not tainted 4.19.193-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ------------[ cut here ]------------ Call Trace: kernel BUG at fs/inode.c:1571! invalid opcode: 0000 [#1] PREEMPT SMP KASAN __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x226 lib/dump_stack.c:118 CPU: 1 PID: 10029 Comm: syz-executor.5 Not tainted 4.19.193-syzkaller #0 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold.2+0x5/0xa lib/fault-inject.c:149 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:iput+0x536/0x6b0 fs/inode.c:1571 __should_failslab+0xba/0xf0 mm/failslab.c:32 Code: 48 b8 00 00 00 00 00 fc ff df 48 8b 55 c8 48 c1 ea 03 80 3c 02 00 0f 84 ac fd ff ff 48 8b 7d c8 e8 af aa f0 ff e9 9e fd ff ff <0f> 0b 48 89 df e8 60 f9 ff ff 48 8b 7d d0 e8 a7 9c 09 06 e9 2a fe should_failslab+0x9/0x20 mm/slab_common.c:1588 RSP: 0018:ffff88807fe07a18 EFLAGS: 00010202 slab_pre_alloc_hook mm/slab.h:424 [inline] slab_alloc mm/slab.c:3383 [inline] kmem_cache_alloc+0x28e/0x390 mm/slab.c:3557 RAX: dffffc0000000000 RBX: ffff88808dbae2a8 RCX: 1ffff11015e55d25 RDX: 1ffff11011b75c6f RSI: ffff8880af2ae908 RDI: ffff88808dbae2a8 __d_alloc+0x28/0xa30 fs/dcache.c:1612 RBP: ffff88807fe07a60 R08: ffff8880af2ae928 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff88808dbae2a8 d_alloc_anon fs/dcache.c:1715 [inline] d_make_root+0x38/0x70 fs/dcache.c:1909 R13: ffff88807f810580 R14: 0000000000000000 R15: ffff88807f8105e8 erofs_read_super drivers/staging/erofs/super.c:407 [inline] erofs_fill_super+0xf02/0x1168 drivers/staging/erofs/super.c:499 FS: 00007f700ebfe700(0000) GS:ffff8880ba300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f45044d1000 CR3: 00000000b00ba000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 mount_bdev+0x26f/0x330 fs/super.c:1158 Call Trace: erofs_read_super drivers/staging/erofs/super.c:439 [inline] erofs_fill_super+0x10b4/0x1168 drivers/staging/erofs/super.c:499 erofs_mount+0x6a/0x90 drivers/staging/erofs/super.c:512 mount_fs+0x7f/0x2b0 fs/super.c:1261 vfs_kern_mount.part.11+0x58/0x3d0 fs/namespace.c:961 mount_bdev+0x26f/0x330 fs/super.c:1158 vfs_kern_mount fs/namespace.c:951 [inline] do_new_mount fs/namespace.c:2469 [inline] do_mount+0x376/0x2710 fs/namespace.c:2799 erofs_mount+0x6a/0x90 drivers/staging/erofs/super.c:512 mount_fs+0x7f/0x2b0 fs/super.c:1261 vfs_kern_mount.part.11+0x58/0x3d0 fs/namespace.c:961 ksys_mount+0xb1/0xd0 fs/namespace.c:3015 vfs_kern_mount fs/namespace.c:951 [inline] do_new_mount fs/namespace.c:2469 [inline] do_mount+0x376/0x2710 fs/namespace.c:2799 __do_sys_mount fs/namespace.c:3029 [inline] __se_sys_mount fs/namespace.c:3026 [inline] __x64_sys_mount+0xb9/0x150 fs/namespace.c:3026 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x46702a ksys_mount+0xb1/0xd0 fs/namespace.c:3015 Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 __do_sys_mount fs/namespace.c:3029 [inline] __se_sys_mount fs/namespace.c:3026 [inline] __x64_sys_mount+0xb9/0x150 fs/namespace.c:3026 RSP: 002b:00007f5fcccbafa8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 000000000046702a entry_SYSCALL_64_after_hwframe+0x49/0xbe RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f5fcccbb000 RIP: 0033:0x46702a RBP: 00007f5fcccbb040 R08: 00007f5fcccbb040 R09: 0000000020000000 Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000000 RSP: 002b:00007f700ebfdfa8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 R13: 0000000020000100 R14: 00007f5fcccbb000 R15: 0000000020000140 RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 000000000046702a ------------[ cut here ]------------ RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f700ebfe000 kernel BUG at fs/inode.c:1571! RBP: 00007f700ebfe040 R08: 00007f700ebfe040 R09: 0000000020000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000000 R13: 0000000020000100 R14: 00007f700ebfe000 R15: 0000000020000140 Modules linked in: invalid opcode: 0000 [#2] PREEMPT SMP KASAN CPU: 0 PID: 10039 Comm: syz-executor.4 Tainted: G D 4.19.193-syzkaller #0 erofs: unmounted for /dev/loop1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:iput+0x536/0x6b0 fs/inode.c:1571 Code: 48 b8 00 00 00 00 00 fc ff df 48 8b 55 c8 48 c1 ea 03 80 3c 02 00 0f 84 ac fd ff ff 48 8b 7d c8 e8 af aa f0 ff e9 9e fd ff ff <0f> 0b 48 89 df e8 60 f9 ff ff 48 8b 7d d0 e8 a7 9c 09 06 e9 2a fe RSP: 0018:ffff88807ff0fa18 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff8880816824c0 RCX: ffffffff814c3da1 RDX: 1ffff110102d04b2 RSI: 1ffff110174457d2 RDI: ffff8880816824c0 RBP: ffff88807ff0fa60 R08: ffffed1017444553 R09: ffffed1017444552 R10: ffffed1017444552 R11: ffff8880ba222a93 R12: ffff8880816824c0 R13: ffff88809412a480 R14: 0000000000000000 R15: ffff88809412a4e8 FS: 00007f4d38dee700(0000) GS:ffff8880ba200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005566428010e8 CR3: 000000009e3bb000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: erofs_read_super drivers/staging/erofs/super.c:439 [inline] erofs_fill_super+0x10b4/0x1168 drivers/staging/erofs/super.c:499 mount_bdev+0x26f/0x330 fs/super.c:1158 erofs_mount+0x6a/0x90 drivers/staging/erofs/super.c:512 mount_fs+0x7f/0x2b0 fs/super.c:1261 vfs_kern_mount.part.11+0x58/0x3d0 fs/namespace.c:961 vfs_kern_mount fs/namespace.c:951 [inline] do_new_mount fs/namespace.c:2469 [inline] do_mount+0x376/0x2710 fs/namespace.c:2799 ksys_mount+0xb1/0xd0 fs/namespace.c:3015 __do_sys_mount fs/namespace.c:3029 [inline] __se_sys_mount fs/namespace.c:3026 [inline] __x64_sys_mount+0xb9/0x150 fs/namespace.c:3026 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x46702a Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f4d38dedfa8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 000000000046702a RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f4d38dee000 RBP: 00007f4d38dee040 R08: 00007f4d38dee040 R09: 0000000020000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000000 R13: 0000000020000100 R14: 00007f4d38dee000 R15: 0000000020000140 Modules linked in: erofs: unmounted for /dev/loop3 erofs: mounted on /dev/loop2 with opts: acl. ---[ end trace 87393c2259a450ec ]--- erofs: unmounted for /dev/loop2 RIP: 0010:iput+0x536/0x6b0 fs/inode.c:1571 Code: 48 b8 00 00 00 00 00 fc ff df 48 8b 55 c8 48 c1 ea 03 80 3c 02 00 0f 84 ac fd ff ff 48 8b 7d c8 e8 af aa f0 ff e9 9e fd ff ff <0f> 0b 48 89 df e8 60 f9 ff ff 48 8b 7d d0 e8 a7 9c 09 06 e9 2a fe ---[ end trace 87393c2259a450ed ]--- RSP: 0018:ffff88807fe07a18 EFLAGS: 00010202 RIP: 0010:iput+0x536/0x6b0 fs/inode.c:1571 ------------[ cut here ]------------ Code: 48 b8 00 00 00 00 00 fc ff df 48 8b 55 c8 48 c1 ea 03 80 3c 02 00 0f 84 ac fd ff ff 48 8b 7d c8 e8 af aa f0 ff e9 9e fd ff ff <0f> 0b 48 89 df e8 60 f9 ff ff 48 8b 7d d0 e8 a7 9c 09 06 e9 2a fe kernel BUG at fs/inode.c:1571! RAX: dffffc0000000000 RBX: ffff88808dbae2a8 RCX: 1ffff11015e55d25 RSP: 0018:ffff88807fe07a18 EFLAGS: 00010202 invalid opcode: 0000 [#3] PREEMPT SMP KASAN RAX: dffffc0000000000 RBX: ffff88808dbae2a8 RCX: 1ffff11015e55d25 CPU: 0 PID: 10049 Comm: syz-executor.0 Tainted: G D 4.19.193-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:iput+0x536/0x6b0 fs/inode.c:1571 Code: 48 b8 00 00 00 00 00 fc ff df 48 8b 55 c8 48 c1 ea 03 80 3c 02 00 0f 84 ac fd ff ff 48 8b 7d c8 e8 af aa f0 ff e9 9e fd ff ff <0f> 0b 48 89 df e8 60 f9 ff ff 48 8b 7d d0 e8 a7 9c 09 06 e9 2a fe RDX: 1ffff11011b75c6f RSI: ffff8880af2ae908 RDI: ffff88808dbae2a8 RSP: 0018:ffff88807f887a18 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff88808dbdc998 RCX: ffffffff814c3da1 RDX: 1ffff11011b7b94d RSI: 1ffff110174457d2 RDI: ffff88808dbdc998 RBP: ffff88807f887a60 R08: ffffed1017444553 R09: ffffed1017444552 R10: ffffed1017444552 R11: ffff8880ba222a93 R12: ffff88808dbdc998 R13: ffff8880abc66440 R14: 0000000000000000 R15: ffff8880abc664a8 FS: 00007f5fcccbb700(0000) GS:ffff8880ba200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f3e8f9c718 CR3: 00000000aa07e000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: erofs_read_super drivers/staging/erofs/super.c:439 [inline] erofs_fill_super+0x10b4/0x1168 drivers/staging/erofs/super.c:499 RBP: ffff88807fe07a60 R08: ffff8880af2ae928 R09: 0000000000000000 mount_bdev+0x26f/0x330 fs/super.c:1158 erofs_mount+0x6a/0x90 drivers/staging/erofs/super.c:512 mount_fs+0x7f/0x2b0 fs/super.c:1261 R10: 0000000000000000 R11: 0000000000000000 R12: ffff88808dbae2a8 vfs_kern_mount.part.11+0x58/0x3d0 fs/namespace.c:961 vfs_kern_mount fs/namespace.c:951 [inline] do_new_mount fs/namespace.c:2469 [inline] do_mount+0x376/0x2710 fs/namespace.c:2799 ksys_mount+0xb1/0xd0 fs/namespace.c:3015 __do_sys_mount fs/namespace.c:3029 [inline] __se_sys_mount fs/namespace.c:3026 [inline] __x64_sys_mount+0xb9/0x150 fs/namespace.c:3026 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe R13: ffff88807f810580 R14: 0000000000000000 R15: ffff88807f8105e8 RIP: 0033:0x46702a Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5fcccbafa8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 000000000046702a RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f5fcccbb000 RBP: 00007f5fcccbb040 R08: 00007f5fcccbb040 R09: 0000000020000000 FS: 00007f700ebfe700(0000) GS:ffff8880ba300000(0000) knlGS:0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000000 R13: 0000000020000100 R14: 00007f5fcccbb000 R15: 0000000020000140 Modules linked in: RDX: 1ffff11011b75c6f RSI: ffff8880af2ae908 RDI: ffff88808dbae2a8 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 RBP: ffff88807fe07a60 R08: ffff8880af2ae928 R09: 0000000000000000 CR2: 00007f45044e5000 CR3: 00000000b00ba000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400