ci2 starts bisection 2023-06-27 01:23:34.896886142 +0000 UTC m=+38233.987233999
bisecting fixing commit since 1fe619a7d25218e9b9fdcce9fcac6a05cd62abed
building syzkaller on 0513b3e670c9ff1eb79183e59e0f7d46ea76d243
ensuring issue is reproducible on original commit 1fe619a7d25218e9b9fdcce9fcac6a05cd62abed
testing commit 1fe619a7d25218e9b9fdcce9fcac6a05cd62abed gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: e461f37bca428c5d14e9cedbf7c0e2050e8eddc06759c1ecc11ab8a864063323
run #0: failed: failed to run binary in VM: broken console: Permission denied (publickey)
run #1: crashed: BUG: Bad page state
run #2: crashed: BUG: Bad page state
run #3: crashed: BUG: Bad page state
run #4: crashed: BUG: Bad page state
run #5: crashed: BUG: Bad page state
run #6: crashed: BUG: Bad page state
run #7: crashed: BUG: Bad page state
run #8: crashed: BUG: Bad page state
run #9: crashed: BUG: Bad page state
run #10: crashed: BUG: Bad page state
run #11: crashed: BUG: Bad page state
run #12: crashed: BUG: Bad page state
run #13: crashed: BUG: Bad page state
run #14: crashed: BUG: Bad page state
run #15: crashed: BUG: Bad page state
run #16: crashed: BUG: Bad page state
run #17: crashed: BUG: Bad page state
run #18: crashed: BUG: Bad page state
run #19: crashed: BUG: Bad page state
testing current HEAD f67653019430833d5003f16817d7fa85272a6a76
testing commit f67653019430833d5003f16817d7fa85272a6a76 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 0e4c5d10b856bd6552630d3dd6b81eb5a8ba8c62a7dd33d7c1f481ade38900f6
all runs: crashed: BUG: Bad page state
crash still not fixed/happens on the oldest tested release
revisions tested: 2, total time: 1h1m50.39481588s (build: 54m24.464507706s, test: 6m36.511494598s)
crash still not fixed on HEAD or HEAD had kernel test errors
commit msg: Linux 5.15.118
crash: BUG: Bad page state
BUG: Bad page state in process jfsCommit pfn:6cda7
page:ffffea0001b369c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1c pfn:0x6cda7
flags: 0xfff00000002005(locked|uptodate|private|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000002005 dead000000000100 dead000000000122 0000000000000000
raw: 000000000000001c ffff88806ccad9b0 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x100c40(GFP_NOFS|__GFP_HARDWALL), pid 3953, ts 63968916215, free_ts 8278908338
prep_new_page mm/page_alloc.c:2426 [inline]
get_page_from_freelist+0xa76/0x2f80 mm/page_alloc.c:4159
__alloc_pages+0x1b2/0x470 mm/page_alloc.c:5421
do_read_cache_page+0x2b7/0xd00 mm/filemap.c:3448
read_mapping_page include/linux/pagemap.h:515 [inline]
__get_metapage+0x55c/0x1370 fs/jfs/jfs_metapage.c:621
diRead+0x4c0/0x990 fs/jfs/jfs_imap.c:363
jfs_iget+0x5a/0x420 fs/jfs/inode.c:35
jfs_fill_super+0x651/0xb90 fs/jfs/super.c:585
mount_bdev+0x2cc/0x3b0 fs/super.c:1378
legacy_get_tree+0xfa/0x1f0 fs/fs_context.c:610
vfs_get_tree+0x7f/0x2c0 fs/super.c:1508
do_new_mount fs/namespace.c:2994 [inline]
path_mount+0x41e/0x1a30 fs/namespace.c:3324
do_mount fs/namespace.c:3337 [inline]
__do_sys_mount fs/namespace.c:3545 [inline]
__se_sys_mount fs/namespace.c:3522 [inline]
__x64_sys_mount+0x1f5/0x260 fs/namespace.c:3522
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1340 [inline]
free_pcp_prepare+0x2c5/0x780 mm/page_alloc.c:1391
free_unref_page_prepare mm/page_alloc.c:3317 [inline]
free_unref_page+0x19/0x6a0 mm/page_alloc.c:3396
free_contig_range+0xa8/0xf0 mm/page_alloc.c:9340
destroy_args+0x7e/0x503 mm/debug_vm_pgtable.c:1018
debug_vm_pgtable+0x1e77/0x1efb mm/debug_vm_pgtable.c:1331
do_one_initcall+0xbe/0x3a0 init/main.c:1306
do_initcall_level init/main.c:1379 [inline]
do_initcalls init/main.c:1395 [inline]
do_basic_setup init/main.c:1414 [inline]
kernel_init_freeable+0x5ab/0x605 init/main.c:1619
kernel_init+0x14/0x120 init/main.c:1510
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
Modules linked in:
CPU: 1 PID: 275 Comm: jfsCommit Not tainted 5.15.118-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x57/0x7d lib/dump_stack.c:106
bad_page.cold+0x9c/0xbd mm/page_alloc.c:652
check_free_page_bad mm/page_alloc.c:1199 [inline]
check_free_page mm/page_alloc.c:1209 [inline]
free_pages_prepare mm/page_alloc.c:1334 [inline]
free_pcp_prepare+0x2f6/0x780 mm/page_alloc.c:1391
free_unref_page_prepare mm/page_alloc.c:3317 [inline]
free_unref_page+0x19/0x6a0 mm/page_alloc.c:3396
put_page include/linux/mm.h:1247 [inline]
_metapage_homeok fs/jfs/jfs_metapage.h:119 [inline]
txUnlock+0x4df/0xa50 fs/jfs/jfs_txnmgr.c:927
txLazyCommit fs/jfs/jfs_txnmgr.c:2711 [inline]
jfs_lazycommit+0x61c/0x9c0 fs/jfs/jfs_txnmgr.c:2761
kthread+0x38b/0x460 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
page:ffffea0001b369c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1c pfn:0x6cda7
flags: 0xfff00000002005(locked|uptodate|private|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000002005 dead000000000100 dead000000000122 0000000000000000
raw: 000000000000001c ffff88806ccad9b0 00000000ffffffff 0000000000000000
page dumped because: VM_BUG_ON_PAGE(((unsigned int) page_ref_count(page) + 127u <= 127u))
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x100c40(GFP_NOFS|__GFP_HARDWALL), pid 3953, ts 63968916215, free_ts 8278908338
prep_new_page mm/page_alloc.c:2426 [inline]
get_page_from_freelist+0xa76/0x2f80 mm/page_alloc.c:4159
__alloc_pages+0x1b2/0x470 mm/page_alloc.c:5421
do_read_cache_page+0x2b7/0xd00 mm/filemap.c:3448
read_mapping_page include/linux/pagemap.h:515 [inline]
__get_metapage+0x55c/0x1370 fs/jfs/jfs_metapage.c:621
diRead+0x4c0/0x990 fs/jfs/jfs_imap.c:363
jfs_iget+0x5a/0x420 fs/jfs/inode.c:35
jfs_fill_super+0x651/0xb90 fs/jfs/super.c:585
mount_bdev+0x2cc/0x3b0 fs/super.c:1378
legacy_get_tree+0xfa/0x1f0 fs/fs_context.c:610
vfs_get_tree+0x7f/0x2c0 fs/super.c:1508
do_new_mount fs/namespace.c:2994 [inline]
path_mount+0x41e/0x1a30 fs/namespace.c:3324
do_mount fs/namespace.c:3337 [inline]
__do_sys_mount fs/namespace.c:3545 [inline]
__se_sys_mount fs/namespace.c:3522 [inline]
__x64_sys_mount+0x1f5/0x260 fs/namespace.c:3522
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1340 [inline]
free_pcp_prepare+0x2c5/0x780 mm/page_alloc.c:1391
free_unref_page_prepare mm/page_alloc.c:3317 [inline]
free_unref_page+0x19/0x6a0 mm/page_alloc.c:3396
free_contig_range+0xa8/0xf0 mm/page_alloc.c:9340
destroy_args+0x7e/0x503 mm/debug_vm_pgtable.c:1018
debug_vm_pgtable+0x1e77/0x1efb mm/debug_vm_pgtable.c:1331
do_one_initcall+0xbe/0x3a0 init/main.c:1306
do_initcall_level init/main.c:1379 [inline]
do_initcalls init/main.c:1395 [inline]
do_basic_setup init/main.c:1414 [inline]
kernel_init_freeable+0x5ab/0x605 init/main.c:1619
kernel_init+0x14/0x120 init/main.c:1510
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
------------[ cut here ]------------
kernel BUG at include/linux/mm.h:1213!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 275 Comm: jfsCommit Tainted: G B 5.15.118-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
RIP: 0010:get_page include/linux/mm.h:1213 [inline]
RIP: 0010:put_metapage+0x486/0x520 fs/jfs/jfs_metapage.c:722
Code: a1 fd ff ff e8 1b e7 13 ff e9 79 fc ff ff 4c 89 f7 e8 0e e7 13 ff e9 2e fd ff ff 48 c7 c6 00 71 43 89 4c 89 e7 e8 4a 58 03 ff <0f> 0b 4c 89 ef e8 00 e7 13 ff e9 1a fc ff ff 4c 89 ff e8 f3 e6 13
RSP: 0018:ffffc900027cfc68 EFLAGS: 00010296
RAX: 0000000000000000 RBX: 1ffff920004f9f93 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff8880136e8f5a
RBP: ffff88806ccad9b0 R08: 0000000000000018 R09: ffff8880b9c27a5b
R10: ffffed1017384f4b R11: 6f72665f74657220 R12: ffffea0001b369c0
R13: ffff88806ccada40 R14: ffffea0001b369f4 R15: ffff88806ccad9d8
FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000564ae67a5131 CR3: 0000000022be9000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
txUnlock+0x33b/0xa50 fs/jfs/jfs_txnmgr.c:942
txLazyCommit fs/jfs/jfs_txnmgr.c:2711 [inline]
jfs_lazycommit+0x61c/0x9c0 fs/jfs/jfs_txnmgr.c:2761
kthread+0x38b/0x460 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
Modules linked in:
---[ end trace d2ceb5caab7e7341 ]---
RIP: 0010:get_page include/linux/mm.h:1213 [inline]
RIP: 0010:put_metapage+0x486/0x520 fs/jfs/jfs_metapage.c:722
Code: a1 fd ff ff e8 1b e7 13 ff e9 79 fc ff ff 4c 89 f7 e8 0e e7 13 ff e9 2e fd ff ff 48 c7 c6 00 71 43 89 4c 89 e7 e8 4a 58 03 ff <0f> 0b 4c 89 ef e8 00 e7 13 ff e9 1a fc ff ff 4c 89 ff e8 f3 e6 13
RSP: 0018:ffffc900027cfc68 EFLAGS: 00010296
RAX: 0000000000000000 RBX: 1ffff920004f9f93 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff8880136e8f5a
RBP: ffff88806ccad9b0 R08: 0000000000000018 R09: ffff8880b9c27a5b
R10: ffffed1017384f4b R11: 6f72665f74657220 R12: ffffea0001b369c0
R13: ffff88806ccada40 R14: ffffea0001b369f4 R15: ffff88806ccad9d8
FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055dc9f709680 CR3: 000000000ae8e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400