ci2 starts bisection 2023-03-03 11:59:50.117020506 +0000 UTC m=+143405.055709861 bisecting fixing commit since 0a924817d2ed9396401e0557c6134276d2e26382 building syzkaller on 9da18ae8fa827d046ef8da48cc23c97418553c23 ensuring issue is reproducible on original commit 0a924817d2ed9396401e0557c6134276d2e26382 testing commit 0a924817d2ed9396401e0557c6134276d2e26382 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: cab1e271b5ee0b810795c7da0c1a7834af563fcbee974aaffaadffbb91dbf9a8 all runs: crashed: general protection fault in gfs2_rindex_update testing current HEAD 2eb29d59ddf02e39774abfb60b2030b0b7e27c1f testing commit 2eb29d59ddf02e39774abfb60b2030b0b7e27c1f gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: e4087239375ccbb78f9318c5416c40c9983bf71294785644420fffb67685561d all runs: crashed: general protection fault in gfs2_rindex_update revisions tested: 2, total time: 40m4.460659898s (build: 30m30.473910824s, test: 6m47.930783967s) the crash still happens on HEAD commit msg: Merge tag 'drm-next-2023-03-03-1' of git://anongit.freedesktop.org/drm/drm crash: general protection fault in gfs2_rindex_update loop0: detected capacity change from 0 to 32768 gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" gfs2: fsid=syz:syz: Now mounting FS (format 1801)... gfs2: fsid=syz:syz.0: journal 0 mapped with 3 extents in 0ms general protection fault, probably for non-canonical address 0xdffffc0000000097: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x00000000000004b8-0x00000000000004bf] CPU: 1 PID: 5620 Comm: syz-executor.0 Not tainted 6.2.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/16/2023 RIP: 0010:gfs2_rindex_update+0xa8/0x2e0 Code: f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 fe b6 61 fe 49 8b 06 48 89 44 24 38 4c 8d b0 b8 04 00 00 4c 89 f0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 f7 e8 d9 b6 61 fe 49 8b 06 48 89 44 24 RSP: 0018:ffffc90004baf1a0 EFLAGS: 00010202 RAX: 0000000000000097 RBX: 1ffff92000975e3c RCX: 1ffff1100e94b422 RDX: 0000000000000000 RSI: ffffc90004baf4c0 RDI: ffff888078f90000 RBP: ffffc90004baf2b0 R08: dffffc0000000000 R09: ffffed100e325db4 R10: 0000000000000000 R11: dffffc0000000001 R12: ffff888078f90000 R13: dffffc0000000000 R14: 00000000000004b8 R15: 1ffff92000975e90 FS: 00007f8e06418700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005573606b6680 CR3: 000000007ef7c000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: punch_hole+0x981/0x2d90 gfs2_truncatei_resume+0x36/0x50 gfs2_glock_wait+0x163/0x200 init_journal+0x14ac/0x2170 init_inodes+0xcd/0x2e0 gfs2_fill_super+0x17fe/0x22b0 get_tree_bdev+0x3d7/0x620 gfs2_get_tree+0x4b/0x1a0 vfs_get_tree+0x7f/0x220 do_new_mount+0x1e5/0x940 __se_sys_mount+0x20d/0x2a0 do_syscall_64+0x41/0xc0 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f8e0568d5da Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f8e06417f88 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000000012551 RCX: 00007f8e0568d5da RDX: 00000000200124c0 RSI: 0000000020000040 RDI: 00007f8e06417fe0 RBP: 00007f8e06418020 R08: 00007f8e06418020 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000200124c0 R13: 0000000020000040 R14: 00007f8e06417fe0 R15: 0000000020000080 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:gfs2_rindex_update+0xa8/0x2e0 Code: f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 fe b6 61 fe 49 8b 06 48 89 44 24 38 4c 8d b0 b8 04 00 00 4c 89 f0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 f7 e8 d9 b6 61 fe 49 8b 06 48 89 44 24 RSP: 0018:ffffc90004baf1a0 EFLAGS: 00010202 RAX: 0000000000000097 RBX: 1ffff92000975e3c RCX: 1ffff1100e94b422 RDX: 0000000000000000 RSI: ffffc90004baf4c0 RDI: ffff888078f90000 RBP: ffffc90004baf2b0 R08: dffffc0000000000 R09: ffffed100e325db4 R10: 0000000000000000 R11: dffffc0000000001 R12: ffff888078f90000 R13: dffffc0000000000 R14: 00000000000004b8 R15: 1ffff92000975e90 FS: 00007f8e06418700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005573606b6680 CR3: 000000007ef7c000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: f0 48 c1 e8 03 lock shr $0x3,%rax 5: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) a: 74 08 je 0x14 c: 4c 89 f7 mov %r14,%rdi f: e8 fe b6 61 fe callq 0xfe61b712 14: 49 8b 06 mov (%r14),%rax 17: 48 89 44 24 38 mov %rax,0x38(%rsp) 1c: 4c 8d b0 b8 04 00 00 lea 0x4b8(%rax),%r14 23: 4c 89 f0 mov %r14,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 4c 89 f7 mov %r14,%rdi 34: e8 d9 b6 61 fe callq 0xfe61b712 39: 49 8b 06 mov (%r14),%rax 3c: 48 rex.W 3d: 89 .byte 0x89 3e: 44 rex.R 3f: 24 .byte 0x24