bisecting fixing commit since dbb5afad100a828c97e012c6106566d99f041db6 building syzkaller on ed7d41c582d6f194ff35353d8bfdf7681dc0718e testing commit dbb5afad100a828c97e012c6106566d99f041db6 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: d422b14f30f72dd7ff758db85f779ea93493f7dd0c166f121bb11e96866128be run #0: crashed: WARNING in cpu_latency_qos_remove_request run #1: crashed: WARNING in cpu_latency_qos_remove_request run #2: crashed: WARNING in cpu_latency_qos_remove_request run #3: crashed: WARNING in cpu_latency_qos_remove_request run #4: crashed: WARNING in cpu_latency_qos_remove_request run #5: crashed: WARNING in cpu_latency_qos_remove_request run #6: crashed: WARNING in cpu_latency_qos_remove_request run #7: crashed: WARNING in cpu_latency_qos_remove_request run #8: crashed: WARNING in cpu_latency_qos_remove_request run #9: crashed: WARNING in cpu_latency_qos_remove_request run #10: crashed: WARNING in cpu_latency_qos_remove_request run #11: crashed: WARNING in cpu_latency_qos_remove_request run #12: crashed: WARNING in cpu_latency_qos_remove_request run #13: crashed: WARNING in cpu_latency_qos_remove_request run #14: crashed: WARNING in cpu_latency_qos_remove_request run #15: crashed: general protection fault in pm_qos_update_target run #16: crashed: WARNING in cpu_latency_qos_remove_request run #17: crashed: WARNING in cpu_latency_qos_remove_request run #18: crashed: WARNING in cpu_latency_qos_remove_request run #19: crashed: WARNING in cpu_latency_qos_remove_request testing current HEAD 923dcc5eb0c111eccd51cc7ce1658537e3c38b25 testing commit 923dcc5eb0c111eccd51cc7ce1658537e3c38b25 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 2b05ef56fcefe677e3c05df458c0bee8cc20585b5efa9618f3bca33190331f2b run #0: crashed: WARNING in cpu_latency_qos_remove_request run #1: crashed: WARNING in cpu_latency_qos_remove_request run #2: crashed: WARNING in cpu_latency_qos_remove_request run #3: crashed: WARNING in cpu_latency_qos_remove_request run #4: crashed: WARNING in cpu_latency_qos_remove_request run #5: crashed: WARNING in cpu_latency_qos_remove_request run #6: crashed: WARNING in cpu_latency_qos_remove_request run #7: crashed: WARNING in cpu_latency_qos_remove_request run #8: crashed: BUG: unable to handle kernel paging request in pm_qos_update_target run #9: crashed: BUG: unable to handle kernel paging request in pm_qos_update_target revisions tested: 2, total time: 23m41.234241116s (build: 12m41.267639184s, test: 10m12.788466681s) the crash still happens on HEAD commit msg: Merge branch 'akpm' (patches from Andrew) crash: BUG: unable to handle kernel paging request in pm_qos_update_target BUG: unable to handle page fault for address: fffffffffffffff0 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD a88f067 P4D a88f067 PUD a891067 PMD 0 Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 16521 Comm: syz-executor.1 Not tainted 5.16.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:list_empty include/linux/list.h:284 [inline] RIP: 0010:plist_del+0x8f/0x420 lib/plist.c:124 Code: 00 00 4c 8b 73 18 4d 39 ee 74 2c 4d 8d 7e f0 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f4 02 00 00 <49> 8b 46 f0 49 39 c7 0f 84 c0 01 00 00 4c 8d 73 10 48 89 ef e8 08 RSP: 0018:ffffc90002a7fcc0 EFLAGS: 00010046 RAX: dffffc0000000000 RBX: ffff88814a7db840 RCX: 1ffffffff154fdcc RDX: 1ffffffffffffffe RSI: ffffffff8aa7ee60 RDI: ffffffff8aa7ee68 RBP: ffff88814a7db848 R08: 0000000000000001 R09: ffffffff8e043a38 R10: fffff5200054ff8e R11: 000000000007a08a R12: ffff88814a7db858 R13: ffffffff8aa7ee60 R14: 0000000000000000 R15: fffffffffffffff0 FS: 00007fe024d49700(0000) GS:ffff8880b9e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffffffffffff0 CR3: 000000006f959000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: pm_qos_update_target+0x340/0x410 kernel/power/qos.c:114 cpu_latency_qos_apply kernel/power/qos.c:247 [inline] cpu_latency_qos_remove_request.part.0+0x78/0x210 kernel/power/qos.c:328 snd_pcm_hw_free sound/core/pcm_native.c:857 [inline] snd_pcm_common_ioctl+0x154d/0x2d10 sound/core/pcm_native.c:3256 snd_pcm_ioctl+0x62/0xa0 sound/core/pcm_native.c:3339 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __x64_sys_ioctl+0x11f/0x190 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x4665d9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fe024d49188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 00000000004665d9 RDX: 0000000000000000 RSI: 0000000000004112 RDI: 0000000000000004 RBP: 00000000004bfcb9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60 R13: 00007ffd96a1de3f R14: 00007fe024d49300 R15: 0000000000022000 Modules linked in: CR2: fffffffffffffff0 ---[ end trace c79dca149a9cc62c ]--- RIP: 0010:list_empty include/linux/list.h:284 [inline] RIP: 0010:plist_del+0x8f/0x420 lib/plist.c:124 Code: 00 00 4c 8b 73 18 4d 39 ee 74 2c 4d 8d 7e f0 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f4 02 00 00 <49> 8b 46 f0 49 39 c7 0f 84 c0 01 00 00 4c 8d 73 10 48 89 ef e8 08 RSP: 0018:ffffc90002a7fcc0 EFLAGS: 00010046 RAX: dffffc0000000000 RBX: ffff88814a7db840 RCX: 1ffffffff154fdcc RDX: 1ffffffffffffffe RSI: ffffffff8aa7ee60 RDI: ffffffff8aa7ee68 RBP: ffff88814a7db848 R08: 0000000000000001 R09: ffffffff8e043a38 R10: fffff5200054ff8e R11: 000000000007a08a R12: ffff88814a7db858 R13: ffffffff8aa7ee60 R14: 0000000000000000 R15: fffffffffffffff0 FS: 00007fe024d49700(0000) GS:ffff8880b9e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffffffffffff0 CR3: 000000006f959000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 4c 8b 73 18 mov 0x18(%rbx),%r14 6: 4d 39 ee cmp %r13,%r14 9: 74 2c je 0x37 b: 4d 8d 7e f0 lea -0x10(%r14),%r15 f: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 16: fc ff df 19: 4c 89 fa mov %r15,%rdx 1c: 48 c1 ea 03 shr $0x3,%rdx 20: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) 24: 0f 85 f4 02 00 00 jne 0x31e * 2a: 49 8b 46 f0 mov -0x10(%r14),%rax <-- trapping instruction 2e: 49 39 c7 cmp %rax,%r15 31: 0f 84 c0 01 00 00 je 0x1f7 37: 4c 8d 73 10 lea 0x10(%rbx),%r14 3b: 48 89 ef mov %rbp,%rdi 3e: e8 .byte 0xe8 3f: 08 .byte 0x8