bisecting fixing commit since c37da90efff5f183bea6ae4c2af33571f61fe317
building syzkaller on abf9ba4fc75d9b29af15625d44dcfc1360fad3b7
testing commit c37da90efff5f183bea6ae4c2af33571f61fe317 with gcc (GCC) 8.1.0
kernel signature: 042e6e4b683b6c8947f24c2a739decee605fcd0ca4744b7a37ce324baffd3782
run #0: crashed: general protection fault in __radix_tree_lookup
run #1: crashed: INFO: trying to register non-static key in corrupted
run #2: crashed: general protection fault in mm_update_next_owner
run #3: crashed: general protection fault in __radix_tree_lookup
run #4: crashed: general protection fault in timerqueue_del
run #5: crashed: KASAN: use-after-free Read in fixup_exception
run #6: crashed: general protection fault in cfb_imageblit
run #7: crashed: kernel BUG at arch/x86/mm/physaddr.c:LINE!
run #8: crashed: kernel BUG at arch/x86/mm/physaddr.c:LINE!
run #9: crashed: kernel BUG at arch/x86/mm/physaddr.c:LINE!
testing current HEAD a1b977b49b66c75e6c51a515f6700371ae720217
testing commit a1b977b49b66c75e6c51a515f6700371ae720217 with gcc (GCC) 8.1.0
kernel signature: 0eafbdba46b9e68196dab76a48c4eaeda9676aee31fecfbacdc1fe998ae33dba
run #0: crashed: BUG: Bad page map
run #1: crashed: general protection fault in __radix_tree_lookup
run #2: crashed: general protection fault in anon_vma_interval_tree_insert
run #3: crashed: general protection fault in m_start
run #4: crashed: general protection fault in corrupted
run #5: crashed: kernel BUG at arch/x86/kernel/traps.c:LINE!
run #6: crashed: WARNING in debug_mutex_wake_waiter
run #7: crashed: general protection fault in anon_vma_interval_tree_verify
run #8: crashed: BUG: corrupted list in copy_process
run #9: crashed: kernel BUG at arch/x86/mm/physaddr.c:LINE!
revisions tested: 2, total time: 29m12.695220881s (build: 18m40.462298065s, test: 9m32.415981562s)
the crash still happens on HEAD
commit msg: Linux 4.19.150
crash: kernel BUG at arch/x86/mm/physaddr.c:LINE!
Bluetooth: hci1: command 0x0409 tx timeout
Bluetooth: hci1: command 0x041b tx timeout
Bluetooth: hci1: command 0x040f tx timeout
Bluetooth: hci1: command 0x0419 tx timeout
------------[ cut here ]------------
kernel BUG at arch/x86/mm/physaddr.c:27!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 3718 Comm: systemd-udevd Not tainted 4.19.150-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__phys_addr+0x6b/0xc0 arch/x86/mm/physaddr.c:27
Code: b6 14 11 48 89 f9 83 e1 07 38 ca 7f 04 84 d2 75 1b 0f b6 0d 00 54 f7 07 48 89 c2 48 d3 ea 48 85 d2 75 07 48 83 c4 08 5b 5d c3 <0f> 0b 48 89 45 f0 e8 da c4 65 00 48 8b 45 f0 eb d6 48 c7 c7 10 50
RSP: 0018:ffff88808ec7fb90 EFLAGS: 00010287
RAX: 0000778000077000 RBX: 0000000080077000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff88808ec76fc8 RDI: 0000000000077000
RBP: ffff88808ec7fba0 R08: ffffed1025fff6b1 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000077000 R15: ffffffff885205c0
FS:  00007f1a84ac48c0(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000558742eb0be8 CR3: 000000008f696000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 qlink_to_cache+0x9/0x40 include/linux/mm.h:665
 qlist_free_all+0x103/0x120 mm/kasan/quarantine.c:163
 quarantine_reduce+0x163/0x1a0 mm/kasan/quarantine.c:259
 kasan_kmalloc+0x9b/0xc0 mm/kasan/kasan.c:538
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490
 slab_post_alloc_hook mm/slab.h:445 [inline]
 slab_alloc mm/slab.c:3397 [inline]
 kmem_cache_alloc+0x11b/0x390 mm/slab.c:3557
 getname_flags+0xb8/0x510 fs/namei.c:140
 user_path_at_empty+0x1e/0x40 fs/namei.c:2609
 user_path_at include/linux/namei.h:57 [inline]
 vfs_statx+0xbe/0x150 fs/stat.c:185
 vfs_lstat include/linux/fs.h:3138 [inline]
 __do_sys_newlstat fs/stat.c:350 [inline]
 __se_sys_newlstat+0x85/0xe0 fs/stat.c:344
 __x64_sys_newlstat+0x4f/0x70 fs/stat.c:344
 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f1a83937335
Code: 69 db 2b 00 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 83 ff 01 48 89 f0 77 30 48 89 c7 48 89 d6 b8 06 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 03 f3 c3 90 48 8b 15 31 db 2b 00 f7 d8 64 89
RSP: 002b:00007fff78575e68 EFLAGS: 00000246 ORIG_RAX: 0000000000000006
RAX: ffffffffffffffda RBX: 0000558742e78980 RCX: 00007f1a83937335
RDX: 00007fff78575ea0 RSI: 00007fff78575ea0 RDI: 0000558742e77980
RBP: 00007fff78575f60 R08: 00007f1a83bf61f8 R09: 0000000000001010
R10: 00007f1a83bf5b58 R11: 0000000000000246 R12: 0000558742e77980
R13: 0000558742e77994 R14: 0000558742e7befd R15: 0000558742e7bf04
Modules linked in:
---[ end trace 553ad585513a747d ]---
RIP: 0010:__phys_addr+0x6b/0xc0 arch/x86/mm/physaddr.c:27
Code: b6 14 11 48 89 f9 83 e1 07 38 ca 7f 04 84 d2 75 1b 0f b6 0d 00 54 f7 07 48 89 c2 48 d3 ea 48 85 d2 75 07 48 83 c4 08 5b 5d c3 <0f> 0b 48 89 45 f0 e8 da c4 65 00 48 8b 45 f0 eb d6 48 c7 c7 10 50
RSP: 0018:ffff88808ec7fb90 EFLAGS: 00010287
RAX: 0000778000077000 RBX: 0000000080077000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff88808ec76fc8 RDI: 0000000000077000
RBP: ffff88808ec7fba0 R08: ffffed1025fff6b1 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000077000 R15: ffffffff885205c0
FS:  00007f1a84ac48c0(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000558742eb0be8 CR3: 000000008f696000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400