bisecting fixing commit since 21ad423fe5210f5aa50bd43f9ae99b655090a227 building syzkaller on 0b33604d8e2793b82ec89abecf82d92b82e3d410 testing commit 21ad423fe5210f5aa50bd43f9ae99b655090a227 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: a314803db6e4cbd93f56b660bfb084818d2d4a6d25dfb82fb3dd9bf251b126d8 run #0: crashed: WARNING in mark_buffer_dirty run #1: crashed: unregister_netdevice: waiting for DEV to become free run #2: crashed: WARNING in mark_buffer_dirty run #3: crashed: WARNING in mark_buffer_dirty run #4: crashed: WARNING in mark_buffer_dirty run #5: crashed: unregister_netdevice: waiting for DEV to become free run #6: crashed: unregister_netdevice: waiting for DEV to become free run #7: crashed: unregister_netdevice: waiting for DEV to become free run #8: crashed: WARNING in mark_buffer_dirty run #9: crashed: unregister_netdevice: waiting for DEV to become free run #10: crashed: WARNING in mark_buffer_dirty run #11: crashed: unregister_netdevice: waiting for DEV to become free run #12: crashed: unregister_netdevice: waiting for DEV to become free run #13: crashed: WARNING in mark_buffer_dirty run #14: crashed: WARNING in mark_buffer_dirty run #15: crashed: unregister_netdevice: waiting for DEV to become free run #16: crashed: unregister_netdevice: waiting for DEV to become free run #17: crashed: unregister_netdevice: waiting for DEV to become free run #18: crashed: unregister_netdevice: waiting for DEV to become free run #19: crashed: unregister_netdevice: waiting for DEV to become free testing current HEAD 74766a973637a02c32c04c1c6496e114e4855239 testing commit 74766a973637a02c32c04c1c6496e114e4855239 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 43d563d04d1dfa58860f05eb7a54112f9a0857e8c3e4d430b7043911b30904ba run #0: crashed: WARNING in mark_buffer_dirty run #1: crashed: WARNING in mark_buffer_dirty run #2: crashed: WARNING in mark_buffer_dirty run #3: crashed: WARNING in mark_buffer_dirty run #4: crashed: WARNING in mark_buffer_dirty run #5: crashed: WARNING in mark_buffer_dirty run #6: crashed: unregister_netdevice: waiting for DEV to become free run #7: crashed: WARNING in mark_buffer_dirty run #8: crashed: WARNING in mark_buffer_dirty run #9: crashed: WARNING in mark_buffer_dirty revisions tested: 2, total time: 27m38.805780129s (build: 20m57.712074147s, test: 6m17.602286041s) the crash still happens on HEAD commit msg: Linux 4.14.275 crash: WARNING in mark_buffer_dirty audit: type=1804 audit(1649798233.321:2): pid=8306 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor271" name="/root/file0/bus" dev="loop1" ino=3 res=1 BFS-fs: bfs_fill_super(): loop4 is unclean, continuing ------------[ cut here ]------------ WARNING: CPU: 0 PID: 8305 at fs/buffer.c:1149 mark_buffer_dirty+0x2c3/0x3c0 fs/buffer.c:1179 Kernel panic - not syncing: panic_on_warn set ... audit: type=1804 audit(1649798233.321:3): pid=8305 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor271" name="/root/file0/bus" dev="loop3" ino=3 res=1 CPU: 0 PID: 8305 Comm: syz-executor271 Not tainted 4.14.275-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x14b/0x1e7 lib/dump_stack.c:58 panic+0x1b0/0x358 kernel/panic.c:183 kasan: CONFIG_KASAN_INLINE enabled __warn.cold.7+0x25/0x25 kernel/panic.c:547 kasan: GPF could be caused by NULL-ptr deref or user memory access report_bug+0x1a1/0x200 lib/bug.c:183 fixup_bug arch/x86/kernel/traps.c:177 [inline] fixup_bug arch/x86/kernel/traps.c:172 [inline] do_error_trap+0x1bd/0x310 arch/x86/kernel/traps.c:295 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:314 invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:964 RIP: 0010:mark_buffer_dirty+0x2c3/0x3c0 fs/buffer.c:1149 RSP: 0018:ffff8880ab457268 EFLAGS: 00010246 RAX: 0000000000000020 RBX: ffff88808a18c000 RCX: 0000000000000000 RDX: 1ffff11011431800 RSI: ffff8880ab304400 RDI: ffff88808a18c000 RBP: ffff8880ab457288 R08: 0000000000000000 R09: 0000000000000008 R10: ffffed10111c10bf R11: ffff888088e085ff R12: ffff88808a188f18 R13: ffff8880a0b98e40 R14: ffffed10141731ed R15: ffff88808a18c000 bfs_move_block fs/bfs/file.c:43 [inline] bfs_move_blocks fs/bfs/file.c:56 [inline] bfs_get_block+0x31d/0xaf0 fs/bfs/file.c:125 general protection fault: 0000 [#1] PREEMPT SMP KASAN __block_write_begin_int+0x327/0x1640 fs/buffer.c:2038 Modules linked in: CPU: 1 PID: 8313 Comm: syz-executor271 Not tainted 4.14.275-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff8880a04f01c0 task.stack: ffff88809a8c0000 RIP: 0010:bfs_move_block fs/bfs/file.c:42 [inline] RIP: 0010:bfs_move_blocks fs/bfs/file.c:56 [inline] RIP: 0010:bfs_get_block+0x302/0xaf0 fs/bfs/file.c:125 __block_write_begin fs/buffer.c:2088 [inline] block_write_begin+0x48/0x240 fs/buffer.c:2147 RSP: 0018:ffff88809a8c7298 EFLAGS: 00010206 bfs_write_begin+0x2f/0xb0 fs/bfs/file.c:177 RAX: 0000000000000005 RBX: 000000000000001f RCX: dffffc0000000000 generic_perform_write+0x227/0x450 mm/filemap.c:3055 RDX: 0000000000000200 RSI: ffff8880941d8e00 RDI: 0000000000000028 RBP: ffff88809a8c7340 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000078 R11: ffff8880a04f01c0 R12: ffff88808a19abd0 R13: ffff8880908b4800 R14: ffffed1012116925 R15: 0000000000000000 FS: 00007f95e670c700(0000) GS:ffff8880ba700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 __generic_file_write_iter+0x205/0x590 mm/filemap.c:3180 CR2: 00007fdcc3200000 CR3: 0000000093313000 CR4: 00000000003406e0 generic_file_write_iter+0x302/0x660 mm/filemap.c:3208 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 call_write_iter include/linux/fs.h:1780 [inline] new_sync_write fs/read_write.c:469 [inline] __vfs_write+0x413/0x840 fs/read_write.c:482 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __kernel_write+0xe4/0x360 fs/read_write.c:501 __block_write_begin_int+0x327/0x1640 fs/buffer.c:2038 write_pipe_buf+0x14c/0x1e0 fs/splice.c:797 splice_from_pipe_feed fs/splice.c:502 [inline] __splice_from_pipe+0x2cb/0x720 fs/splice.c:626 __block_write_begin fs/buffer.c:2088 [inline] block_write_begin+0x48/0x240 fs/buffer.c:2147 splice_from_pipe+0xb5/0x110 fs/splice.c:661 bfs_write_begin+0x2f/0xb0 fs/bfs/file.c:177 generic_perform_write+0x227/0x450 mm/filemap.c:3055 default_file_splice_write+0x18/0x50 fs/splice.c:809 do_splice_from fs/splice.c:851 [inline] direct_splice_actor+0x104/0x1c0 fs/splice.c:1018 splice_direct_to_actor+0x27c/0x750 fs/splice.c:973 __generic_file_write_iter+0x205/0x590 mm/filemap.c:3180 generic_file_write_iter+0x302/0x660 mm/filemap.c:3208 call_write_iter include/linux/fs.h:1780 [inline] new_sync_write fs/read_write.c:469 [inline] __vfs_write+0x413/0x840 fs/read_write.c:482 do_splice_direct+0x144/0x250 fs/splice.c:1061 __kernel_write+0xe4/0x360 fs/read_write.c:501 do_sendfile+0x46c/0xcf0 fs/read_write.c:1441 write_pipe_buf+0x14c/0x1e0 fs/splice.c:797 splice_from_pipe_feed fs/splice.c:502 [inline] __splice_from_pipe+0x2cb/0x720 fs/splice.c:626 SYSC_sendfile64 fs/read_write.c:1502 [inline] SyS_sendfile64+0xf5/0x110 fs/read_write.c:1488 splice_from_pipe+0xb5/0x110 fs/splice.c:661 default_file_splice_write+0x18/0x50 fs/splice.c:809 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 do_splice_from fs/splice.c:851 [inline] direct_splice_actor+0x104/0x1c0 fs/splice.c:1018 entry_SYSCALL_64_after_hwframe+0x46/0xbb splice_direct_to_actor+0x27c/0x750 fs/splice.c:973 RIP: 0033:0x7f95e675f619 RSP: 002b:00007f95e670c2f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 RAX: ffffffffffffffda RBX: 00007f95e67e4420 RCX: 00007f95e675f619 RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003 do_splice_direct+0x144/0x250 fs/splice.c:1061 RBP: 00007f95e67b10a4 R08: 0000000000000000 R09: 0000000000000000 R10: 00008400fffffffa R11: 0000000000000246 R12: 0030656c69662f2e R13: 000010011badface R14: 75ca34411a118209 R15: 00007f95e67e4428 do_sendfile+0x46c/0xcf0 fs/read_write.c:1441 SYSC_sendfile64 fs/read_write.c:1502 [inline] SyS_sendfile64+0xf5/0x110 fs/read_write.c:1488 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f95e675f619 RSP: 002b:00007f95e670c2f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 RAX: ffffffffffffffda RBX: 00007f95e67e4420 RCX: 00007f95e675f619 RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003 RBP: 00007f95e67b10a4 R08: 0000000000000000 R09: 0000000000000000 R10: 00008400fffffffa R11: 0000000000000246 R12: 0030656c69662f2e R13: 000010011badface R14: 75ca34411a118209 R15: 00007f95e67e4428 Code: 48 89 f8 48 c1 e8 03 80 3c 08 00 0f 85 0b 06 00 00 49 8d 7f 28 49 8b 74 24 28 48 b9 00 00 00 00 00 fc ff df 48 89 f8 48 c1 e8 03 <80> 3c 08 00 0f 85 c1 05 00 00 49 8b 7f 28 e8 8b 85 ad ff 4c 89 RIP: bfs_move_block fs/bfs/file.c:42 [inline] RSP: ffff88809a8c7298 RIP: bfs_move_blocks fs/bfs/file.c:56 [inline] RSP: ffff88809a8c7298 RIP: bfs_get_block+0x302/0xaf0 fs/bfs/file.c:125 RSP: ffff88809a8c7298 Kernel Offset: disabled Rebooting in 86400 seconds.. ---------------- Code disassembly (best guess): 0: 48 89 f8 mov %rdi,%rax 3: 48 c1 e8 03 shr $0x3,%rax 7: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) b: 0f 85 0b 06 00 00 jne 0x61c 11: 49 8d 7f 28 lea 0x28(%r15),%rdi 15: 49 8b 74 24 28 mov 0x28(%r12),%rsi 1a: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx 21: fc ff df 24: 48 89 f8 mov %rdi,%rax 27: 48 c1 e8 03 shr $0x3,%rax * 2b: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction 2f: 0f 85 c1 05 00 00 jne 0x5f6 35: 49 8b 7f 28 mov 0x28(%r15),%rdi 39: e8 8b 85 ad ff callq 0xffad85c9 3e: 4c rex.WR 3f: 89 .byte 0x89