bisecting fixing commit since 31acccdc877486a649a86d37725a15175fcd5ed6
building syzkaller on 1bf9a662c66aa432ff2fe3bf2562578cef626c09
testing commit 31acccdc877486a649a86d37725a15175fcd5ed6 with gcc (GCC) 8.1.0
kernel signature: 58572c16bd71489c9c14c72cf4d5ece5b00eac279bd37ac57063828e3e2a6382
all runs: crashed: kernel BUG at fs/ext4/ext4.h:LINE!
testing current HEAD 675cc038067f0e530471c56a7442935f84669d95
testing commit 675cc038067f0e530471c56a7442935f84669d95 with gcc (GCC) 8.1.0
kernel signature: 7a6d7a9dff5653c0e6da195e694265a3a44f3ff7d3f31b4003e0847c3d003476
all runs: crashed: kernel BUG at fs/ext4/ext4.h:LINE!
revisions tested: 2, total time: 36m8.194673653s (build: 17m2.727477497s, test: 18m26.893461277s)
the crash still happens on HEAD
commit msg: Linux 4.19.167
crash: kernel BUG at fs/ext4/ext4.h:LINE!
EXT4-fs: failed to create workqueue
EXT4-fs (loop2): mount failed
EXT4-fs: failed to create workqueue
EXT4-fs (loop0): mount failed
------------[ cut here ]------------
kernel BUG at fs/ext4/ext4.h:2870!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 31666 Comm: syz-executor943 Not tainted 4.19.167-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:ext4_get_group_info fs/ext4/ext4.h:2870 [inline]
RIP: 0010:ext4_mb_load_buddy_gfp+0xfdd/0x1560 fs/ext4/mballoc.c:1116
Code: 0f 87 3c fc ff ff 4c 89 e7 e8 6f 63 a1 ff e9 93 fc ff ff e9 3d fa ff ff e9 9f f7 ff ff 4c 89 e7 e8 b8 14 a7 ff e9 bd fb ff ff <0f> 0b 8b 55 bc 44 89 e6 4c 89 ff e8 53 de ff ff 85 c0 41 89 c5 0f
RSP: 0018:ffff8881c6847bd8 EFLAGS: 00010286
RAX: dffffc0000000000 RBX: ffff8881c6847d50 RCX: 1ffff1103bea5c58
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8881df52e2c0
RBP: ffff8881c6847c48 R08: 1ffff1103c7279a0 R09: ffffed10395086f0
R10: ffffed10395086f0 R11: ffff8881ca843783 R12: 00000000fffcef43
R13: ffff8881df52e280 R14: ffff8881d93088c0 R15: ffff8881d9308240
FS:  00000000008ad880(0000) GS:ffff8881f6400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f120da19000 CR3: 00000001d0ce3005 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 ext4_discard_preallocations+0x9f1/0xe70 fs/ext4/mballoc.c:4089
 ext4_release_file+0x236/0x2b0 fs/ext4/file.c:98
 __fput+0x249/0x7f0 fs/file_table.c:278
 ____fput+0x9/0x10 fs/file_table.c:309
 task_work_run+0x108/0x180 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:193 [inline]
 exit_to_usermode_loop+0x185/0x1e0 arch/x86/entry/common.c:167
 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
 do_syscall_64+0x413/0x4e0 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x406571
Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 64 19 00 00 c3 48 83 ec 08 e8 6a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 b3 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007ffdb0aa2e30 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000007 RCX: 0000000000406571
RDX: fffffffffffffff7 RSI: 0000000000000000 RDI: 0000000000000006
RBP: 00000000006dec8c R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000293 R12: 000000000006cfc6
R13: 0000000000000002 R14: 20c49ba5e353f7cf R15: 0000000000000009
Modules linked in:
---[ end trace 33e7951f5f9e0a22 ]---
RIP: 0010:ext4_get_group_info fs/ext4/ext4.h:2870 [inline]
RIP: 0010:ext4_mb_load_buddy_gfp+0xfdd/0x1560 fs/ext4/mballoc.c:1116
Code: 0f 87 3c fc ff ff 4c 89 e7 e8 6f 63 a1 ff e9 93 fc ff ff e9 3d fa ff ff e9 9f f7 ff ff 4c 89 e7 e8 b8 14 a7 ff e9 bd fb ff ff <0f> 0b 8b 55 bc 44 89 e6 4c 89 ff e8 53 de ff ff 85 c0 41 89 c5 0f
RSP: 0018:ffff8881c6847bd8 EFLAGS: 00010286
RAX: dffffc0000000000 RBX: ffff8881c6847d50 RCX: 1ffff1103bea5c58
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8881df52e2c0
RBP: ffff8881c6847c48 R08: 1ffff1103c7279a0 R09: ffffed10395086f0
R10: ffffed10395086f0 R11: ffff8881ca843783 R12: 00000000fffcef43
R13: ffff8881df52e280 R14: ffff8881d93088c0 R15: ffff8881d9308240
FS:  00000000008ad880(0000) GS:ffff8881f6400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4f33434e78 CR3: 00000001d0ce3005 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400