ci2 starts bisection 2023-05-03 10:20:11.120664247 +0000 UTC m=+44719.030205784 bisecting fixing commit since 0a924817d2ed9396401e0557c6134276d2e26382 building syzkaller on 9da18ae8fa827d046ef8da48cc23c97418553c23 ensuring issue is reproducible on original commit 0a924817d2ed9396401e0557c6134276d2e26382 testing commit 0a924817d2ed9396401e0557c6134276d2e26382 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 6014de10ba1a81630eb8dece69c5b21c3c6c454bfc7deb334b538c43090f5ff4 all runs: crashed: general protection fault in gfs2_rindex_update testing current HEAD 348551ddaf311c76b01cdcbaf61b6fef06a49144 testing commit 348551ddaf311c76b01cdcbaf61b6fef06a49144 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: ea94211629faa9c5c0f6ad55c213c66dab4bc66f3a2023f619e5adc015322450 all runs: crashed: general protection fault in gfs2_rindex_update revisions tested: 2, total time: 57m45.864630845s (build: 50m8.290408842s, test: 6m22.890759288s) the crash still happens on HEAD commit msg: Merge tag 'pinctrl-v6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl crash: general protection fault in gfs2_rindex_update loop0: detected capacity change from 0 to 32768 gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" gfs2: fsid=syz:syz: Now mounting FS (format 1801)... gfs2: fsid=syz:syz.0: journal 0 mapped with 3 extents in 0ms general protection fault, probably for non-canonical address 0xdffffc0000000097: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x00000000000004b8-0x00000000000004bf] CPU: 0 PID: 5413 Comm: syz-executor.0 Not tainted 6.3.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 RIP: 0010:gfs2_rindex_update+0xa8/0x2e0 Code: f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 6e 3a 69 fe 49 8b 06 48 89 44 24 38 4c 8d b0 b8 04 00 00 4c 89 f0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 f7 e8 49 3a 69 fe 49 8b 06 48 89 44 24 RSP: 0018:ffffc90004c67180 EFLAGS: 00010202 RAX: 0000000000000097 RBX: 1ffff9200098ce38 RCX: 1ffff1100d9b15d0 RDX: 0000000000000000 RSI: ffffc90004c674a0 RDI: ffff888078ffc000 RBP: ffffc90004c67290 R08: dffffc0000000000 R09: ffffed100d99a9d1 R10: 0000000000000000 R11: dffffc0000000001 R12: ffff888078ffc000 R13: dffffc0000000000 R14: 00000000000004b8 R15: 1ffff9200098ce8c FS: 00007f07b566a700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdacb9325e8 CR3: 000000001f23e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: punch_hole+0x981/0x2d90 gfs2_truncatei_resume+0x36/0x50 gfs2_glock_wait+0x163/0x200 init_journal+0x14c5/0x20d0 init_inodes+0xcd/0x2e0 gfs2_fill_super+0x17fe/0x22b0 get_tree_bdev+0x3da/0x620 gfs2_get_tree+0x4b/0x1a0 vfs_get_tree+0x7f/0x220 do_new_mount+0x1e5/0x940 __se_sys_mount+0x20d/0x2a0 do_syscall_64+0x41/0xc0 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f07b488d5da Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f07b5669f88 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000000012551 RCX: 00007f07b488d5da RDX: 00000000200124c0 RSI: 0000000020000040 RDI: 00007f07b5669fe0 RBP: 00007f07b566a020 R08: 00007f07b566a020 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000200124c0 R13: 0000000020000040 R14: 00007f07b5669fe0 R15: 0000000020000080 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:gfs2_rindex_update+0xa8/0x2e0 Code: f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 6e 3a 69 fe 49 8b 06 48 89 44 24 38 4c 8d b0 b8 04 00 00 4c 89 f0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 f7 e8 49 3a 69 fe 49 8b 06 48 89 44 24 RSP: 0018:ffffc90004c67180 EFLAGS: 00010202 RAX: 0000000000000097 RBX: 1ffff9200098ce38 RCX: 1ffff1100d9b15d0 RDX: 0000000000000000 RSI: ffffc90004c674a0 RDI: ffff888078ffc000 RBP: ffffc90004c67290 R08: dffffc0000000000 R09: ffffed100d99a9d1 R10: 0000000000000000 R11: dffffc0000000001 R12: ffff888078ffc000 R13: dffffc0000000000 R14: 00000000000004b8 R15: 1ffff9200098ce8c FS: 00007f07b566a700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffef2442248 CR3: 000000001f23e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: f0 48 c1 e8 03 lock shr $0x3,%rax 5: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) a: 74 08 je 0x14 c: 4c 89 f7 mov %r14,%rdi f: e8 6e 3a 69 fe callq 0xfe693a82 14: 49 8b 06 mov (%r14),%rax 17: 48 89 44 24 38 mov %rax,0x38(%rsp) 1c: 4c 8d b0 b8 04 00 00 lea 0x4b8(%rax),%r14 23: 4c 89 f0 mov %r14,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 4c 89 f7 mov %r14,%rdi 34: e8 49 3a 69 fe callq 0xfe693a82 39: 49 8b 06 mov (%r14),%rax 3c: 48 rex.W 3d: 89 .byte 0x89 3e: 44 rex.R 3f: 24 .byte 0x24