bisecting fixing commit since c37da90efff5f183bea6ae4c2af33571f61fe317
building syzkaller on abf9ba4fc75d9b29af15625d44dcfc1360fad3b7
testing commit c37da90efff5f183bea6ae4c2af33571f61fe317 with gcc (GCC) 8.1.0
kernel signature: 418eb518cd5fdd90c8b36ea9dc1095baad584216837b756a7a94c04bf7af8b19
run #0: crashed: general protection fault in anon_vma_interval_tree_insert
run #1: crashed: KASAN: user-memory-access Write in calculate_sigpending
run #2: crashed: PANIC: double fault in error_entry
run #3: crashed: general protection fault in __switch_to
run #4: crashed: BUG: corrupted list in tty_write_lock
run #5: crashed: WARNING in debug_mutex_wake_waiter
run #6: crashed: BUG: corrupted list in account_entity_dequeue
run #7: crashed: general protection fault in pick_next_task_fair
run #8: crashed: WARNING: locking bug in notifier_call_chain
run #9: crashed: INFO: trying to register non-static key in calculate_sigpending
testing current HEAD b09c34517e1ac4018e3bb75ed5c8610a8a1f486b
testing commit b09c34517e1ac4018e3bb75ed5c8610a8a1f486b with gcc (GCC) 8.1.0
kernel signature: c933089e0eb2122ba66760322604ca30b69426e219360aa26e2f713876a9bccb
run #0: crashed: general protection fault in timerqueue_del
run #1: crashed: general protection fault in schedule
run #2: crashed: BUG: corrupted list in __unqueue_futex
run #3: crashed: general protection fault in mm_update_next_owner
run #4: crashed: general protection fault in futex_wake
run #5: crashed: BUG: unable to handle kernel paging request in corrupted
run #6: crashed: general protection fault in futex_wait_queue_me
run #7: crashed: general protection fault in pick_next_task_fair
run #8: crashed: general protection fault in acct_collect
run #9: crashed: kernel BUG at arch/x86/mm/physaddr.c:LINE!
revisions tested: 2, total time: 27m33.651045552s (build: 18m16.098518711s, test: 8m26.138656629s)
the crash still happens on HEAD
commit msg: Linux 4.19.149
crash: kernel BUG at arch/x86/mm/physaddr.c:LINE!
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
------------[ cut here ]------------
kernel BUG at arch/x86/mm/physaddr.c:27!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 3710 Comm: systemd-udevd Not tainted 4.19.149-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__phys_addr+0x6b/0xc0 arch/x86/mm/physaddr.c:27
Code: b6 14 11 48 89 f9 83 e1 07 38 ca 7f 04 84 d2 75 1b 0f b6 0d c0 52 f7 07 48 89 c2 48 d3 ea 48 85 d2 75 07 48 83 c4 08 5b 5d c3 <0f> 0b 48 89 45 f0 e8 da c4 65 00 48 8b 45 f0 eb d6 48 c7 c7 10 50
RSP: 0018:ffff88809027fb90 EFLAGS: 00010287
RAX: 00007ef000000770 RBX: 0000077080000770 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff888090274dc8 RDI: 0000077000000770
RBP: ffff88809027fba0 R08: ffffed1025fff789 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000077000000770 R15: ffffffff885205c0
FS:  00007f42bfafc8c0(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000564c2db9e008 CR3: 000000008fc88000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 qlink_to_cache+0x9/0x40 include/linux/mm.h:665
 qlist_free_all+0x103/0x120 mm/kasan/quarantine.c:163
 quarantine_reduce+0x163/0x1a0 mm/kasan/quarantine.c:259
 kasan_kmalloc+0x9b/0xc0 mm/kasan/kasan.c:538
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490
 slab_post_alloc_hook mm/slab.h:445 [inline]
 slab_alloc mm/slab.c:3397 [inline]
 kmem_cache_alloc+0x11b/0x390 mm/slab.c:3557
 getname_flags+0xb8/0x510 fs/namei.c:140
 user_path_at_empty+0x1e/0x40 fs/namei.c:2609
 user_path_at include/linux/namei.h:57 [inline]
 vfs_statx+0xbe/0x150 fs/stat.c:185
 vfs_lstat include/linux/fs.h:3138 [inline]
 __do_sys_newlstat fs/stat.c:350 [inline]
 __se_sys_newlstat+0x85/0xe0 fs/stat.c:344
 __x64_sys_newlstat+0x4f/0x70 fs/stat.c:344
 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f42be96f335
Code: 69 db 2b 00 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 83 ff 01 48 89 f0 77 30 48 89 c7 48 89 d6 b8 06 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 03 f3 c3 90 48 8b 15 31 db 2b 00 f7 d8 64 89
RSP: 002b:00007ffc11842aa8 EFLAGS: 00000246 ORIG_RAX: 0000000000000006
RAX: ffffffffffffffda RBX: 0000564c2db7e980 RCX: 00007f42be96f335
RDX: 00007ffc11842ae0 RSI: 00007ffc11842ae0 RDI: 0000564c2db7d980
RBP: 00007ffc11842ba0 R08: 00007f42bec2e1f8 R09: 0000000000001010
R10: 0000000000000020 R11: 0000000000000246 R12: 0000564c2db7d980
R13: 0000564c2db7d994 R14: 0000564c2db8588d R15: 0000564c2db85894
Modules linked in:
---[ end trace 70b88d0cad5db78e ]---
RIP: 0010:__phys_addr+0x6b/0xc0 arch/x86/mm/physaddr.c:27
Code: b6 14 11 48 89 f9 83 e1 07 38 ca 7f 04 84 d2 75 1b 0f b6 0d c0 52 f7 07 48 89 c2 48 d3 ea 48 85 d2 75 07 48 83 c4 08 5b 5d c3 <0f> 0b 48 89 45 f0 e8 da c4 65 00 48 8b 45 f0 eb d6 48 c7 c7 10 50
RSP: 0018:ffff88809027fb90 EFLAGS: 00010287
RAX: 00007ef000000770 RBX: 0000077080000770 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff888090274dc8 RDI: 0000077000000770
RBP: ffff88809027fba0 R08: ffffed1025fff789 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000077000000770 R15: ffffffff885205c0
FS:  00007f42bfafc8c0(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000564c2db9e008 CR3: 000000008fc88000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400