bisecting fixing commit since 811218eceeaa7618652e1b8d11caeff67ab42072 building syzkaller on 624dad51316f9973e1349b6c71e789737d1e00d9 testing commit 811218eceeaa7618652e1b8d11caeff67ab42072 with gcc (GCC) 8.4.1 20210217 kernel signature: bd9ad0f8a1b5663747d8647329428d04bc67f067a6d08ab5c6610569ddafa8c2 run #0: crashed: kernel BUG in iput run #1: crashed: kernel BUG in corrupted run #2: crashed: kernel BUG in iput run #3: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop2] run #4: crashed: kernel BUG in iput run #5: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop2] run #6: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop0] run #7: crashed: kernel BUG in iput run #8: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop1] run #9: crashed: kernel BUG in iput run #10: crashed: kernel BUG in iput run #11: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop1] run #12: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop5] run #13: crashed: kernel BUG in iput run #14: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop0] run #15: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop5] run #16: crashed: kernel BUG in iput run #17: crashed: kernel BUG in corrupted run #18: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop2] run #19: crashed: kernel BUG in iput testing current HEAD dfb571610ba392179348c8472bfb131d4173d585 testing commit dfb571610ba392179348c8472bfb131d4173d585 with gcc (GCC) 8.4.1 20210217 kernel signature: ecd9e600b73172176605b2b25653a3b9b6f2382bf2ec7b71cad6aa50fdd97b60 run #0: crashed: kernel BUG in iput run #1: crashed: kernel BUG in iput run #2: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop2] run #3: crashed: kernel BUG in iput run #4: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop4] run #5: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop2] run #6: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop3] run #7: crashed: kernel BUG in iput run #8: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop3] run #9: crashed: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop0] revisions tested: 2, total time: 22m49.20212588s (build: 14m52.941436809s, test: 6m58.437066705s) the crash still happens on HEAD commit msg: Linux 4.19.178 crash: BUG: Dentry ADDR{i=0,n=/} still in use (-128) [unmount of erofs loop0] RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 000000000046702a RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f5a41118000 RBP: 00007f5a41118040 R08: 00007f5a41118040 R09: 0000000020000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000000 R13: 0000000020000100 R14: 00007f5a41118000 R15: 0000000020000140 BUG: Dentry 000000006f4886ab{i=0,n=/} still in use (-128) [unmount of erofs loop0] ------------[ cut here ]------------ WARNING: CPU: 1 PID: 10114 at fs/dcache.c:1518 umount_check fs/dcache.c:1518 [inline] WARNING: CPU: 1 PID: 10114 at fs/dcache.c:1518 umount_check.cold.19+0xe0/0x149 fs/dcache.c:1499 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 10114 Comm: syz-executor.0 Not tainted 4.19.178-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x226 lib/dump_stack.c:118 panic+0x1cd/0x375 kernel/panic.c:186 __warn.cold.7+0x1b/0x36 kernel/panic.c:541 report_bug+0x1a1/0x200 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:178 [inline] fixup_bug arch/x86/kernel/traps.c:173 [inline] do_error_trap+0x200/0x350 arch/x86/kernel/traps.c:296 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1038 RIP: 0010:umount_check fs/dcache.c:1518 [inline] RIP: 0010:umount_check.cold.19+0xe0/0x149 fs/dcache.c:1499 Code: 75 7f 49 8b 54 24 40 41 55 4d 89 f1 41 89 d8 48 89 f1 48 c7 c7 60 86 13 88 e8 b5 05 ff ff 48 c7 c7 a0 85 13 88 e8 a9 05 ff ff <0f> 0b 58 e9 e1 a0 18 fa 48 89 75 d8 e8 0c 2c 0a fa 48 8b 75 d8 e9 RSP: 0018:ffff88807f917a60 EFLAGS: 00010286 RAX: 0000000000000024 RBX: 00000000ffffff80 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff88500880 RDI: ffffffff8bad7720 RBP: ffff88807f917a90 R08: ffffed1017464e99 R09: ffffed1017464e98 R10: ffffed1017464e98 R11: ffff8880ba3274c7 R12: 0000000000000000 R13: ffff88809b280790 R14: ffffffff88d28300 R15: ffff8880addd8180 d_walk.part.6+0x151/0x6e0 fs/dcache.c:1253 d_walk fs/dcache.c:1246 [inline] do_one_tree+0x1f/0x40 fs/dcache.c:1525 shrink_dcache_for_umount+0x56/0x120 fs/dcache.c:1541 generic_shutdown_super+0x61/0x330 fs/super.c:441 kill_block_super+0x96/0xe0 fs/super.c:1185 erofs_kill_sb+0x9/0x10 drivers/staging/erofs/super.c:518 deactivate_locked_super+0x77/0xd0 fs/super.c:329 mount_bdev+0x2cb/0x330 fs/super.c:1160 erofs_mount+0x6a/0x90 drivers/staging/erofs/super.c:512 mount_fs+0x7f/0x2b0 fs/super.c:1261 vfs_kern_mount.part.11+0x58/0x3d0 fs/namespace.c:961 vfs_kern_mount fs/namespace.c:951 [inline] do_new_mount fs/namespace.c:2469 [inline] do_mount+0x376/0x2710 fs/namespace.c:2799 ksys_mount+0xb1/0xd0 fs/namespace.c:3015 __do_sys_mount fs/namespace.c:3029 [inline] __se_sys_mount fs/namespace.c:3026 [inline] __x64_sys_mount+0xb9/0x150 fs/namespace.c:3026 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x46702a Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5a41117fa8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 000000000046702a RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f5a41118000 RBP: 00007f5a41118040 R08: 00007f5a41118040 R09: 0000000020000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000000 R13: 0000000020000100 R14: 00007f5a41118000 R15: 0000000020000140 Kernel Offset: disabled Rebooting in 86400 seconds..