bisecting fixing commit since 1bab61d3e8cd96f2badf515dcb06e4e1029bc017
building syzkaller on 4afdfa205b55633e7eb9db03a9d099d7aa324801
testing commit 1bab61d3e8cd96f2badf515dcb06e4e1029bc017 with gcc (GCC) 8.1.0
kernel signature: 77b0e667335e207408c27074665291f2eb76cd1f4773d4df425491bf703c4499
all runs: crashed: kernel BUG at mm/memory.c:LINE!
testing current HEAD 015e94d0e37b6860e4354ce3cac56bd7c39c8992
testing commit 015e94d0e37b6860e4354ce3cac56bd7c39c8992 with gcc (GCC) 8.1.0
kernel signature: 2bb47d613454305c1ebccf735e7e9596d2005f91a2d1eeedf0d41730039f702b
all runs: crashed: kernel BUG at mm/memory.c:LINE!
revisions tested: 2, total time: 23m44.513559444s (build: 17m14.043398116s, test: 5m54.213245985s)
the crash still happens on HEAD
commit msg: Linux 4.19.146
crash: kernel BUG at mm/memory.c:LINE!
next ffff88808cc1dda8 prev ffff88808cc1deb0 mm ffff88808c456fc0
prot 25 anon_vma 0000000000000000 vm_ops ffffffff87311720
pgoff 0 file ffff88808fb70080 private_data 0000000000000000
flags: 0xfe(write|exec|shared|mayread|maywrite|mayexec|mayshare)
------------[ cut here ]------------
kernel BUG at mm/memory.c:3947!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 7833 Comm: syz-executor.4 Not tainted 4.19.146-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:wp_huge_pmd mm/memory.c:3947 [inline]
RIP: 0010:__handle_mm_fault+0x2177/0x41a0 mm/memory.c:4155
Code: 49 8d b6 a0 00 00 00 48 89 da 44 89 9d 10 ff ff ff e8 2d 71 fe ff 44 8b 9d 10 ff ff ff e9 28 ec ff ff 48 89 df e8 70 a7 fd ff <0f> 0b 49 8d 84 24 60 ff ff ff 48 89 c7 e8 a7 ee 0b 00 41 89 c3 e9
RSP: 0018:ffff88808cd2fcc8 EFLAGS: 00010296
RAX: 0000000000000137 RBX: ffff88808cc1d460 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff87678520 RDI: ffffffff8a19aa60
RBP: ffff88808cd2fde8 R08: ffffed1015d65081 R09: ffffed1015d65080
R10: ffffed1015d65080 R11: ffff8880aeb28407 R12: ffff88808cd2fdc0
R13: 1ffff110119a5fa0 R14: ffffffff87311720 R15: ffff88808c456fc0
FS:  00000000019af940(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffff5ed5ee0 CR3: 000000008d5c8000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 handle_mm_fault+0x3dd/0x8ab mm/memory.c:4202
 __do_page_fault+0x50e/0xb30 arch/x86/mm/fault.c:1412
 do_page_fault+0x64/0x3a7 arch/x86/mm/fault.c:1487
 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1205
RIP: 0033:0x443d51
Code: 8d 15 b3 1b 0d 00 8b 0c 8a 8b 04 82 29 c8 c3 66 2e 0f 1f 84 00 00 00 00 00 48 83 fa 20 48 89 f8 73 77 f6 c2 01 74 0b 0f b6 0e <88> 0f 48 ff c6 48 ff c7 f6 c2 02 74 12 0f b7 0e 66 89 0f 48 83 c6
RSP: 002b:00007ffd7357f838 EFLAGS: 00010202
RAX: 00000000200001c0 RBX: 0000000000000000 RCX: 0000000000000063
RDX: 0000000000000013 RSI: 0000000000790398 RDI: 00000000200001c0
RBP: 0000000000790378 R08: 0000000000000000 R09: 0000000000000000
R10: 00007ffd7357f920 R11: 0000000000000246 R12: 0000000000790380
R13: 000000000000c475 R14: fffffffffffffffe R15: 000000000078bfac
Modules linked in:
---[ end trace d2b012ab1bad07db ]---
RIP: 0010:wp_huge_pmd mm/memory.c:3947 [inline]
RIP: 0010:__handle_mm_fault+0x2177/0x41a0 mm/memory.c:4155
Code: 49 8d b6 a0 00 00 00 48 89 da 44 89 9d 10 ff ff ff e8 2d 71 fe ff 44 8b 9d 10 ff ff ff e9 28 ec ff ff 48 89 df e8 70 a7 fd ff <0f> 0b 49 8d 84 24 60 ff ff ff 48 89 c7 e8 a7 ee 0b 00 41 89 c3 e9
RSP: 0018:ffff88808cd2fcc8 EFLAGS: 00010296
RAX: 0000000000000137 RBX: ffff88808cc1d460 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff87678520 RDI: ffffffff8a19aa60
RBP: ffff88808cd2fde8 R08: ffffed1015d65081 R09: ffffed1015d65080
R10: ffffed1015d65080 R11: ffff8880aeb28407 R12: ffff88808cd2fdc0
R13: 1ffff110119a5fa0 R14: ffffffff87311720 R15: ffff88808c456fc0
FS:  00000000019af940(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000b90004 CR3: 000000008d5c8000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400