bisecting fixing commit since 34d4ddd359dbcdf6c5fb3f85a179243d7a1cb7f8
building syzkaller on 409809d8a7c9c775eaea317add40e7a86a1e836c
testing commit 34d4ddd359dbcdf6c5fb3f85a179243d7a1cb7f8 with gcc (GCC) 8.1.0
kernel signature: 6f3ea505a5ae79e9fe94e988ef16049b22c6ad976f245563809717635200457a
run #0: crashed: BUG: unable to handle kernel paging request in pmd_trans_migrating
run #1: crashed: INFO: trying to register non-static key in calculate_sigpending
run #2: crashed: PANIC: double fault in __switch_to_asm
run #3: crashed: general protection fault in __enqueue_entity
run #4: crashed: BUG: unable to handle kernel paging request in anon_vma_interval_tree_insert
run #5: crashed: BUG: unable to handle kernel NULL pointer dereference in mm_update_next_owner
run #6: crashed: general protection fault in __enqueue_entity
run #7: crashed: BUG: unable to handle kernel paging request in corrupted
run #8: crashed: BUG: unable to handle kernel NULL pointer dereference in do_swap_page
run #9: crashed: BUG: unable to handle kernel NULL pointer dereference in rcu_core
testing current HEAD 6f2f486d57c4d562cdf4932320b66fbb878ab1c4
testing commit 6f2f486d57c4d562cdf4932320b66fbb878ab1c4 with gcc (GCC) 8.1.0
kernel signature: 990b1916307b67b479448b0c78be630169358b7bddd3add5c16c1b54202e1a7d
run #0: crashed: BUG: unable to handle kernel NULL pointer dereference in psi_task_change
run #1: crashed: BUG: unable to handle kernel NULL pointer dereference in do_swap_page
run #2: crashed: BUG: unable to handle kernel NULL pointer dereference in anon_vma_interval_tree_verify
run #3: crashed: BUG: unable to handle kernel paging request in wait_consider_task
run #4: crashed: BUG: unable to handle kernel NULL pointer dereference in corrupted
run #5: crashed: general protection fault in set_next_entity
run #6: crashed: BUG: unable to handle kernel paging request in wait_consider_task
run #7: crashed: BUG: unable to handle kernel NULL pointer dereference in anon_vma_interval_tree_insert
run #8: crashed: unexpected kernel reboot
run #9: crashed: BUG: unable to handle kernel NULL pointer dereference in anon_vma_interval_tree_insert
revisions tested: 2, total time: 20m11.392859993s (build: 10m5.912065832s, test: 9m37.194983848s)
the crash still happens on HEAD
commit msg: Merge tag 'spi-fix-v5.9-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
crash: BUG: unable to handle kernel NULL pointer dereference in anon_vma_interval_tree_insert
BUG: kernel NULL pointer dereference, address: 0000000000000098
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 127d7f067 P4D 127d7f067 PUD 127d7e067 PMD 0 
Oops: 0000 [#1] PREEMPT SMP
CPU: 0 PID: 17628 Comm: syz-executor.1 Not tainted 5.9.0-rc8-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__anon_vma_interval_tree_insert mm/interval_tree.c:71 [inline]
RIP: 0010:anon_vma_interval_tree_insert+0x6a/0xb0 mm/interval_tree.c:82
Code: 89 f1 48 c1 ea 0c 49 8d 7c 12 ff eb 07 48 8d 4a 10 49 89 d1 48 8b 11 48 85 d2 74 20 48 3b 7a 18 76 04 48 89 7a 18 48 8b 4a e0 <4c> 3b 91 98 00 00 00 72 da 48 8d 4a 08 45 31 c0 eb d5 48 89 78 38
RSP: 0018:ffffc90001113c80 EFLAGS: 00010246
RAX: ffff88810ebd1a50 RBX: ffff88811e1a6480 RCX: 0000000000000000
RDX: ffff888000129e80 RSI: ffff88811e1a6530 RDI: 00000000000016aa
RBP: ffff88811d46eaf0 R08: 0000000000000000 R09: ffff8880b1d2eb10
R10: 0000000000001590 R11: e6628273309dfd13 R12: ffff88811e1a6480
R13: ffff88800fbf9578 R14: ffff88811e1a6480 R15: ffff88810ebd1a50
FS:  000000000177a940(0000) GS:ffff88812c000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000098 CR3: 0000000122268000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 anon_vma_clone+0x95/0x1a0 mm/rmap.c:292
 anon_vma_fork+0x28/0x130 mm/rmap.c:345
 dup_mmap kernel/fork.c:548 [inline]
 dup_mm+0x4a6/0x580 kernel/fork.c:1355
 copy_mm kernel/fork.c:1411 [inline]
 copy_process+0x1515/0x1d50 kernel/fork.c:2070
 _do_fork+0x98/0x730 kernel/fork.c:2429
 __do_sys_clone+0x66/0x80 kernel/fork.c:2546
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45bb8a
Code: f7 d8 64 89 04 25 d4 02 00 00 64 4c 8b 0c 25 10 00 00 00 31 d2 4d 8d 91 d0 02 00 00 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 f5 00 00 00 85 c0 41 89 c5 0f 85 fc 00 00
RSP: 002b:00007ffd57ca5670 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007ffd57ca5670 RCX: 000000000045bb8a
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 00007ffd57ca56b0 R08: 0000000000000001 R09: 000000000177a940
R10: 000000000177ac10 R11: 0000000000000246 R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffd57ca5700
Modules linked in:
CR2: 0000000000000098
---[ end trace 3fc0ed74814ff430 ]---
RIP: 0010:__anon_vma_interval_tree_insert mm/interval_tree.c:71 [inline]
RIP: 0010:anon_vma_interval_tree_insert+0x6a/0xb0 mm/interval_tree.c:82
Code: 89 f1 48 c1 ea 0c 49 8d 7c 12 ff eb 07 48 8d 4a 10 49 89 d1 48 8b 11 48 85 d2 74 20 48 3b 7a 18 76 04 48 89 7a 18 48 8b 4a e0 <4c> 3b 91 98 00 00 00 72 da 48 8d 4a 08 45 31 c0 eb d5 48 89 78 38
RSP: 0018:ffffc90001113c80 EFLAGS: 00010246
RAX: ffff88810ebd1a50 RBX: ffff88811e1a6480 RCX: 0000000000000000
RDX: ffff888000129e80 RSI: ffff88811e1a6530 RDI: 00000000000016aa
RBP: ffff88811d46eaf0 R08: 0000000000000000 R09: ffff8880b1d2eb10
R10: 0000000000001590 R11: e6628273309dfd13 R12: ffff88811e1a6480
R13: ffff88800fbf9578 R14: ffff88811e1a6480 R15: ffff88810ebd1a50
FS:  000000000177a940(0000) GS:ffff88812c000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff21d1ccdb8 CR3: 0000000122268000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400