bisecting fixing commit since 1bab61d3e8cd96f2badf515dcb06e4e1029bc017 building syzkaller on 4afdfa205b55633e7eb9db03a9d099d7aa324801 testing commit 1bab61d3e8cd96f2badf515dcb06e4e1029bc017 with gcc (GCC) 8.1.0 kernel signature: 6c8407a3517a2468f5433fe12ec21b3b349b7fef3864442ae1bbf47fd846bb6b all runs: crashed: kernel BUG at mm/memory.c:LINE! testing current HEAD 13d2ce42de8cb98ff952f8de6307f896203854c2 testing commit 13d2ce42de8cb98ff952f8de6307f896203854c2 with gcc (GCC) 8.1.0 kernel signature: e1fe261c3525181934571b3bf70bbaa621549d780446a77aeb814b72f79693be all runs: crashed: kernel BUG at mm/memory.c:LINE! revisions tested: 2, total time: 25m32.626209529s (build: 19m18.761244937s, test: 5m14.785337769s) the crash still happens on HEAD commit msg: Linux 4.19.163 crash: kernel BUG at mm/memory.c:LINE! next ffff8881deb11460 prev ffff8881deb11568 mm ffff8881d73f2840 prot 25 anon_vma 0000000000000000 vm_ops ffffffff87310ce0 pgoff 0 file ffff8881d7aa0300 private_data 0000000000000000 flags: 0xfe(write|exec|shared|mayread|maywrite|mayexec|mayshare) ------------[ cut here ]------------ kernel BUG at mm/memory.c:4040! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 7275 Comm: syz-executor.5 Not tainted 4.19.163-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:wp_huge_pmd mm/memory.c:4040 [inline] RIP: 0010:__handle_mm_fault+0x2177/0x41a0 mm/memory.c:4248 Code: 49 8d b6 a0 00 00 00 48 89 da 44 89 9d 10 ff ff ff e8 2d 71 fe ff 44 8b 9d 10 ff ff ff e9 28 ec ff ff 48 89 df e8 e0 9b fd ff <0f> 0b 49 8d 84 24 60 ff ff ff 48 89 c7 e8 37 ef 0b 00 41 89 c3 e9 RSP: 0018:ffff8881d9897cc8 EFLAGS: 00010296 RAX: 0000000000000137 RBX: ffff8881d8f43148 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff87678520 RDI: ffffffff8a192a60 RBP: ffff8881d9897de8 R08: ffffed103ed25081 R09: ffffed103ed25080 vma ffff8881d549be70 start 0000000020000000 end 0000000020b36000 next ffff8881d7a15c60 prev ffff8881d7a15d68 mm ffff8881d58ad600 prot 25 anon_vma 0000000000000000 vm_ops ffffffff87310ce0 pgoff 0 file ffff8881d7d1b540 private_data 0000000000000000 flags: 0xfe(write|exec|shared|mayread|maywrite|mayexec|mayshare) R10: ffffed103ed25080 R11: ffff8881f6928407 R12: ffff8881d9897dc0 R13: 1ffff1103b312fa0 R14: ffffffff87310ce0 R15: ffff8881d73f2840 FS: 00000000024b2940(0000) GS:ffff8881f6900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd3f7e07000 CR3: 00000001de625006 CR4: 00000000001606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 ------------[ cut here ]------------ DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 kernel BUG at mm/memory.c:4040! Call Trace: handle_mm_fault+0x3dd/0x8ab mm/memory.c:4295 __do_page_fault+0x50e/0xb30 arch/x86/mm/fault.c:1412 do_page_fault+0x64/0x3a7 arch/x86/mm/fault.c:1487 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1205 RIP: 0033:0x443d51 Code: 8d 15 b3 1b 0d 00 8b 0c 8a 8b 04 82 29 c8 c3 66 2e 0f 1f 84 00 00 00 00 00 48 83 fa 20 48 89 f8 73 77 f6 c2 01 74 0b 0f b6 0e <88> 0f 48 ff c6 48 ff c7 f6 c2 02 74 12 0f b7 0e 66 89 0f 48 83 c6 RSP: 002b:00007ffc31862598 EFLAGS: 00010202 RAX: 00000000200001c0 RBX: 0000000000000000 RCX: 0000000000000063 RDX: 0000000000000013 RSI: 0000000000790398 RDI: 00000000200001c0 RBP: 0000000000790378 R08: 0000000000000000 R09: 0000000000000000 R10: 00007ffc31862680 R11: 0000000000000246 R12: 0000000000790380 R13: 000000000000b828 R14: fffffffffffffffe R15: 000000000078c04c Modules linked in: invalid opcode: 0000 [#2] PREEMPT SMP KASAN CPU: 0 PID: 7305 Comm: syz-executor.1 Tainted: G D 4.19.163-syzkaller #0 ---[ end trace 8a9b64ee46f01391 ]--- Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:wp_huge_pmd mm/memory.c:4040 [inline] RIP: 0010:__handle_mm_fault+0x2177/0x41a0 mm/memory.c:4248 RIP: 0010:wp_huge_pmd mm/memory.c:4040 [inline] RIP: 0010:__handle_mm_fault+0x2177/0x41a0 mm/memory.c:4248 Code: 49 8d b6 a0 00 00 00 48 89 da 44 89 9d 10 ff ff ff e8 2d 71 fe ff 44 8b 9d 10 ff ff ff e9 28 ec ff ff 48 89 df e8 e0 9b fd ff <0f> 0b 49 8d 84 24 60 ff ff ff 48 89 c7 e8 37 ef 0b 00 41 89 c3 e9 RSP: 0018:ffff8881d7c4fcc8 EFLAGS: 00010296 RAX: 0000000000000137 RBX: ffff8881d549be70 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffffff87678520 RDI: ffffffff8a192a60 RBP: ffff8881d7c4fde8 R08: ffffed103ed05081 R09: ffffed103ed05080 R10: ffffed103ed05080 R11: ffff8881f6828407 R12: ffff8881d7c4fdc0 R13: 1ffff1103af89fa0 R14: ffffffff87310ce0 R15: ffff8881d58ad600 FS: 00000000018ff940(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000200001c0 CR3: 00000001dc68d002 CR4: 00000000001606f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: Code: 49 8d b6 a0 00 00 00 48 89 da 44 89 9d 10 ff ff ff e8 2d 71 fe ff 44 8b 9d 10 ff ff ff e9 28 ec ff ff 48 89 df e8 e0 9b fd ff <0f> 0b 49 8d 84 24 60 ff ff ff 48 89 c7 e8 37 ef 0b 00 41 89 c3 e9 handle_mm_fault+0x3dd/0x8ab mm/memory.c:4295 __do_page_fault+0x50e/0xb30 arch/x86/mm/fault.c:1412 do_page_fault+0x64/0x3a7 arch/x86/mm/fault.c:1487 vma ffff8881d9795a90 start 0000000020000000 end 0000000020b36000 next ffff8881d672fa90 prev ffff8881d672fb98 mm ffff8881d79ee240 prot 25 anon_vma 0000000000000000 vm_ops ffffffff87310ce0 pgoff 0 file ffff8881d7b9d540 private_data 0000000000000000 flags: 0xfe(write|exec|shared|mayread|maywrite|mayexec|mayshare) page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1205 RIP: 0033:0x443d51 Code: 8d 15 b3 1b 0d 00 8b 0c 8a 8b 04 82 29 c8 c3 66 2e 0f 1f 84 00 00 00 00 00 48 83 fa 20 48 89 f8 73 77 f6 c2 01 74 0b 0f b6 0e <88> 0f 48 ff c6 48 ff c7 f6 c2 02 74 12 0f b7 0e 66 89 0f 48 83 c6 RSP: 002b:00007ffc81bbe028 EFLAGS: 00010202 RAX: 00000000200001c0 RBX: 0000000000000000 RCX: 0000000000000063 RDX: 0000000000000013 RSI: 0000000000790398 RDI: 00000000200001c0 RBP: 0000000000790378 R08: 0000000000000000 R09: 0000000000000000 R10: 00007ffc81bbe110 R11: 0000000000000246 R12: 0000000000790380 R13: 000000000000b8c1 R14: fffffffffffffffe R15: 000000000078c04c ------------[ cut here ]------------ Modules linked in: kernel BUG at mm/memory.c:4040! ---[ end trace 8a9b64ee46f01392 ]--- RSP: 0018:ffff8881d9897cc8 EFLAGS: 00010296 RIP: 0010:wp_huge_pmd mm/memory.c:4040 [inline] RIP: 0010:__handle_mm_fault+0x2177/0x41a0 mm/memory.c:4248 RAX: 0000000000000137 RBX: ffff8881d8f43148 RCX: 0000000000000000 Code: 49 8d b6 a0 00 00 00 48 89 da 44 89 9d 10 ff ff ff e8 2d 71 fe ff 44 8b 9d 10 ff ff ff e9 28 ec ff ff 48 89 df e8 e0 9b fd ff <0f> 0b 49 8d 84 24 60 ff ff ff 48 89 c7 e8 37 ef 0b 00 41 89 c3 e9 invalid opcode: 0000 [#3] PREEMPT SMP KASAN RSP: 0018:ffff8881d9897cc8 EFLAGS: 00010296 CPU: 1 PID: 7296 Comm: syz-executor.0 Tainted: G D 4.19.163-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:wp_huge_pmd mm/memory.c:4040 [inline] RIP: 0010:__handle_mm_fault+0x2177/0x41a0 mm/memory.c:4248 Code: 49 8d b6 a0 00 00 00 48 89 da 44 89 9d 10 ff ff ff e8 2d 71 fe ff 44 8b 9d 10 ff ff ff e9 28 ec ff ff 48 89 df e8 e0 9b fd ff <0f> 0b 49 8d 84 24 60 ff ff ff 48 89 c7 e8 37 ef 0b 00 41 89 c3 e9 RAX: 0000000000000137 RBX: ffff8881d8f43148 RCX: 0000000000000000 RSP: 0018:ffff8881d8f27cc8 EFLAGS: 00010296 RAX: 0000000000000137 RBX: ffff8881d9795a90 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffffff87678520 RDI: ffffffff8a192a60 RBP: ffff8881d8f27de8 R08: ffffed103ed25081 R09: ffffed103ed25080 R10: ffffed103ed25080 R11: ffff8881f6928407 R12: ffff8881d8f27dc0 R13: 1ffff1103b1e4fa0 R14: ffffffff87310ce0 R15: ffff8881d79ee240 FS: 00000000026f9940(0000) GS:ffff8881f6900000(0000) knlGS:0000000000000000 RDX: 0000000000000000 RSI: ffffffff87678520 RDI: ffffffff8a192a60 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd3f7e11000 CR3: 00000001d68eb004 CR4: 00000000001606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: RBP: ffff8881d9897de8 R08: ffffed103ed25081 R09: ffffed103ed25080 R10: ffffed103ed25080 R11: ffff8881f6928407 R12: ffff8881d9897dc0 handle_mm_fault+0x3dd/0x8ab mm/memory.c:4295 __do_page_fault+0x50e/0xb30 arch/x86/mm/fault.c:1412 R13: 1ffff1103b312fa0 R14: ffffffff87310ce0 R15: ffff8881d73f2840 do_page_fault+0x64/0x3a7 arch/x86/mm/fault.c:1487 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1205 RIP: 0033:0x443d51 Code: 8d 15 b3 1b 0d 00 8b 0c 8a 8b 04 82 29 c8 c3 66 2e 0f 1f 84 00 00 00 00 00 48 83 fa 20 48 89 f8 73 77 f6 c2 01 74 0b 0f b6 0e <88> 0f 48 ff c6 48 ff c7 f6 c2 02 74 12 0f b7 0e 66 89 0f 48 83 c6 RSP: 002b:00007ffe8f35de58 EFLAGS: 00010202 RAX: 00000000200001c0 RBX: 0000000000000000 RCX: 0000000000000063 RDX: 0000000000000013 RSI: 0000000000790398 RDI: 00000000200001c0 RBP: 0000000000790378 R08: 0000000000000000 R09: 0000000000000000 R10: 00007ffe8f35df40 R11: 0000000000000246 R12: 0000000000790380 R13: 000000000000b9d5 R14: fffffffffffffffe R15: 000000000078c0ec Modules linked in: RDX: 0000000000000000 RSI: ffffffff87678520 RDI: ffffffff8a192a60 FS: 00000000018ff940(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000 RBP: ffff8881d9897de8 R08: ffffed103ed25081 R09: ffffed103ed25080 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 R10: ffffed103ed25080 R11: ffff8881f6928407 R12: ffff8881d9897dc0 CR2: 00007f41f0ae1a08 CR3: 00000001dc68d003 CR4: 00000000001606f0 ---[ end trace 8a9b64ee46f01393 ]--- DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 RIP: 0010:wp_huge_pmd mm/memory.c:4040 [inline] RIP: 0010:__handle_mm_fault+0x2177/0x41a0 mm/memory.c:4248 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 R13: 1ffff1103b312fa0 R14: ffffffff87310ce0 R15: ffff8881d73f2840