bisecting fixing commit since 3f2ecb86cb909da0b9157fd2952ad79924cbe5ae building syzkaller on 04201c0669446145fd9c347c5538da0ca13ff29b testing commit 3f2ecb86cb909da0b9157fd2952ad79924cbe5ae with gcc (GCC) 8.1.0 kernel signature: df71d1ab0b450e3a7ae3b290173019534451c6e88f136a36349dbe53add7d3de all runs: crashed: inconsistent lock state in free_huge_page testing current HEAD 2762b48e9611529239da2e68cba908dbbec9805f testing commit 2762b48e9611529239da2e68cba908dbbec9805f with gcc (GCC) 8.1.0 kernel signature: 89b188072f400cd9a70e57a6d6774c3b91be3318c1835ed1acf0883c22072b4c all runs: crashed: inconsistent lock state in free_huge_page revisions tested: 2, total time: 22m13.148657556s (build: 16m11.06666297s, test: 5m35.822250196s) the crash still happens on HEAD commit msg: Linux 4.14.216 crash: inconsistent lock state in free_huge_page IPv6: ADDRCONF(NETDEV_UP): veth1_vlan: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready ================================ WARNING: inconsistent lock state 4.14.216-syzkaller #0 Not tainted -------------------------------- inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage. syz-executor.5/9692 [HC1[1]:SC0[0]:HE0:SE1] takes: ( IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready hugetlb_lock){?.+.}, at: [] spin_lock include/linux/spinlock.h:317 [inline] hugetlb_lock){?.+.}, at: [] free_huge_page+0x5a8/0x800 mm/hugetlb.c:1291 {HARDIRQ-ON-W} state was registered at: mark_irqflags kernel/locking/lockdep.c:3086 [inline] __lock_acquire+0xef4/0x42d0 kernel/locking/lockdep.c:3448 lock_acquire+0x17e/0x3e0 kernel/locking/lockdep.c:3998 IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:152 spin_lock include/linux/spinlock.h:317 [inline] hugetlb_overcommit_handler+0x25d/0x4f0 mm/hugetlb.c:2992 proc_sys_call_handler.isra.20+0x162/0x1f0 fs/proc/proc_sysctl.c:598 proc_sys_write+0x37/0x60 fs/proc/proc_sysctl.c:616 __vfs_write+0xdb/0x840 fs/read_write.c:480 vfs_write+0x150/0x4f0 fs/read_write.c:544 IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready SYSC_write fs/read_write.c:590 [inline] SyS_write+0x100/0x250 fs/read_write.c:582 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb irq event stamp: 280 IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready hardirqs last enabled at (279): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] hardirqs last enabled at (279): [] _raw_spin_unlock_irqrestore+0x82/0xd0 kernel/locking/spinlock.c:192 hardirqs last disabled at (280): [] common_interrupt+0x95/0x9a arch/x86/entry/entry_64.S:576 softirqs last enabled at (0): [] copy_process.part.5+0x1317/0x6e70 kernel/fork.c:1733 IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready softirqs last disabled at (0): [< (null)>] (null) other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(hugetlb_lock); lock(hugetlb_lock); *** DEADLOCK *** 1 lock held by syz-executor.5/9692: IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready #0: (&(&virtscsi_vq->vq_lock)->rlock){-.-.}, at: [] virtscsi_vq_done+0x8d/0x120 drivers/scsi/virtio_scsi.c:219 stack backtrace: batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 CPU: 1 PID: 9692 Comm: syz-executor.5 Not tainted 4.14.216-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x14b/0x1e7 lib/dump_stack.c:58 print_usage_bug.cold.46+0x433/0x563 kernel/locking/lockdep.c:2589 valid_state kernel/locking/lockdep.c:2602 [inline] mark_lock_irq kernel/locking/lockdep.c:2796 [inline] mark_lock+0xc00/0x11a0 kernel/locking/lockdep.c:3194 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! mark_irqflags kernel/locking/lockdep.c:3069 [inline] __lock_acquire+0x1214/0x42d0 kernel/locking/lockdep.c:3448 batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready lock_acquire+0x17e/0x3e0 kernel/locking/lockdep.c:3998 batman_adv: batadv0: Interface activated: batadv_slave_1 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:152 spin_lock include/linux/spinlock.h:317 [inline] free_huge_page+0x5a8/0x800 mm/hugetlb.c:1291 __put_compound_page+0x67/0xa0 mm/swap.c:95 __put_page+0x5d/0x280 mm/swap.c:111 put_page include/linux/mm.h:875 [inline] bio_check_pages_dirty+0x24d/0x470 block/bio.c:1794 dio_bio_complete+0x3d9/0x690 fs/direct-io.c:553 IPv6: ADDRCONF(NETDEV_UP): veth1_macvtap: link is not ready dio_bio_end_aio+0x41/0x430 fs/direct-io.c:358 bio_endio.part.11+0x23f/0x5d0 block/bio.c:1918 bio_endio+0x9/0x10 block/bio.c:1888 req_bio_endio block/blk-core.c:204 [inline] blk_update_request+0x284/0x9b0 block/blk-core.c:2765 device veth0_vlan entered promiscuous mode scsi_end_request+0x74/0x8e0 drivers/scsi/scsi_lib.c:659 device veth1_vlan entered promiscuous mode scsi_io_completion+0xa3c/0x1890 drivers/scsi/scsi_lib.c:885 IPv6: ADDRCONF(NETDEV_UP): macvlan0: link is not ready scsi_finish_command+0x39d/0x560 drivers/scsi/scsi.c:248 IPv6: ADDRCONF(NETDEV_UP): macvlan1: link is not ready scsi_softirq_done+0x2b2/0x360 drivers/scsi/scsi_lib.c:1671 __blk_mq_complete_request+0x2c6/0x640 block/blk-mq.c:571 blk_mq_complete_request+0x44/0x50 block/blk-mq.c:591 scsi_mq_done+0x61/0x260 drivers/scsi/scsi_lib.c:1979 virtscsi_complete_cmd+0x4eb/0x8d0 drivers/scsi/virtio_scsi.c:207 IPv6: ADDRCONF(NETDEV_UP): veth0_macvtap: link is not ready virtscsi_vq_done+0xa7/0x120 drivers/scsi/virtio_scsi.c:223 IPv6: ADDRCONF(NETDEV_UP): veth1_macvtap: link is not ready virtscsi_req_done+0xa1/0xc0 drivers/scsi/virtio_scsi.c:238 vring_interrupt+0x100/0x1c0 drivers/virtio/virtio_ring.c:954 device veth0_macvtap entered promiscuous mode __handle_irq_event_percpu+0xdc/0x6c0 kernel/irq/handle.c:147 handle_irq_event_percpu+0x64/0x120 kernel/irq/handle.c:187 IPv6: ADDRCONF(NETDEV_UP): macvtap0: link is not ready device veth1_macvtap entered promiscuous mode handle_irq_event+0xa2/0x130 kernel/irq/handle.c:204 handle_edge_irq+0x206/0x780 kernel/irq/chip.c:770 IPv6: ADDRCONF(NETDEV_UP): macsec0: link is not ready generic_handle_irq_desc include/linux/irqdesc.h:159 [inline] handle_irq+0x37/0x50 arch/x86/kernel/irq_64.c:87 do_IRQ+0x98/0x1d0 arch/x86/kernel/irq.c:230 common_interrupt+0x9a/0x9a arch/x86/entry/entry_64.S:576 IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline] RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0xaf/0xd0 kernel/locking/spinlock.c:192 RSP: 0018:ffff88809afe78a8 EFLAGS: 00000286 IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready ORIG_RAX: ffffffffffffff6e RAX: dffffc0000000000 RBX: 0000000000000286 RCX: 0000000000000000 RDX: 1ffffffff11e10b9 RSI: 0000000000000001 RDI: 0000000000000286 RBP: ffff88809afe78b8 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff893cfe80 batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 R13: 0000000000000000 R14: ffff88809a1519c8 R15: ffff88809a0e1810 spin_unlock_irqrestore include/linux/spinlock.h:372 [inline] percpu_ref_kill_and_confirm+0x129/0x230 lib/percpu-refcount.c:340 percpu_ref_kill include/linux/percpu-refcount.h:121 [inline] kill_ioctx+0x19d/0x250 fs/aio.c:872 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! exit_aio+0x186/0x2e0 fs/aio.c:914 __mmput kernel/fork.c:927 [inline] mmput+0x7d/0x360 kernel/fork.c:951 batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 exit_mm kernel/exit.c:548 [inline] do_exit+0x8ee/0x2c90 kernel/exit.c:855 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! do_group_exit+0xf8/0x2c0 kernel/exit.c:965 get_signal+0x2f6/0x1ab0 kernel/signal.c:2423 do_signal+0x7f/0x18b0 arch/x86/kernel/signal.c:814 batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 exit_to_usermode_loop+0x11e/0x190 arch/x86/entry/common.c:160 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline] syscall_return_slowpath arch/x86/entry/common.c:270 [inline] do_syscall_64+0x416/0x5b0 arch/x86/entry/common.c:297 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45e149 batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 RSP: 002b:00007fc92bbc1cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: 0000000000000001 RBX: 000000000119c030 RCX: 000000000045e149 RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 000000000119c034 RBP: 000000000119c028 R08: 000000000000000e R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000246 R12: 000000000119c034 R13: 00007ffddc9b88af R14: 00007fc92bbc29c0 R15: 000000000119c034 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! Bluetooth: hci1 command 0x0419 tx timeout IPv6: ADDRCONF(NETDEV_UP): batadv_slave_0: link is not ready Bluetooth: hci0 command 0x0419 tx timeout batman_adv: batadv0: Interface activated: batadv_slave_0 Bluetooth: hci4 command 0x0419 tx timeout IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready device veth0_macvtap entered promiscuous mode Bluetooth: hci5 command 0x0419 tx timeout IPv6: ADDRCONF(NETDEV_UP): macvtap0: link is not ready device veth1_macvtap entered promiscuous mode Bluetooth: hci2 command 0x0419 tx timeout Bluetooth: hci3 command 0x0419 tx timeout batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready batman_adv: batadv0: Interface activated: batadv_slave_1 IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! IPv6: ADDRCONF(NETDEV_UP): batadv_slave_0: link is not ready batman_adv: batadv0: Interface activated: batadv_slave_0 IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready batman_adv: batadv0: Interface activated: batadv_slave_1 IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready