ci starts bisection 2023-06-03 11:22:14.082310767 +0000 UTC m=+163287.580265321 bisecting cause commit starting from 4ecd704a4c51fd95973fcc3a60444e0e24eb9439 building syzkaller on a4ae4f428721da42ac15f07d6f3b54584dedee27 ensuring issue is reproducible on original commit 4ecd704a4c51fd95973fcc3a60444e0e24eb9439 testing commit 4ecd704a4c51fd95973fcc3a60444e0e24eb9439 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 8651fb6252151881ff69d52766841c4329b5547ba35d21558234cbed531b1038 all runs: crashed: WARNING in invalidate_bh_lru testing release v6.3 testing commit 457391b0380335d5e9a5babdec90ac53928b23b4 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 415712fc081e3bd0c825b1a7210fb49b50c3c5202792e36f7120b25875d59626 all runs: crashed: WARNING in invalidate_bh_lru testing release v6.2 testing commit c9c3395d5e3dcc6daee66c6908354d47bf98cb0c gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 05fc4e9f394f6f01bf48cd2c7e91f5777718b3a900cd7f0ee8b9305a1fabcd3a all runs: crashed: WARNING in invalidate_bh_lru testing release v6.1 testing commit 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 5b2c61e3b6e76037e8fc5139aa3317e61d8a75d2679b80dfb22988350a341b47 all runs: crashed: WARNING in invalidate_bh_lru testing release v6.0 testing commit 4fe89d07dcc2804c8b562f6c7896a45643d34b2f gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 9adca45670c3c4d5fcd91d9dcf62372d06b982274bedc8bea067a6868039a97d all runs: crashed: WARNING in invalidate_bh_lru testing release v5.19 testing commit 3d7cb6b04c3f3115719235cc6866b10326de34cd gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 3ff2cf93b4d8bf7ebcceaa398eda3bb424f109c66548e435d9c36fbaf4105911 all runs: crashed: WARNING in invalidate_bh_lru testing release v5.18 testing commit 4b0986a3613c92f4ec1bdc7f60ec66fea135991f gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 70d008ef27018ece2a52dd4fd54e21bde524d4e70c0cd27cd0ba56aefb1b1415 all runs: OK # git bisect start 3d7cb6b04c3f3115719235cc6866b10326de34cd 4b0986a3613c92f4ec1bdc7f60ec66fea135991f Bisecting: 8493 revisions left to test after this (roughly 13 steps) [c011dd537ffe47462051930413fed07dbdc80313] Merge tag 'arm-soc-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc testing commit c011dd537ffe47462051930413fed07dbdc80313 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: e94830355fccb3efb7fc93c17910bbf3a9864db928333a1bdf92aaab3eb48c39 all runs: OK # git bisect good c011dd537ffe47462051930413fed07dbdc80313 Bisecting: 4244 revisions left to test after this (roughly 12 steps) [5d4af9c1f04ab0411ba5818baad9a68e87f33099] Merge branch 'mv88e6xxx-fixes-for-reading-serdes-state' testing commit 5d4af9c1f04ab0411ba5818baad9a68e87f33099 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 9d8715bde779b59d5d3df408eb5763aff265e111512daf2770a171bc905bee0d all runs: crashed: WARNING in invalidate_bh_lru # git bisect bad 5d4af9c1f04ab0411ba5818baad9a68e87f33099 Bisecting: 2116 revisions left to test after this (roughly 11 steps) [7e284070abe53d448517b80493863595af4ab5f0] Merge tag 'for-5.19/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm testing commit 7e284070abe53d448517b80493863595af4ab5f0 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 7eb6aa067ca66cd9f2ff39d93e8d4cc8bd63e0c22208043e20dde550f2399deb all runs: OK # git bisect good 7e284070abe53d448517b80493863595af4ab5f0 Bisecting: 1073 revisions left to test after this (roughly 10 steps) [664a393a2663a0f62fc1b18157ccae33dcdbb8c8] Merge tag 'input-for-v5.19-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input testing commit 664a393a2663a0f62fc1b18157ccae33dcdbb8c8 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 25ee76141e584602f84dbadec24a011146f066b32a5ef413a6a0b36c36ff151e all runs: crashed: WARNING in invalidate_bh_lru # git bisect bad 664a393a2663a0f62fc1b18157ccae33dcdbb8c8 Bisecting: 492 revisions left to test after this (roughly 9 steps) [d075c0c1be279c5f4c6688ac0442fff6494e56bc] Merge tag 'v5.19-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 testing commit d075c0c1be279c5f4c6688ac0442fff6494e56bc gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: bffdc9ea1fa179f44e102be159149ce450b88c6e1f8a0ada347aa7e972ba8ce1 all runs: crashed: WARNING in invalidate_bh_lru # git bisect bad d075c0c1be279c5f4c6688ac0442fff6494e56bc Bisecting: 362 revisions left to test after this (roughly 8 steps) [71cc785d295527587faa8e3d825ef7c0e1cb2d12] Merge branch 'clk-qcom' into clk-next testing commit 71cc785d295527587faa8e3d825ef7c0e1cb2d12 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 2670f92bff29b539af952d98d13b2768727168b7773dc347c3bd7611f2c1dbea all runs: OK # git bisect good 71cc785d295527587faa8e3d825ef7c0e1cb2d12 Bisecting: 176 revisions left to test after this (roughly 8 steps) [3cc30140dbe2df9b5ac000898e0ae3d1df980f2c] Merge tag 'pci-v5.19-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci testing commit 3cc30140dbe2df9b5ac000898e0ae3d1df980f2c gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 06ecda1fcb179c69f35d9938b9d7deeea60e400770c6e356da0df9e5b9a5b238 all runs: crashed: WARNING in invalidate_bh_lru # git bisect bad 3cc30140dbe2df9b5ac000898e0ae3d1df980f2c Bisecting: 83 revisions left to test after this (roughly 7 steps) [8291eaafed36f575f23951f3ce18407f480e9ecf] Merge tag 'mm-stable-2022-05-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm testing commit 8291eaafed36f575f23951f3ce18407f480e9ecf gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: db1a6eda886d7569eba9af222fa82a548d02070687c2e3101c226186c995080a all runs: crashed: WARNING in invalidate_bh_lru # git bisect bad 8291eaafed36f575f23951f3ce18407f480e9ecf Bisecting: 50 revisions left to test after this (roughly 6 steps) [cd290a9839cee2f6641558877e707bd373c8f6f1] lib/string_helpers: fix not adding strarray to device's resource list testing commit cd290a9839cee2f6641558877e707bd373c8f6f1 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 48872cb1b98f5173ae3a012ecb4abd209e9655324720bba9a364af58930cce2d all runs: crashed: WARNING in invalidate_bh_lru # git bisect bad cd290a9839cee2f6641558877e707bd373c8f6f1 Bisecting: 25 revisions left to test after this (roughly 5 steps) [f485922d8fe4e44f6d52a5bb95a603b7c65554bb] pipe: make poll_usage boolean and annotate its access testing commit f485922d8fe4e44f6d52a5bb95a603b7c65554bb gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 86e4010468e5487dc8f09b147bcd206a702681d001d05cf35d94021a14eaa171 all runs: OK # git bisect good f485922d8fe4e44f6d52a5bb95a603b7c65554bb Bisecting: 12 revisions left to test after this (roughly 4 steps) [f6e2c20ca7604e6a267c93a511d19dda72573be1] fs: sysv: check sbi->s_firstdatazone in complete_read_super testing commit f6e2c20ca7604e6a267c93a511d19dda72573be1 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 94d6973bb44cb396631590220222dac464164f630077a071d46059045f4e2441 all runs: crashed: WARNING in invalidate_bh_lru # git bisect bad f6e2c20ca7604e6a267c93a511d19dda72573be1 Bisecting: 6 revisions left to test after this (roughly 3 steps) [f26b2afd53e70db67be8252d340b4a1387ec8b55] ptrace: remove redudant check of #ifdef PTRACE_SINGLESTEP testing commit f26b2afd53e70db67be8252d340b4a1387ec8b55 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 9f7a249f9aaff7bdaf0869ef0314683fdffe645d87fc07b08d1865707a51e62c all runs: OK # git bisect good f26b2afd53e70db67be8252d340b4a1387ec8b55 Bisecting: 3 revisions left to test after this (roughly 2 steps) [16b0b7adabfb5564a77fa35917afe08decd55b29] kexec: remove redundant assignments testing commit 16b0b7adabfb5564a77fa35917afe08decd55b29 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: fcc203aebc6689110ab0744eac4aa1555c95666cad7eba4befaf031bfcc732d7 all runs: OK # git bisect good 16b0b7adabfb5564a77fa35917afe08decd55b29 Bisecting: 1 revision left to test after this (roughly 1 step) [0e0af57e0e91b304f36b7d1dba859e3c04094273] taskstats: version 12 with thread group and exe info testing commit 0e0af57e0e91b304f36b7d1dba859e3c04094273 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 072175d0459c90ae24f52d743bb0802513d5c7b6ff8f899a56907fe46e75ec24 all runs: OK # git bisect good 0e0af57e0e91b304f36b7d1dba859e3c04094273 Bisecting: 0 revisions left to test after this (roughly 0 steps) [edc73c7261ca3ea79867437bb0b9dab0e232436c] kernel: make taskstats available from all net namespaces testing commit edc73c7261ca3ea79867437bb0b9dab0e232436c gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 9c8c21c65aa1375df790193ac3a33d998c185fcbadd55296537f862f30efa220 all runs: OK # git bisect good edc73c7261ca3ea79867437bb0b9dab0e232436c f6e2c20ca7604e6a267c93a511d19dda72573be1 is the first bad commit commit f6e2c20ca7604e6a267c93a511d19dda72573be1 Author: Liu Shixin Date: Fri Apr 29 14:38:04 2022 -0700 fs: sysv: check sbi->s_firstdatazone in complete_read_super sbi->s_firstinodezone is initialized to 2 and sbi->s_firstdatazone is read from sbd. There's no guarantee that sbi->s_firstdatazone must bigger than sbi->s_firstinodezone. If sbi->s_firstdatazone less than 2, the filesystem can still be mounted unexpetly. At this point, sbi->s_ninodes flip to very large value and this filesystem is broken. We can observe this by executing 'df' command. When we execute, we will get an error message: "sysv_count_free_inodes: unable to read inode table" Link: https://lkml.kernel.org/r/20220330104215.530223-1-liushixin2@huawei.com Signed-off-by: Liu Shixin Reviewed-by: Christoph Hellwig Signed-off-by: Andrew Morton fs/sysv/super.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) culprit signature: 94d6973bb44cb396631590220222dac464164f630077a071d46059045f4e2441 parent signature: 9c8c21c65aa1375df790193ac3a33d998c185fcbadd55296537f862f30efa220 revisions tested: 22, total time: 6h12m31.472259649s (build: 4h2m32.660792684s, test: 2h5m27.856741145s) first bad commit: f6e2c20ca7604e6a267c93a511d19dda72573be1 fs: sysv: check sbi->s_firstdatazone in complete_read_super recipients (to): ["akpm@linux-foundation.org" "hch@lst.de" "liushixin2@huawei.com"] recipients (cc): [] crash: WARNING in invalidate_bh_lru ------------[ cut here ]------------ VFS: brelse: Trying to free free buffer WARNING: CPU: 0 PID: 3974 at fs/buffer.c:1145 __brelse fs/buffer.c:1145 [inline] WARNING: CPU: 0 PID: 3974 at fs/buffer.c:1145 brelse include/linux/buffer_head.h:290 [inline] WARNING: CPU: 0 PID: 3974 at fs/buffer.c:1145 __invalidate_bh_lrus fs/buffer.c:1391 [inline] WARNING: CPU: 0 PID: 3974 at fs/buffer.c:1145 invalidate_bh_lru+0xf6/0x160 fs/buffer.c:1404 Modules linked in: CPU: 0 PID: 3974 Comm: syz-executor.0 Not tainted 5.18.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 RIP: 0010:__brelse fs/buffer.c:1145 [inline] RIP: 0010:brelse include/linux/buffer_head.h:290 [inline] RIP: 0010:__invalidate_bh_lrus fs/buffer.c:1391 [inline] RIP: 0010:invalidate_bh_lru+0xf6/0x160 fs/buffer.c:1404 Code: 70 5a e7 ff f0 41 ff 4d 00 42 80 7c 3d 00 00 74 81 4c 89 f7 e8 1b 59 e7 ff e9 74 ff ff ff 48 c7 c7 40 35 b6 89 e8 8a 95 75 ff <0f> 0b 42 80 7c 3d 00 00 75 dd e9 59 ff ff ff 44 89 e9 80 e1 07 80 RSP: 0018:ffffc90000007f38 EFLAGS: 00010046 RAX: 5ba7a9f27d3d6900 RBX: 0000000000000000 RCX: 0000000000010002 RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000001 RBP: 1ffff11017386d9f R08: dffffc0000000000 R09: ffffed1017385124 R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8880b9c36cf8 R13: ffff888070fbf888 R14: ffff8880b9c36cf8 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f599dba8000 CR3: 000000007f32e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: flush_smp_call_function_queue+0x219/0xae0 kernel/smp.c:628 __sysvec_call_function_single+0xdf/0x360 arch/x86/kernel/smp.c:248 sysvec_call_function_single+0x8d/0xb0 arch/x86/kernel/smp.c:243 asm_sysvec_call_function_single+0x16/0x20 RIP: 0010:unwind_get_return_address+0x29/0x90 arch/x86/kernel/unwind_orc.c:315 Code: 00 f3 0f 1e fa 41 57 41 56 53 48 89 fb 49 be 00 00 00 00 00 fc ff df 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0 75 47 83 3b 00 <74> 3a 48 83 c3 48 49 89 df 49 c1 ef 03 43 80 3c 37 00 74 08 48 89 RSP: 0018:ffffc90002cfef80 EFLAGS: 00000202 RAX: 0000000000000000 RBX: ffffc90002cfefa0 RCX: 0000000080000000 RDX: dffffc0000000000 RSI: ffffc90002cfff48 RDI: ffffc90002cfefa0 RBP: ffffc90002cff030 R08: dffffc0000000000 R09: ffffc90002cfeff0 R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88801fc2ba80 R13: ffffffff81671880 R14: dffffc0000000000 R15: 0000000000000000 arch_stack_walk+0xf7/0x140 arch/x86/kernel/stacktrace.c:26 stack_trace_save+0x117/0x1c0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4f/0x70 mm/kasan/common.c:45 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370 ____kasan_slab_free+0x124/0x1d0 mm/kasan/common.c:366 kasan_slab_free include/linux/kasan.h:200 [inline] slab_free_hook mm/slub.c:1728 [inline] slab_free_freelist_hook+0x12c/0x1a0 mm/slub.c:1754 slab_free mm/slub.c:3510 [inline] kmem_cache_free+0xfa/0x310 mm/slub.c:3527 pgtable_pte_page_dtor include/linux/mm.h:2336 [inline] ___pte_free_tlb+0x87/0x290 arch/x86/mm/pgtable.c:55 __pte_free_tlb arch/x86/include/asm/pgalloc.h:61 [inline] free_pte_range mm/memory.c:232 [inline] free_pmd_range mm/memory.c:250 [inline] free_pud_range mm/memory.c:284 [inline] free_p4d_range mm/memory.c:318 [inline] free_pgd_range+0x69a/0xb70 mm/memory.c:398 free_pgtables+0x56/0x240 exit_mmap+0x1ac/0x480 mm/mmap.c:3141 __mmput+0xc7/0x360 kernel/fork.c:1183 exit_mm+0x1e8/0x2a0 kernel/exit.c:510 do_exit+0x409/0x1b80 kernel/exit.c:782 do_group_exit+0x109/0x2c0 kernel/exit.c:925 get_signal+0x11d5/0x1220 kernel/signal.c:2864 arch_do_signal_or_restart+0xb4/0x1a60 arch/x86/kernel/signal.c:867 exit_to_user_mode_loop+0x6a/0x100 kernel/entry/common.c:166 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:201 __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline] syscall_exit_to_user_mode+0x61/0x2a0 kernel/entry/common.c:294 do_syscall_64+0x4d/0xc0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f599da8c169 Code: Unable to access opcode bytes at RIP 0x7f599da8c13f. RSP: 002b:00007f599e86a218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f599dbabf88 RCX: 00007f599da8c169 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f599dbabf88 RBP: 00007f599dbabf80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f599dbabf8c R13: 00007fff4551419f R14: 00007f599e86a300 R15: 0000000000022000 ---------------- Code disassembly (best guess): 0: 00 f3 add %dh,%bl 2: 0f 1e fa nop %edx 5: 41 57 push %r15 7: 41 56 push %r14 9: 53 push %rbx a: 48 89 fb mov %rdi,%rbx d: 49 be 00 00 00 00 00 movabs $0xdffffc0000000000,%r14 14: fc ff df 17: 48 89 f8 mov %rdi,%rax 1a: 48 c1 e8 03 shr $0x3,%rax 1e: 42 0f b6 04 30 movzbl (%rax,%r14,1),%eax 23: 84 c0 test %al,%al 25: 75 47 jne 0x6e 27: 83 3b 00 cmpl $0x0,(%rbx) * 2a: 74 3a je 0x66 <-- trapping instruction 2c: 48 83 c3 48 add $0x48,%rbx 30: 49 89 df mov %rbx,%r15 33: 49 c1 ef 03 shr $0x3,%r15 37: 43 80 3c 37 00 cmpb $0x0,(%r15,%r14,1) 3c: 74 08 je 0x46 3e: 48 rex.W 3f: 89 .byte 0x89