bisecting cause commit starting from d881de30d29ee4d14a475b81e523e9335f81ab9f building syzkaller on 8bd6bd63656d411729c450d452e1355b42adf900 testing commit d881de30d29ee4d14a475b81e523e9335f81ab9f with gcc (GCC) 8.1.0 run #0: crashed: general protection fault in locks_remove_file run #1: crashed: general protection fault in locks_remove_file run #2: crashed: general protection fault in corrupted run #3: crashed: general protection fault in locks_remove_file run #4: crashed: general protection fault in corrupted run #5: crashed: general protection fault in locks_remove_file run #6: crashed: general protection fault in locks_remove_file run #7: crashed: general protection fault in corrupted run #8: crashed: general protection fault in locks_remove_file run #9: crashed: general protection fault in locks_remove_file testing release v4.19 testing commit 84df9525b0c27f3ebc2ebb1864fa62a97fdedb7d with gcc (GCC) 8.1.0 all runs: OK # git bisect start d881de30d29ee4d14a475b81e523e9335f81ab9f v4.19 Bisecting: 7280 revisions left to test after this (roughly 13 steps) [685f7e4f161425b137056abe35ba8ef7b669d83d] Merge tag 'powerpc-4.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux testing commit 685f7e4f161425b137056abe35ba8ef7b669d83d with gcc (GCC) 8.1.0 all runs: OK # git bisect good 685f7e4f161425b137056abe35ba8ef7b669d83d Bisecting: 3388 revisions left to test after this (roughly 12 steps) [93335e5911dbffccd3b74c4d214268c0fd2bc1b0] Merge tag 'armsoc-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc testing commit 93335e5911dbffccd3b74c4d214268c0fd2bc1b0 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 93335e5911dbffccd3b74c4d214268c0fd2bc1b0 Bisecting: 1696 revisions left to test after this (roughly 11 steps) [cf5eaa00446b31ed3dcc5a3d8025e469c1784ace] Merge remote-tracking branch 'actions/for-next' testing commit cf5eaa00446b31ed3dcc5a3d8025e469c1784ace with gcc (GCC) 8.1.0 all runs: OK # git bisect good cf5eaa00446b31ed3dcc5a3d8025e469c1784ace Bisecting: 705 revisions left to test after this (roughly 10 steps) [222aa88d6b69e0836c22e6f1d30defad0fe1b2ce] Merge remote-tracking branch 'drm-intel/for-linux-next' testing commit 222aa88d6b69e0836c22e6f1d30defad0fe1b2ce with gcc (GCC) 8.1.0 run #0: crashed: general protection fault in corrupted run #1: crashed: general protection fault in corrupted run #2: crashed: general protection fault in locks_remove_file run #3: crashed: general protection fault in locks_remove_file run #4: crashed: general protection fault in corrupted run #5: crashed: general protection fault in locks_remove_file run #6: crashed: general protection fault in locks_remove_file run #7: crashed: general protection fault in locks_remove_file run #8: crashed: general protection fault in corrupted run #9: crashed: general protection fault in locks_remove_file # git bisect bad 222aa88d6b69e0836c22e6f1d30defad0fe1b2ce Bisecting: 494 revisions left to test after this (roughly 9 steps) [5ba19e9eea06909f857bf847eab7d555cec552dd] Merge remote-tracking branch 'hid/for-next' testing commit 5ba19e9eea06909f857bf847eab7d555cec552dd with gcc (GCC) 8.1.0 run #0: crashed: general protection fault in locks_remove_file run #1: crashed: general protection fault in locks_remove_file run #2: crashed: general protection fault in locks_remove_file run #3: crashed: general protection fault in locks_remove_file run #4: crashed: general protection fault in locks_remove_file run #5: crashed: general protection fault in corrupted run #6: crashed: general protection fault in locks_remove_file run #7: crashed: general protection fault in locks_remove_file run #8: crashed: general protection fault in locks_remove_file run #9: crashed: general protection fault in locks_remove_file # git bisect bad 5ba19e9eea06909f857bf847eab7d555cec552dd Bisecting: 252 revisions left to test after this (roughly 8 steps) [fb2ffed5aa2c27040bc604a06284b73b02873567] Merge remote-tracking branch 's390/features' testing commit fb2ffed5aa2c27040bc604a06284b73b02873567 with gcc (GCC) 8.1.0 all runs: OK # git bisect good fb2ffed5aa2c27040bc604a06284b73b02873567 Bisecting: 129 revisions left to test after this (roughly 7 steps) [dd6e5092017f5b0ceedbcce7ed329c99c484ad1b] Merge remote-tracking branch 'xfs/for-next' testing commit dd6e5092017f5b0ceedbcce7ed329c99c484ad1b with gcc (GCC) 8.1.0 all runs: OK # git bisect good dd6e5092017f5b0ceedbcce7ed329c99c484ad1b Bisecting: 64 revisions left to test after this (roughly 6 steps) [ee2c444650f47fc99077b13870b4ed76cec29dfe] Merge branch 'for-4.20/google' into for-next testing commit ee2c444650f47fc99077b13870b4ed76cec29dfe with gcc (GCC) 8.1.0 all runs: OK # git bisect good ee2c444650f47fc99077b13870b4ed76cec29dfe Bisecting: 32 revisions left to test after this (roughly 5 steps) [094a14cefa9ec8ce9671635ee9f935f2a8dc87f0] vfs: syscall: Add fspick() to select a superblock for reconfiguration testing commit 094a14cefa9ec8ce9671635ee9f935f2a8dc87f0 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 094a14cefa9ec8ce9671635ee9f935f2a8dc87f0 Bisecting: 18 revisions left to test after this (roughly 4 steps) [d708e87ca399a09f48316c14f3b56f6facaf75a2] Merge branch 'work.mount' into for-next testing commit d708e87ca399a09f48316c14f3b56f6facaf75a2 with gcc (GCC) 8.1.0 all runs: OK # git bisect good d708e87ca399a09f48316c14f3b56f6facaf75a2 Bisecting: 9 revisions left to test after this (roughly 3 steps) [f76efae43ae0aa33c3bcfc4c6aad9075484e6df2] fs/locks: change all *_conflict() functions to return bool. testing commit f76efae43ae0aa33c3bcfc4c6aad9075484e6df2 with gcc (GCC) 8.1.0 run #0: crashed: general protection fault in locks_remove_flock run #1: crashed: general protection fault in locks_remove_flock run #2: crashed: general protection fault in locks_remove_flock run #3: crashed: general protection fault in locks_remove_flock run #4: crashed: general protection fault in locks_remove_flock run #5: crashed: general protection fault in locks_remove_flock run #6: crashed: general protection fault in locks_remove_flock run #7: crashed: general protection fault in corrupted run #8: crashed: general protection fault in locks_remove_flock run #9: crashed: general protection fault in locks_remove_flock # git bisect bad f76efae43ae0aa33c3bcfc4c6aad9075484e6df2 Bisecting: 4 revisions left to test after this (roughly 2 steps) [890536da18546983c795e3360fe39e329e0ab95a] gfs2: properly initial file_lock used for unlock. testing commit 890536da18546983c795e3360fe39e329e0ab95a with gcc (GCC) 8.1.0 all runs: OK # git bisect good 890536da18546983c795e3360fe39e329e0ab95a Bisecting: 2 revisions left to test after this (roughly 1 step) [dee160df820de41ff2f59a715643680822a0ab06] locks: use properly initialized file_lock when unlocking. testing commit dee160df820de41ff2f59a715643680822a0ab06 with gcc (GCC) 8.1.0 run #0: crashed: general protection fault in locks_remove_flock run #1: crashed: general protection fault in locks_remove_flock run #2: crashed: general protection fault in locks_remove_flock run #3: crashed: general protection fault in locks_remove_flock run #4: crashed: general protection fault in locks_remove_flock run #5: crashed: general protection fault in locks_remove_flock run #6: crashed: general protection fault in locks_remove_flock run #7: crashed: general protection fault in locks_remove_flock run #8: crashed: general protection fault in corrupted run #9: crashed: general protection fault in locks_remove_flock # git bisect bad dee160df820de41ff2f59a715643680822a0ab06 Bisecting: 0 revisions left to test after this (roughly 0 steps) [a4399c3b7b8c0ff7937990519e527a8f3657b846] ocfs2: properly initial file_lock used for unlock. testing commit a4399c3b7b8c0ff7937990519e527a8f3657b846 with gcc (GCC) 8.1.0 all runs: OK # git bisect good a4399c3b7b8c0ff7937990519e527a8f3657b846 dee160df820de41ff2f59a715643680822a0ab06 is the first bad commit commit dee160df820de41ff2f59a715643680822a0ab06 Author: NeilBrown Date: Mon Nov 5 12:30:47 2018 +1100 locks: use properly initialized file_lock when unlocking. Both locks_remove_posix() and locks_remove_flock() use a struct file_lock without calling locks_init_lock() on it. This means the various list_heads are not initialized, which will become a problem with a later patch. So change them both to initialize properly. For flock locks, this involves using flock_make_lock(), and changing it to allow a file_lock to be passed in, so memory allocation isn't always needed. Signed-off-by: NeilBrown Signed-off-by: Jeff Layton fs/locks.c | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-) revisions tested: 16, total time: 3h28m28.946192774s (build: 1h17m18.879212249s, test: 2h7m10.858884193s) first bad commit: dee160df820de41ff2f59a715643680822a0ab06 locks: use properly initialized file_lock when unlocking. cc: ["bfields@fieldses.org" "jlayton@kernel.org" "linux-fsdevel@vger.kernel.org" "linux-kernel@vger.kernel.org" "neilb@suse.com" "viro@zeniv.linux.org.uk"] crash: general protection fault in locks_remove_flock IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 8021q: adding VLAN 0 to HW filter on device team0 8021q: adding VLAN 0 to HW filter on device team0 kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 7334 Comm: syz-executor4 Not tainted 4.20.0-rc1+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 RIP: 0010:locks_remove_flock+0x1ef/0x320 fs/locks.c:2524 Code: 80 3c 02 00 0f 85 10 01 00 00 4d 8b 64 24 98 4d 85 e4 74 32 49 8d 7c 24 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 12 01 00 00 49 8b 44 24 08 48 85 c0 74 08 4c 89 RSP: 0018:ffff880058eaf890 EFLAGS: 00010207 RAX: dffffc0000000000 RBX: 1ffff1000b1d5f15 RCX: 0000000000000000 RDX: 03fffe200163abe8 RSI: 00000000ffffffff RDI: 1ffff1000b1d5f45 RBP: ffff880058eafa70 R08: ffffed000d8e5b68 R09: ffffed000d8e5b67 R10: ffffed000d8e5b67 R11: ffff88006c72db3b R12: 1ffff1000b1d5f3d R13: ffff88005a7fca80 R14: ffff880058eaf908 R15: dffffc0000000000 FS: 00000000010db940(0000) GS:ffff88006c700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000619570 CR3: 0000000063d68000 CR4: 00000000007406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: locks_remove_file+0x126/0x590 fs/locks.c:2564 __fput+0x26f/0xab0 fs/file_table.c:270 ____fput+0x9/0x10 fs/file_table.c:309 task_work_run+0x19f/0x240 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop+0x26e/0x300 arch/x86/entry/common.c:166 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline] syscall_return_slowpath arch/x86/entry/common.c:268 [inline] do_syscall_64+0x587/0x700 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x410501 Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 14 1a 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 RSP: 002b:00007ffea44e8570 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000410501 RDX: 0000000000000000 RSI: 00000000007200b8 RDI: 0000000000000003 RBP: 0000000000000001 R08: 0000000000000000 R09: 00007ffea44e8490 R10: 00007ffea44e8490 R11: 0000000000000293 R12: 0000000000000000 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000004 Modules linked in: ---[ end trace f5eb6568faf6902a ]--- RIP: 0010:locks_remove_flock+0x1ef/0x320 fs/locks.c:2524 Code: 80 3c 02 00 0f 85 10 01 00 00 4d 8b 64 24 98 4d 85 e4 74 32 49 8d 7c 24 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 12 01 00 00 49 8b 44 24 08 48 85 c0 74 08 4c 89 RSP: 0018:ffff880058eaf890 EFLAGS: 00010207 RAX: dffffc0000000000 RBX: 1ffff1000b1d5f15 RCX: 0000000000000000 RDX: 03fffe200163abe8 RSI: 00000000ffffffff RDI: 1ffff1000b1d5f45 RBP: ffff880058eafa70 R08: ffffed000d8e5b68 R09: ffffed000d8e5b67 R10: ffffed000d8e5b67 R11: ffff88006c72db3b R12: 1ffff1000b1d5f3d R13: ffff88005a7fca80 R14: ffff880058eaf908 R15: dffffc0000000000 FS: 00000000010db940(0000) GS:ffff88006c700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000063f210 CR3: 0000000063d68000 CR4: 00000000007406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554