bisecting fixing commit since 1bab61d3e8cd96f2badf515dcb06e4e1029bc017
building syzkaller on 4afdfa205b55633e7eb9db03a9d099d7aa324801
testing commit 1bab61d3e8cd96f2badf515dcb06e4e1029bc017
compiler: gcc version 8.4.1 20210217 (GCC)
kernel signature: e807bf3949bf624cea24af0a2626abe6daacbee70138f0efe76f28fdfc83a061
all runs: crashed: kernel BUG in __handle_mm_fault
testing current HEAD 4938296e03bd227e5020d63d418956fe52baf97c
testing commit 4938296e03bd227e5020d63d418956fe52baf97c
compiler: gcc version 8.4.1 20210217 (GCC)
kernel signature: 2b8a5876e79a1547fd29336442c8ff2ae84dfb13dc0eb27b14acad2e49d2d4fc
all runs: crashed: kernel BUG in __handle_mm_fault
revisions tested: 2, total time: 27m38.438859935s (build: 20m5.873522366s, test: 6m40.42926654s)
the crash still happens on HEAD
commit msg: Linux 4.19.198
crash: kernel BUG in __handle_mm_fault
flags: 0xfe(write|exec|shared|mayread|maywrite|mayexec|mayshare)
IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
------------[ cut here ]------------
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
kernel BUG at mm/memory.c:4081!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
CPU: 1 PID: 7125 Comm: syz-executor.4 Not tainted 4.19.198-syzkaller #0
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:wp_huge_pmd mm/memory.c:4081 [inline]
RIP: 0010:__handle_mm_fault+0x2192/0x4100 mm/memory.c:4289
Code: 00 00 00 4c 89 f7 e8 dd f4 09 00 f0 41 ff 0e 0f 85 54 ec ff ff 48 89 df e8 ab e4 f5 ff e9 47 ec ff ff 48 89 df e8 53 9e 3b 05 <0f> 0b 49 8d 84 24 60 ff ff ff 48 89 c7 e8 bc de 0b 00 41 89 c7 e9
RSP: 0018:ffff8881dc6cfcc8 EFLAGS: 00010296
RAX: 0000000000000137 RBX: ffff8881da1c6000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8767a180 RDI: ffffffff8a195aa0
RBP: ffff8881dc6cfde8 R08: ffffed103ed25081 R09: ffffed103ed25080
R10: ffffed103ed25080 R11: ffff8881f6928407 R12: ffff8881dc6cfdc0
R13: 1ffff1103b8d9fa0 R14: ffffffff873112a0 R15: 0000000000000080
FS:  0000000002585400(0000) GS:ffff8881f6900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff59f6a8000 CR3: 00000001dafb7004 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 handle_mm_fault+0x3dd/0x8b0 mm/memory.c:4336
 __do_page_fault+0x50e/0xb30 arch/x86/mm/fault.c:1412
 do_page_fault+0x64/0x3b0 arch/x86/mm/fault.c:1487
 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1205
RIP: 0033:0x45fb08
Code: d1 f3 a4 c3 80 fa 10 73 17 80 fa 08 73 27 80 fa 04 73 33 80 fa 01 77 3b 72 05 0f b6 0e 88 0f c3 c5 fa 6f 06 c5 fa 6f 4c 16 f0 <c5> fa 7f 07 c5 fa 7f 4c 17 f0 c3 48 8b 4c 16 f8 48 8b 36 48 89 4c
RSP: 002b:00007ffc5bae7938 EFLAGS: 00010206
RAX: 00000000200001c0 RBX: 000000000055c900 RCX: 0000000000960000
RDX: 0000000000000013 RSI: 0000000000560398 RDI: 00000000200001c0
RBP: 00007ffc5bae79d8 R08: 0000000000560278 R09: 0000000000000000
R10: 00007ffc5bae79f0 R11: 0000000000000246 R12: 00000000000003e8
R13: 000000000055bfac R14: 000000000055bf00 R15: 000000000055bfa0
Modules linked in:
---[ end trace 404dc424260cd94c ]---
RIP: 0010:wp_huge_pmd mm/memory.c:4081 [inline]
RIP: 0010:__handle_mm_fault+0x2192/0x4100 mm/memory.c:4289
IPv6: ADDRCONF(NETDEV_UP): veth1_macvtap: link is not ready
Code: 00 00 00 4c 89 f7 e8 dd f4 09 00 f0 41 ff 0e 0f 85 54 ec ff ff 48 89 df e8 ab e4 f5 ff e9 47 ec ff ff 48 89 df e8 53 9e 3b 05 <0f> 0b 49 8d 84 24 60 ff ff ff 48 89 c7 e8 bc de 0b 00 41 89 c7 e9
IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready
batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
RSP: 0018:ffff8881dc6cfcc8 EFLAGS: 00010296
batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
RAX: 0000000000000137 RBX: ffff8881da1c6000 RCX: 0000000000000000
batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
RDX: 0000000000000000 RSI: ffffffff8767a180 RDI: ffffffff8a195aa0
batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
RBP: ffff8881dc6cfde8 R08: ffffed103ed25081 R09: ffffed103ed25080
batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
R10: ffffed103ed25080 R11: ffff8881f6928407 R12: ffff8881dc6cfdc0
R13: 1ffff1103b8d9fa0 R14: ffffffff873112a0 R15: 0000000000000080
FS:  0000000002585400(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000
IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
batman_adv: batadv0: Interface activated: batadv_slave_1
CR2: 00007ffdfe07d080 CR3: 00000001dafb7004 CR4: 00000000001606f0
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready