bisecting fixing commit since 1bab61d3e8cd96f2badf515dcb06e4e1029bc017
building syzkaller on 4afdfa205b55633e7eb9db03a9d099d7aa324801
testing commit 1bab61d3e8cd96f2badf515dcb06e4e1029bc017 with gcc (GCC) 8.1.0
kernel signature: 92003427b9d3a84236dcb4e0f0de9f0203d764d9cd0c74c4f5bf7b4ed4b763a6
run #0: crashed: kernel BUG in corrupted
run #1: crashed: kernel BUG in __handle_mm_fault
run #2: crashed: kernel BUG in __handle_mm_fault
run #3: crashed: kernel BUG in __handle_mm_fault
run #4: crashed: kernel BUG in __handle_mm_fault
run #5: crashed: kernel BUG in __handle_mm_fault
run #6: crashed: kernel BUG in __handle_mm_fault
run #7: crashed: kernel BUG in __handle_mm_fault
run #8: crashed: kernel BUG in __handle_mm_fault
run #9: crashed: kernel BUG in __handle_mm_fault
testing current HEAD 2263955bf7e71ca8419b64d7a60510aad29002f6
testing commit 2263955bf7e71ca8419b64d7a60510aad29002f6 with gcc (GCC) 8.1.0
kernel signature: 5ef508326965badfe41cf56d3814b19a73121b4cacacc7e59a5a0ff8bd845eba
all runs: crashed: kernel BUG in __handle_mm_fault
revisions tested: 2, total time: 29m25.6581813s (build: 22m50.478114959s, test: 5m44.830222579s)
the crash still happens on HEAD
commit msg: Linux 4.19.170
crash: kernel BUG in __handle_mm_fault
next ffff8881d7ba8778 prev ffff8881d7ba8880 mm ffff8881d7b794c0
prot 25 anon_vma 0000000000000000 vm_ops ffffffff87310ce0
pgoff 0 file ffff8881d7a3a000 private_data 0000000000000000
flags: 0xfe(write|exec|shared|mayread|maywrite|mayexec|mayshare)
------------[ cut here ]------------
kernel BUG at mm/memory.c:4040!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 7237 Comm: syz-executor.1 Not tainted 4.19.170-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:wp_huge_pmd mm/memory.c:4040 [inline]
RIP: 0010:__handle_mm_fault+0x2177/0x41a0 mm/memory.c:4248
Code: 49 8d b6 a0 00 00 00 48 89 da 44 89 9d 10 ff ff ff e8 2d 71 fe ff 44 8b 9d 10 ff ff ff e9 28 ec ff ff 48 89 df e8 50 5e 39 05 <0f> 0b 49 8d 84 24 60 ff ff ff 48 89 c7 e8 17 d5 0b 00 41 89 c3 e9
RSP: 0000:ffff8881d6eafcc8 EFLAGS: 00010296
RAX: 0000000000000137 RBX: ffff8881d8b1b250 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff87678700 RDI: ffffffff8a192a60
RBP: ffff8881d6eafde8 R08: ffffed103ed05081 R09: ffffed103ed05080
R10: ffffed103ed05080 R11: ffff8881f6828407 R12: ffff8881d6eafdc0
R13: 1ffff1103add5fa0 R14: ffffffff87310ce0 R15: ffff8881d7b794c0
FS:  0000000000cea940(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000200001c0 CR3: 00000001d7407003 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 handle_mm_fault+0x3dd/0x8b0 mm/memory.c:4295
 __do_page_fault+0x50e/0xb30 arch/x86/mm/fault.c:1412
 do_page_fault+0x64/0x3b0 arch/x86/mm/fault.c:1487
 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1205
RIP: 0033:0x443d51
Code: 8d 15 b3 1b 0d 00 8b 0c 8a 8b 04 82 29 c8 c3 66 2e 0f 1f 84 00 00 00 00 00 48 83 fa 20 48 89 f8 73 77 f6 c2 01 74 0b 0f b6 0e <88> 0f 48 ff c6 48 ff c7 f6 c2 02 74 12 0f b7 0e 66 89 0f 48 83 c6
RSP: 002b:00007ffdd4a3d528 EFLAGS: 00010202
RAX: 00000000200001c0 RBX: 0000000000000000 RCX: 0000000000000063
RDX: 0000000000000013 RSI: 0000000000790398 RDI: 00000000200001c0
RBP: 0000000000790378 R08: 0000000000000000 R09: 0000000000000000
R10: 00007ffdd4a3d610 R11: 0000000000000246 R12: 0000000000790380
R13: 000000000000bead R14: fffffffffffffffe R15: 000000000078c04c
Modules linked in:
---[ end trace 7b8f3b3e150705f4 ]---
RIP: 0010:wp_huge_pmd mm/memory.c:4040 [inline]
RIP: 0010:__handle_mm_fault+0x2177/0x41a0 mm/memory.c:4248
Code: 49 8d b6 a0 00 00 00 48 89 da 44 89 9d 10 ff ff ff e8 2d 71 fe ff 44 8b 9d 10 ff ff ff e9 28 ec ff ff 48 89 df e8 50 5e 39 05 <0f> 0b 49 8d 84 24 60 ff ff ff 48 89 c7 e8 17 d5 0b 00 41 89 c3 e9
RSP: 0000:ffff8881d6eafcc8 EFLAGS: 00010296
RAX: 0000000000000137 RBX: ffff8881d8b1b250 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff87678700 RDI: ffffffff8a192a60
RBP: ffff8881d6eafde8 R08: ffffed103ed05081 R09: ffffed103ed05080
R10: ffffed103ed05080 R11: ffff8881f6828407 R12: ffff8881d6eafdc0
R13: 1ffff1103add5fa0 R14: ffffffff87310ce0 R15: ffff8881d7b794c0
FS:  0000000000cea940(0000) GS:ffff8881f6900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe3fbf6c70 CR3: 00000001d7407004 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400