bisecting fixing commit since 811218eceeaa7618652e1b8d11caeff67ab42072 building syzkaller on 624dad51316f9973e1349b6c71e789737d1e00d9 testing commit 811218eceeaa7618652e1b8d11caeff67ab42072 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 0d22bf676f3962e1ca95b6f37c59b8f639d5a9aa2d97bc7fa09f1839a81eb343 run #0: crashed: kernel BUG in iput run #1: crashed: BUG: Dentry ADDR{i=NUM,n=/} still in use (-NUM) [unmount of erofs loop1] run #2: crashed: BUG: Dentry ADDR{i=NUM,n=/} still in use (-NUM) [unmount of erofs loop2] run #3: crashed: kernel BUG in iput run #4: crashed: BUG: Dentry ADDR{i=NUM,n=/} still in use (-NUM) [unmount of erofs loop0] run #5: crashed: BUG: Dentry ADDR{i=NUM,n=/} still in use (-NUM) [unmount of erofs loop0] run #6: crashed: BUG: Dentry ADDR{i=NUM,n=/} still in use (-NUM) [unmount of erofs loop1] run #7: crashed: BUG: Dentry ADDR{i=NUM,n=/} still in use (-NUM) [unmount of erofs loop1] run #8: crashed: kernel BUG in iput run #9: crashed: kernel BUG in corrupted run #10: crashed: BUG: Dentry ADDR{i=NUM,n=/} still in use (-NUM) [unmount of erofs loop3] run #11: crashed: kernel BUG in corrupted run #12: crashed: BUG: Dentry ADDR{i=NUM,n=/} still in use (-NUM) [unmount of erofs loop2] run #13: crashed: kernel BUG in iput run #14: crashed: kernel BUG in iput run #15: crashed: BUG: Dentry ADDR{i=NUM,n=/} still in use (-NUM) [unmount of erofs loop4] run #16: crashed: BUG: Dentry ADDR{i=NUM,n=/} still in use (-NUM) [unmount of erofs loop2] run #17: crashed: kernel BUG in corrupted run #18: crashed: kernel BUG in iput run #19: crashed: BUG: Dentry ADDR{i=NUM,n=/} still in use (-NUM) [unmount of erofs loop3] testing current HEAD 59456c9cc40c8f75b5a7efa0fe1f211d9c6fcaf1 testing commit 59456c9cc40c8f75b5a7efa0fe1f211d9c6fcaf1 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: af5672fa141970104458046b4191eae2df09ea3f21ccdefc5ec4521dbc0a6221 run #0: crashed: kernel BUG in iput run #1: crashed: kernel BUG in iput run #2: crashed: kernel BUG in iput run #3: crashed: BUG: Dentry ADDR{i=NUM,n=/} still in use (-NUM) [unmount of erofs loop1] run #4: crashed: kernel BUG in iput run #5: crashed: kernel BUG in corrupted run #6: crashed: kernel BUG in iput run #7: crashed: kernel BUG in corrupted run #8: crashed: kernel BUG in corrupted run #9: crashed: kernel BUG in corrupted revisions tested: 2, total time: 28m40.509211941s (build: 21m17.637918255s, test: 6m37.937316649s) the crash still happens on HEAD commit msg: Linux 4.19.204 crash: kernel BUG in corrupted Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x226 lib/dump_stack.c:118 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold.2+0x5/0xa lib/fault-inject.c:149 ------------[ cut here ]------------ __should_failslab+0xba/0xf0 mm/failslab.c:32 kernel BUG at fs/inode.c:1571! should_failslab+0x9/0x20 mm/slab_common.c:1590 invalid opcode: 0000 [#1] PREEMPT SMP KASAN slab_pre_alloc_hook mm/slab.h:424 [inline] slab_alloc mm/slab.c:3383 [inline] kmem_cache_alloc+0x28e/0x390 mm/slab.c:3557 CPU: 0 PID: 10030 Comm: syz-executor.3 Not tainted 4.19.204-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 __d_alloc+0x28/0xa30 fs/dcache.c:1612 RIP: 0010:iput+0x536/0x6b0 fs/inode.c:1571 Code: 48 b8 00 00 00 00 00 fc ff df 48 8b 55 c8 48 c1 ea 03 80 3c 02 00 0f 84 ac fd ff ff 48 8b 7d c8 e8 7f ac f0 ff e9 9e fd ff ff <0f> 0b 48 89 df e8 60 f9 ff ff 48 8b 7d d0 e8 c7 1f 0a 06 e9 2a fe d_alloc_anon fs/dcache.c:1715 [inline] d_make_root+0x38/0x70 fs/dcache.c:1909 RSP: 0018:ffff88808d527a18 EFLAGS: 00010202 erofs_read_super drivers/staging/erofs/super.c:407 [inline] erofs_fill_super+0xf02/0x1168 drivers/staging/erofs/super.c:499 RAX: dffffc0000000000 RBX: ffff8880812345c0 RCX: 1ffff11015e4fd85 RDX: 1ffff110102468d2 RSI: ffff8880af27ec08 RDI: ffff8880812345c0 RBP: ffff88808d527a60 R08: ffff8880af27ec28 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880812345c0 mount_bdev+0x26f/0x330 fs/super.c:1158 R13: ffff8880af17cd40 R14: 0000000000000000 R15: ffff8880af17cda8 FS: 00007fd6f1284700(0000) GS:ffff8880ba200000(0000) knlGS:0000000000000000 erofs_mount+0x6a/0x90 drivers/staging/erofs/super.c:512 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8d2386c008 CR3: 000000009a8ac000 CR4: 00000000001406f0 mount_fs+0x7f/0x2b0 fs/super.c:1261 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 vfs_kern_mount.part.11+0x58/0x3d0 fs/namespace.c:961 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: vfs_kern_mount fs/namespace.c:951 [inline] do_new_mount fs/namespace.c:2483 [inline] do_mount+0x376/0x2630 fs/namespace.c:2813 erofs_read_super drivers/staging/erofs/super.c:439 [inline] erofs_fill_super+0x10b4/0x1168 drivers/staging/erofs/super.c:499 mount_bdev+0x26f/0x330 fs/super.c:1158 ksys_mount+0xb1/0xd0 fs/namespace.c:3029 __do_sys_mount fs/namespace.c:3043 [inline] __se_sys_mount fs/namespace.c:3040 [inline] __x64_sys_mount+0xb9/0x150 fs/namespace.c:3040 erofs_mount+0x6a/0x90 drivers/staging/erofs/super.c:512 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe mount_fs+0x7f/0x2b0 fs/super.c:1261 RIP: 0033:0x46702a vfs_kern_mount.part.11+0x58/0x3d0 fs/namespace.c:961 Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 vfs_kern_mount fs/namespace.c:951 [inline] do_new_mount fs/namespace.c:2483 [inline] do_mount+0x376/0x2630 fs/namespace.c:2813 RSP: 002b:00007fc6337e7fa8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 000000000046702a RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007fc6337e8000 RBP: 00007fc6337e8040 R08: 00007fc6337e8040 R09: 0000000020000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000000 R13: 0000000020000100 R14: 00007fc6337e8000 R15: 0000000020000140 ksys_mount+0xb1/0xd0 fs/namespace.c:3029 __do_sys_mount fs/namespace.c:3043 [inline] __se_sys_mount fs/namespace.c:3040 [inline] __x64_sys_mount+0xb9/0x150 fs/namespace.c:3040 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x46702a Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd6f1283fa8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 000000000046702a RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007fd6f1284000 RBP: 00007fd6f1284040 R08: 00007fd6f1284040 R09: 0000000020000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000000 R13: 0000000020000100 R14: 00007fd6f1284000 R15: 0000000020000140 Modules linked in: ------------[ cut here ]------------ kernel BUG at fs/inode.c:1571! invalid opcode: 0000 [#2] PREEMPT SMP KASAN CPU: 1 PID: 10041 Comm: syz-executor.5 Tainted: G D 4.19.204-syzkaller #0 ---[ end trace 202ea7258348ed7e ]--- Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:iput+0x536/0x6b0 fs/inode.c:1571 RIP: 0010:iput+0x536/0x6b0 fs/inode.c:1571 Code: 48 b8 00 00 00 00 00 fc ff df 48 8b 55 c8 48 c1 ea 03 80 3c 02 00 0f 84 ac fd ff ff 48 8b 7d c8 e8 7f ac f0 ff e9 9e fd ff ff <0f> 0b 48 89 df e8 60 f9 ff ff 48 8b 7d d0 e8 c7 1f 0a 06 e9 2a fe RSP: 0018:ffff8880af69fa18 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff888081228128 RCX: ffffffff814c5a51 RDX: 1ffff1101024503f RSI: 1ffff110174657d2 RDI: ffff888081228128 RBP: ffff8880af69fa60 R08: ffffed1017464553 R09: ffffed1017464552 R10: ffffed1017464552 R11: ffff8880ba322a93 R12: ffff888081228128 R13: ffff8880aecd6380 R14: 0000000000000000 R15: ffff8880aecd63e8 FS: 00007fc6337e8700(0000) GS:ffff8880ba300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007faba4feb000 CR3: 00000000b3a75000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: erofs_read_super drivers/staging/erofs/super.c:439 [inline] erofs_fill_super+0x10b4/0x1168 drivers/staging/erofs/super.c:499 mount_bdev+0x26f/0x330 fs/super.c:1158 erofs_mount+0x6a/0x90 drivers/staging/erofs/super.c:512 mount_fs+0x7f/0x2b0 fs/super.c:1261 vfs_kern_mount.part.11+0x58/0x3d0 fs/namespace.c:961 vfs_kern_mount fs/namespace.c:951 [inline] do_new_mount fs/namespace.c:2483 [inline] do_mount+0x376/0x2630 fs/namespace.c:2813 ksys_mount+0xb1/0xd0 fs/namespace.c:3029 __do_sys_mount fs/namespace.c:3043 [inline] __se_sys_mount fs/namespace.c:3040 [inline] __x64_sys_mount+0xb9/0x150 fs/namespace.c:3040 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x46702a Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fc6337e7fa8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 000000000046702a RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007fc6337e8000 RBP: 00007fc6337e8040 R08: 00007fc6337e8040 R09: 0000000020000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000000 R13: 0000000020000100 R14: 00007fc6337e8000 R15: 0000000020000140 Modules linked in: ---[ end trace 202ea7258348ed7f ]--- Code: 48 b8 00 00 00 00 00 fc ff df 48 8b 55 c8 48 c1 ea 03 80 3c 02 00 0f 84 ac fd ff ff 48 8b 7d c8 e8 7f ac f0 ff e9 9e fd ff ff <0f> 0b 48 89 df e8 60 f9 ff ff 48 8b 7d d0 e8 c7 1f 0a 06 e9 2a fe erofs: unmounted for /dev/loop4 RSP: 0018:ffff88808d527a18 EFLAGS: 00010202 RIP: 0010:iput+0x536/0x6b0 fs/inode.c:1571 RAX: dffffc0000000000 RBX: ffff8880812345c0 RCX: 1ffff11015e4fd85 Code: 48 b8 00 00 00 00 00 fc ff df 48 8b 55 c8 48 c1 ea 03 80 3c 02 00 0f 84 ac fd ff ff 48 8b 7d c8 e8 7f ac f0 ff e9 9e fd ff ff <0f> 0b 48 89 df e8 60 f9 ff ff 48 8b 7d d0 e8 c7 1f 0a 06 e9 2a fe RSP: 0018:ffff88808d527a18 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff8880812345c0 RCX: 1ffff11015e4fd85 RDX: 1ffff110102468d2 RSI: ffff8880af27ec08 RDI: ffff8880812345c0 RBP: ffff88808d527a60 R08: ffff8880af27ec28 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880812345c0 R13: ffff8880af17cd40 R14: 0000000000000000 R15: ffff8880af17cda8 FS: 00007fc6337e8700(0000) GS:ffff8880ba300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000021eb848 CR3: 00000000b3a75000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 48 c7 c2 bc ff ff ff mov $0xffffffffffffffbc,%rdx 7: f7 d8 neg %eax 9: 64 89 02 mov %eax,%fs:(%rdx) c: b8 ff ff ff ff mov $0xffffffff,%eax 11: eb d2 jmp 0xffffffe5 13: e8 b8 04 00 00 callq 0x4d0 18: 0f 1f 84 00 00 00 00 nopl 0x0(%rax,%rax,1) 1f: 00 20: 49 89 ca mov %rcx,%r10 23: b8 a5 00 00 00 mov $0xa5,%eax 28: 0f 05 syscall * 2a: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction 30: 73 01 jae 0x33 32: c3 retq 33: 48 c7 c1 bc ff ff ff mov $0xffffffffffffffbc,%rcx 3a: f7 d8 neg %eax 3c: 64 89 01 mov %eax,%fs:(%rcx) 3f: 48 rex.W