bisecting fixing commit since 21ad423fe5210f5aa50bd43f9ae99b655090a227 building syzkaller on 0b33604d8e2793b82ec89abecf82d92b82e3d410 testing commit 21ad423fe5210f5aa50bd43f9ae99b655090a227 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 16b00f21d859e69d7ac10778df60e2cc94a7a59d2d4d7678fbdd8738b623db6a run #0: crashed: unregister_netdevice: waiting for DEV to become free run #1: crashed: unregister_netdevice: waiting for DEV to become free run #2: crashed: WARNING in mark_buffer_dirty run #3: crashed: unregister_netdevice: waiting for DEV to become free run #4: crashed: unregister_netdevice: waiting for DEV to become free run #5: crashed: unregister_netdevice: waiting for DEV to become free run #6: crashed: unregister_netdevice: waiting for DEV to become free run #7: crashed: unregister_netdevice: waiting for DEV to become free run #8: crashed: unregister_netdevice: waiting for DEV to become free run #9: crashed: WARNING in mark_buffer_dirty run #10: crashed: unregister_netdevice: waiting for DEV to become free run #11: crashed: unregister_netdevice: waiting for DEV to become free run #12: crashed: WARNING in mark_buffer_dirty run #13: crashed: WARNING in mark_buffer_dirty run #14: crashed: unregister_netdevice: waiting for DEV to become free run #15: crashed: unregister_netdevice: waiting for DEV to become free run #16: crashed: unregister_netdevice: waiting for DEV to become free run #17: crashed: unregister_netdevice: waiting for DEV to become free run #18: crashed: unregister_netdevice: waiting for DEV to become free run #19: crashed: unregister_netdevice: waiting for DEV to become free testing current HEAD af48f51cb5934738a3ee97e951d7dededf029488 testing commit af48f51cb5934738a3ee97e951d7dededf029488 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: e4dd953f5e16413c33464ef6f5dc10e1d8512ae5bd76afd6fad1947db984b851 run #0: crashed: unregister_netdevice: waiting for DEV to become free run #1: crashed: unregister_netdevice: waiting for DEV to become free run #2: crashed: unregister_netdevice: waiting for DEV to become free run #3: crashed: WARNING in mark_buffer_dirty run #4: crashed: WARNING in mark_buffer_dirty run #5: crashed: unregister_netdevice: waiting for DEV to become free run #6: crashed: WARNING in mark_buffer_dirty run #7: crashed: unregister_netdevice: waiting for DEV to become free run #8: crashed: unregister_netdevice: waiting for DEV to become free run #9: crashed: WARNING in mark_buffer_dirty revisions tested: 2, total time: 22m24.068319042s (build: 15m22.739114613s, test: 6m38.192825061s) the crash still happens on HEAD commit msg: Linux 4.14.271 crash: WARNING in mark_buffer_dirty audit: type=1804 audit(1647204350.749:2): pid=8308 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor426" name="/root/file0/bus" dev="loop5" ino=3 res=1 BFS-fs: bfs_fill_super(): loop0 is unclean, continuing BFS-fs: bfs_fill_super(): loop3 is unclean, continuing BFS-fs: bfs_fill_super(): loop4 is unclean, continuing ------------[ cut here ]------------ WARNING: CPU: 0 PID: 8334 at fs/buffer.c:1149 mark_buffer_dirty+0x2c3/0x3c0 fs/buffer.c:1179 audit: type=1804 audit(1647204350.749:3): pid=8307 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor426" name="/root/file0/bus" dev="loop2" ino=3 res=1 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 8334 Comm: syz-executor426 Not tainted 4.14.271-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x14b/0x1e7 lib/dump_stack.c:58 panic+0x1b0/0x358 kernel/panic.c:183 __warn.cold.7+0x25/0x25 kernel/panic.c:547 report_bug+0x1a1/0x200 lib/bug.c:183 fixup_bug arch/x86/kernel/traps.c:177 [inline] fixup_bug arch/x86/kernel/traps.c:172 [inline] do_error_trap+0x1bd/0x310 arch/x86/kernel/traps.c:295 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:314 invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:964 RIP: 0010:mark_buffer_dirty+0x2c3/0x3c0 fs/buffer.c:1149 RSP: 0018:ffff88809e6ff268 EFLAGS: 00010246 RAX: 0000000000000020 RBX: ffff88808a13f738 RCX: 0000000000000000 RDX: 1ffff11011427ee7 RSI: ffff88808918b400 RDI: ffff88808a13f738 RBP: ffff88809e6ff288 R08: 0000000000000000 R09: 0000000000000008 R10: ffffed1011dfc5ff R11: ffff88808efe2fff R12: ffff88808a17e5e8 R13: ffff8880aab4a2c0 R14: ffffed101556947d R15: ffff88808a13f738 bfs_move_block fs/bfs/file.c:43 [inline] bfs_move_blocks fs/bfs/file.c:56 [inline] bfs_get_block+0x31d/0xaf0 fs/bfs/file.c:125 audit: type=1804 audit(1647204350.819:4): pid=8301 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor426" name="/root/file0/bus" dev="loop0" ino=3 res=1 __block_write_begin_int+0x327/0x1640 fs/buffer.c:2038 audit: type=1804 audit(1647204350.819:5): pid=8322 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor426" name="/root/file0/bus" dev="loop4" ino=3 res=1 __block_write_begin fs/buffer.c:2088 [inline] block_write_begin+0x48/0x240 fs/buffer.c:2147 bfs_write_begin+0x2f/0xb0 fs/bfs/file.c:177 generic_perform_write+0x227/0x450 mm/filemap.c:3055 __generic_file_write_iter+0x205/0x590 mm/filemap.c:3180 generic_file_write_iter+0x302/0x660 mm/filemap.c:3208 call_write_iter include/linux/fs.h:1780 [inline] new_sync_write fs/read_write.c:469 [inline] __vfs_write+0x413/0x840 fs/read_write.c:482 __kernel_write+0xe4/0x360 fs/read_write.c:501 write_pipe_buf+0x14c/0x1e0 fs/splice.c:797 splice_from_pipe_feed fs/splice.c:502 [inline] __splice_from_pipe+0x2cb/0x720 fs/splice.c:626 audit: type=1804 audit(1647204350.829:6): pid=8316 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor426" name="/root/file0/bus" dev="loop1" ino=3 res=1 splice_from_pipe+0xb5/0x110 fs/splice.c:661 default_file_splice_write+0x18/0x50 fs/splice.c:809 audit: type=1804 audit(1647204350.829:7): pid=8317 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor426" name="/root/file0/bus" dev="loop3" ino=3 res=1 do_splice_from fs/splice.c:851 [inline] direct_splice_actor+0x104/0x1c0 fs/splice.c:1018 splice_direct_to_actor+0x27c/0x750 fs/splice.c:973 do_splice_direct+0x144/0x250 fs/splice.c:1061 audit: type=1804 audit(1647204350.839:8): pid=8333 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="ToMToU" comm="syz-executor426" name="/root/file0/bus" dev="loop3" ino=3 res=1 do_sendfile+0x46c/0xcf0 fs/read_write.c:1441 audit: type=1804 audit(1647204350.839:9): pid=8333 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="ToMToU" comm="syz-executor426" name="/root/file0/bus" dev="loop3" ino=3 res=1 SYSC_sendfile64 fs/read_write.c:1502 [inline] SyS_sendfile64+0xf5/0x110 fs/read_write.c:1488 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f53207e9619 RSP: 002b:00007f53207962f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 RAX: ffffffffffffffda RBX: 00007f532086e420 RCX: 00007f53207e9619 RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000003 RBP: 00007f532083b0a4 R08: 0000000000000000 R09: 0000000000000000 R10: 00008400fffffffa R11: 0000000000000246 R12: 0030656c69662f2e R13: 000010011badface R14: 75ca34411a118209 R15: 00007f532086e428 audit: type=1804 audit(1647204350.839:10): pid=8333 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor426" name="/root/file0/bus" dev="loop3" ino=3 res=1 Kernel Offset: disabled Rebooting in 86400 seconds..