bisecting fixing commit since 1bab61d3e8cd96f2badf515dcb06e4e1029bc017
building syzkaller on 4afdfa205b55633e7eb9db03a9d099d7aa324801
testing commit 1bab61d3e8cd96f2badf515dcb06e4e1029bc017 with gcc (GCC) 8.1.0
kernel signature: 5c59d31056a05d3e69fb6f7d9a87533b67f9277c7b744e1aadced6fde8e3c1d8
all runs: crashed: kernel BUG at mm/memory.c:LINE!
testing current HEAD 3fc898571b974f9a05e4e5c1fe17b18548207091
testing commit 3fc898571b974f9a05e4e5c1fe17b18548207091 with gcc (GCC) 8.1.0
kernel signature: c5c9a5e876b1053c5a2395ca1ab545ad317661043968a1054afc145d6101576c
all runs: crashed: kernel BUG at mm/memory.c:LINE!
revisions tested: 2, total time: 24m34.657707366s (build: 17m58.737118236s, test: 6m5.919271163s)
the crash still happens on HEAD
commit msg: Linux 4.19.128
crash: kernel BUG at mm/memory.c:LINE!
next ffff88808c14ea90 prev ffff88808c14eb98 mm ffff88808f532a40
prot 25 anon_vma 0000000000000000 vm_ops ffffffff87310a60
pgoff 0 file ffff888092716080 private_data 0000000000000000
flags: 0xfe(write|exec|shared|mayread|maywrite|mayexec|mayshare)
------------[ cut here ]------------
kernel BUG at mm/memory.c:3947!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 7897 Comm: syz-executor.0 Not tainted 4.19.128-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:wp_huge_pmd mm/memory.c:3947 [inline]
RIP: 0010:__handle_mm_fault+0x2177/0x41a0 mm/memory.c:4155
Code: 49 8d b6 a0 00 00 00 48 89 da 44 89 9d 10 ff ff ff e8 2d 71 fe ff 44 8b 9d 10 ff ff ff e9 28 ec ff ff 48 89 df e8 70 a7 fd ff <0f> 0b 49 8d 84 24 60 ff ff ff 48 89 c7 e8 67 eb 0b 00 41 89 c3 e9
RSP: 0018:ffff88809ec07cc8 EFLAGS: 00010296
RAX: 0000000000000137 RBX: ffff888091c63988 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff87676320 RDI: ffffffff8a192a60
RBP: ffff88809ec07de8 R08: ffffed1015d65081 R09: ffffed1015d65080
R10: ffffed1015d65080 R11: ffff8880aeb28407 R12: ffff88809ec07dc0
R13: 1ffff11013d80fa0 R14: ffffffff87310a60 R15: ffff88808f532a40
FS:  0000000002b95940(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3c36aa2070 CR3: 000000008f8b6000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 handle_mm_fault+0x3dd/0x8ab mm/memory.c:4202
 __do_page_fault+0x50e/0xb30 arch/x86/mm/fault.c:1412
 do_page_fault+0x64/0x3a7 arch/x86/mm/fault.c:1487
 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1205
RIP: 0033:0x443cd1
Code: 8d 15 b3 1b 0d 00 8b 0c 8a 8b 04 82 29 c8 c3 66 2e 0f 1f 84 00 00 00 00 00 48 83 fa 20 48 89 f8 73 77 f6 c2 01 74 0b 0f b6 0e <88> 0f 48 ff c6 48 ff c7 f6 c2 02 74 12 0f b7 0e 66 89 0f 48 83 c6
RSP: 002b:00007ffc1c5c2798 EFLAGS: 00010202
RAX: 00000000200001c0 RBX: 0000000000000000 RCX: 0000000000000063
RDX: 0000000000000013 RSI: 0000000000790398 RDI: 00000000200001c0
RBP: 0000000000790378 R08: 0000000000000000 R09: 0000000000000000
R10: 00007ffc1c5c2880 R11: 0000000000000246 R12: 0000000000790380
R13: 000000000000ba6a R14: fffffffffffffffe R15: 000000000078bfac
Modules linked in:
---[ end trace 185b96e67c75b556 ]---
RIP: 0010:wp_huge_pmd mm/memory.c:3947 [inline]
RIP: 0010:__handle_mm_fault+0x2177/0x41a0 mm/memory.c:4155
Code: 49 8d b6 a0 00 00 00 48 89 da 44 89 9d 10 ff ff ff e8 2d 71 fe ff 44 8b 9d 10 ff ff ff e9 28 ec ff ff 48 89 df e8 70 a7 fd ff <0f> 0b 49 8d 84 24 60 ff ff ff 48 89 c7 e8 67 eb 0b 00 41 89 c3 e9
RSP: 0018:ffff88809ec07cc8 EFLAGS: 00010296
RAX: 0000000000000137 RBX: ffff888091c63988 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff87676320 RDI: ffffffff8a192a60
RBP: ffff88809ec07de8 R08: ffffed1015d65081 R09: ffffed1015d65080
R10: ffffed1015d65080 R11: ffff8880aeb28407 R12: ffff88809ec07dc0
R13: 1ffff11013d80fa0 R14: ffffffff87310a60 R15: ffff88808f532a40
FS:  0000000002b95940(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f128ecae080 CR3: 000000008f8b6000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400