ci starts bisection 2023-09-29 06:00:29.584082819 +0000 UTC m=+11558.666285359
bisecting fixing commit since bfa3037d828050896ae52f6467b6ca2489ae6fb1
building syzkaller on 4547cdf9e497f833628b7b0660809b3247a7411e
ensuring issue is reproducible on original commit bfa3037d828050896ae52f6467b6ca2489ae6fb1
testing commit bfa3037d828050896ae52f6467b6ca2489ae6fb1 gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: fa38c3a9566680d85f8fc255c60a180ad48170a4133fa276e89de14cb577757b
run #0: crashed: BUG: unable to handle kernel paging request in corrupted
run #1: crashed: general protection fault in __hrtimer_run_queues
run #2: crashed: general protection fault in rcu_core
run #3: crashed: general protection fault in psi_group_change
run #4: crashed: general protection fault in cpuacct_charge
run #5: crashed: BUG: unable to handle kernel paging request in corrupted
run #6: crashed: general protection fault in lookup_object_or_alloc
run #7: crashed: general protection fault in __hrtimer_run_queues
run #8: crashed: general protection fault in test_bdev_super_fc
run #9: crashed: general protection fault in update_curr
run #10: crashed: BUG: unable to handle kernel NULL pointer dereference in rcu_core
run #11: crashed: general protection fault in vma_interval_tree_remove
run #12: crashed: BUG: corrupted list in worker_thread
run #13: crashed: kernel BUG in corrupted
run #14: crashed: general protection fault in __call_rcu_common
run #15: crashed: kernel BUG in corrupted
run #16: crashed: kernel BUG in __phys_addr
run #17: crashed: general protection fault in __hrtimer_run_queues
run #18: crashed: KASAN: stack-out-of-bounds Read in timerqueue_del
run #19: crashed: no output from test machine
representative crash: BUG: unable to handle kernel paging request in corrupted, types: [UNKNOWN]
check whether we can drop unnecessary instrumentation
disabling configs for [HANG LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed
testing commit bfa3037d828050896ae52f6467b6ca2489ae6fb1 gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: eec764c115283d34a2554a767398dd757221e22c705248b84455419542e4bb1a
run #0: crashed: general protection fault in corrupted
run #1: crashed: stack segment fault in corrupted
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
representative crash: general protection fault in corrupted, types: [UNKNOWN]
kconfig minimization: base=3883 full=7652 leaves diff=1999
split chunks (needed=false): <1999>
split chunk #0 of len 1999 into 5 parts
testing without sub-chunk 1/5
testing commit bfa3037d828050896ae52f6467b6ca2489ae6fb1 gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 01a06dd00764485057de96c7c9070d470432fe71dfb40a8b2063ce69ecf58ae5
run #0: crashed: general protection fault in __mod_lruvec_page_state
run #1: crashed: general protection fault in psi_task_switch
run #2: crashed: general protection fault in corrupted
run #3: crashed: general protection fault in end_bio_bh_io_sync
run #4: crashed: BUG: unable to handle kernel paging request in tomoyo_encode2
run #5: crashed: general protection fault in __switch_to
run #6: crashed: general protection fault in mod_objcg_mlstate
run #7: crashed: BUG: unable to handle kernel paging request in ext4_ext_remove_space
run #8: crashed: WARNING: locking bug in __lock_task_sighand
run #9: crashed: KASAN: wild-memory-access Write in mapping_try_invalidate
run #10: crashed: KASAN: stack-out-of-bounds Read in timerqueue_del
run #11: crashed: general protection fault in mtree_range_walk
run #12: crashed: BUG: unable to handle kernel paging request in ext4_ext_remove_space
run #13: crashed: BUG: unable to handle kernel paging request in generic_file_write_iter
run #14: crashed: general protection fault in debug_check_no_obj_freed
run #15: crashed: general protection fault in __hrtimer_run_queues
run #16: crashed: no output from test machine
run #17: crashed: general protection fault in psi_account_irqtime
run #18: crashed: general protection fault in psi_account_irqtime
run #19: OK
representative crash: general protection fault in __mod_lruvec_page_state, types: [UNKNOWN]
the chunk can be dropped
testing without sub-chunk 2/5
testing commit bfa3037d828050896ae52f6467b6ca2489ae6fb1 gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: e7f9f517f6732e6ec0375b5b1dac266dfe8eca3d4fbd345f51cfe8e555ddcf1d
run #0: crashed: general protection fault in pick_next_task_fair
run #1: crashed: general protection fault in corrupted
run #2: crashed: kernel BUG in corrupted
run #3: crashed: general protection fault in __es_tree_search
run #4: basic kernel testing failed: failed to copy binary to VM: failed to run ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "BatchMode=yes" "-o" "IdentitiesOnly=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-v" "/tmp/syz-executor3505809743" "root@10.128.0.55:./syz-executor3505809743"]: exit status 255
Executing: program /usr/bin/ssh host 10.128.0.55, user root, command sftp
OpenSSH_9.2p1 Debian-2, OpenSSL 3.0.9 30 May 2023
debug1: Reading configuration data /dev/null
debug1: Connecting to 10.128.0.55 [10.128.0.55] port 22.
debug1: connect to address 10.128.0.55 port 22: Connection timed out
ssh: connect to host 10.128.0.55 port 22: Connection timed out
scp: Connection closed
run #5: crashed: BUG: unable to handle kernel paging request in ext4_ext_remove_space
run #6: crashed: general protection fault in pid_task
run #7: crashed: BUG: unable to handle kernel paging request in generic_file_write_iter
run #8: crashed: general protection fault in enqueue_task_fair
run #9: crashed: WARNING: locking bug in lockref_get
run #10: crashed: go runtime error
run #11: crashed: kernel panic: Attempted to kill init!
run #12: crashed: kernel BUG in corrupted
run #13: crashed: go runtime error
run #14: crashed: BUG: unable to handle kernel paging request in ext4_ext_remove_space
run #15: crashed: general protection fault in ext4_write_begin
run #16: crashed: kernel BUG in corrupted
run #17: crashed: general protection fault, probably for non-canonical address ADDRSeaBIOS (version NUM.NUM.NUM-google)
run #18: crashed: BUG: unable to handle kernel paging request in __free_object
run #19: OK
representative crash: general protection fault in pick_next_task_fair, types: [UNKNOWN]
the chunk can be dropped
testing without sub-chunk 3/5
testing commit bfa3037d828050896ae52f6467b6ca2489ae6fb1 gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: fa36b4454416c0f295e580030872a840dda6ae0c4f0dc0c033f38f6080f58e2d
run #0: crashed: general protection fault in __hrtimer_run_queues
run #1: crashed: general protection fault in __hrtimer_run_queues
run #2: crashed: general protection fault in cpuacct_account_field
run #3: crashed: BUG: unable to handle kernel paging request in ext4_ext_remove_space
run #4: crashed: WARNING: locking bug in psi_group_change
run #5: crashed: WARNING: locking bug in ext4_mb_use_preallocated
run #6: crashed: general protection fault in pid_task
run #7: crashed: general protection fault in update_curr
run #8: crashed: UBSAN: shift-out-of-bounds in corrupted
run #9: crashed: general protection fault in debug_check_no_obj_freed
run #10: crashed: general protection fault in vfs_write
run #11: crashed: general protection fault in debug_check_no_obj_freed
run #12: crashed: general protection fault in __fput
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: general protection fault in __hrtimer_run_queues, types: [UNKNOWN]
the chunk can be dropped
testing without sub-chunk 4/5
testing commit bfa3037d828050896ae52f6467b6ca2489ae6fb1 gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 4bd5427bbf870a568cb2a95c9fa66b2fbd53aad46d068ef140e9736b7a2e025d
run #0: crashed: WARNING in ext4_punch_hole
run #1: crashed: go runtime error
run #2: crashed: general protection fault in enqueue_task_fair
run #3: crashed: KFENCE: invalid read in ext4_ext_remove_space
run #4: crashed: general protection fault in __cgroup_account_cputime
run #5: crashed: BUG: unable to handle kernel paging request in __stack_depot_save
run #6: crashed: possible deadlock in try_to_wake_up
run #7: crashed: KASAN: user-memory-access Read in __find_get_block
run #8: crashed: kernel BUG in __phys_addr
run #9: crashed: UBSAN: shift-out-of-bounds in __block_write_full_folio
run #10: crashed: general protection fault in end_bio_bh_io_sync
run #11: crashed: BUG: unable to handle kernel NULL pointer dereference in rcu_core
run #12: crashed: BUG: unable to handle kernel NULL pointer dereference in rcu_core
run #13: crashed: general protection fault in timerqueue_del
run #14: crashed: WARNING: locking bug in igrab
run #15: crashed: KASAN: wild-memory-access Read in fsnotify_perm
run #16: crashed: general protection fault in init_timer_key
run #17: crashed: no output from test machine
run #18: crashed: general protection fault in debug_check_no_obj_freed
run #19: OK
representative crash: go runtime error, types: [UNKNOWN LOCKDEP]
the chunk can be dropped
testing without sub-chunk 5/5
testing commit bfa3037d828050896ae52f6467b6ca2489ae6fb1 gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: c2deb8f6eff487ff79b800e97fa03ae5ba411a4d9022233cd176f6727b4c959b
run #0: crashed: BUG: corrupted list in percpu_counter_destroy
run #1: crashed: UBSAN: shift-out-of-bounds in __radix_tree_lookup
run #2: crashed: stack segment fault in __stack_depot_save
run #3: crashed: go runtime error
run #4: crashed: general protection fault in inode_permission
run #5: crashed: BUG: corrupted list in unregister_shrinker
run #6: crashed: go runtime error
run #7: crashed: UBSAN: shift-out-of-bounds in radix_tree_next_chunk
run #8: crashed: general protection fault in do_iter_write
run #9: crashed: general protection fault in do_iter_write
run #10: crashed: KASAN: wild-memory-access Write in filemap_get_read_batch
run #11: crashed: UBSAN: shift-out-of-bounds in __block_write_full_folio
run #12: crashed: general protection fault in timerqueue_del
run #13: crashed: general protection fault in __get_obj_cgroup_from_memcg
run #14: crashed: general protection fault in rcu_core
run #15: crashed: general protection fault in do_iter_write
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: stack segment fault in __stack_depot_save, types: [UNKNOWN UBSAN]
the chunk can be dropped
testing current HEAD 9ed22ae6be817d7a3f5c15ca22cbc9d3963b481d
testing commit 9ed22ae6be817d7a3f5c15ca22cbc9d3963b481d gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: faff4566ebfd3dd1d646740c771f7d631caa58f678f117a051d597faa237b4d2
run #0: crashed: WARNING: See https://kernel.org/doc/html/latest/admin-guide/hw-vuln/srso.html for mitigation options.
run #1: crashed: BUG: unable to handle kernel NULL pointer dereference in rcu_core
run #2: crashed: general protection fault in pid_task
run #3: crashed: general protection fault in rcu_core
run #4: crashed: KFENCE: invalid read in ext4_ext_remove_space
run #5: crashed: KFENCE: invalid read in ext4_ext_remove_space
run #6: crashed: general protection fault in rcu_core
run #7: crashed: WARNING: locking bug in __filemap_add_folio
run #8: crashed: KFENCE: invalid read in ext4_ext_remove_space
run #9: crashed: UBSAN: shift-out-of-bounds in filemap_get_entry
run #10: crashed: KASAN: wild-memory-access Write in find_get_entry
run #11: crashed: WARNING: locking bug in dput
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: BUG: unable to handle kernel NULL pointer dereference in rcu_core, types: [UNKNOWN LOCKDEP]
crash still not fixed/happens on the oldest tested release
reproducer is flaky (0.80 repro chance estimate)
revisions tested: 8, total time: 2h35m59.852499723s (build: 1h0m21.28990725s, test: 1h30m44.793818463s)
crash still not fixed or there were kernel test errors
commit msg: Merge tag 'spi-fix-v6.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
crash: BUG: unable to handle kernel NULL pointer dereference in rcu_core
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 10d367067 P4D 10d367067 PUD 125139067 PMD 0
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 5788 Comm: syz-executor.1 Not tainted 6.6.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023
RIP: 0010:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 0018:ffffc90000198e18 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8881f7139f80 RCX: 0000000000000001
RDX: 1ffff11022e644d8 RSI: ffffffff83675a20 RDI: ffff888128172c18
RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffff81316b2b
R10: ffffffff867289df R11: 0000000000365c00 R12: dffffc0000000000
R13: ffffffff81316b6d R14: 0000000000000000 R15: 0000000000000000
FS: 00007f07c64d86c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 000000011268d000 CR4: 0000000000350ee0
Call Trace:
rcu_do_batch kernel/rcu/tree.c:2139 [inline]
rcu_core+0x7ff/0x1a70 kernel/rcu/tree.c:2403
__do_softirq+0x20b/0x94e kernel/softirq.c:553
invoke_softirq kernel/softirq.c:427 [inline]
__irq_exit_rcu kernel/softirq.c:632 [inline]
irq_exit_rcu+0xa7/0x110 kernel/softirq.c:644
sysvec_apic_timer_interrupt+0x8e/0xb0 arch/x86/kernel/apic/apic.c:1074
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
RIP: 0010:memmove+0x4c/0x1b0 arch/x86/lib/memmove_64.S:70
Code: 01 00 00 66 0f 1f 44 00 00 48 81 fa a8 02 00 00 72 05 40 38 fe 74 47 48 83 ea 20 48 83 ea 20 4c 8b 1e 4c 8b 56 08 4c 8b 4e 10 <4c> 8b 46 18 48 8d 76 20 4c 89 1f 4c 89 57 08 4c 89 4f 10 4c 89 47
RSP: 0018:ffffc9000446f838 EFLAGS: 00000286
RAX: ffff888127780078 RBX: ffff888127780002 RCX: ffff888127780000
RDX: fffffffffd37ffe8 RSI: ffff88812a3fffe4 RDI: ffff88812a3fffd8
RBP: ffff888127780078 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88812778007c R14: dffffc0000000000 R15: dffffc0000000000
ext4_ext_rm_leaf fs/ext4/extents.c:2736 [inline]
ext4_ext_remove_space+0x117a/0x3f30 fs/ext4/extents.c:2958
ext4_punch_hole+0xb89/0xec0 fs/ext4/inode.c:4011
ext4_fallocate+0x3af/0x3010 fs/ext4/extents.c:4706
vfs_fallocate+0x296/0xbb0 fs/open.c:324
ioctl_preallocate+0x15b/0x1d0 fs/ioctl.c:291
file_ioctl fs/ioctl.c:334 [inline]
do_vfs_ioctl+0x1336/0x14d0 fs/ioctl.c:850
__do_sys_ioctl fs/ioctl.c:869 [inline]
__se_sys_ioctl fs/ioctl.c:857 [inline]
__x64_sys_ioctl+0xcc/0x1a0 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x38/0x80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f07ced36b29
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f07c64d80c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f07cee56050 RCX: 00007f07ced36b29
RDX: 0000000020000080 RSI: 000000004030582b RDI: 0000000000000004
RBP: 00007f07ced8247a R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000006e R14: 00007f07cee56050 R15: 00007ffc6de9bd28
Modules linked in:
CR2: 0000000000000000
---[ end trace 0000000000000000 ]---
RIP: 0010:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 0018:ffffc90000198e18 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8881f7139f80 RCX: 0000000000000001
RDX: 1ffff11022e644d8 RSI: ffffffff83675a20 RDI: ffff888128172c18
RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffff81316b2b
R10: ffffffff867289df R11: 0000000000365c00 R12: dffffc0000000000
R13: ffffffff81316b6d R14: 0000000000000000 R15: 0000000000000000
FS: 00007f07c64d86c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 000000011268d000 CR4: 0000000000350ee0
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 00 00 add %al,(%rax)
2: 66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1)
8: 48 81 fa a8 02 00 00 cmp $0x2a8,%rdx
f: 72 05 jb 0x16
11: 40 38 fe cmp %dil,%sil
14: 74 47 je 0x5d
16: 48 83 ea 20 sub $0x20,%rdx
1a: 48 83 ea 20 sub $0x20,%rdx
1e: 4c 8b 1e mov (%rsi),%r11
21: 4c 8b 56 08 mov 0x8(%rsi),%r10
25: 4c 8b 4e 10 mov 0x10(%rsi),%r9
* 29: 4c 8b 46 18 mov 0x18(%rsi),%r8 <-- trapping instruction
2d: 48 8d 76 20 lea 0x20(%rsi),%rsi
31: 4c 89 1f mov %r11,(%rdi)
34: 4c 89 57 08 mov %r10,0x8(%rdi)
38: 4c 89 4f 10 mov %r9,0x10(%rdi)
3c: 4c rex.WR
3d: 89 .byte 0x89
3e: 47 rex.RXB