bisecting fixing commit since 1bab61d3e8cd96f2badf515dcb06e4e1029bc017 building syzkaller on 4afdfa205b55633e7eb9db03a9d099d7aa324801 testing commit 1bab61d3e8cd96f2badf515dcb06e4e1029bc017 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 013176a9dff65d3fb66973bae96c23968692be957080d92fab0ec9999f22d178 run #0: crashed: kernel BUG in __handle_mm_fault run #1: crashed: kernel BUG in __handle_mm_fault run #2: crashed: kernel BUG in corrupted run #3: crashed: kernel BUG in __handle_mm_fault run #4: crashed: kernel BUG in __handle_mm_fault run #5: crashed: kernel BUG in corrupted run #6: crashed: kernel BUG in __handle_mm_fault run #7: crashed: kernel BUG in __handle_mm_fault run #8: crashed: kernel BUG in __handle_mm_fault run #9: crashed: kernel BUG in __handle_mm_fault run #10: crashed: kernel BUG in __handle_mm_fault run #11: crashed: kernel BUG in __handle_mm_fault run #12: crashed: kernel BUG in __handle_mm_fault run #13: crashed: kernel BUG in __handle_mm_fault run #14: crashed: kernel BUG in __handle_mm_fault run #15: crashed: kernel BUG in __handle_mm_fault run #16: crashed: kernel BUG in __handle_mm_fault run #17: crashed: kernel BUG in __handle_mm_fault run #18: crashed: kernel BUG in __handle_mm_fault run #19: crashed: kernel BUG in __handle_mm_fault testing current HEAD 2950c9c5e0df6bd34af45a5168bbee345e95eae2 testing commit 2950c9c5e0df6bd34af45a5168bbee345e95eae2 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 7e9d0147dc8ab38ecaafb801fa154a5d7497390ea04128cb144379b0d095059b run #0: crashed: kernel BUG in __handle_mm_fault run #1: crashed: kernel BUG in __handle_mm_fault run #2: crashed: kernel BUG in __handle_mm_fault run #3: crashed: kernel BUG in corrupted run #4: crashed: kernel BUG in __handle_mm_fault run #5: crashed: kernel BUG in __handle_mm_fault run #6: crashed: kernel BUG in __handle_mm_fault run #7: crashed: kernel BUG in __handle_mm_fault run #8: crashed: kernel BUG in __handle_mm_fault run #9: crashed: kernel BUG in corrupted revisions tested: 2, total time: 33m20.791593122s (build: 25m43.874653918s, test: 6m30.18087306s) the crash still happens on HEAD commit msg: Linux 4.19.207 crash: kernel BUG in corrupted next ffff8881dc78b108 prev ffff8881dc78b210 mm ffff8881da0bc000 prot 25 anon_vma 0000000000000000 vm_ops ffffffff87311460 pgoff 0 file ffff8881e2f830c0 private_data 0000000000000000 flags: 0xfe(write|exec|shared|mayread|maywrite|mayexec|mayshare) ------------[ cut here ]------------ kernel BUG at mm/memory.c:4081! ------------[ cut here ]------------ kernel BUG at mm/memory.c:4081! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 7123 Comm: syz-executor.3 Not tainted 4.19.207-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:wp_huge_pmd mm/memory.c:4081 [inline] RIP: 0010:__handle_mm_fault+0x2192/0x4100 mm/memory.c:4289 Code: 00 00 00 4c 89 f7 e8 dd f4 09 00 f0 41 ff 0e 0f 85 54 ec ff ff 48 89 df e8 fb e3 f5 ff e9 47 ec ff ff 48 89 df e8 1a f3 3b 05 <0f> 0b 49 8d 84 24 60 ff ff ff 48 89 c7 e8 bc de 0b 00 41 89 c7 e9 RSP: 0018:ffff8881db00fcc8 EFLAGS: 00010296 RAX: 0000000000000137 RBX: ffff8881ddc0ceb0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8767a4a0 RDI: ffffffff8a195aa0 RBP: ffff8881db00fde8 R08: ffffed103ed05091 R09: ffffed103ed05090 R10: ffffed103ed05090 R11: ffff8881f6828487 R12: ffff8881db00fdc0 R13: 1ffff1103b601fa0 R14: ffffffff87311460 R15: 0000000000000080 FS: 00000000019ce400(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc75995d5c CR3: 00000001e2d9c005 CR4: 00000000001606f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: handle_mm_fault+0x3dd/0x8b0 mm/memory.c:4336 __do_page_fault+0x50e/0xb30 arch/x86/mm/fault.c:1412 do_page_fault+0x64/0x3b0 arch/x86/mm/fault.c:1487 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1205 RIP: 0033:0x45fb08 Code: d1 f3 a4 c3 80 fa 10 73 17 80 fa 08 73 27 80 fa 04 73 33 80 fa 01 77 3b 72 05 0f b6 0e 88 0f c3 c5 fa 6f 06 c5 fa 6f 4c 16 f0 fa 7f 07 c5 fa 7f 4c 17 f0 c3 48 8b 4c 16 f8 48 8b 36 48 89 4c RSP: 002b:00007ffed6e76c78 EFLAGS: 00010206 RAX: 00000000200001c0 RBX: 000000000055c900 RCX: 0000000000960000 RDX: 0000000000000013 RSI: 0000000000560398 RDI: 00000000200001c0 RBP: 00007ffed6e76d18 R08: 0000000000560278 R09: 0000000000000000 R10: 00007ffed6e76d30 R11: 0000000000000246 R12: 00000000000003e8 R13: 000000000055c04c R14: 000000000055bf00 R15: 000000000055c040 Modules linked in: invalid opcode: 0000 [#2] PREEMPT SMP KASAN CPU: 1 PID: 7135 Comm: syz-executor.0 Tainted: G D 4.19.207-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:wp_huge_pmd mm/memory.c:4081 [inline] RIP: 0010:__handle_mm_fault+0x2192/0x4100 mm/memory.c:4289 Code: 00 00 00 4c 89 f7 e8 dd f4 09 00 f0 41 ff 0e 0f 85 54 ec ff ff 48 89 df e8 fb e3 f5 ff e9 47 ec ff ff 48 89 df e8 1a f3 3b 05 <0f> 0b 49 8d 84 24 60 ff ff ff 48 89 c7 e8 bc de 0b 00 41 89 c7 e9 RSP: 0000:ffff8881da287cc8 EFLAGS: 00010296 RAX: 0000000000000137 RBX: ffff8881d95eb460 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8767a4a0 RDI: ffffffff8a195aa0 RBP: ffff8881da287de8 R08: ffffed103ed05091 R09: ffffed103ed05090 R10: ffffed103ed05090 R11: ffff8881f6828487 R12: ffff8881da287dc0 R13: 1ffff1103b450fa0 R14: ffffffff87311460 R15: 0000000000000080 FS: 00000000018f0400(0000) GS:ffff8881f6900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc44e3fedc CR3: 00000001dce4a001 CR4: 00000000001606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: handle_mm_fault+0x3dd/0x8b0 mm/memory.c:4336 ---[ end trace 307d51dd584ea3b9 ]--- __do_page_fault+0x50e/0xb30 arch/x86/mm/fault.c:1412 do_page_fault+0x64/0x3b0 arch/x86/mm/fault.c:1487 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1205 RIP: 0033:0x45fb08 Code: d1 f3 a4 c3 80 fa 10 73 17 80 fa 08 73 27 80 fa 04 73 33 80 fa 01 77 3b 72 05 0f b6 0e 88 0f c3 c5 fa 6f 06 c5 fa 6f 4c 16 f0 fa 7f 07 c5 fa 7f 4c 17 f0 c3 48 8b 4c 16 f8 48 8b 36 48 89 4c RIP: 0010:wp_huge_pmd mm/memory.c:4081 [inline] RIP: 0010:__handle_mm_fault+0x2192/0x4100 mm/memory.c:4289 RSP: 002b:00007fff211210b8 EFLAGS: 00010206 RAX: 00000000200001c0 RBX: 000000000055c900 RCX: 0000000000960000 RDX: 0000000000000013 RSI: 0000000000560398 RDI: 00000000200001c0 RBP: 00007fff21121158 R08: 0000000000560278 R09: 0000000000000000 R10: 00007fff21121170 R11: 0000000000000246 R12: 00000000000003e8 R13: 000000000055c04c R14: 000000000055bf00 R15: 000000000055c040 Modules linked in: ---[ end trace 307d51dd584ea3ba ]--- Code: 00 00 00 4c 89 f7 e8 dd f4 09 00 f0 41 ff 0e 0f 85 54 ec ff ff 48 89 df e8 fb e3 f5 ff e9 47 ec ff ff 48 89 df e8 1a f3 3b 05 <0f> 0b 49 8d 84 24 60 ff ff ff 48 89 c7 e8 bc de 0b 00 41 89 c7 e9 RIP: 0010:wp_huge_pmd mm/memory.c:4081 [inline] RIP: 0010:__handle_mm_fault+0x2192/0x4100 mm/memory.c:4289 RSP: 0018:ffff8881db00fcc8 EFLAGS: 00010296 Code: 00 00 00 4c 89 f7 e8 dd f4 09 00 f0 41 ff 0e 0f 85 54 ec ff ff 48 89 df e8 fb e3 f5 ff e9 47 ec ff ff 48 89 df e8 1a f3 3b 05 <0f> 0b 49 8d 84 24 60 ff ff ff 48 89 c7 e8 bc de 0b 00 41 89 c7 e9 RAX: 0000000000000137 RBX: ffff8881ddc0ceb0 RCX: 0000000000000000 RSP: 0018:ffff8881db00fcc8 EFLAGS: 00010296 RAX: 0000000000000137 RBX: ffff8881ddc0ceb0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8767a4a0 RDI: ffffffff8a195aa0 RBP: ffff8881db00fde8 R08: ffffed103ed05091 R09: ffffed103ed05090 RDX: 0000000000000000 RSI: ffffffff8767a4a0 RDI: ffffffff8a195aa0 RBP: ffff8881db00fde8 R08: ffffed103ed05091 R09: ffffed103ed05090 R10: ffffed103ed05090 R11: ffff8881f6828487 R12: ffff8881db00fdc0 R13: 1ffff1103b601fa0 R14: ffffffff87311460 R15: 0000000000000080 R10: ffffed103ed05090 R11: ffff8881f6828487 R12: ffff8881db00fdc0 FS: 00000000018f0400(0000) GS:ffff8881f6900000(0000) knlGS:0000000000000000 R13: 1ffff1103b601fa0 R14: ffffffff87311460 R15: 0000000000000080 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 FS: 00000000019ce400(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000 CR2: 00000000017c4928 CR3: 00000001dce4a002 CR4: 00000000001606e0 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 CR2: 00007faf37919000 CR3: 00000001e2d9c005 CR4: 00000000001606f0 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000