bisecting fixing commit since aec3002d07fd2564cd32e56f126fa6db14a168bb building syzkaller on 907bf74686129436f81aa40336ee89f7cc01b0b4 testing commit aec3002d07fd2564cd32e56f126fa6db14a168bb with gcc (GCC) 8.1.0 kernel signature: 7e35542e5ac35ef91d7fb1857f61ddb6d6912720969164d8ad38a8dce0a23eef all runs: crashed: WARNING in perf_group_attach testing current HEAD 0c88e405c97ed1828443b67891e6d4bb6e56cd4e testing commit 0c88e405c97ed1828443b67891e6d4bb6e56cd4e with gcc (GCC) 8.1.0 kernel signature: 9f88459040a3eb55e78822070805ed0088a635ff65baa3e4056b7d07215fbc48 all runs: crashed: WARNING in perf_group_attach revisions tested: 2, total time: 25m6.317894104s (build: 18m29.964518969s, test: 5m58.665071917s) the crash still happens on HEAD commit msg: Linux 4.19.160 crash: WARNING in perf_group_attach IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready 8021q: adding VLAN 0 to HW filter on device batadv0 8021q: adding VLAN 0 to HW filter on device batadv0 WARNING: CPU: 0 PID: 6793 at kernel/events/core.c:1840 perf_group_attach+0x3b1/0x470 kernel/events/core.c:1832 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 6793 Comm: syz-executor.4 Not tainted 4.19.160-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x123/0x177 lib/dump_stack.c:118 panic+0x1cd/0x375 kernel/panic.c:186 __warn.cold.8+0x1b/0x3e kernel/panic.c:541 report_bug+0x1a4/0x200 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:178 [inline] do_error_trap+0x200/0x350 arch/x86/kernel/traps.c:296 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1038 RIP: 0010:perf_group_attach+0x3b1/0x470 kernel/events/core.c:1840 Code: ec 10 4c 39 e3 75 d7 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 de b1 1d 00 e9 c8 fc ff ff e8 d4 b1 1d 00 e9 fe fc ff ff <0f> 0b e9 75 fd ff ff e8 e3 b1 1d 00 eb c1 e8 dc b1 1d 00 e9 6d fc RSP: 0018:ffff8881f6807ec0 EFLAGS: 00010006 RAX: dffffc0000000000 RBX: ffff8881d9db4a40 RCX: 1ffff1103b3b6852 RDX: 1ffff1103b3b687b RSI: ffff8881f6831460 RDI: ffff8881d9db43d8 RBP: ffff8881f6807ef0 R08: ffffffff890a4018 R09: 0000000000000006 R10: fffffbfff1214801 R11: 0000000000000001 R12: ffff8881d9db41c0 R13: ffffe8ffffc11bd0 R14: 0000000000000000 R15: ffff8881f6831448 add_event_to_ctx kernel/events/core.c:2398 [inline] __perf_install_in_context+0x3f6/0x860 kernel/events/core.c:2539 remote_function+0xff/0x180 kernel/events/core.c:87 flush_smp_call_function_queue+0x10e/0x3d0 kernel/smp.c:243 generic_smp_call_function_single_interrupt+0xe/0x11 kernel/smp.c:192 smp_call_function_single_interrupt+0xa0/0x440 arch/x86/kernel/smp.c:304 call_function_single_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:916 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline] RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0xaf/0xd0 kernel/locking/spinlock.c:184 Code: 88 ff 11 88 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 28 48 83 3d c0 09 8c 01 00 74 15 48 89 df 57 9d <0f> 1f 44 00 00 eb ad e8 90 64 7a fa eb bb 0f 0b 0f 0b e8 4a a6 0c RSP: 0018:ffff8881dd2e7428 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff04 RAX: dffffc0000000000 RBX: 0000000000000282 RCX: 0000000000000000 RDX: 1ffffffff1023ff1 RSI: 0000000000000001 RDI: 0000000000000282 RBP: ffff8881dd2e7438 R08: fffffbfff13b128a R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff89d89448 R13: 0000000000000000 R14: ffff8881c6dd5000 R15: dffffc0000000000 __debug_check_no_obj_freed lib/debugobjects.c:798 [inline] debug_check_no_obj_freed+0x1ff/0x472 lib/debugobjects.c:817 free_pages_prepare mm/page_alloc.c:1056 [inline] __free_pages_ok+0x254/0xd90 mm/page_alloc.c:1279 free_compound_page+0x62/0x90 mm/page_alloc.c:595 free_transhuge_page+0x1e3/0x2b0 mm/huge_memory.c:2826 __put_compound_page+0x65/0xa0 mm/swap.c:96 release_pages+0x399/0x12e0 mm/swap.c:768 free_pages_and_swap_cache+0x17a/0x370 mm/swap_state.c:320 tlb_flush_mmu_free+0xb3/0x150 mm/memory.c:261 zap_pte_range mm/memory.c:1417 [inline] zap_pmd_range mm/memory.c:1452 [inline] zap_pud_range mm/memory.c:1481 [inline] zap_p4d_range mm/memory.c:1502 [inline] unmap_page_range+0xf23/0x16b0 mm/memory.c:1523 unmap_single_vma+0x121/0x300 mm/memory.c:1568 unmap_vmas+0xe7/0x1a0 mm/memory.c:1598 exit_mmap+0x251/0x470 mm/mmap.c:3093 __mmput kernel/fork.c:1015 [inline] mmput+0x107/0x3f0 kernel/fork.c:1036 exit_mm kernel/exit.c:549 [inline] do_exit+0x9f1/0x2d70 kernel/exit.c:877 do_group_exit+0xf4/0x2f0 kernel/exit.c:993 get_signal+0x313/0x1a30 kernel/signal.c:2589 do_signal+0x87/0x1960 arch/x86/kernel/signal.c:821 exit_to_usermode_loop+0x114/0x200 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x413/0x4e0 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x459599 Code: Bad RIP value. RSP: 002b:00007f9808fc6c78 EFLAGS: 00000246 ORIG_RAX: 000000000000012a RAX: 0000000000000005 RBX: 0000000000000005 RCX: 0000000000459599 RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000020000000 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000003 R11: 0000000000000246 R12: 00007f9808fc76d4 R13: 00000000004c620d R14: 00000000004daea0 R15: 00000000ffffffff Kernel Offset: disabled Rebooting in 86400 seconds..