bisecting fixing commit since cbfa1702aaf69b2311ea1b35e04f113c48368c67 building syzkaller on 5abc3f1ab298244473b613c289f1536e366fcf04 testing commit cbfa1702aaf69b2311ea1b35e04f113c48368c67 with gcc (GCC) 8.4.1 20210217 kernel signature: f6d8e0e878100622f638d6aa57b6796c5b5552e97e5724f4a0e221b265bee923 run #0: crashed: kernel BUG in f2fs_evict_inode run #1: crashed: kernel BUG in f2fs_evict_inode run #2: crashed: kernel BUG in corrupted run #3: crashed: kernel BUG in f2fs_evict_inode run #4: crashed: kernel BUG in f2fs_evict_inode run #5: crashed: kernel BUG in corrupted run #6: crashed: kernel BUG in f2fs_evict_inode run #7: crashed: kernel BUG in f2fs_evict_inode run #8: crashed: kernel BUG in f2fs_evict_inode run #9: crashed: kernel BUG in f2fs_evict_inode run #10: crashed: kernel BUG in f2fs_evict_inode run #11: crashed: kernel BUG in f2fs_evict_inode run #12: crashed: kernel BUG in f2fs_evict_inode run #13: crashed: kernel BUG in corrupted run #14: crashed: kernel BUG in f2fs_evict_inode run #15: crashed: kernel BUG in f2fs_evict_inode run #16: crashed: kernel BUG in f2fs_evict_inode run #17: crashed: kernel BUG in f2fs_evict_inode run #18: crashed: kernel BUG in f2fs_evict_inode run #19: crashed: kernel BUG in f2fs_evict_inode testing current HEAD 3242aa3a635c0958671ee1e4b0958dcc7c4e5c79 testing commit 3242aa3a635c0958671ee1e4b0958dcc7c4e5c79 with gcc (GCC) 8.4.1 20210217 kernel signature: a6aaa48a077be7c7165940123f1b2cfda28699565712b5788633c8ecd5022978 run #0: crashed: kernel BUG in f2fs_evict_inode run #1: crashed: kernel BUG in f2fs_evict_inode run #2: crashed: kernel BUG in corrupted run #3: crashed: kernel BUG in f2fs_evict_inode run #4: crashed: kernel BUG in f2fs_evict_inode run #5: crashed: kernel BUG in f2fs_evict_inode run #6: crashed: kernel BUG in f2fs_evict_inode run #7: crashed: kernel BUG in f2fs_evict_inode run #8: crashed: kernel BUG in f2fs_evict_inode run #9: crashed: kernel BUG in f2fs_evict_inode revisions tested: 2, total time: 22m50.004874692s (build: 15m18.460772026s, test: 6m33.086229164s) the crash still happens on HEAD commit msg: Linux 4.14.222 crash: kernel BUG in f2fs_evict_inode IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 ------------[ cut here ]------------ kernel BUG at fs/f2fs/inode.c:600! batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! invalid opcode: 0000 [#1] PREEMPT SMP KASAN Modules linked in: batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! CPU: 0 PID: 5808 Comm: syz-executor.1 Not tainted 4.14.222-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff8881d208e480 task.stack: ffff8881d26c8000 RIP: 0010:f2fs_evict_inode+0xc5c/0xf70 fs/f2fs/inode.c:600 RSP: 0018:ffff8881d26cfb48 EFLAGS: 00010202 RAX: 0000000000000142 RBX: ffff8881d03f27c0 RCX: 0000000000000001 RDX: 1ffff11039265178 RSI: 0000000000000001 RDI: ffff8881d7448c04 RBP: ffff8881d26cfbc8 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000040 R12: ffff8881c9328bc0 R13: ffff8881d03f2c00 R14: ffff8881d7448b80 R15: ffff8881c93287f0 FS: 0000000001566400(0000) GS:ffff8881f6600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready CR2: 000000000156f848 CR3: 00000001e83a4004 CR4: 00000000001606f0 batman_adv: batadv0: Interface activated: batadv_slave_1 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: evict+0x29c/0x590 fs/inode.c:555 iput_final fs/inode.c:1524 [inline] iput fs/inode.c:1551 [inline] iput+0x3ac/0x810 fs/inode.c:1536 ieee80211 phy4: Selected rate control algorithm 'minstrel_ht' dentry_unlink_inode+0x22d/0x2e0 fs/dcache.c:387 ieee80211 phy4: hwaddr 02:00:00:00:04:00 registered __dentry_kill+0x2d2/0x540 fs/dcache.c:591 dentry_kill fs/dcache.c:632 [inline] dput.part.6+0x491/0x610 fs/dcache.c:847 dput fs/dcache.c:811 [inline] do_one_tree+0x36/0x40 fs/dcache.c:1507 shrink_dcache_for_umount+0x56/0x110 fs/dcache.c:1521 generic_shutdown_super+0x61/0x330 fs/super.c:431 ieee80211 phy4: mac80211_hwsim_start kill_block_super+0x96/0xe0 fs/super.c:1161 ieee80211 phy4: mac80211_hwsim_add_interface (type=1 mac_addr=02:00:00:00:04:00) kill_f2fs_super+0x8d/0xb0 fs/f2fs/super.c:2786 deactivate_locked_super+0x62/0xb0 fs/super.c:319 deactivate_super fs/super.c:350 [inline] deactivate_super+0x7d/0x90 fs/super.c:346 cleanup_mnt+0x9f/0x130 fs/namespace.c:1183 __cleanup_mnt+0xd/0x10 fs/namespace.c:1190 task_work_run+0xe5/0x170 kernel/task_work.c:113 ieee80211 phy4: mac80211_hwsim_bss_info_changed(changed=0xe vif->addr=02:00:00:00:04:00) tracehook_notify_resume include/linux/tracehook.h:191 [inline] exit_to_usermode_loop+0x14a/0x190 arch/x86/entry/common.c:164 ieee80211 phy4: ERP_CTS_PROT: 0 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline] syscall_return_slowpath arch/x86/entry/common.c:270 [inline] do_syscall_64+0x416/0x5b0 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x466ae7 RSP: 002b:00007ffebae8e938 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000466ae7 RDX: 00007ffebae8ea09 RSI: 0000000000000002 RDI: 00007ffebae8ea00 RBP: 00007ffebae8ea00 R08: 00000000ffffffff R09: 00007ffebae8e7d0 ieee80211 phy4: ERP_PREAMBLE: 0 R10: 00000000015678ab R11: 0000000000000246 R12: 00000000004ae4b9 ieee80211 phy4: ERP_SLOT: 0 R13: 00007ffebae8fab0 R14: 0000000001567810 R15: 0000000000000001 Code: c0 0f 85 20 f9 ff ff 48 c7 c2 60 f2 fa 86 be 1d 01 00 00 48 c7 c7 c0 f2 fa ieee80211 phy4: mac80211_hwsim_conf_tx (queue=0 txop=47 cw_min=3 cw_max=7 aifs=2) 86 ieee80211 phy4: mac80211_hwsim_conf_tx (queue=1 txop=94 cw_min=7 cw_max=15 aifs=2) c6 05 6c 79 04 06 01 e8 cb 68 a9 03 e9 fc f8 ff ff <0f> 0b e8 3d 29 d8 fe e9 e4 f4 ff ff 48 8b 7d a0 e8 2f 29 d8 fe RIP: f2fs_evict_inode+0xc5c/0xf70 fs/f2fs/inode.c:600 RSP: ffff8881d26cfb48 ---[ end trace 0be6a74fd3d05743 ]--- ieee80211 phy4: mac80211_hwsim_conf_tx (queue=2 txop=0 cw_min=15 cw_max=1023 aifs=3)