bisecting fixing commit since 45f092f9e9cb31486db546e39bfe7cc0b3f57099 building syzkaller on ca6f3cfa782bb9aa9e1cb1247a2a4632608ab368 testing commit 45f092f9e9cb31486db546e39bfe7cc0b3f57099 with gcc (GCC) 8.1.0 kernel signature: 4e5ab1fbdbf2ffe422d0726c794a847e528f615af942be7e60266fb17bd66c1d run #0: crashed: WARNING in unmap_single_vma run #1: crashed: WARNING in untrack_pfn run #2: crashed: WARNING in corrupted run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK testing current HEAD 98db2bf27b9ed2d5ed0b6c9c8a4bfcb127a19796 testing commit 98db2bf27b9ed2d5ed0b6c9c8a4bfcb127a19796 with gcc (GCC) 8.1.0 kernel signature: cf60d3dfdab02c9f99298a87b67f845642cf834a7724eb82a3e7df28d3902a28 run #0: crashed: WARNING in untrack_pfn run #1: crashed: WARNING in untrack_pfn run #2: crashed: WARNING in corrupted run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK revisions tested: 2, total time: 37m21.067714734s (build: 16m42.048219375s, test: 19m45.419648017s) the crash still happens on HEAD commit msg: Linux 4.14.171 crash: WARNING in corrupted RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f80af6966d4 ------------[ cut here ]------------ R13: 00000000004bfce6 R14: 00000000004d1a58 R15: 0000000000000005 WARNING: CPU: 0 PID: 7040 at arch/x86/mm/pat.c:1020 untrack_pfn+0x1ab/0x210 arch/x86/mm/pat.c:1027 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 7043 Comm: syz-executor.1 Not tainted 4.14.171-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0xf7/0x13b lib/dump_stack.c:58 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold.3+0x105/0x14b lib/fault-inject.c:149 should_failslab+0xba/0xf0 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3376 [inline] kmem_cache_alloc+0x2cf/0x790 mm/slab.c:3550 ptlock_alloc+0x1d/0x70 mm/memory.c:4741 ptlock_init include/linux/mm.h:1752 [inline] pgtable_page_ctor include/linux/mm.h:1786 [inline] pte_alloc_one+0x46/0xd0 arch/x86/mm/pgtable.c:33 __pte_alloc+0x1d/0x280 mm/memory.c:656 copy_pte_range mm/memory.c:1081 [inline] copy_pmd_range mm/memory.c:1157 [inline] copy_pud_range mm/memory.c:1191 [inline] copy_p4d_range mm/memory.c:1213 [inline] copy_page_range+0xfed/0x1970 mm/memory.c:1275 dup_mmap kernel/fork.c:709 [inline] dup_mm kernel/fork.c:1199 [inline] copy_mm kernel/fork.c:1254 [inline] copy_process.part.37+0x5d91/0x66e0 kernel/fork.c:1771 copy_process kernel/fork.c:1586 [inline] _do_fork+0x155/0xbb0 kernel/fork.c:2070 SYSC_clone kernel/fork.c:2180 [inline] SyS_clone+0x14/0x20 kernel/fork.c:2174 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x459829 RSP: 002b:00007fe603a39c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 RAX: ffffffffffffffda RBX: 00007fe603a39c90 RCX: 0000000000459829 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe603a3a6d4 R13: 00000000004bfce6 R14: 00000000004d1a58 R15: 0000000000000005 CPU: 0 PID: 7040 Comm: syz-executor.2 Not tainted 4.14.171-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0xf7/0x13b lib/dump_stack.c:58 panic+0x1b0/0x358 kernel/panic.c:183 __warn.cold.8+0x25/0x2c kernel/panic.c:547 report_bug+0x1a4/0x1f3 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:177 [inline] do_error_trap+0x1bd/0x310 arch/x86/kernel/traps.c:295 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:314 invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:963 RIP: 0010:untrack_pfn+0x1ab/0x210 arch/x86/mm/pat.c:1020 RSP: 0018:ffff888080def8f8 EFLAGS: 00010282 RAX: 00000000ffffffea RBX: ffff88809312f840 RCX: 0000000000000000 RDX: 0000000000000004 RSI: 0000000000000001 RDI: ffffffff89383840 RBP: ffff888080def9c8 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: ffff888098e4a440 R12: 1ffff110101bdf21 R13: 0000000000000000 R14: ffff888080def9a8 R15: ffff888080defa98 unmap_single_vma+0x144/0x300 mm/memory.c:1539 unmap_vmas+0xe2/0x190 mm/memory.c:1590 exit_mmap+0x249/0x450 mm/mmap.c:3056 __mmput kernel/fork.c:930 [inline] mmput+0xed/0x3c0 kernel/fork.c:951 dup_mm kernel/fork.c:1215 [inline] copy_mm kernel/fork.c:1254 [inline] copy_process.part.37+0x5d6f/0x66e0 kernel/fork.c:1771 copy_process kernel/fork.c:1586 [inline] _do_fork+0x155/0xbb0 kernel/fork.c:2070 SYSC_clone kernel/fork.c:2180 [inline] SyS_clone+0x14/0x20 kernel/fork.c:2174 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x459829 RSP: 002b:00007faca427cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 RAX: ffffffffffffffda RBX: 00007faca427cc90 RCX: 0000000000459829 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007faca427d6d4 R13: 00000000004bfce6 R14: 00000000004d1a58 R15: 0000000000000005 Kernel Offset: disabled Rebooting in 86400 seconds..