bisecting fixing commit since f4cc0ed9b2c72687303b035379c5824a02224354
building syzkaller on 7509bf360eba1461ac6059e4cacfbc29c9d2d4c7
testing commit f4cc0ed9b2c72687303b035379c5824a02224354 with gcc (GCC) 8.1.0
kernel signature: d15a2f06b43879c9f899cedb5b721c88f4be6b2199287702ef9ff58ae0feb820
run #0: crashed: INFO: rcu detected stall in sendfile64
run #1: crashed: INFO: rcu detected stall in corrupted
run #2: crashed: INFO: rcu detected stall in corrupted
run #3: crashed: INFO: rcu detected stall in ext4_file_write_iter
run #4: crashed: INFO: rcu detected stall in corrupted
run #5: crashed: INFO: rcu detected stall in corrupted
run #6: crashed: INFO: rcu detected stall in corrupted
run #7: crashed: INFO: rcu detected stall in corrupted
run #8: crashed: INFO: rcu detected stall in corrupted
run #9: crashed: INFO: rcu detected stall in corrupted
testing current HEAD ca87c82811906f4fc5e936705564ba8176ba497f
testing commit ca87c82811906f4fc5e936705564ba8176ba497f with gcc (GCC) 8.1.0
kernel signature: 779074db730a881e57d6420dd96a80af0df9f95a374e3679ae006b2bf3eb84e5
run #0: crashed: INFO: rcu detected stall in corrupted
run #1: crashed: INFO: rcu detected stall in corrupted
run #2: crashed: INFO: rcu detected stall in ext4_file_write_iter
run #3: crashed: INFO: rcu detected stall in corrupted
run #4: crashed: INFO: rcu detected stall in corrupted
run #5: crashed: INFO: rcu detected stall in corrupted
run #6: crashed: INFO: rcu detected stall in corrupted
run #7: crashed: INFO: rcu detected stall in sendfile64
run #8: crashed: INFO: rcu detected stall in sendfile64
run #9: crashed: INFO: rcu detected stall in corrupted
revisions tested: 2, total time: 25m40.162385775s (build: 15m41.2531986s, test: 9m18.867385869s)
the crash still happens on HEAD
commit msg: Linux 4.14.199
crash: INFO: rcu detected stall in corrupted
bridge0: port 2(bridge_slave_1) entered forwarding state
IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready
INFO: rcu_sched detected stalls on CPUs/tasks:
	1-...: (10501 ticks this GP) idle=836/140000000000000/0 softirq=10035/10039 fqs=17 
	(detected by 0, t=10502 jiffies, g=337, c=336, q=6)
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 6998 Comm: syz-executor.1 Not tainted 4.14.199-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8880a5a00240 task.stack: ffff888094f80000
RIP: 0010:__lock_acquire+0x1d9/0x4500 kernel/locking/lockdep.c:3369
RSP: 0018:ffff888094f875d0 EFLAGS: 00000046
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 1ffffffff12561f0 RSI: 0000000000000000 RDI: ffffffff87716dc0
RBP: ffff888094f877a0 R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000000001 R11: ffff8880a5a00240 R12: ffffffff892b0f80
R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000
FS:  00007f8a168f0700(0000) GS:ffff8880aef00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000758080 CR3: 00000000a89c9000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 lock_acquire+0x173/0x400 kernel/locking/lockdep.c:3998
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x99/0xd0 kernel/locking/spinlock.c:160
 __debug_check_no_obj_freed lib/debugobjects.c:738 [inline]
 debug_check_no_obj_freed+0x153/0x930 lib/debugobjects.c:776
 kfree+0xbd/0x270 mm/slab.c:3814
 iter_file_splice_write+0x49a/0xc20 fs/splice.c:776
 do_splice_from fs/splice.c:851 [inline]
 direct_splice_actor+0x104/0x1c0 fs/splice.c:1018
 splice_direct_to_actor+0x27c/0x750 fs/splice.c:973
 do_splice_direct+0x144/0x250 fs/splice.c:1061
 do_sendfile+0x463/0xd00 fs/read_write.c:1441
 SYSC_sendfile64 fs/read_write.c:1496 [inline]
 SyS_sendfile64+0x97/0x110 fs/read_write.c:1488
 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x459599
RSP: 002b:00007f8a168efc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000459599
RDX: 0000000020000000 RSI: 0000000000000003 RDI: 0000000000000003
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 00008080fffffffe R11: 0000000000000246 R12: 00007f8a168f06d4
R13: 00000000004c6b70 R14: 00000000004dbde8 R15: 00000000ffffffff
Code: 8b 84 24 98 00 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 ea 03 80 3c 02 00 <0f> 85 f2 30 00 00 49 81 3c 24 60 62 5b 88 0f 84 30 ff ff ff 83 
rcu_sched kthread starved for 10467 jiffies! g337 c336 f0x0 RCU_GP_WAIT_FQS(3) ->state=0x0 ->cpu=0
rcu_sched       R  running task    29832     9      2 0x80000000
Call Trace:
 context_switch kernel/sched/core.c:2808 [inline]
 __schedule+0x780/0x1d20 kernel/sched/core.c:3384
 schedule+0x7f/0x1b0 kernel/sched/core.c:3428
 schedule_timeout+0x40c/0xcc0 kernel/time/timer.c:1754
 rcu_gp_kthread+0xbbf/0x1e00 kernel/rcu/tree.c:2255
 kthread+0x338/0x400 kernel/kthread.c:232
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
INFO: rcu_preempt detected stalls on CPUs/tasks:
	1-...: (10543 ticks this GP) idle=836/140000000000000/0 softirq=10039/10039 fqs=15 
	(detected by 0, t=10543 jiffies, g=1142, c=1141, q=395)
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 6998 Comm: syz-executor.1 Not tainted 4.14.199-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8880a5a00240 task.stack: ffff888094f80000
RIP: 0010:memcmp+0x82/0x160 lib/string.c:861
RSP: 0018:ffff888094f87668 EFLAGS: 00000083
RAX: ffff888094f8774c RBX: ffff888094f8774c RCX: 0000000000000081
RDX: ffff888094f87770 RSI: ffff888095b94c34 RDI: 0000000000000003
RBP: ffff888094f87690 R08: ffff888094f87710 R09: 0000000047170800
R10: 0000000000000003 R11: 00000000047f5c7b R12: dffffc0000000000
R13: 0000000000000060 R14: ffff888095b94be0 R15: 00000000000cc036
FS:  00007f8a168f0700(0000) GS:ffff8880aef00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000758080 CR3: 00000000a89c9000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 find_stack lib/stackdepot.c:180 [inline]
 depot_save_stack+0x122/0x43a lib/stackdepot.c:229
 save_stack+0xa9/0xd0 mm/kasan/kasan.c:453
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524
 __cache_free mm/slab.c:3496 [inline]
 kfree+0xcc/0x270 mm/slab.c:3815
 iter_file_splice_write+0x49a/0xc20 fs/splice.c:776
 do_splice_from fs/splice.c:851 [inline]
 direct_splice_actor+0x104/0x1c0 fs/splice.c:1018
 splice_direct_to_actor+0x27c/0x750 fs/splice.c:973
 do_splice_direct+0x144/0x250 fs/splice.c:1061
 do_sendfile+0x463/0xd00 fs/read_write.c:1441
 SYSC_sendfile64 fs/read_write.c:1496 [inline]
 SyS_sendfile64+0x97/0x110 fs/read_write.c:1488
 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x459599
RSP: 002b:00007f8a168efc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000459599
RDX: 0000000020000000 RSI: 0000000000000003 RDI: 0000000000000003
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 00008080fffffffe R11: 0000000000000246 R12: 00007f8a168f06d4
R13: 00000000004c6b70 R14: 00000000004dbde8 R15: 00000000ffffffff
Code: 89 f7 83 e7 07 40 38 f9 7f 08 84 c9 0f 85 87 00 00 00 0f b6 0e 29 c8 75 5d 49 bc 00 00 00 00 00 fc ff df 48 01 da eb 3f 48 89 d8 <48> 89 d9 48 c1 e8 03 83 e1 07 42 0f b6 04 20 38 c8 7f 04 84 c0 
rcu_preempt kthread starved for 10512 jiffies! g1142 c1141 f0x0 RCU_GP_WAIT_FQS(3) ->state=0x0 ->cpu=0
rcu_preempt     R  running task    29720     8      2 0x80000000
Call Trace:
 context_switch kernel/sched/core.c:2808 [inline]
 __schedule+0x780/0x1d20 kernel/sched/core.c:3384
 schedule+0x7f/0x1b0 kernel/sched/core.c:3428
 schedule_timeout+0x40c/0xcc0 kernel/time/timer.c:1754
 rcu_gp_kthread+0xbbf/0x1e00 kernel/rcu/tree.c:2255
 kthread+0x338/0x400 kernel/kthread.c:232
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404