bisecting fixing commit since 312017a460d5ea31d646e7148e400e13db799ddc
building syzkaller on eef6e5808d6507716d331b9eff67fdd991be891a
testing commit 312017a460d5ea31d646e7148e400e13db799ddc with gcc (GCC) 8.1.0
kernel signature: e5ade613bbd7bdbe24c3b8174a43cde1cb5fc2fafd40c25a8fadf7eec1059257
run #0: crashed: BUG: unable to handle kernel NULL pointer dereference in blk_mq_map_swqueue
run #1: crashed: BUG: unable to handle kernel NULL pointer dereference in blk_mq_map_swqueue
run #2: crashed: BUG: unable to handle kernel NULL pointer dereference in blk_mq_map_swqueue
run #3: crashed: BUG: unable to handle kernel NULL pointer dereference in blk_mq_map_swqueue
run #4: crashed: BUG: unable to handle kernel NULL pointer dereference in blk_mq_map_swqueue
run #5: crashed: BUG: unable to handle kernel NULL pointer dereference in corrupted
run #6: crashed: BUG: unable to handle kernel NULL pointer dereference in blk_mq_map_swqueue
run #7: crashed: BUG: unable to handle kernel NULL pointer dereference in blk_mq_map_swqueue
run #8: crashed: BUG: unable to handle kernel NULL pointer dereference in blk_mq_map_swqueue
run #9: crashed: BUG: unable to handle kernel NULL pointer dereference in blk_mq_map_swqueue
testing current HEAD 7edd66cf61670d2d0c31f89cb3a247016e489a8a
testing commit 7edd66cf61670d2d0c31f89cb3a247016e489a8a with gcc (GCC) 8.1.0
kernel signature: 07e91818d7837519eab4e0ebaf4442fe6aa0648601a6d32611a05d7ea6f21bce
run #0: crashed: BUG: unable to handle kernel NULL pointer dereference in blk_mq_map_swqueue
run #1: crashed: BUG: unable to handle kernel NULL pointer dereference in blk_mq_map_swqueue
run #2: crashed: BUG: unable to handle kernel NULL pointer dereference in blk_mq_map_swqueue
run #3: crashed: BUG: unable to handle kernel NULL pointer dereference in blk_mq_map_swqueue
run #4: crashed: BUG: unable to handle kernel NULL pointer dereference in blk_mq_map_swqueue
run #5: crashed: BUG: unable to handle kernel NULL pointer dereference in blk_mq_map_swqueue
run #6: crashed: BUG: unable to handle kernel NULL pointer dereference in corrupted
run #7: crashed: BUG: unable to handle kernel NULL pointer dereference in blk_mq_map_swqueue
run #8: crashed: BUG: unable to handle kernel NULL pointer dereference in corrupted
run #9: crashed: BUG: unable to handle kernel NULL pointer dereference in blk_mq_map_swqueue
revisions tested: 2, total time: 26m8.362039791s (build: 18m5.982031608s, test: 6m51.587657606s)
the crash still happens on HEAD
commit msg: Linux 4.19.118
crash: BUG: unable to handle kernel NULL pointer dereference in blk_mq_map_swqueue
RAX: ffffffffffffffda RBX: 00007ff1da9d9c90 RCX: 000000000045a909
RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000003
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff1da9da6d4
R13: 00000000004c4670 R14: 00000000004d9da0 R15: 0000000000000007
BUG: unable to handle kernel NULL pointer dereference at 0000000000000118
PGD 97b2a067 P4D 97b2a067 PUD 97b29067 PMD 0 
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 7540 Comm: syz-executor.2 Not tainted 4.19.118-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:set_bit arch/x86/include/asm/bitops.h:76 [inline]
RIP: 0010:cpumask_set_cpu include/linux/cpumask.h:311 [inline]
RIP: 0010:blk_mq_map_swqueue+0x269/0xb00 block/blk-mq.c:2344
Code: 0f 85 37 07 00 00 8b 00 49 8d 04 c0 48 89 c7 48 c1 ef 03 42 80 3c 3f 00 0f 85 f4 06 00 00 83 fa 3f 4c 8b 00 0f 87 4a 04 00 00 <f0> 4d 0f ab 88 18 01 00 00 49 8d b8 74 01 00 00 48 89 f8 48 c1 e8
RSP: 0018:ffff88808b9278a8 EFLAGS: 00010293
RAX: ffff8880a3f65a88 RBX: 0000000000000007 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffffe8ffffd36340 RDI: 1ffff110147ecb51
RBP: ffff88808b927920 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: ffff88808834ff83 R12: ffff8880a3f67a40
R13: fffffbfff1244f76 R14: ffff8880a3f6d000 R15: dffffc0000000000
FS:  00007ff1da9da700(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000118 CR3: 000000009522d000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 blk_mq_queue_reinit block/blk-mq.c:2686 [inline]
 __blk_mq_update_nr_hw_queues block/blk-mq.c:3007 [inline]
 blk_mq_update_nr_hw_queues+0x68a/0xb50 block/blk-mq.c:3021
 nbd_start_device+0x1b6/0xc60 drivers/block/nbd.c:1200
 nbd_start_device_ioctl drivers/block/nbd.c:1251 [inline]
 __nbd_ioctl drivers/block/nbd.c:1333 [inline]
 nbd_ioctl+0x1b6/0xb20 drivers/block/nbd.c:1373
 __blkdev_driver_ioctl block/ioctl.c:303 [inline]
 blkdev_ioctl+0x7ae/0x16e0 block/ioctl.c:601
 block_ioctl+0xd7/0x130 fs/block_dev.c:1894
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:501 [inline]
 do_vfs_ioctl+0x196/0x10c0 fs/ioctl.c:688
 ksys_ioctl+0x62/0x90 fs/ioctl.c:705
 __do_sys_ioctl fs/ioctl.c:712 [inline]
 __se_sys_ioctl fs/ioctl.c:710 [inline]
 __x64_sys_ioctl+0x6e/0xb0 fs/ioctl.c:710
 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45a909
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ff1da9d9c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ff1da9d9c90 RCX: 000000000045a909
RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000003
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff1da9da6d4
R13: 00000000004c4670 R14: 00000000004d9da0 R15: 0000000000000007
Modules linked in:
CR2: 0000000000000118
---[ end trace 1aa38280e27e6937 ]---
RIP: 0010:set_bit arch/x86/include/asm/bitops.h:76 [inline]
RIP: 0010:cpumask_set_cpu include/linux/cpumask.h:311 [inline]
RIP: 0010:blk_mq_map_swqueue+0x269/0xb00 block/blk-mq.c:2344
Code: 0f 85 37 07 00 00 8b 00 49 8d 04 c0 48 89 c7 48 c1 ef 03 42 80 3c 3f 00 0f 85 f4 06 00 00 83 fa 3f 4c 8b 00 0f 87 4a 04 00 00 <f0> 4d 0f ab 88 18 01 00 00 49 8d b8 74 01 00 00 48 89 f8 48 c1 e8
RSP: 0018:ffff88808b9278a8 EFLAGS: 00010293
RAX: ffff8880a3f65a88 RBX: 0000000000000007 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffffe8ffffd36340 RDI: 1ffff110147ecb51
RBP: ffff88808b927920 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: ffff88808834ff83 R12: ffff8880a3f67a40
R13: fffffbfff1244f76 R14: ffff8880a3f6d000 R15: dffffc0000000000
FS:  00007ff1da9da700(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000118 CR3: 000000009522d000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400