Hello, When using Healer to fuzz the latest Linux kernel, the following crash was triggered. HEAD commit: 519d81956ee2 Linux 5.15-rc6 git tree: upstream console output: https://drive.google.com/file/d/1kiBZK6oiSXPTCnvaFCepaFbsxSfO1KTC/view?usp=sharing kernel config: https://drive.google.com/file/d/12PUnxIM1EPBgW4ZJmI7WJBRaY1lA83an/view?usp=sharing Sorry, I don't have a reproducer for this crash, hope the symbolized report can help. If you fix this issue, please add the following tag to the commit: Reported-by: Hao Sun <sunhao.th@xxxxxxxxx> loop15: detected capacity change from 0 to 4081 NILFS (loop15): broken superblock, retrying with spare superblock (blocksize = 1024) NILFS (loop15): broken superblock, retrying with spare superblock (blocksize = 2048) NILFS (loop15): mounting unchecked fs NILFS (loop15): recovery complete FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 16429 Comm: syz-executor Not tainted 5.15.0-rc6 #4 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 fail_dump lib/fault-inject.c:52 [inline] should_fail.cold+0x5/0xa lib/fault-inject.c:146 should_failslab+0x5/0x10 mm/slab_common.c:1328 slab_pre_alloc_hook mm/slab.h:494 [inline] slab_alloc_node mm/slub.c:3120 [inline] slab_alloc mm/slub.c:3214 [inline] kmem_cache_alloc+0x62/0x340 mm/slub.c:3219 kmem_cache_zalloc include/linux/slab.h:711 [inline] lsm_inode_alloc security/security.c:593 [inline] security_inode_alloc+0x34/0x160 security/security.c:1018 inode_init_always+0x603/0xe50 fs/inode.c:170 alloc_inode+0x82/0x1e0 fs/inode.c:244 new_inode_pseudo+0x14/0xe0 fs/inode.c:938 new_inode+0x1b/0x40 fs/inode.c:967 nilfs_new_inode+0xca/0x7e0 fs/nilfs2/inode.c:333 nilfs_create+0xfe/0x300 fs/nilfs2/namei.c:85 lookup_open+0xfae/0x13a0 fs/namei.c:3282 open_last_lookups fs/namei.c:3352 [inline] path_openat+0xa93/0x2710 fs/namei.c:3558 do_filp_open+0x1c1/0x290 fs/namei.c:3588 do_sys_openat2+0x61b/0x9a0 fs/open.c:1200 do_sys_open+0xc3/0x140 fs/open.c:1216 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f13bd8dcc4d Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f13bae44c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 RAX: ffffffffffffffda RBX: 00007f13bda030a0 RCX: 00007f13bd8dcc4d RDX: 0000000000000000 RSI: 0000000000000021 RDI: 0000000020005580 RBP: 00007f13bae44c90 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000a R13: 00007ffd7026ebdf R14: 00007ffd7026ed80 R15: 00007f13bae44dc0 page:ffffea0000053000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14c0 flags: 0xfff00000001000(reserved|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000001000 ffffea0000053008 ffffea0000053008 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: VM_BUG_ON_PAGE(!PageCompound(page)) page_owner info is not present (never set?) ------------[ cut here ]------------ kernel BUG at mm/slub.c:3516! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 16429 Comm: syz-executor Not tainted 5.15.0-rc6 #4 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:free_nonslab_page mm/slub.c:3516 [inline] RIP: 0010:free_nonslab_page mm/slub.c:3512 [inline] RIP: 0010:kfree+0x6d1/0x700 mm/slub.c:4540 Code: 5e 41 5f e9 31 f3 ff ff 0f 0b 48 c7 c6 80 6c 18 8b 4c 89 e7 e8 20 c3 ec ff 0f 0b 48 c7 c6 58 14 1a 8b 4c 89 e7 e8 0f c3 ec ff <0f> 0b e8 b8 8b 75 07 e9 26 ff ff ff 8b 75 1c 48 89 df e8 48 f2 28 RSP: 0018:ffffc90004dff680 EFLAGS: 00010246 RAX: 0000000000040000 RBX: ffffffff814c0d90 RCX: 0000000000040000 RDX: ffffc90001ac1000 RSI: ffff888024289c80 RDI: 0000000000000002 RBP: ffff8881088d0200 R08: ffffffff81bd5321 R09: 0000000000000000 R10: 0000000000000005 R11: ffffed100c7c3f53 R12: ffffea0000053000 R13: ffff888033efd8c8 R14: ffff88801d8c2000 R15: ffff888033efd8f0 FS: 00007f13bae45700(0000) GS:ffff888063e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000400000 CR3: 0000000016eed000 CR4: 0000000000350ef0 Call Trace: nilfs_mdt_destroy+0x59/0x80 fs/nilfs2/mdt.c:486 nilfs_free_inode+0x3e/0x60 fs/nilfs2/super.c:167 i_callback+0x3f/0x70 fs/inode.c:226 alloc_inode+0x13e/0x1e0 fs/inode.c:251 new_inode_pseudo+0x14/0xe0 fs/inode.c:938 new_inode+0x1b/0x40 fs/inode.c:967 nilfs_new_inode+0xca/0x7e0 fs/nilfs2/inode.c:333 nilfs_create+0xfe/0x300 fs/nilfs2/namei.c:85 lookup_open+0xfae/0x13a0 fs/namei.c:3282 open_last_lookups fs/namei.c:3352 [inline] path_openat+0xa93/0x2710 fs/namei.c:3558 do_filp_open+0x1c1/0x290 fs/namei.c:3588 do_sys_openat2+0x61b/0x9a0 fs/open.c:1200 do_sys_open+0xc3/0x140 fs/open.c:1216 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f13bd8dcc4d Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f13bae44c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 RAX: ffffffffffffffda RBX: 00007f13bda030a0 RCX: 00007f13bd8dcc4d RDX: 0000000000000000 RSI: 0000000000000021 RDI: 0000000020005580 RBP: 00007f13bae44c90 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000a R13: 00007ffd7026ebdf R14: 00007ffd7026ed80 R15: 00007f13bae44dc0 Modules linked in: Dumping ftrace buffer: (ftrace buffer empty) ---[ end trace 07725c0702aaad66 ]--- RIP: 0010:free_nonslab_page mm/slub.c:3516 [inline] RIP: 0010:free_nonslab_page mm/slub.c:3512 [inline] RIP: 0010:kfree+0x6d1/0x700 mm/slub.c:4540 Code: 5e 41 5f e9 31 f3 ff ff 0f 0b 48 c7 c6 80 6c 18 8b 4c 89 e7 e8 20 c3 ec ff 0f 0b 48 c7 c6 58 14 1a 8b 4c 89 e7 e8 0f c3 ec ff <0f> 0b e8 b8 8b 75 07 e9 26 ff ff ff 8b 75 1c 48 89 df e8 48 f2 28 RSP: 0018:ffffc90004dff680 EFLAGS: 00010246 RAX: 0000000000040000 RBX: ffffffff814c0d90 RCX: 0000000000040000 RDX: ffffc90001ac1000 RSI: ffff888024289c80 RDI: 0000000000000002 RBP: ffff8881088d0200 R08: ffffffff81bd5321 R09: 0000000000000000 R10: 0000000000000005 R11: ffffed100c7c3f53 R12: ffffea0000053000 R13: ffff888033efd8c8 R14: ffff88801d8c2000 R15: ffff888033efd8f0 FS: 00007f13bae45700(0000) GS:ffff888063e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000400000 CR3: 0000000016eed000 CR4: 0000000000350ef0
