I also tested v4.15-rc5, which failed with the same stack trace. Then I returned to 4.14 mainline, and got this one:
[ 953.659489] BUG: unable to handle kernel NULL pointer dereference at 0000000000000d40 [ 953.668707] IP: search_free+0x31/0x40 [bcache] [ 953.674872] PGD 0 P4D 0 [ 953.677680] Oops: 0000 [#34] SMP [ 953.678796] Modules linked in: nls_utf8 isofs nls_iso8859_1 ppdev kvm_intel kvm irqbypass parport_pc joydev input_leds parport serio_raw mac_hid sch_fq_codel ib_iser rdma_cm iw_cm ib_cm ib_core iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi virtio_rng ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear bcache psmouse virtio_scsi virtio_blk virtio_net i2c_piix4 floppy pata_acpi [ 953.700549] CPU: 1 PID: 3132 Comm: kworker/1:229 Tainted: G D 4.14.0-041400-generic #201711122031 [ 953.704522] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 953.707128] Workqueue: bcache bch_data_insert_keys [bcache] [ 953.708986] task: ffff985fe6050000 task.stack: ffffc01402c4c000 [ 953.711147] RIP: 0010:search_free+0x31/0x40 [bcache] [ 953.712997] RSP: 0018:ffffc01402c4fdf8 EFLAGS: 00010282 [ 953.714287] RAX: 0000000000000000 RBX: ffff985ffb385e78 RCX: ffffe83580d58e00 [ 953.716883] RDX: 0000000000000007 RSI: 000000000001f540 RDI: ffff985ffb385e78 [ 953.718731] RBP: ffffc01402c4fe00 R08: ffff985ff8121800 R09: 000000018010000f [ 953.720269] R10: ffffc01402c4fd70 R11: 0000000000000001 R12: ffff985fe3670010 [ 953.721583] R13: ffff985ffb386000 R14: ffff985fffc9bb40 R15: ffff985ff83eab40 [ 953.723315] FS: 0000000000000000(0000) GS:ffff985fffc80000(0000) knlGS:0000000000000000 [ 953.725738] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 953.727401] CR2: 0000000000000d40 CR3: 0000000028c09000 CR4: 00000000000006e0 [ 953.729737] Call Trace: [ 953.730687] cached_dev_cache_miss_done+0x38/0x80 [bcache] [ 953.732939] closure_put+0x8b/0xc0 [bcache] [ 953.734647] closure_sub+0x6f/0xc0 [bcache] [ 953.736104] bch_data_insert_keys+0xd8/0x130 [bcache] [ 953.737311] process_one_work+0x1e7/0x410 [ 953.738233] worker_thread+0x32/0x410 [ 953.739246] kthread+0x125/0x140 [ 953.740231] ? process_one_work+0x410/0x410 [ 953.741407] ? kthread_create_on_node+0x70/0x70 [ 953.742631] ret_from_fork+0x25/0x30 [ 953.743431] Code: 48 89 e5 53 48 89 fb e8 0e ff ff ff 48 8b bb 68 01 00 00 48 85 ff 74 05 e8 cd f7 2d e7 48 8b 83 e8 00 00 00 48 89 df 48 8b 40 70 <48> 8b b0 40 0d 00 00 e8 33 51 07 e7 5b 5d c3 0f 1f 44 00 00 55 [ 953.747654] RIP: search_free+0x31/0x40 [bcache] RSP: ffffc01402c4fdf8 [ 953.749962] CR2: 0000000000000d40 [ 953.751475] ---[ end trace c40c3beab1ff3af1 ]---
Retesting 4.13 mainline as well.
I also tested v4.15-rc5, which failed with the same stack trace. Then I returned to 4.14 mainline, and got this one:
[ 953.659489] BUG: unable to handle kernel NULL pointer dereference at free+0x31/ 0x40 [bcache] iscsi virtio_rng ip_tables x_tables autofs4 btrfs zstd_compress 041400- generic #201711122031 1.8.2-1ubuntu1 04/01/2014 insert_ keys [bcache] free+0x31/ 0x40 [bcache] c4fdf8 EFLAGS: 00010282 0(0000) GS:ffff985fffc8 0000(0000) 0000000 dev_cache_ miss_done+ 0x38/0x80 [bcache] put+0x8b/ 0xc0 [bcache] sub+0x6f/ 0xc0 [bcache] insert_ keys+0xd8/ 0x130 [bcache] one_work+ 0x1e7/0x410 thread+ 0x32/0x410 one_work+ 0x410/0x410 create_ on_node+ 0x70/0x70 fork+0x25/ 0x30 free+0x31/ 0x40 [bcache] RSP: ffffc01402c4fdf8
0000000000000d40
[ 953.668707] IP: search_
[ 953.674872] PGD 0 P4D 0
[ 953.677680] Oops: 0000 [#34] SMP
[ 953.678796] Modules linked in: nls_utf8 isofs nls_iso8859_1 ppdev kvm_intel
kvm irqbypass parport_pc joydev input_leds parport serio_raw mac_hid
sch_fq_codel ib_iser rdma_cm iw_cm ib_cm ib_core iscsi_tcp libiscsi_tcp libiscsi
scsi_transport_
raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor
raid6_pq libcrc32c raid1 raid0 multipath linear bcache psmouse virtio_scsi
virtio_blk virtio_net i2c_piix4 floppy pata_acpi
[ 953.700549] CPU: 1 PID: 3132 Comm: kworker/1:229 Tainted: G D
4.14.0-
[ 953.704522] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
Ubuntu-
[ 953.707128] Workqueue: bcache bch_data_
[ 953.708986] task: ffff985fe6050000 task.stack: ffffc01402c4c000
[ 953.711147] RIP: 0010:search_
[ 953.712997] RSP: 0018:ffffc01402
[ 953.714287] RAX: 0000000000000000 RBX: ffff985ffb385e78 RCX: ffffe83580d58e00
[ 953.716883] RDX: 0000000000000007 RSI: 000000000001f540 RDI: ffff985ffb385e78
[ 953.718731] RBP: ffffc01402c4fe00 R08: ffff985ff8121800 R09: 000000018010000f
[ 953.720269] R10: ffffc01402c4fd70 R11: 0000000000000001 R12: ffff985fe3670010
[ 953.721583] R13: ffff985ffb386000 R14: ffff985fffc9bb40 R15: ffff985ff83eab40
[ 953.723315] FS: 000000000000000
knlGS:000000000
[ 953.725738] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 953.727401] CR2: 0000000000000d40 CR3: 0000000028c09000 CR4: 00000000000006e0
[ 953.729737] Call Trace:
[ 953.730687] cached_
[ 953.732939] closure_
[ 953.734647] closure_
[ 953.736104] bch_data_
[ 953.737311] process_
[ 953.738233] worker_
[ 953.739246] kthread+0x125/0x140
[ 953.740231] ? process_
[ 953.741407] ? kthread_
[ 953.742631] ret_from_
[ 953.743431] Code: 48 89 e5 53 48 89 fb e8 0e ff ff ff 48 8b bb 68 01 00 00 48
85 ff 74 05 e8 cd f7 2d e7 48 8b 83 e8 00 00 00 48 89 df 48 8b 40 70 <48> 8b b0
40 0d 00 00 e8 33 51 07 e7 5b 5d c3 0f 1f 44 00 00 55
[ 953.747654] RIP: search_
[ 953.749962] CR2: 0000000000000d40
[ 953.751475] ---[ end trace c40c3beab1ff3af1 ]---
Retesting 4.13 mainline as well.