bisecting fixing commit since a68a0262abdaa251e12c53715f48e698a18ef402 building syzkaller on c090b4da255257841173fb4eb18c19d69b293180 testing commit a68a0262abdaa251e12c53715f48e698a18ef402 with gcc (GCC) 8.1.0 kernel signature: c050303259cf3f8f0a81aea6f505ac3897d3abec94c507d45083e11a2095ad8f all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow testing current HEAD 996e435fd401de35df62ac943ab9402cfe85c430 testing commit 996e435fd401de35df62ac943ab9402cfe85c430 with gcc (GCC) 8.1.0 kernel signature: e2bbaa00c98f2e5e3f12fbc4d3d88b2233fccdf4a9bc3a1f0894b80b1a4505e0 all runs: OK # git bisect start 996e435fd401de35df62ac943ab9402cfe85c430 a68a0262abdaa251e12c53715f48e698a18ef402 Bisecting: 7119 revisions left to test after this (roughly 13 steps) [2911ed9f47b47cb5ab87d03314b3b9fe008e607f] Merge tag 'char-misc-5.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc testing commit 2911ed9f47b47cb5ab87d03314b3b9fe008e607f with gcc (GCC) 8.1.0 kernel signature: a452ec1152f51f20dd0fe7aa83babb09ed8ad55e83b9045cfdef3d168270ee07 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow # git bisect good 2911ed9f47b47cb5ab87d03314b3b9fe008e607f Bisecting: 3897 revisions left to test after this (roughly 12 steps) [b0a6cd29e00a317d7fd823e0db57abbbd9bbb610] Merge tag 'arm-soc-defconfig-5.11' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc testing commit b0a6cd29e00a317d7fd823e0db57abbbd9bbb610 with gcc (GCC) 8.1.0 kernel signature: c63ec71985fe48712f0aa801e4f32d52ea4284ba842480c0103f7be77a4eb291 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow # git bisect good b0a6cd29e00a317d7fd823e0db57abbbd9bbb610 Bisecting: 1931 revisions left to test after this (roughly 11 steps) [a409ed156a90093a03fe6a93721ddf4c591eac87] Merge tag 'gpio-v5.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio testing commit a409ed156a90093a03fe6a93721ddf4c591eac87 with gcc (GCC) 8.1.0 kernel signature: 56de408be89d7ebbaa218416ef6f067f273b46f052bf8bc32b7552365490a6b1 all runs: OK # git bisect bad a409ed156a90093a03fe6a93721ddf4c591eac87 Bisecting: 985 revisions left to test after this (roughly 10 steps) [48c1c40ab40cb087b992e7b77518c3a2926743cc] Merge tag 'arm-soc-drivers-5.11' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc testing commit 48c1c40ab40cb087b992e7b77518c3a2926743cc with gcc (GCC) 8.1.0 kernel signature: edc4be1500fae776859ef6d731b6908dc529e5e7f9293109aff570dde586a856 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow # git bisect good 48c1c40ab40cb087b992e7b77518c3a2926743cc Bisecting: 554 revisions left to test after this (roughly 9 steps) [09c0796adf0c793462fda1d7c8c43324551405c7] Merge tag 'trace-v5.11' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace testing commit 09c0796adf0c793462fda1d7c8c43324551405c7 with gcc (GCC) 8.1.0 kernel signature: aafcece0534626787860d912378e4192bb83666d44c7aa76a05729b4601c07aa all runs: OK # git bisect bad 09c0796adf0c793462fda1d7c8c43324551405c7 Bisecting: 225 revisions left to test after this (roughly 8 steps) [be695ee29e8fc0af266d9f1882868c47da01a790] Merge tag 'ceph-for-5.11-rc1' of git://github.com/ceph/ceph-client testing commit be695ee29e8fc0af266d9f1882868c47da01a790 with gcc (GCC) 8.1.0 kernel signature: 2fe119abaa93de5f2038e44c96323c4a89353e42dbaa446354efb5e0bf3e9cb0 all runs: OK # git bisect bad be695ee29e8fc0af266d9f1882868c47da01a790 Bisecting: 94 revisions left to test after this (roughly 7 steps) [ff49c86f27e4726a86f5034543e6e684daf41955] Merge tag 'f2fs-for-5.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs testing commit ff49c86f27e4726a86f5034543e6e684daf41955 with gcc (GCC) 8.1.0 kernel signature: c3029d9305a581a2c364fe4ed596becf742f6f6ddb4a4e9cfc77247d352e3bb2 all runs: OK # git bisect bad ff49c86f27e4726a86f5034543e6e684daf41955 Bisecting: 54 revisions left to test after this (roughly 6 steps) [7fbee7e3386cb51e5ebc60c4d7cea13ffeab31d6] Merge tag 'omap-for-v5.11/genpd-rest-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into arm/omap-genpd testing commit 7fbee7e3386cb51e5ebc60c4d7cea13ffeab31d6 with gcc (GCC) 8.1.0 kernel signature: fb44c8de65a7fa8097154d96c12c49fecf2eb9e7a80c02259f12b0b30fd28dbc all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow # git bisect good 7fbee7e3386cb51e5ebc60c4d7cea13ffeab31d6 Bisecting: 27 revisions left to test after this (roughly 5 steps) [ec2ddf499402a665d1f6f7f5ce1391100e54089e] f2fs: don't allow any writes on readonly mount testing commit ec2ddf499402a665d1f6f7f5ce1391100e54089e with gcc (GCC) 8.1.0 kernel signature: d1586ed8a4e5a8ea9baf69687bb53f2de636d029fc9f5148613e0fdc8d4c9b72 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow # git bisect good ec2ddf499402a665d1f6f7f5ce1391100e54089e Bisecting: 17 revisions left to test after this (roughly 4 steps) [f7387170339afb473a0d95b7732f904346f9795e] writeback: don't warn on an unregistered BDI in __mark_inode_dirty testing commit f7387170339afb473a0d95b7732f904346f9795e with gcc (GCC) 8.1.0 kernel signature: 60bc9a69ab40036f540c0a2856119e52c99d8ccbc9e002694800b9e35e93ce68 all runs: OK # git bisect bad f7387170339afb473a0d95b7732f904346f9795e Bisecting: 4 revisions left to test after this (roughly 2 steps) [2356eb80ca42deba0bf2523c62530d4c79dad08f] docs: filesystems: Reduce ext2.rst to one top-level heading testing commit 2356eb80ca42deba0bf2523c62530d4c79dad08f with gcc (GCC) 8.1.0 kernel signature: 9dc3640dbc050429f3da31c262153fa0ba975daaabd2db09ef11bff2d658d1e5 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow # git bisect good 2356eb80ca42deba0bf2523c62530d4c79dad08f Bisecting: 2 revisions left to test after this (roughly 1 step) [8fca3c8a3451514c6f20dd26d5e66e78220d16e3] ext2: Fix fall-through warnings for Clang testing commit 8fca3c8a3451514c6f20dd26d5e66e78220d16e3 with gcc (GCC) 8.1.0 kernel signature: 9dc3640dbc050429f3da31c262153fa0ba975daaabd2db09ef11bff2d658d1e5 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow # git bisect good 8fca3c8a3451514c6f20dd26d5e66e78220d16e3 Bisecting: 0 revisions left to test after this (roughly 1 step) [e51d68e76d604c6d5d1eb13ae1d6da7f6c8c0dfc] fs: quota: fix array-index-out-of-bounds bug by passing correct argument to vfs_cleanup_quota_inode() testing commit e51d68e76d604c6d5d1eb13ae1d6da7f6c8c0dfc with gcc (GCC) 8.1.0 kernel signature: 8e98c2ba8aef93f7273458995333822be65de9b47e61de0243ba07f7bafc6d70 all runs: OK # git bisect bad e51d68e76d604c6d5d1eb13ae1d6da7f6c8c0dfc Bisecting: 0 revisions left to test after this (roughly 0 steps) [d24396c5290ba8ab04ba505176874c4e04a2d53c] reiserfs: add check for an invalid ih_entry_count testing commit d24396c5290ba8ab04ba505176874c4e04a2d53c with gcc (GCC) 8.1.0 kernel signature: a84946d160732faed20eee4ac0ee717ae22d7c38f68ef1da84e3025d1c43cab1 all runs: OK # git bisect bad d24396c5290ba8ab04ba505176874c4e04a2d53c d24396c5290ba8ab04ba505176874c4e04a2d53c is the first bad commit commit d24396c5290ba8ab04ba505176874c4e04a2d53c Author: Rustam Kovhaev Date: Sun Nov 1 06:09:58 2020 -0800 reiserfs: add check for an invalid ih_entry_count when directory item has an invalid value set for ih_entry_count it might trigger use-after-free or out-of-bounds read in bin_search_in_dir_item() ih_entry_count * IH_SIZE for directory item should not be larger than ih_item_len Link: https://lore.kernel.org/r/20201101140958.3650143-1-rkovhaev@gmail.com Reported-and-tested-by: syzbot+83b6f7cf9922cae5c4d7@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=83b6f7cf9922cae5c4d7 Signed-off-by: Rustam Kovhaev Signed-off-by: Jan Kara fs/reiserfs/stree.c | 6 ++++++ 1 file changed, 6 insertions(+) culprit signature: a84946d160732faed20eee4ac0ee717ae22d7c38f68ef1da84e3025d1c43cab1 parent signature: 9dc3640dbc050429f3da31c262153fa0ba975daaabd2db09ef11bff2d658d1e5 revisions tested: 16, total time: 2h45m54.72117893s (build: 1h12m48.596506339s, test: 1h31m36.916720156s) first good commit: d24396c5290ba8ab04ba505176874c4e04a2d53c reiserfs: add check for an invalid ih_entry_count recipients (to): ["jack@suse.cz" "rkovhaev@gmail.com" "syzbot+83b6f7cf9922cae5c4d7@syzkaller.appspotmail.com"] recipients (cc): []