bisecting cause commit starting from 87066fdd2e30fe9dd531125d95257c118a74617e building syzkaller on 4f0000ee28dffdfa5be45c94f77c16ec68994384 testing commit 87066fdd2e30fe9dd531125d95257c118a74617e compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 0aaa435b6854a727c2ff31cf0f831b59543a9ff644498d4234b82d7f9193db92 run #0: crashed: WARNING in z_erofs_lz4_decompress run #1: crashed: WARNING in z_erofs_lz4_decompress run #2: crashed: WARNING in z_erofs_lz4_decompress run #3: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #4: crashed: WARNING in z_erofs_lz4_decompress run #5: crashed: WARNING in z_erofs_lz4_decompress run #6: crashed: WARNING in z_erofs_lz4_decompress run #7: crashed: WARNING in z_erofs_lz4_decompress run #8: crashed: WARNING in z_erofs_lz4_decompress run #9: crashed: WARNING in z_erofs_lz4_decompress run #10: crashed: WARNING in z_erofs_lz4_decompress run #11: crashed: WARNING in z_erofs_lz4_decompress run #12: crashed: WARNING in z_erofs_lz4_decompress run #13: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #14: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #15: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #16: crashed: WARNING in z_erofs_lz4_decompress run #17: crashed: WARNING in z_erofs_lz4_decompress run #18: crashed: WARNING in z_erofs_lz4_decompress run #19: crashed: WARNING in z_erofs_lz4_decompress testing release v5.14 testing commit 7d2a07b769330c34b4deabeed939325c77a7ec2f compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: e7f82353780f7353f2b9831acf2c3b929072ab7502510d2c9ec919816098867b run #0: crashed: WARNING in z_erofs_lz4_decompress run #1: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #2: crashed: WARNING in z_erofs_lz4_decompress run #3: crashed: WARNING in z_erofs_lz4_decompress run #4: crashed: WARNING in z_erofs_lz4_decompress run #5: crashed: WARNING in z_erofs_lz4_decompress run #6: crashed: WARNING in z_erofs_lz4_decompress run #7: crashed: WARNING in z_erofs_lz4_decompress run #8: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #9: crashed: WARNING in z_erofs_lz4_decompress testing release v5.13 testing commit 62fb9874f5da54fdb243003b386128037319b219 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 3893288ffb73b25437d9014c3a302e9da56e6c80694523f6acbeb8e844d7d15a run #0: crashed: WARNING in z_erofs_lz4_decompress run #1: crashed: WARNING in z_erofs_lz4_decompress run #2: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #3: crashed: WARNING in z_erofs_lz4_decompress run #4: crashed: WARNING in z_erofs_lz4_decompress run #5: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #6: crashed: WARNING in z_erofs_lz4_decompress run #7: crashed: WARNING in z_erofs_lz4_decompress run #8: crashed: WARNING in z_erofs_lz4_decompress run #9: crashed: WARNING in z_erofs_lz4_decompress testing release v5.12 testing commit 9f4ad9e425a1d3b6a34617b8ea226d56a119a717 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: fef6bbeef0730e250dce5c4d00ca978c6faccee48182ecededef71f007012dae run #0: crashed: WARNING in z_erofs_lz4_decompress run #1: crashed: WARNING in z_erofs_lz4_decompress run #2: crashed: WARNING in z_erofs_lz4_decompress run #3: crashed: WARNING in z_erofs_lz4_decompress run #4: crashed: WARNING in z_erofs_lz4_decompress run #5: crashed: WARNING in z_erofs_lz4_decompress run #6: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #7: crashed: WARNING in z_erofs_lz4_decompress run #8: crashed: WARNING in z_erofs_lz4_decompress run #9: crashed: WARNING in z_erofs_lz4_decompress testing release v5.11 testing commit f40ddce88593482919761f74910f42f4b84c004b compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: e70248e93361f34dd873e40495a67fb19d7b2d6e1499d9fc363168f631887141 run #0: crashed: WARNING in z_erofs_lz4_decompress run #1: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #2: crashed: WARNING in z_erofs_lz4_decompress run #3: crashed: WARNING in z_erofs_lz4_decompress run #4: crashed: WARNING in z_erofs_lz4_decompress run #5: crashed: WARNING in z_erofs_lz4_decompress run #6: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #7: crashed: WARNING in z_erofs_lz4_decompress run #8: crashed: WARNING in z_erofs_lz4_decompress run #9: crashed: WARNING in z_erofs_lz4_decompress testing release v5.10 testing commit 2c85ebc57b3e1817b6ce1a6b703928e113a90442 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: c6eee30e83a4bfc1d174b45494b852005166c4538581c49180638cb8462d3b3a run #0: crashed: WARNING in z_erofs_lz4_decompress run #1: crashed: WARNING in z_erofs_lz4_decompress run #2: crashed: WARNING in z_erofs_lz4_decompress run #3: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #4: crashed: WARNING in z_erofs_lz4_decompress run #5: crashed: WARNING in z_erofs_lz4_decompress run #6: crashed: WARNING in z_erofs_lz4_decompress run #7: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #8: crashed: WARNING in z_erofs_lz4_decompress run #9: crashed: WARNING in z_erofs_lz4_decompress testing release v5.9 testing commit bbf5c979011a099af5dc76498918ed7df445635b compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 8abfd263d08f5a1944abf7487b0cd3fa8a13d2cbbae2833d87ee62892ed94117 run #0: crashed: WARNING in z_erofs_lz4_decompress run #1: crashed: WARNING in z_erofs_lz4_decompress run #2: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #3: crashed: WARNING in z_erofs_lz4_decompress run #4: crashed: WARNING in z_erofs_lz4_decompress run #5: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #6: crashed: KASAN: out-of-bounds Read in LZ4_decompress_safe_partial run #7: crashed: WARNING in z_erofs_lz4_decompress run #8: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #9: crashed: WARNING in z_erofs_lz4_decompress testing release v5.8 testing commit bcf876870b95592b52519ed4aafcf9d95999bc9c compiler: gcc (GCC) 8.4.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 261e40aa3ea66f2994281fd1f1351c40218e8d2382abca2a698e489c42cf9ad6 run #0: crashed: WARNING in z_erofs_lz4_decompress run #1: crashed: WARNING in z_erofs_lz4_decompress run #2: crashed: WARNING in z_erofs_lz4_decompress run #3: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #4: crashed: WARNING in z_erofs_lz4_decompress run #5: crashed: WARNING in z_erofs_lz4_decompress run #6: crashed: WARNING in z_erofs_lz4_decompress run #7: crashed: WARNING in z_erofs_lz4_decompress run #8: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #9: crashed: WARNING in z_erofs_lz4_decompress testing release v5.7 testing commit 3d77e6a8804abcc0504c904bd6e5cdf3a5cf8162 compiler: gcc version 8.4.1 20210217 (GCC), GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: f465b659524de2aa97eb77e7ad8a4bb7936a3b1791edd7cd15bf833edd9dac3a run #0: crashed: WARNING in z_erofs_lz4_decompress run #1: crashed: WARNING in z_erofs_lz4_decompress run #2: crashed: WARNING in z_erofs_lz4_decompress run #3: crashed: WARNING in z_erofs_lz4_decompress run #4: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #5: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #6: crashed: WARNING in z_erofs_lz4_decompress run #7: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #8: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #9: crashed: WARNING in z_erofs_lz4_decompress testing release v5.6 testing commit 7111951b8d4973bda27ff663f2cf18b663d15b48 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 0fc1f3346314f13db78f40d21279d9cf424c7ca11f4fd63953c5fc19806ea298 run #0: crashed: WARNING in z_erofs_lz4_decompress run #1: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #2: crashed: WARNING in z_erofs_lz4_decompress run #3: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #4: crashed: WARNING in z_erofs_lz4_decompress run #5: crashed: WARNING in z_erofs_lz4_decompress run #6: crashed: WARNING in z_erofs_lz4_decompress run #7: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #8: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #9: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial testing release v5.5 testing commit d5226fa6dbae0569ee43ecfc08bdcd6770fc4755 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: f866600bc4ef9117180a91fb78e4a8c316600a48cf118634280f94390a0c27eb run #0: crashed: WARNING in z_erofs_lz4_decompress run #1: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #2: crashed: WARNING in z_erofs_lz4_decompress run #3: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #4: crashed: WARNING in z_erofs_lz4_decompress run #5: crashed: WARNING in z_erofs_lz4_decompress run #6: crashed: WARNING in z_erofs_lz4_decompress run #7: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #8: crashed: WARNING in z_erofs_lz4_decompress run #9: crashed: WARNING in z_erofs_lz4_decompress testing release v5.4 testing commit 219d54332a09e8d8741c1e1982f5eae56099de85 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: f9c94704da58ed8242f3f31ac82201a9c31c001fc480cbdd2d8d6d827241ff37 run #0: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #1: crashed: WARNING in z_erofs_lz4_decompress run #2: crashed: WARNING in z_erofs_lz4_decompress run #3: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #4: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #5: crashed: WARNING in z_erofs_lz4_decompress run #6: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #7: crashed: WARNING in z_erofs_lz4_decompress run #8: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #9: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial testing release v5.3 testing commit 4d856f72c10ecb060868ed10ff1b1453943fc6c8 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: fd630f5600ac9ce9229d36a41fbae02765c8b9ae9fc2ec1bf2d5567c3df70aad run #0: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #1: crashed: WARNING in lz4_decompress run #2: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #3: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #4: crashed: WARNING in lz4_decompress run #5: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #6: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #7: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #8: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #9: crashed: WARNING in lz4_decompress testing release v5.2 testing commit 0ecfebd2b52404ae0c54a878c872bb93363ada36 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 7a5cd6ccb913e948426ba6ec7912cfcb67ade9efdd62a3e5fce48a13935181a0 run #0: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #1: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #2: crashed: WARNING in z_erofs_unzip_lz4 run #3: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #4: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #5: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #6: crashed: WARNING in z_erofs_unzip_lz4 run #7: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #8: crashed: WARNING in z_erofs_unzip_lz4 run #9: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial testing release v5.1 testing commit e93c9c99a629c61837d5a7fc2120cd2b6c70dbdd compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 3daad16c0cc66d0188334ccb4831ec09dce9b865b8b46fe82d8c8b04fe2c686f run #0: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #1: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #2: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #3: crashed: WARNING in z_erofs_unzip_lz4 run #4: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #5: crashed: WARNING in z_erofs_unzip_lz4 run #6: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #7: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #8: crashed: WARNING in z_erofs_unzip_lz4 run #9: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial testing release v5.0 testing commit 1c163f4c7b3f621efff9b28a47abb36f7378d783 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: a6c31f69eea08cc5977a3c397a79551c4e2695004c68b6649eec12907ca0ffd1 run #0: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #1: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #2: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #3: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #4: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #5: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #6: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #7: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #8: crashed: KASAN: use-after-free Read in LZ4_decompress_safe_partial run #9: crashed: WARNING in z_erofs_unzip_lz4 testing release v4.20 testing commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: f13ea23d63f67d217bafc95323e6a76e5a9270831eb9df7a568bc6aee2a3180f run #0: crashed: KASAN: use-after-free Write in ___d_drop run #1: crashed: KASAN: use-after-free Write in __d_rehash run #2: crashed: KASAN: use-after-free Write in ___d_drop run #3: crashed: KASAN: use-after-free Write in __d_rehash run #4: crashed: KASAN: use-after-free Write in ___d_drop run #5: crashed: KASAN: use-after-free Write in ___d_drop run #6: crashed: KASAN: use-after-free Write in ___d_drop run #7: crashed: KASAN: use-after-free Write in ___d_drop run #8: crashed: KASAN: use-after-free Write in ___d_drop run #9: crashed: KASAN: use-after-free Write in ___d_drop testing release v4.19 testing commit 84df9525b0c27f3ebc2ebb1864fa62a97fdedb7d compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 11d387ae7099130086eb344b01387b9b8a0f32d06ec5d9926ebd35ff28c5e949 run #0: crashed: KASAN: use-after-free Write in __d_rehash run #1: crashed: KASAN: use-after-free Write in ___d_drop run #2: crashed: KASAN: use-after-free Write in ___d_drop run #3: crashed: KASAN: use-after-free Write in ___d_drop run #4: crashed: KASAN: use-after-free Write in ___d_drop run #5: crashed: KASAN: use-after-free Write in ___d_drop run #6: crashed: KASAN: use-after-free Write in ___d_drop run #7: crashed: KASAN: use-after-free Write in ___d_drop run #8: crashed: KASAN: use-after-free Write in ___d_drop run #9: OK testing release v4.18 testing commit 94710cac0ef4ee177a63b5227664b38c95bbf703 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 21cc75661478c8bedb30781cf094a254d8e8c8aab627b0fafc8a345a071ab15e all runs: OK # git bisect start 84df9525b0c27f3ebc2ebb1864fa62a97fdedb7d 94710cac0ef4ee177a63b5227664b38c95bbf703 Bisecting: 7596 revisions left to test after this (roughly 13 steps) [db06f826ec12bf0701ea7fc0a3c0aa00b84417c8] Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux testing commit db06f826ec12bf0701ea7fc0a3c0aa00b84417c8 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 79ee53f2a8a6d43b3a6ace0bb914f65e284bb4c3fd6d1d7ab49d96069e3f308e run #0: OK run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: boot failed: KASAN: use-after-free Read in dd_has_work # git bisect good db06f826ec12bf0701ea7fc0a3c0aa00b84417c8 Bisecting: 3768 revisions left to test after this (roughly 12 steps) [cd9b44f90763c3367e8dd0601849ffb028e8ba52] Merge branch 'akpm' (patches from Andrew) testing commit cd9b44f90763c3367e8dd0601849ffb028e8ba52 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 1b0ac74b40160e66f638bf9a2ee3bafb30d7e9bf25f09e7e714354e7cdcb820a all runs: OK # git bisect good cd9b44f90763c3367e8dd0601849ffb028e8ba52 Bisecting: 1886 revisions left to test after this (roughly 11 steps) [4290d5b9ca018be10c7582524f7500df731bfab0] Merge tag 'for-linus-4.19b-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip testing commit 4290d5b9ca018be10c7582524f7500df731bfab0 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: bb9cd4239bfa8616ba3fa610fe9e2123b4641b3d2e1fc9534e2991ce7d314570 all runs: OK # git bisect good 4290d5b9ca018be10c7582524f7500df731bfab0 Bisecting: 942 revisions left to test after this (roughly 10 steps) [576156bb01a62c1f64b32b416593862bb34bddaa] Merge branch 'for-upstream/malidp-fixes' of git://linux-arm.org/linux-ld into drm-fixes testing commit 576156bb01a62c1f64b32b416593862bb34bddaa compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 8ef01eace3a71ec4e10382ee3951f6e7e01a1759b037ac31cb6e51ee679cfcca run #0: crashed: KASAN: use-after-free Write in __d_rehash run #1: crashed: KASAN: use-after-free Write in ___d_drop run #2: crashed: KASAN: use-after-free Write in ___d_drop run #3: crashed: KASAN: use-after-free Read in ___d_drop run #4: crashed: KASAN: use-after-free Write in ___d_drop run #5: crashed: KASAN: use-after-free Write in ___d_drop run #6: crashed: KASAN: use-after-free Write in ___d_drop run #7: crashed: KASAN: use-after-free Read in ___d_drop run #8: crashed: KASAN: use-after-free Write in ___d_drop run #9: crashed: KASAN: use-after-free Write in ___d_drop # git bisect bad 576156bb01a62c1f64b32b416593862bb34bddaa Bisecting: 482 revisions left to test after this (roughly 9 steps) [67b076095dd7a13ff24e9b5f830fcb1291ae0678] Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net testing commit 67b076095dd7a13ff24e9b5f830fcb1291ae0678 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: f96da6ea7dcd7de8ea62f206111c2849ef396a26fe045cf766dafd08ef7adbfe all runs: OK # git bisect good 67b076095dd7a13ff24e9b5f830fcb1291ae0678 Bisecting: 240 revisions left to test after this (roughly 8 steps) [1795f81f6167bd57b37459789f1f05ab61ace896] Merge tag 'kvm-ppc-fixes-4.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc into HEAD testing commit 1795f81f6167bd57b37459789f1f05ab61ace896 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: dd5b5be08d474190f3b11cc2efe62fcc13157a12358aedfa0528bf876ea2056a run #0: crashed: KASAN: use-after-free Write in __d_rehash run #1: crashed: KASAN: use-after-free Write in ___d_drop run #2: crashed: KASAN: use-after-free Write in ___d_drop run #3: crashed: KASAN: use-after-free Write in __d_rehash run #4: crashed: KASAN: use-after-free Write in ___d_drop run #5: crashed: KASAN: use-after-free Write in ___d_drop run #6: crashed: KASAN: use-after-free Write in ___d_drop run #7: crashed: KASAN: use-after-free Write in ___d_drop run #8: crashed: KASAN: use-after-free Write in ___d_drop run #9: crashed: KASAN: use-after-free Write in __d_rehash # git bisect bad 1795f81f6167bd57b37459789f1f05ab61ace896 Bisecting: 120 revisions left to test after this (roughly 7 steps) [c284cf062191237abfda57dd526cd10afc8abb19] Merge tag 'tty-4.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty testing commit c284cf062191237abfda57dd526cd10afc8abb19 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: db7fe3ae4d44c5716ec901edcd5ac0a495e0c4bf7b0b41d0ab81472752e48605 run #0: crashed: KASAN: use-after-free Write in ___d_drop run #1: crashed: KASAN: use-after-free Write in ___d_drop run #2: crashed: KASAN: use-after-free Write in ___d_drop run #3: crashed: KASAN: use-after-free Write in ___d_drop run #4: crashed: KASAN: use-after-free Write in ___d_drop run #5: crashed: KASAN: use-after-free Write in ___d_drop run #6: crashed: KASAN: use-after-free Write in __d_rehash run #7: crashed: KASAN: use-after-free Write in __d_rehash run #8: crashed: KASAN: use-after-free Write in ___d_drop run #9: crashed: KASAN: use-after-free Write in __d_rehash # git bisect bad c284cf062191237abfda57dd526cd10afc8abb19 Bisecting: 65 revisions left to test after this (roughly 6 steps) [145ea6f10d42dac0a1e8a6dfb83b273c0acabf5b] Merge tag 'pstore-v4.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux testing commit 145ea6f10d42dac0a1e8a6dfb83b273c0acabf5b compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: ab1a5ba079c188c43e7ebaac2b3772dbeb142f7e2ab0e64c7d8bebcc82189198 all runs: OK # git bisect good 145ea6f10d42dac0a1e8a6dfb83b273c0acabf5b Bisecting: 29 revisions left to test after this (roughly 5 steps) [48751b562bce96c4284885571da1bdda7673f38e] Merge tag 'ovl-fixes-4.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs testing commit 48751b562bce96c4284885571da1bdda7673f38e compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 867e1f48e5cf1b87de307d1f6198ad1a110ef51458b16899f686e78af3f7048b all runs: OK # git bisect good 48751b562bce96c4284885571da1bdda7673f38e Bisecting: 15 revisions left to test after this (roughly 4 steps) [319cbacfc0f272297849ce61d36557a408bb3771] Merge tag 'char-misc-4.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc testing commit 319cbacfc0f272297849ce61d36557a408bb3771 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: ca6ceb958d7d69615974e45a6c5592915aad2834be0b5c64b4da1e7330ac7797 all runs: OK # git bisect good 319cbacfc0f272297849ce61d36557a408bb3771 Bisecting: 7 revisions left to test after this (roughly 3 steps) [f8ff6b2d4a51f08ff53360aab633ba6d4f2d54b6] staging/fbtft: Update TODO and mailing lists testing commit f8ff6b2d4a51f08ff53360aab633ba6d4f2d54b6 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 625627a6489bb898e8915de8e12684b84fe55cfad665f89f7ae728ebcb70e76b run #0: crashed: KASAN: use-after-free Read in ___d_drop run #1: crashed: KASAN: use-after-free Write in ___d_drop run #2: crashed: KASAN: use-after-free Write in ___d_drop run #3: crashed: KASAN: use-after-free Write in ___d_drop run #4: crashed: KASAN: use-after-free Write in ___d_drop run #5: crashed: KASAN: use-after-free Write in ___d_drop run #6: crashed: KASAN: use-after-free Write in ___d_drop run #7: crashed: KASAN: use-after-free Write in ___d_drop run #8: crashed: KASAN: use-after-free Write in __d_rehash run #9: crashed: KASAN: use-after-free Write in ___d_drop # git bisect bad f8ff6b2d4a51f08ff53360aab633ba6d4f2d54b6 Bisecting: 4 revisions left to test after this (roughly 2 steps) [f86cf25a609107960cf05263e491463feaae1f99] Revert "staging: erofs: disable compiling temporarile" testing commit f86cf25a609107960cf05263e491463feaae1f99 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 625627a6489bb898e8915de8e12684b84fe55cfad665f89f7ae728ebcb70e76b run #0: crashed: KASAN: use-after-free Write in __d_rehash run #1: crashed: KASAN: use-after-free Write in __d_rehash run #2: crashed: KASAN: use-after-free Write in ___d_drop run #3: crashed: KASAN: use-after-free Write in ___d_drop run #4: crashed: KASAN: use-after-free Write in ___d_drop run #5: crashed: KASAN: use-after-free Write in ___d_drop run #6: crashed: KASAN: use-after-free Write in __d_rehash run #7: crashed: KASAN: use-after-free Write in ___d_drop run #8: crashed: KASAN: use-after-free Write in __d_rehash run #9: crashed: KASAN: use-after-free Write in __d_rehash # git bisect bad f86cf25a609107960cf05263e491463feaae1f99 Bisecting: 0 revisions left to test after this (roughly 1 step) [849c70dacb169da751b171c7d230206a72cf7391] MAINTAINERS: Switch a maintainer for drivers/staging/gasket testing commit 849c70dacb169da751b171c7d230206a72cf7391 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 9f8c933d385332dce2634d225fa08d09961d03d01af4a5a739eacb7e98ca0a24 all runs: OK # git bisect good 849c70dacb169da751b171c7d230206a72cf7391 f86cf25a609107960cf05263e491463feaae1f99 is the first bad commit commit f86cf25a609107960cf05263e491463feaae1f99 Author: Gao Xiang Date: Tue Aug 28 11:39:48 2018 +0800 Revert "staging: erofs: disable compiling temporarile" This reverts commit 156c3df8d4db4e693c062978186f44079413d74d. Since XArray and the new mount apis aren't merged in 4.19-rc1 merge window, the BROKEN mark can be reverted directly without any problems. Fixes: 156c3df8d4db ("staging: erofs: disable compiling temporarile") Cc: Matthew Wilcox Cc: David Howells Reviewed-by: Chao Yu Signed-off-by: Gao Xiang Signed-off-by: Greg Kroah-Hartman drivers/staging/erofs/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) culprit signature: 625627a6489bb898e8915de8e12684b84fe55cfad665f89f7ae728ebcb70e76b parent signature: 9f8c933d385332dce2634d225fa08d09961d03d01af4a5a739eacb7e98ca0a24 revisions tested: 32, total time: 6h20m1.435751606s (build: 3h11m21.733894103s, test: 3h4m13.908886908s) first bad commit: f86cf25a609107960cf05263e491463feaae1f99 Revert "staging: erofs: disable compiling temporarile" recipients (to): ["gaoxiang25@huawei.com" "gregkh@linuxfoundation.org" "yuchao0@huawei.com"] recipients (cc): [] crash: KASAN: use-after-free Write in __d_rehash erofs: unmounted for /dev/loop0 erofs: read_super, device -> /dev/loop5 erofs: options -> erofs: root inode @ nid 36 ================================================================== BUG: KASAN: use-after-free in hlist_bl_add_head_rcu include/linux/rculist_bl.h:109 [inline] BUG: KASAN: use-after-free in __d_rehash+0x217/0x220 fs/dcache.c:2385 Write of size 8 at addr ffff880090858038 by task syz-executor.5/10635 CPU: 1 PID: 10635 Comm: syz-executor.5 Not tainted 4.19.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x15a/0x20d lib/dump_stack.c:113 print_address_description.cold.6+0x9/0x244 mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report mm/kasan/report.c:412 [inline] kasan_report.cold.7+0x242/0x305 mm/kasan/report.c:396 __asan_report_store8_noabort+0x17/0x20 mm/kasan/report.c:438 hlist_bl_add_head_rcu include/linux/rculist_bl.h:109 [inline] __d_rehash+0x217/0x220 fs/dcache.c:2385 d_rehash+0x21/0x30 fs/dcache.c:2399 erofs_read_super drivers/staging/erofs/super.c:411 [inline] erofs_fill_super+0x115a/0x1269 drivers/staging/erofs/super.c:487 mount_bdev+0x26f/0x330 fs/super.c:1158 erofs_mount+0x6a/0x90 drivers/staging/erofs/super.c:500 mount_fs+0x7f/0x2a9 fs/super.c:1261 vfs_kern_mount.part.11+0x58/0x3d0 fs/namespace.c:961 vfs_kern_mount fs/namespace.c:951 [inline] do_new_mount fs/namespace.c:2457 [inline] do_mount+0x376/0x2710 fs/namespace.c:2787 ksys_mount+0xb1/0xd0 fs/namespace.c:3003 __do_sys_mount fs/namespace.c:3017 [inline] __se_sys_mount fs/namespace.c:3014 [inline] __x64_sys_mount+0xb9/0x150 fs/namespace.c:3014 do_syscall_64+0xda/0x540 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7fe409ba9f6a Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fe40931dfa8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 00007fe409ba9f6a RDX: 0000000020000080 RSI: 0000000020000100 RDI: 00007fe40931e000 RBP: 00007fe40931e040 R08: 00007fe40931e040 R09: 0000000020000080 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000080 R13: 0000000020000100 R14: 00007fe40931e000 R15: 0000000020000280 Allocated by task 10615: save_stack mm/kasan/kasan.c:448 [inline] set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:553 kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:538 kasan_slab_alloc+0x11/0x20 mm/kasan/kasan.c:490 slab_post_alloc_hook mm/slab.h:444 [inline] slab_alloc_node mm/slub.c:2707 [inline] slab_alloc mm/slub.c:2715 [inline] kmem_cache_alloc+0xe8/0x2c0 mm/slub.c:2720 __d_alloc+0x28/0x9d0 fs/dcache.c:1614 d_alloc_anon fs/dcache.c:1718 [inline] d_make_root+0x38/0xa0 fs/dcache.c:1905 erofs_read_super drivers/staging/erofs/super.c:389 [inline] erofs_fill_super+0xfdc/0x1269 drivers/staging/erofs/super.c:487 mount_bdev+0x26f/0x330 fs/super.c:1158 erofs_mount+0x6a/0x90 drivers/staging/erofs/super.c:500 mount_fs+0x7f/0x2a9 fs/super.c:1261 vfs_kern_mount.part.11+0x58/0x3d0 fs/namespace.c:961 vfs_kern_mount fs/namespace.c:951 [inline] do_new_mount fs/namespace.c:2457 [inline] do_mount+0x376/0x2710 fs/namespace.c:2787 ksys_mount+0xb1/0xd0 fs/namespace.c:3003 __do_sys_mount fs/namespace.c:3017 [inline] __se_sys_mount fs/namespace.c:3014 [inline] __x64_sys_mount+0xb9/0x150 fs/namespace.c:3014 do_syscall_64+0xda/0x540 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 18: save_stack mm/kasan/kasan.c:448 [inline] set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free+0x167/0x240 mm/kasan/kasan.c:521 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528 slab_free_hook mm/slub.c:1372 [inline] slab_free_freelist_hook mm/slub.c:1399 [inline] slab_free mm/slub.c:2954 [inline] kmem_cache_free+0xdd/0x320 mm/slub.c:2970 __d_free+0x17/0x20 fs/dcache.c:257 __rcu_reclaim kernel/rcu/rcu.h:236 [inline] rcu_do_batch kernel/rcu/tree.c:2576 [inline] invoke_rcu_callbacks kernel/rcu/tree.c:2880 [inline] __rcu_process_callbacks kernel/rcu/tree.c:2847 [inline] rcu_process_callbacks+0x93a/0x19b0 kernel/rcu/tree.c:2864 __do_softirq+0x25f/0x8ed kernel/softirq.c:292 The buggy address belongs to the object at ffff880090858000 which belongs to the cache dentry of size 288 The buggy address is located 56 bytes inside of 288-byte region [ffff880090858000, ffff880090858120) The buggy address belongs to the page: page:ffffea0002421600 count:1 mapcount:0 mapping:ffff88013be25800 index:0x0 compound_mapcount: 0 flags: 0xfff00000008100(slab|head) raw: 00fff00000008100 dead000000000100 dead000000000200 ffff88013be25800 raw: 0000000000000000 0000000000170017 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page allocated via order 1, migratetype Reclaimable, gfp_mask 0x152d0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_RECLAIMABLE) set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook mm/page_alloc.c:1907 [inline] prep_new_page mm/page_alloc.c:1915 [inline] get_page_from_freelist+0x3033/0x4530 mm/page_alloc.c:3346 __alloc_pages_nodemask+0x39e/0x2670 mm/page_alloc.c:4371 alloc_pages_current+0xd6/0x1b0 mm/mempolicy.c:2093 alloc_pages include/linux/gfp.h:509 [inline] alloc_slab_page mm/slub.c:1439 [inline] allocate_slab mm/slub.c:1584 [inline] new_slab+0x4a9/0x850 mm/slub.c:1655 new_slab_objects mm/slub.c:2418 [inline] ___slab_alloc+0x648/0x980 mm/slub.c:2570 __slab_alloc.isra.22+0x78/0xe0 mm/slub.c:2610 slab_alloc_node mm/slub.c:2673 [inline] slab_alloc mm/slub.c:2715 [inline] kmem_cache_alloc+0x250/0x2c0 mm/slub.c:2720 __d_alloc+0x28/0x9d0 fs/dcache.c:1614 d_alloc+0x43/0x250 fs/dcache.c:1698 __lookup_hash+0xa5/0x150 fs/namei.c:1542 filename_create+0x179/0x400 fs/namei.c:3636 user_path_create fs/namei.c:3693 [inline] do_mkdirat+0xae/0x220 fs/namei.c:3832 __do_sys_mkdir fs/namei.c:3856 [inline] __se_sys_mkdir fs/namei.c:3854 [inline] __x64_sys_mkdir+0x57/0x80 fs/namei.c:3854 do_syscall_64+0xda/0x540 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Memory state around the buggy address: ffff880090857f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff880090857f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff880090858000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff880090858080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff880090858100: fb fb fb fb fc fc fc fc fc fc fc fc fb fb fb fb ==================================================================