bisecting fixing commit since 830a059cbba6832c11fefc0894c7ec7a27f75734 building syzkaller on 6a81331a1d4c744da9204d02ec88d558f7eea9c9 testing commit 830a059cbba6832c11fefc0894c7ec7a27f75734 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: f00075df9d9b561f590bb289a68ee87053e912eee36a3cb537b78598418771ec all runs: crashed: KASAN: out-of-bounds Read in ext4_xattr_set_entry testing current HEAD e34184f53363f6bb873c2fe0ce1a08ed7d16e94a testing commit e34184f53363f6bb873c2fe0ce1a08ed7d16e94a compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: c91bc2bd66874db596fe733945ac46a9119c321cbfbf510f0d7b39edab379284 all runs: OK # git bisect start e34184f53363f6bb873c2fe0ce1a08ed7d16e94a 830a059cbba6832c11fefc0894c7ec7a27f75734 Bisecting: 1121 revisions left to test after this (roughly 10 steps) [ee59cafe5de910a429f44cc48b245847b6edd0fe] media: gspca/gl860: fix zero-length control requests testing commit ee59cafe5de910a429f44cc48b245847b6edd0fe compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 808deacaa57fbb9b5c6e9e0a4a0953221069c4621adecf01c65df5c349b561e4 all runs: crashed: KASAN: out-of-bounds Read in ext4_xattr_set_entry # git bisect good ee59cafe5de910a429f44cc48b245847b6edd0fe Bisecting: 560 revisions left to test after this (roughly 9 steps) [4c07e70141eebd3db64297515a427deea4822957] KVM: X86: MMU: Use the correct inherited permissions to get shadow page testing commit 4c07e70141eebd3db64297515a427deea4822957 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 375b640ebb5737124c83c9439dbc6c2ba0bc464b9249ada9c6f428b75ba7bb2e all runs: crashed: KASAN: out-of-bounds Read in ext4_xattr_set_entry # git bisect good 4c07e70141eebd3db64297515a427deea4822957 Bisecting: 280 revisions left to test after this (roughly 8 steps) [9076623badf1dba7a45743bad393ede47ca3f72e] HID: input: do not report stylus battery state as "full" testing commit 9076623badf1dba7a45743bad393ede47ca3f72e compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: e5649ef3712ebefc597590f8beb298f9f69464b6d99edbd3956e411fbb432f5b all runs: OK # git bisect bad 9076623badf1dba7a45743bad393ede47ca3f72e Bisecting: 139 revisions left to test after this (roughly 7 steps) [f4b606f708379d10ea822bde217bdf338a94d096] USB: serial: mos7720: improve OOM-handling in read_mos_reg() testing commit f4b606f708379d10ea822bde217bdf338a94d096 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: e4f8f9d541fa47dfb3a1d72bbdf7b6fbed3f9ca9547fffeb9fc5c808a73e7c67 all runs: OK # git bisect bad f4b606f708379d10ea822bde217bdf338a94d096 Bisecting: 69 revisions left to test after this (roughly 6 steps) [4e370cc081a78ee23528311ca58fd98a06768ec7] net: 6pack: fix slab-out-of-bounds in decode_data testing commit 4e370cc081a78ee23528311ca58fd98a06768ec7 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 844112003f5968f0e3ce161c27b48a51f3096fd55632500618ea4c23a7595434 all runs: crashed: KASAN: out-of-bounds Read in ext4_xattr_set_entry # git bisect good 4e370cc081a78ee23528311ca58fd98a06768ec7 Bisecting: 34 revisions left to test after this (roughly 5 steps) [24d34768233fba8613064c93234774c5c97e0f50] xgene-v2: Fix a resource leak in the error handling path of 'xge_probe()' testing commit 24d34768233fba8613064c93234774c5c97e0f50 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: aa7acfaed094b5d4572417237af2abbd2be4fb07b0b095c10b94fdb4a648c70a all runs: crashed: KASAN: out-of-bounds Read in ext4_xattr_set_entry # git bisect good 24d34768233fba8613064c93234774c5c97e0f50 Bisecting: 17 revisions left to test after this (roughly 4 steps) [e9544276b3e60800a150f27fe5d031d133c77eea] net: don't unconditionally copy_from_user a struct ifreq for socket ioctls testing commit e9544276b3e60800a150f27fe5d031d133c77eea compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 180d0f135acb61798a65e10f27092f903bbecec334c8d1e0655b6caefa0b0e09 all runs: crashed: KASAN: out-of-bounds Read in ext4_xattr_set_entry # git bisect good e9544276b3e60800a150f27fe5d031d133c77eea Bisecting: 8 revisions left to test after this (roughly 3 steps) [cff9af5340e39dcca479538459bb5795716fde33] perf/x86/amd/ibs: Work around erratum #1197 testing commit cff9af5340e39dcca479538459bb5795716fde33 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 560d217c5bba59778d35e62efecab20e1e947329ce4bbb631cbf6532a8b0a087 all runs: OK # git bisect bad cff9af5340e39dcca479538459bb5795716fde33 Bisecting: 4 revisions left to test after this (roughly 2 steps) [42150e1b46a474541f677c759ac61599277c8a9c] gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for (semi)planar U/V formats testing commit 42150e1b46a474541f677c759ac61599277c8a9c compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: ad94aca07fb8f21927a0ff199df7b05f904e5612cda37abff621f9cacb56fffb all runs: OK # git bisect bad 42150e1b46a474541f677c759ac61599277c8a9c Bisecting: 1 revision left to test after this (roughly 1 step) [c481607ba522e31e6ed01efefc19cc1d0e0a46fa] ext4: fix race writing to an inline_data file while its xattrs are changing testing commit c481607ba522e31e6ed01efefc19cc1d0e0a46fa compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: ad94aca07fb8f21927a0ff199df7b05f904e5612cda37abff621f9cacb56fffb all runs: OK # git bisect bad c481607ba522e31e6ed01efefc19cc1d0e0a46fa Bisecting: 0 revisions left to test after this (roughly 0 steps) [b172b44fcb1771e083aad806fa96f3f60e2ddfac] Linux 4.19.206 testing commit b172b44fcb1771e083aad806fa96f3f60e2ddfac compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: d78f3b8df218fc7af159be50e1037fa510b2915c60a9492e4a66df006966dc47 all runs: crashed: KASAN: out-of-bounds Read in ext4_xattr_set_entry # git bisect good b172b44fcb1771e083aad806fa96f3f60e2ddfac c481607ba522e31e6ed01efefc19cc1d0e0a46fa is the first bad commit commit c481607ba522e31e6ed01efefc19cc1d0e0a46fa Author: Theodore Ts'o Date: Fri Aug 20 23:44:17 2021 -0400 ext4: fix race writing to an inline_data file while its xattrs are changing commit a54c4613dac1500b40e4ab55199f7c51f028e848 upstream. The location of the system.data extended attribute can change whenever xattr_sem is not taken. So we need to recalculate the i_inline_off field since it mgiht have changed between ext4_write_begin() and ext4_write_end(). This means that caching i_inline_off is probably not helpful, so in the long run we should probably get rid of it and shrink the in-memory ext4 inode slightly, but let's fix the race the simple way for now. Cc: stable@kernel.org Fixes: f19d5870cbf72 ("ext4: add normal write support for inline data") Reported-by: syzbot+13146364637c7363a7de@syzkaller.appspotmail.com Signed-off-by: Theodore Ts'o Signed-off-by: Greg Kroah-Hartman fs/ext4/inline.c | 6 ++++++ 1 file changed, 6 insertions(+) culprit signature: ad94aca07fb8f21927a0ff199df7b05f904e5612cda37abff621f9cacb56fffb parent signature: d78f3b8df218fc7af159be50e1037fa510b2915c60a9492e4a66df006966dc47 revisions tested: 13, total time: 3h16m24.615349352s (build: 1h45m9.810174347s, test: 1h30m4.043416228s) first good commit: c481607ba522e31e6ed01efefc19cc1d0e0a46fa ext4: fix race writing to an inline_data file while its xattrs are changing recipients (to): ["adilger.kernel@dilger.ca" "gregkh@linuxfoundation.org" "linux-ext4@vger.kernel.org" "tytso@mit.edu" "tytso@mit.edu"] recipients (cc): ["linux-kernel@vger.kernel.org"]