ci2 starts bisection 2025-10-25 08:00:24.645924198 +0000 UTC m=+223683.463302169 bisecting fixing commit since d0c22de9995b624f563bc5004d44ac2655712a56 building syzkaller on ed351ea732d889c7798e7f0226bcaec65a8a6b52 ensuring issue is reproducible on original commit d0c22de9995b624f563bc5004d44ac2655712a56 testing commit d0c22de9995b624f563bc5004d44ac2655712a56 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 2c4f3e3b070d15635d5239af202725242d2de815540ebe05832f7ba1620a2dd5 run #0: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #1: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #2: crashed: KASAN: use-after-free Read in ext4_find_extent run #3: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #4: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #5: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #6: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #7: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #8: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #9: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #10: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #11: crashed: KASAN: use-after-free Read in ext4_find_extent run #12: crashed: KASAN: use-after-free Read in ext4_find_extent run #13: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #14: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #15: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #16: crashed: KASAN: use-after-free Read in ext4_find_extent run #17: crashed: KASAN: use-after-free Read in ext4_find_extent run #18: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #19: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent representative crash: KASAN: slab-use-after-free Read in ext4_find_extent, types: [KASAN-USE-AFTER-FREE-READ] check whether we can drop unnecessary instrumentation disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed testing commit d0c22de9995b624f563bc5004d44ac2655712a56 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: fc3896a06e201a94c3e1f6bebc48dd8838cd13ada1161aac3f520a7329286079 run #0: crashed: KASAN: slab-use-after-free Read in ext4_ext_insert_extent run #1: crashed: KASAN: slab-use-after-free Read in ext4_ext_insert_extent run #2: crashed: KASAN: use-after-free Read in ext4_find_extent run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #4: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #5: crashed: KASAN: use-after-free Read in ext4_find_extent run #6: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #7: crashed: KASAN: use-after-free Read in ext4_find_extent run #8: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #9: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent representative crash: KASAN: slab-use-after-free Read in ext4_ext_insert_extent, types: [KASAN-USE-AFTER-FREE-READ KASAN-READ] the bug reproduces without the instrumentation disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed kconfig minimization: base=4109 full=8326 leaves diff=2154 split chunks (needed=false): <2154> split chunk #0 of len 2154 into 5 parts testing without sub-chunk 1/5 disabling configs for [locking atomic_sleep hang memleak ubsan bug_or_warning], they are not needed testing commit d0c22de9995b624f563bc5004d44ac2655712a56 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 0df69b31206ef5b196d66564ab2ae115823928858d5c648800b7cc47de29556b run #0: crashed: KASAN: slab-use-after-free Read in ext4_ext_insert_extent run #1: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #2: crashed: KASAN: use-after-free Read in ext4_find_extent run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #4: crashed: KASAN: slab-use-after-free Read in ext4_ext_insert_extent run #5: crashed: KASAN: slab-use-after-free Read in ext4_ext_insert_extent run #6: crashed: KASAN: use-after-free Read in ext4_find_extent run #7: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #8: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #9: crashed: KASAN: use-after-free Read in ext4_ext_insert_extent representative crash: KASAN: slab-use-after-free Read in ext4_ext_insert_extent, types: [KASAN-USE-AFTER-FREE-READ KASAN-READ] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [bug_or_warning locking atomic_sleep hang memleak ubsan], they are not needed testing commit d0c22de9995b624f563bc5004d44ac2655712a56 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: c2aff6dd416b9242008788da407c4ea087e51d47c952f88681f45ffb6311119e run #0: crashed: KASAN: use-after-free Read in ext4_find_extent run #1: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #2: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #4: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #5: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #6: crashed: KASAN: slab-out-of-bounds Read in ext4_ext_insert_extent run #7: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #8: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #9: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent representative crash: KASAN: slab-out-of-bounds Read in ext4_find_extent, types: [KASAN-READ KASAN-USE-AFTER-FREE-READ] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed testing commit d0c22de9995b624f563bc5004d44ac2655712a56 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: b4e373418db6ca141641718cf6a2d539151dbd289260137f78af34637ea6e310 run #0: crashed: KASAN: use-after-free Read in ext4_ext_correct_indexes run #1: crashed: KASAN: slab-out-of-bounds Read in ext4_ext_insert_extent run #2: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #4: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #5: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #6: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #7: crashed: KASAN: slab-out-of-bounds Read in ext4_ext_insert_extent run #8: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #9: crashed: KASAN: use-after-free Read in ext4_find_extent representative crash: KASAN: slab-out-of-bounds Read in ext4_ext_insert_extent, types: [KASAN-READ KASAN-USE-AFTER-FREE-READ] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed testing commit d0c22de9995b624f563bc5004d44ac2655712a56 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: fd56647e2604901eba647b9c8754aafee01f6a37e428c1e06b4cc40a09fe53f4 run #0: crashed: KASAN: slab-out-of-bounds Read in ext4_ext_insert_extent run #1: crashed: KASAN: slab-use-after-free Read in ext4_ext_insert_extent run #2: crashed: KASAN: slab-out-of-bounds Read in ext4_ext_insert_extent run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_ext_insert_extent run #4: crashed: KASAN: slab-use-after-free Read in ext4_ext_insert_extent run #5: crashed: KASAN: slab-use-after-free Read in ext4_ext_insert_extent run #6: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #7: crashed: KASAN: use-after-free Read in ext4_find_extent run #8: crashed: KASAN: use-after-free Read in ext4_ext_insert_extent run #9: crashed: KASAN: slab-use-after-free Read in ext4_ext_insert_extent representative crash: KASAN: slab-use-after-free Read in ext4_ext_insert_extent, types: [KASAN-USE-AFTER-FREE-READ KASAN-READ] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [locking atomic_sleep hang memleak ubsan bug_or_warning], they are not needed testing commit d0c22de9995b624f563bc5004d44ac2655712a56 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 30d96a2d87604fdf35b0c18550bc4480becd688d161a5f5ef5cb420d3a766fa2 run #0: crashed: KASAN: use-after-free Read in ext4_ext_insert_extent run #1: crashed: KASAN: slab-use-after-free Read in ext4_ext_insert_extent run #2: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #3: crashed: KASAN: slab-use-after-free Read in ext4_ext_insert_extent run #4: crashed: KASAN: use-after-free Read in ext4_ext_insert_extent run #5: crashed: KASAN: use-after-free Read in ext4_find_extent run #6: crashed: KASAN: slab-out-of-bounds Read in ext4_ext_insert_extent run #7: crashed: KASAN: slab-out-of-bounds Read in ext4_ext_insert_extent run #8: crashed: KASAN: slab-use-after-free Read in ext4_ext_insert_extent run #9: crashed: KASAN: slab-out-of-bounds Read in ext4_ext_insert_extent representative crash: KASAN: use-after-free Read in ext4_ext_insert_extent, types: [KASAN-USE-AFTER-FREE-READ KASAN-READ] the chunk can be dropped disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed testing current HEAD 566771afc7a81e343da9939f0bd848d3622e2501 testing commit 566771afc7a81e343da9939f0bd848d3622e2501 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 39a1c21e89699191e2fe6055f2660bc8e53f101223de5456e80b2604d3bf734c run #0: crashed: KASAN: use-after-free Read in ext4_find_extent run #1: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #2: crashed: KASAN: slab-use-after-free Read in ext4_ext_insert_extent run #3: crashed: KASAN: use-after-free Read in ext4_ext_insert_extent run #4: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #5: crashed: KASAN: use-after-free Read in ext4_find_extent run #6: crashed: KASAN: use-after-free Read in ext4_ext_insert_extent run #7: crashed: KASAN: use-after-free Read in ext4_find_extent run #8: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #9: crashed: KASAN: slab-use-after-free Read in ext4_find_extent representative crash: KASAN: use-after-free Read in ext4_find_extent, types: [KASAN-USE-AFTER-FREE-READ] crash still not fixed/happens on the oldest tested release revisions tested: 8, total time: 2h21m32.751386726s (build: 1h19m29.617364737s, test: 53m17.446584388s) crash still not fixed or there were kernel test errors commit msg: Merge tag 'v6.18-rc2-smb-server-fixes' of git://git.samba.org/ksmbd crash: KASAN: use-after-free Read in ext4_find_extent ================================================================== BUG: KASAN: use-after-free in ext4_ext_binsearch fs/ext4/extents.c:841 [inline] BUG: KASAN: use-after-free in ext4_find_extent+0xad0/0xc50 fs/ext4/extents.c:956 Read of size 4 at addr ffff88812fb63018 by task syz.3.182/4951 CPU: 0 UID: 0 PID: 4951 Comm: syz.3.182 Not tainted syzkaller #0 PREEMPT(none) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Call Trace: dump_stack_lvl+0xf4/0x170 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 ext4_ext_binsearch fs/ext4/extents.c:841 [inline] ext4_find_extent+0xad0/0xc50 fs/ext4/extents.c:956 ext4_ext_map_blocks+0x214/0x5810 fs/ext4/extents.c:4208 ext4_map_query_blocks+0x10f/0x7c0 fs/ext4/inode.c:550 ext4_map_blocks+0x37e/0x12d0 fs/ext4/inode.c:773 _ext4_get_block+0x19f/0x3d0 fs/ext4/inode.c:910 ext4_get_block_unwritten+0x17/0xa0 fs/ext4/inode.c:943 ext4_block_write_begin+0x757/0xcc0 fs/ext4/inode.c:1198 ext4_write_begin+0x8f7/0x13f0 fs/ext4/inode.c:-1 ext4_da_write_begin+0x2d7/0xa00 fs/ext4/inode.c:3129 generic_perform_write+0x26f/0x630 mm/filemap.c:4242 ext4_buffered_write_iter+0x2c3/0x510 fs/ext4/file.c:299 ext4_file_write_iter+0x202/0x12a0 fs/ext4/file.c:-1 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x56b/0xc70 fs/read_write.c:686 ksys_pwrite64 fs/read_write.c:793 [inline] __do_sys_pwrite64 fs/read_write.c:801 [inline] __se_sys_pwrite64 fs/read_write.c:798 [inline] __x64_sys_pwrite64+0x139/0x1c0 fs/read_write.c:798 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x8f/0x250 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f504d47e969 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f504ceef038 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 RAX: ffffffffffffffda RBX: 00007f504d6a5fa0 RCX: 00007f504d47e969 RDX: 000000000000fdef RSI: 0000200000000140 RDI: 0000000000000004 RBP: 00007f504d500ab1 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000fecc R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f504d6a5fa0 R15: 00007ffce23fb898 The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12fb63 flags: 0x200000000000000(node=0|zone=2) raw: 0200000000000000 0000000000000000 00000000ffffffff 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1488, tgid 1488 (modprobe), ts 43586715133, free_ts 102469087585 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x168/0x1a0 mm/page_alloc.c:1850 prep_new_page mm/page_alloc.c:1858 [inline] get_page_from_freelist+0x29f0/0x2bb0 mm/page_alloc.c:3884 __alloc_frozen_pages_noprof+0x26b/0x460 mm/page_alloc.c:5183 alloc_pages_mpol+0xcb/0x270 mm/mempolicy.c:2416 alloc_slab_page mm/slub.c:3055 [inline] allocate_slab+0x96/0x2f0 mm/slub.c:3228 new_slab mm/slub.c:3282 [inline] ___slab_alloc+0xb41/0x1320 mm/slub.c:4651 __kmem_cache_alloc_bulk+0x198/0x3e0 mm/slub.c:7394 refill_sheaf mm/slub.c:2633 [inline] kmem_cache_prefill_sheaf+0x243/0x320 mm/slub.c:5411 mt_get_sheaf lib/maple_tree.c:187 [inline] mas_alloc_nodes+0x175/0x2a0 lib/maple_tree.c:1138 mas_preallocate+0x6a6/0xbe0 lib/maple_tree.c:5192 vma_iter_prealloc mm/vma.h:442 [inline] __mmap_new_vma mm/vma.c:2470 [inline] __mmap_region mm/vma.c:2670 [inline] mmap_region+0xe5c/0x1ba0 mm/vma.c:2740 do_mmap+0x930/0xc30 mm/mmap.c:558 vm_mmap_pgoff+0x1c0/0x370 mm/util.c:581 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x8f/0x250 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 4511 tgid 4511 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1394 [inline] __free_frozen_pages+0xa62/0xbd0 mm/page_alloc.c:2906 __slab_free+0x2be/0x350 mm/slub.c:5962 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:352 kasan_slab_alloc include/linux/kasan.h:252 [inline] slab_post_alloc_hook mm/slub.c:4970 [inline] slab_alloc_node mm/slub.c:5280 [inline] kmem_cache_alloc_noprof+0x315/0x620 mm/slub.c:5287 getname_flags+0x9b/0x490 fs/namei.c:146 getname include/linux/fs.h:2922 [inline] __do_sys_rename fs/namei.c:5411 [inline] __se_sys_rename fs/namei.c:5409 [inline] __x64_sys_rename+0x58/0x90 fs/namei.c:5409 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x8f/0x250 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff88812fb62f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88812fb62f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff88812fb63000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88812fb63080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88812fb63100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================