ci2 starts bisection 2023-07-06 10:33:08.186039143 +0000 UTC m=+70094.226489778 bisecting fixing commit since d2869ace6eeb8ea8a6e70e6904524c5a6456d3fb building syzkaller on a4ae4f428721da42ac15f07d6f3b54584dedee27 ensuring issue is reproducible on original commit d2869ace6eeb8ea8a6e70e6904524c5a6456d3fb testing commit d2869ace6eeb8ea8a6e70e6904524c5a6456d3fb gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: fdefef8a3a0902a28ebc207ec2e10a0c74aa3da751cd4e8c3230c08285d7e2f9 all runs: crashed: general protection fault in direct2indirect representative crash: general protection fault in direct2indirect, types: [UNKNOWN] check whether we can drop unnecessary instrumentation disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG KASAN], they are not needed testing commit d2869ace6eeb8ea8a6e70e6904524c5a6456d3fb gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 17ebb8f3e20828ef106244e597df2fbebe6d6dc696a228a829a6a9c0e6f4e830 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in direct2indirect representative crash: BUG: unable to handle kernel NULL pointer dereference in direct2indirect, types: [UNKNOWN] the bug reproduces without the instrumentation disabling configs for [BUG KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed testing current HEAD 61fd484b2cf6bc8022e8e5ea6f693a9991740ac2 testing commit 61fd484b2cf6bc8022e8e5ea6f693a9991740ac2 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 0dac373f3f6b5fefa7dc2b4084fa89e482871dc1b0fa5498eacc895289aca328 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in direct2indirect representative crash: BUG: unable to handle kernel NULL pointer dereference in direct2indirect, types: [UNKNOWN] crash still not fixed/happens on the oldest tested release revisions tested: 3, total time: 2h2m36.195227255s (build: 1h17m42.141495498s, test: 13m42.589334285s) crash still not fixed on HEAD or HEAD had kernel test errors commit msg: Linux 6.1.38 crash: BUG: unable to handle kernel NULL pointer dereference in direct2indirect REISERFS (device loop0): checking transaction log (loop0) REISERFS (device loop0): Using r5 hash to sort names REISERFS (device loop0): using 3.5.x disk format REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. REISERFS warning: reiserfs-5093 is_leaf: item entry count seems wrong *3.5*[2 1 0(1) DIR], item_len 35, item_location 4029, free_space(entry_count) 2 REISERFS error (device loop0): vs-5150 search_by_key: invalid format found in block 532. Fsck? REISERFS (device loop0): Remounting filesystem read-only BUG: kernel NULL pointer dereference, address: 0000000000000028 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 119d0c067 P4D 119d0c067 PUD 114bb9067 PMD 0 Oops: 0000 [#1] PREEMPT SMP CPU: 0 PID: 4082 Comm: syz-executor.0 Not tainted 6.1.38-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 RIP: 0010:reiserfs_node_data fs/reiserfs/reiserfs.h:2184 [inline] RIP: 0010:item_head fs/reiserfs/reiserfs.h:2200 [inline] RIP: 0010:tp_item_head fs/reiserfs/reiserfs.h:2226 [inline] RIP: 0010:direct2indirect+0x2ce/0x480 fs/reiserfs/tail_conversion.c:119 Code: ef 48 89 de 4c 89 f2 e8 b0 cf ff ff 83 f8 01 0f 84 99 01 00 00 49 63 06 48 c1 e0 04 48 8b 54 24 18 48 8b 0c 02 48 63 44 02 08 <48> 8b 51 28 48 8d 04 40 48 8d 4c c2 18 66 83 7c c2 2e 00 4c 8b 6c RSP: 0018:ffffc900039b7a20 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffffc900039b7a80 RCX: 0000000000000000 RDX: ffffc900039b7bc8 RSI: 00000000fffffffb RDI: ffff888112b76d20 RBP: ffff888117fd5000 R08: 0000000000000000 R09: ffffffff84f45100 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000001000 R14: ffffc900039b7bc0 R15: ffffc900039b7a80 FS: 00007fed8fc0b700(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000028 CR3: 000000011119e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: reiserfs_get_block+0x122c/0x1360 fs/reiserfs/inode.c:949 __block_write_begin_int+0x13b/0x670 fs/buffer.c:1991 reiserfs_write_begin+0x117/0x280 fs/reiserfs/inode.c:2775 generic_cont_expand_simple+0x55/0xa0 fs/buffer.c:2347 reiserfs_setattr+0x188/0x470 fs/reiserfs/inode.c:3305 notify_change+0x44a/0x480 fs/attr.c:482 do_truncate+0xdd/0x120 fs/open.c:65 do_sys_ftruncate+0xb1/0xf0 fs/open.c:193 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fed8ee8c169 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fed8fc0b168 EFLAGS: 00000246 ORIG_RAX: 000000000000004d RAX: ffffffffffffffda RBX: 00007fed8efabf80 RCX: 00007fed8ee8c169 RDX: 0000000000000000 RSI: 0000000000000f88 RDI: 0000000000000004 RBP: 00007fed8eee7ca1 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fffbad6240f R14: 00007fed8fc0b300 R15: 0000000000022000 Modules linked in: CR2: 0000000000000028 ---[ end trace 0000000000000000 ]--- RIP: 0010:reiserfs_node_data fs/reiserfs/reiserfs.h:2184 [inline] RIP: 0010:item_head fs/reiserfs/reiserfs.h:2200 [inline] RIP: 0010:tp_item_head fs/reiserfs/reiserfs.h:2226 [inline] RIP: 0010:direct2indirect+0x2ce/0x480 fs/reiserfs/tail_conversion.c:119 Code: ef 48 89 de 4c 89 f2 e8 b0 cf ff ff 83 f8 01 0f 84 99 01 00 00 49 63 06 48 c1 e0 04 48 8b 54 24 18 48 8b 0c 02 48 63 44 02 08 <48> 8b 51 28 48 8d 04 40 48 8d 4c c2 18 66 83 7c c2 2e 00 4c 8b 6c RSP: 0018:ffffc900039b7a20 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffffc900039b7a80 RCX: 0000000000000000 RDX: ffffc900039b7bc8 RSI: 00000000fffffffb RDI: ffff888112b76d20 RBP: ffff888117fd5000 R08: 0000000000000000 R09: ffffffff84f45100 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000001000 R14: ffffc900039b7bc0 R15: ffffc900039b7a80 FS: 00007fed8fc0b700(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000028 CR3: 000000011119e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: ef out %eax,(%dx) 1: 48 89 de mov %rbx,%rsi 4: 4c 89 f2 mov %r14,%rdx 7: e8 b0 cf ff ff callq 0xffffcfbc c: 83 f8 01 cmp $0x1,%eax f: 0f 84 99 01 00 00 je 0x1ae 15: 49 63 06 movslq (%r14),%rax 18: 48 c1 e0 04 shl $0x4,%rax 1c: 48 8b 54 24 18 mov 0x18(%rsp),%rdx 21: 48 8b 0c 02 mov (%rdx,%rax,1),%rcx 25: 48 63 44 02 08 movslq 0x8(%rdx,%rax,1),%rax * 2a: 48 8b 51 28 mov 0x28(%rcx),%rdx <-- trapping instruction 2e: 48 8d 04 40 lea (%rax,%rax,2),%rax 32: 48 8d 4c c2 18 lea 0x18(%rdx,%rax,8),%rcx 37: 66 83 7c c2 2e 00 cmpw $0x0,0x2e(%rdx,%rax,8) 3d: 4c rex.WR 3e: 8b .byte 0x8b 3f: 6c insb (%dx),%es:(%rdi)