ci2 starts bisection 2024-08-08 08:54:27.60046434 +0000 UTC m=+28227.277719575 bisecting fixing commit since ca87e77a2ef8b298aa9f69658d5898e72ee450fe building syzkaller on f3921d4d63f97d1f1fb49a69ea85744bb7ef184b ensuring issue is reproducible on original commit ca87e77a2ef8b298aa9f69658d5898e72ee450fe testing commit ca87e77a2ef8b298aa9f69658d5898e72ee450fe gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 8605caab10e40b3b6bd4948c5aab3c979e2904604f229e84effb964aa3927455 run #0: crashed: KASAN: use-after-free Read in ext4_search_dir run #1: crashed: KASAN: use-after-free Read in ext4_search_dir run #2: crashed: KASAN: use-after-free Read in ext4_search_dir run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_search_dir run #4: crashed: KASAN: use-after-free Read in ext4_search_dir run #5: crashed: KASAN: out-of-bounds Read in ext4_search_dir run #6: crashed: KASAN: use-after-free Read in ext4_search_dir run #7: crashed: KASAN: use-after-free Read in ext4_search_dir run #8: crashed: KASAN: use-after-free Read in ext4_search_dir run #9: crashed: KASAN: use-after-free Read in ext4_search_dir run #10: crashed: KASAN: use-after-free Read in ext4_search_dir run #11: crashed: KASAN: use-after-free Read in ext4_search_dir run #12: crashed: KASAN: use-after-free Read in ext4_search_dir run #13: crashed: KASAN: use-after-free Read in ext4_search_dir run #14: crashed: KASAN: use-after-free Read in ext4_search_dir run #15: crashed: KASAN: use-after-free Read in ext4_search_dir run #16: crashed: KASAN: use-after-free Read in ext4_search_dir run #17: crashed: KASAN: use-after-free Read in ext4_search_dir run #18: crashed: KASAN: use-after-free Read in ext4_search_dir run #19: crashed: KASAN: use-after-free Read in ext4_search_dir representative crash: KASAN: use-after-free Read in ext4_search_dir, types: [KASAN] check whether we can drop unnecessary instrumentation disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing commit ca87e77a2ef8b298aa9f69658d5898e72ee450fe gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: d00097499751d0956e69815d78a3834552034d281efdddc0f92d5841719c1ca6 run #0: crashed: KASAN: out-of-bounds Read in ext4_search_dir run #1: crashed: KASAN: use-after-free Read in ext4_search_dir run #2: crashed: KASAN: use-after-free Read in ext4_search_dir run #3: crashed: KASAN: use-after-free Read in ext4_search_dir run #4: crashed: KASAN: use-after-free Read in ext4_search_dir run #5: crashed: KASAN: use-after-free Read in ext4_search_dir run #6: crashed: KASAN: use-after-free Read in ext4_search_dir run #7: crashed: KASAN: use-after-free Read in ext4_search_dir run #8: crashed: KASAN: use-after-free Read in ext4_search_dir run #9: crashed: KASAN: use-after-free Read in ext4_search_dir representative crash: KASAN: out-of-bounds Read in ext4_search_dir, types: [KASAN] the bug reproduces without the instrumentation disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed kconfig minimization: base=3822 full=7523 leaves diff=1994 split chunks (needed=false): <1994> split chunk #0 of len 1994 into 5 parts testing without sub-chunk 1/5 disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing commit ca87e77a2ef8b298aa9f69658d5898e72ee450fe gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: a6118a1bc36c49f57ee2db76564603df29770be99e215f1e89b8d648bd4747cf run #0: crashed: KASAN: slab-out-of-bounds Read in ext4_search_dir run #1: crashed: KASAN: use-after-free Read in ext4_search_dir run #2: crashed: KASAN: use-after-free Read in ext4_search_dir run #3: crashed: KASAN: out-of-bounds Read in ext4_search_dir run #4: crashed: KASAN: use-after-free Read in ext4_search_dir run #5: crashed: KASAN: use-after-free Read in ext4_search_dir run #6: crashed: KASAN: use-after-free Read in ext4_search_dir run #7: crashed: KASAN: use-after-free Read in ext4_search_dir run #8: crashed: KASAN: use-after-free Read in ext4_search_dir run #9: crashed: KASAN: use-after-free Read in ext4_search_dir representative crash: KASAN: slab-out-of-bounds Read in ext4_search_dir, types: [KASAN] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing commit ca87e77a2ef8b298aa9f69658d5898e72ee450fe gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 36ce877245c24a8975a362e51ce6e150c592e8f6191d0f077ebf272a73e6a08d all runs: crashed: KASAN: use-after-free Read in ext4_search_dir representative crash: KASAN: use-after-free Read in ext4_search_dir, types: [KASAN] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing commit ca87e77a2ef8b298aa9f69658d5898e72ee450fe gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 20085b6124008e257a41d912768d84d57568812f49b54fc15e55c31b0e12da3b all runs: crashed: KASAN: use-after-free Read in ext4_search_dir representative crash: KASAN: use-after-free Read in ext4_search_dir, types: [KASAN] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [BUG LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed testing commit ca87e77a2ef8b298aa9f69658d5898e72ee450fe gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 5ca8e2a088062dd87e74ab8793aea375758aff9b95acb80c15d6c57731de22d3 run #0: crashed: KASAN: use-after-free Read in ext4_search_dir run #1: crashed: KASAN: use-after-free Read in ext4_search_dir run #2: crashed: KASAN: slab-out-of-bounds Read in ext4_search_dir run #3: crashed: KASAN: use-after-free Read in ext4_search_dir run #4: crashed: KASAN: use-after-free Read in ext4_search_dir run #5: crashed: KASAN: use-after-free Read in ext4_search_dir run #6: crashed: KASAN: use-after-free Read in ext4_search_dir run #7: crashed: KASAN: use-after-free Read in ext4_search_dir run #8: crashed: KASAN: use-after-free Read in ext4_search_dir run #9: crashed: KASAN: use-after-free Read in ext4_search_dir representative crash: KASAN: use-after-free Read in ext4_search_dir, types: [KASAN] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed testing commit ca87e77a2ef8b298aa9f69658d5898e72ee450fe gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: e490b70c83bcf6ef53a7d69a9bba1459212a814e7bc2dede05a0e0045b0a3e82 run #0: crashed: KASAN: use-after-free Read in ext4_search_dir run #1: crashed: KASAN: use-after-free Read in ext4_search_dir run #2: crashed: KASAN: use-after-free Read in ext4_search_dir run #3: crashed: KASAN: use-after-free Read in ext4_search_dir run #4: crashed: KASAN: use-after-free Read in ext4_search_dir run #5: crashed: KASAN: use-after-free Read in ext4_search_dir run #6: crashed: KASAN: out-of-bounds Read in ext4_search_dir run #7: crashed: KASAN: use-after-free Read in ext4_search_dir run #8: crashed: KASAN: use-after-free Read in ext4_search_dir run #9: crashed: KASAN: use-after-free Read in ext4_search_dir representative crash: KASAN: use-after-free Read in ext4_search_dir, types: [KASAN] the chunk can be dropped disabling configs for [UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing current HEAD 48d525b0e4634c487cf46a41c1e2824e9ee258ce testing commit 48d525b0e4634c487cf46a41c1e2824e9ee258ce gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 9e72944ecc64e2df49e01b49250f3dd07757caec93a010d350e55257a988b5e3 run #0: crashed: KASAN: slab-out-of-bounds Read in ext4_search_dir run #1: crashed: KASAN: use-after-free Read in ext4_search_dir run #2: crashed: KASAN: use-after-free Read in ext4_search_dir run #3: crashed: KASAN: use-after-free Read in ext4_search_dir run #4: crashed: KASAN: use-after-free Read in ext4_search_dir run #5: crashed: KASAN: use-after-free Read in ext4_search_dir run #6: crashed: KASAN: use-after-free Read in ext4_search_dir run #7: crashed: KASAN: use-after-free Read in ext4_search_dir run #8: crashed: KASAN: slab-out-of-bounds Read in ext4_search_dir run #9: crashed: KASAN: use-after-free Read in ext4_search_dir representative crash: KASAN: slab-out-of-bounds Read in ext4_search_dir, types: [KASAN] crash still not fixed/happens on the oldest tested release revisions tested: 8, total time: 1h7m12.29192415s (build: 40m6.814713468s, test: 24m20.884636054s) crash still not fixed or there were kernel test errors commit msg: Linux 6.1.103 crash: KASAN: slab-out-of-bounds Read in ext4_search_dir EXT4-fs: Ignoring removed bh option EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem EXT4-fs (loop0): 1 truncate cleaned up EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. ================================================================== BUG: KASAN: slab-out-of-bounds in ext4_search_dir+0x148/0x250 fs/ext4/namei.c:1544 Read of size 1 at addr ffff8881140ef3ed by task syz-executor.0/1410 CPU: 0 PID: 1410 Comm: syz-executor.0 Not tainted 6.1.103-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xf4/0x251 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x15f/0x4f0 mm/kasan/report.c:395 kasan_report+0x136/0x160 mm/kasan/report.c:495 ext4_search_dir+0x148/0x250 fs/ext4/namei.c:1544 ext4_find_inline_entry+0x367/0x540 fs/ext4/inline.c:1722 __ext4_find_entry+0x2dc/0x1a10 fs/ext4/namei.c:1617 ext4_lookup_entry fs/ext4/namei.c:1772 [inline] ext4_lookup+0x1ab/0x5f0 fs/ext4/namei.c:1840 lookup_open fs/namei.c:3462 [inline] open_last_lookups fs/namei.c:3552 [inline] path_openat+0xdb6/0x2410 fs/namei.c:3782 do_filp_open+0x226/0x430 fs/namei.c:3812 do_sys_openat2+0x10b/0x3f0 fs/open.c:1318 do_sys_open fs/open.c:1334 [inline] __do_sys_open fs/open.c:1342 [inline] __se_sys_open fs/open.c:1338 [inline] __x64_sys_open+0x1eb/0x240 fs/open.c:1338 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3b/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fd4f32b6b29 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd4f2e390c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 RAX: ffffffffffffffda RBX: 00007fd4f33d5f80 RCX: 00007fd4f32b6b29 RDX: 0000000000000000 RSI: 0000000000141042 RDI: 0000000020000100 RBP: 00007fd4f330247a R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000016 R14: 00007fd4f33d5f80 R15: 00007ffc542d1ca8 Allocated by task 1327: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:52 __kasan_slab_alloc+0x65/0x70 mm/kasan/common.c:328 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook+0x54/0x3e0 mm/slab.h:737 slab_alloc_node mm/slub.c:3398 [inline] slab_alloc mm/slub.c:3406 [inline] __kmem_cache_alloc_lru mm/slub.c:3413 [inline] kmem_cache_alloc+0x10c/0x290 mm/slub.c:3422 vm_area_dup+0x1b/0x90 kernel/fork.c:466 __split_vma+0x95/0x4a0 mm/mmap.c:2352 do_mas_align_munmap+0x3fe/0x11e0 mm/mmap.c:2470 do_mas_munmap+0x195/0x1f0 mm/mmap.c:2640 mmap_region+0x708/0x1780 mm/mmap.c:2688 do_mmap+0x69e/0xb60 mm/mmap.c:1425 vm_mmap_pgoff+0x1b7/0x280 mm/util.c:520 ksys_mmap_pgoff+0x2cf/0x3b0 mm/mmap.c:1471 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3b/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Freed by task 1327: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:52 kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:516 ____kasan_slab_free+0x122/0x1e0 mm/kasan/common.c:236 kasan_slab_free include/linux/kasan.h:177 [inline] slab_free_hook mm/slub.c:1724 [inline] slab_free_freelist_hook mm/slub.c:1750 [inline] slab_free mm/slub.c:3661 [inline] kmem_cache_free+0x2e8/0x510 mm/slub.c:3683 remove_vma mm/mmap.c:144 [inline] remove_mt mm/mmap.c:2308 [inline] do_mas_align_munmap+0xbb6/0x11e0 mm/mmap.c:2585 do_mas_munmap+0x195/0x1f0 mm/mmap.c:2640 mmap_region+0x708/0x1780 mm/mmap.c:2688 do_mmap+0x69e/0xb60 mm/mmap.c:1425 vm_mmap_pgoff+0x1b7/0x280 mm/util.c:520 ksys_mmap_pgoff+0x2cf/0x3b0 mm/mmap.c:1471 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3b/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 The buggy address belongs to the object at ffff8881140ef340 which belongs to the cache vm_area_struct of size 144 The buggy address is located 29 bytes to the right of 144-byte region [ffff8881140ef340, ffff8881140ef3d0) The buggy address belongs to the physical page: page:ffffea0004503bc0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1140ef flags: 0x200000000000200(slab|node=0|zone=2) raw: 0200000000000200 ffffea000420e580 dead000000000006 ffff888100163b40 raw: 0000000000000000 0000000000130013 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 495, tgid 495 (modprobe), ts 30764894116, free_ts 30761269502 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x286/0x2b0 mm/page_alloc.c:2517 prep_new_page mm/page_alloc.c:2524 [inline] get_page_from_freelist+0x2ba7/0x2de0 mm/page_alloc.c:4283 __alloc_pages+0x251/0x640 mm/page_alloc.c:5551 alloc_slab_page+0x6a/0x150 mm/slub.c:1794 allocate_slab mm/slub.c:1939 [inline] new_slab+0x70/0x250 mm/slub.c:1992 ___slab_alloc+0x9df/0xe70 mm/slub.c:3180 __slab_alloc mm/slub.c:3279 [inline] slab_alloc_node mm/slub.c:3364 [inline] slab_alloc mm/slub.c:3406 [inline] __kmem_cache_alloc_lru mm/slub.c:3413 [inline] kmem_cache_alloc+0x18b/0x290 mm/slub.c:3422 vm_area_dup+0x1b/0x90 kernel/fork.c:466 __split_vma+0x95/0x4a0 mm/mmap.c:2352 do_mas_align_munmap+0xd67/0x11e0 mm/mmap.c:2491 do_mas_munmap+0x195/0x1f0 mm/mmap.c:2640 mmap_region+0x708/0x1780 mm/mmap.c:2688 do_mmap+0x69e/0xb60 mm/mmap.c:1425 vm_mmap_pgoff+0x1b7/0x280 mm/util.c:520 ksys_mmap_pgoff+0x2cf/0x3b0 mm/mmap.c:1471 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3b/0x80 arch/x86/entry/common.c:81 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1444 [inline] free_pcp_prepare mm/page_alloc.c:1494 [inline] free_unref_page_prepare+0xccc/0xdb0 mm/page_alloc.c:3362 free_unref_page_list+0xaa/0x690 mm/page_alloc.c:3503 release_pages+0x1a9e/0x1c60 mm/swap.c:1055 tlb_batch_pages_flush mm/mmu_gather.c:59 [inline] tlb_flush_mmu_free mm/mmu_gather.c:254 [inline] tlb_flush_mmu+0x26f/0x3d0 mm/mmu_gather.c:261 tlb_finish_mmu+0xb0/0x1b0 mm/mmu_gather.c:361 exit_mmap+0x311/0x700 mm/mmap.c:3239 __mmput+0x61/0x290 kernel/fork.c:1199 exit_mm+0x122/0x1b0 kernel/exit.c:565 do_exit+0x81e/0x23a0 kernel/exit.c:858 do_group_exit+0x1b5/0x280 kernel/exit.c:1021 __do_sys_exit_group kernel/exit.c:1032 [inline] __se_sys_exit_group kernel/exit.c:1030 [inline] __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1030 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3b/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Memory state around the buggy address: ffff8881140ef280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881140ef300: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb >ffff8881140ef380: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc ^ ffff8881140ef400: fc fc fa fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881140ef480: fb fb fb fb fc fc fc fc fc fc fc fc fa fb fb fb ==================================================================