ci2 starts bisection 2024-03-09 16:28:44.921968669 +0000 UTC m=+41815.925796291 bisecting fixing commit since 61cfd264993d07540f60a5c53d77a14c818e54a9 building syzkaller on cb976f63e0177b96eb9ce1c631cc5e2c4b4b0759 ensuring issue is reproducible on original commit 61cfd264993d07540f60a5c53d77a14c818e54a9 testing commit 61cfd264993d07540f60a5c53d77a14c818e54a9 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 59bff67473bc4d711cc15f0d99570a154e5ac8168535d5d3f70c577004bb4b42 run #0: crashed: KASAN: use-after-free Read in ext4_search_dir run #1: crashed: KASAN: use-after-free Read in ext4_search_dir run #2: crashed: KASAN: use-after-free Read in ext4_search_dir run #3: crashed: KASAN: use-after-free Read in ext4_search_dir run #4: crashed: KASAN: use-after-free Read in ext4_search_dir run #5: crashed: KASAN: use-after-free Read in ext4_search_dir run #6: crashed: KASAN: use-after-free Read in ext4_search_dir run #7: crashed: KASAN: slab-out-of-bounds Read in ext4_search_dir run #8: crashed: KASAN: use-after-free Read in ext4_search_dir run #9: crashed: KASAN: use-after-free Read in ext4_search_dir run #10: crashed: KASAN: use-after-free Read in ext4_search_dir run #11: crashed: KASAN: slab-out-of-bounds Read in ext4_search_dir run #12: crashed: KASAN: use-after-free Read in ext4_search_dir run #13: crashed: KASAN: use-after-free Read in ext4_search_dir run #14: crashed: KASAN: use-after-free Read in ext4_search_dir run #15: crashed: KASAN: use-after-free Read in ext4_search_dir run #16: crashed: KASAN: use-after-free Read in ext4_search_dir run #17: crashed: KASAN: slab-out-of-bounds Read in ext4_search_dir run #18: crashed: KASAN: use-after-free Read in ext4_search_dir run #19: crashed: KASAN: use-after-free Read in ext4_search_dir representative crash: KASAN: use-after-free Read in ext4_search_dir, types: [KASAN] check whether we can drop unnecessary instrumentation disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing commit 61cfd264993d07540f60a5c53d77a14c818e54a9 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: c76bb82b05ef39fc3637cb2faaa186bf5a4d390cf206e9fbea8dfb261f0cf0ef run #0: crashed: KASAN: use-after-free Read in ext4_search_dir run #1: crashed: KASAN: use-after-free Read in ext4_search_dir run #2: crashed: KASAN: use-after-free Read in ext4_search_dir run #3: crashed: KASAN: use-after-free Read in ext4_search_dir run #4: crashed: KASAN: use-after-free Read in ext4_search_dir run #5: crashed: KASAN: use-after-free Read in ext4_search_dir run #6: crashed: KASAN: slab-out-of-bounds Read in ext4_search_dir run #7: crashed: KASAN: use-after-free Read in ext4_search_dir run #8: crashed: KASAN: use-after-free Read in ext4_search_dir run #9: crashed: KASAN: use-after-free Read in ext4_search_dir representative crash: KASAN: use-after-free Read in ext4_search_dir, types: [KASAN] the bug reproduces without the instrumentation disabling configs for [BUG LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed kconfig minimization: base=4920 full=6161 leaves diff=241 split chunks (needed=false): <241> split chunk #0 of len 241 into 5 parts testing without sub-chunk 1/5 disabling configs for [UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing commit 61cfd264993d07540f60a5c53d77a14c818e54a9 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 8d4f0f13f204340ea6d55d6ca43877d174ac11e270459eed7d14819a61606832 run #0: crashed: KASAN: slab-out-of-bounds Read in ext4_search_dir run #1: crashed: KASAN: use-after-free Read in ext4_search_dir run #2: crashed: KASAN: use-after-free Read in ext4_search_dir run #3: crashed: KASAN: use-after-free Read in ext4_search_dir run #4: crashed: KASAN: slab-out-of-bounds Read in ext4_search_dir run #5: crashed: KASAN: use-after-free Read in ext4_search_dir run #6: crashed: KASAN: use-after-free Read in ext4_search_dir run #7: crashed: KASAN: slab-out-of-bounds Read in ext4_search_dir run #8: crashed: KASAN: use-after-free Read in ext4_search_dir run #9: crashed: KASAN: use-after-free Read in ext4_search_dir representative crash: KASAN: slab-out-of-bounds Read in ext4_search_dir, types: [KASAN] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing commit 61cfd264993d07540f60a5c53d77a14c818e54a9 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 4cc711d18d60e201ea7bdb2115d855a7f323a45010747c3a2efa4bb1b37ef03b run #0: crashed: KASAN: use-after-free Read in ext4_search_dir run #1: crashed: KASAN: use-after-free Read in ext4_search_dir run #2: crashed: KASAN: use-after-free Read in ext4_search_dir run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_search_dir run #4: crashed: KASAN: use-after-free Read in ext4_search_dir run #5: crashed: KASAN: use-after-free Read in ext4_search_dir run #6: crashed: KASAN: use-after-free Read in ext4_search_dir run #7: crashed: KASAN: use-after-free Read in ext4_search_dir run #8: crashed: KASAN: use-after-free Read in ext4_search_dir run #9: crashed: KASAN: use-after-free Read in ext4_search_dir representative crash: KASAN: use-after-free Read in ext4_search_dir, types: [KASAN] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing commit 61cfd264993d07540f60a5c53d77a14c818e54a9 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: b04d6f9f94ef2f994d192fdd177a73ac3f1e046e47bf761431e7fb6c7f2baf7a run #0: crashed: KASAN: use-after-free Read in ext4_search_dir run #1: crashed: KASAN: use-after-free Read in ext4_search_dir run #2: crashed: KASAN: slab-out-of-bounds Read in ext4_search_dir run #3: crashed: KASAN: use-after-free Read in ext4_search_dir run #4: crashed: KASAN: use-after-free Read in ext4_search_dir run #5: crashed: KASAN: use-after-free Read in ext4_search_dir run #6: crashed: KASAN: use-after-free Read in ext4_search_dir run #7: crashed: KASAN: use-after-free Read in ext4_search_dir run #8: crashed: KASAN: use-after-free Read in ext4_search_dir run #9: crashed: KASAN: slab-out-of-bounds Read in ext4_search_dir representative crash: KASAN: use-after-free Read in ext4_search_dir, types: [KASAN] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN BUG LOCKDEP], they are not needed testing commit 61cfd264993d07540f60a5c53d77a14c818e54a9 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: d8fe89da489563a22dce4add301329c3075d9166a18b9b53d1b84d25b9ddccbe run #0: crashed: KASAN: use-after-free Read in ext4_search_dir run #1: crashed: KASAN: use-after-free Read in ext4_search_dir run #2: crashed: KASAN: use-after-free Read in ext4_search_dir run #3: crashed: KASAN: use-after-free Read in ext4_search_dir run #4: crashed: KASAN: use-after-free Read in ext4_search_dir run #5: crashed: KASAN: use-after-free Read in ext4_search_dir run #6: crashed: KASAN: slab-out-of-bounds Read in ext4_search_dir run #7: crashed: KASAN: use-after-free Read in ext4_search_dir run #8: crashed: KASAN: use-after-free Read in ext4_search_dir run #9: crashed: KASAN: use-after-free Read in ext4_search_dir representative crash: KASAN: use-after-free Read in ext4_search_dir, types: [KASAN] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing commit 61cfd264993d07540f60a5c53d77a14c818e54a9 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 failed building 61cfd264993d07540f60a5c53d77a14c818e54a9: net/socket.c:1189: undefined reference to `wext_handle_ioctl' net/socket.c:3383: undefined reference to `compat_wext_handle_ioctl' net/core/net-procfs.c:343: undefined reference to `wext_proc_exit' net/core/net-procfs.c:327: undefined reference to `wext_proc_init' minimized to 45 configs; suspects: [HID_ZEROPLUS USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL USB_SERIAL_FTDI_SIO USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_ZYDAS X86_X32 ZEROPLUS_FF] disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing current HEAD 993bed180178156a70afdafe8aaf23a117107352 testing commit 993bed180178156a70afdafe8aaf23a117107352 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: b8a1cc7dd29d46b3b7b562ac41904966401c9fdc978c36cf9bc35ca0da740bd7 all runs: crashed: KASAN: use-after-free Read in ext4_search_dir representative crash: KASAN: use-after-free Read in ext4_search_dir, types: [KASAN] crash still not fixed/happens on the oldest tested release revisions tested: 7, total time: 36m56.438274476s (build: 15m27.936131498s, test: 19m40.967023009s) crash still not fixed or there were kernel test errors commit msg: Merge "Merge branch 'android13-5.15' into branch 'android13-5.15-lts'" into android13-5.15-lts crash: KASAN: use-after-free Read in ext4_search_dir ================================================================== BUG: KASAN: use-after-free in ext4_search_dir+0x18d/0x1c0 fs/ext4/namei.c:1543 Read of size 1 at addr ffff888106bd0d23 by task syz-executor.0/350 CPU: 0 PID: 350 Comm: syz-executor.0 Not tainted 5.15.148-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x38/0x49 lib/dump_stack.c:106 print_address_description.constprop.0+0x24/0x160 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:427 [inline] kasan_report.cold+0x82/0xdb mm/kasan/report.c:444 __asan_report_load1_noabort+0x14/0x20 mm/kasan/report_generic.c:306 ext4_search_dir+0x18d/0x1c0 fs/ext4/namei.c:1543 ext4_find_inline_entry+0x374/0x470 fs/ext4/inline.c:1714 __ext4_find_entry+0x8cd/0xdf0 fs/ext4/namei.c:1616 ext4_lookup_entry fs/ext4/namei.c:1771 [inline] ext4_lookup fs/ext4/namei.c:1839 [inline] ext4_lookup+0x153/0x6b0 fs/ext4/namei.c:1830 lookup_one_qstr_excl+0xe5/0x150 fs/namei.c:1563 filename_create+0x1a5/0x3e0 fs/namei.c:3842 do_mkdirat+0x9c/0x2c0 fs/namei.c:4086 __do_sys_mkdirat fs/namei.c:4111 [inline] __se_sys_mkdirat fs/namei.c:4109 [inline] __x64_sys_mkdirat+0xf4/0x140 fs/namei.c:4109 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f9090292ae9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f908fe150c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 00007f90903b1f80 RCX: 00007f9090292ae9 RDX: 0000000000000000 RSI: 0000000020000040 RDI: ffffffffffffff9c RBP: 00007f90902de47a R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007f90903b1f80 R15: 00007ffc58656448 Allocated by task 1: kasan_save_stack+0x26/0x50 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:433 [inline] ____kasan_kmalloc mm/kasan/common.c:512 [inline] ____kasan_kmalloc mm/kasan/common.c:471 [inline] __kasan_kmalloc+0xae/0xe0 mm/kasan/common.c:521 kasan_kmalloc include/linux/kasan.h:227 [inline] __kmalloc+0x2d5/0x4e0 mm/slub.c:4427 kmalloc include/linux/slab.h:608 [inline] kzalloc include/linux/slab.h:733 [inline] acpi_os_allocate_zeroed include/acpi/platform/aclinuxex.h:57 [inline] acpi_ns_internalize_name.part.0+0xad/0x150 drivers/acpi/acpica/nsutils.c:331 acpi_ns_internalize_name drivers/acpi/acpica/nsutils.c:659 [inline] acpi_ns_get_node_unlocked drivers/acpi/acpica/nsutils.c:666 [inline] acpi_ns_get_node_unlocked+0x112/0x2f0 drivers/acpi/acpica/nsutils.c:635 acpi_ns_get_node+0x3b/0x60 drivers/acpi/acpica/nsutils.c:726 acpi_get_handle+0xdc/0x230 drivers/acpi/acpica/nsxfname.c:98 acpi_has_method+0x5b/0x90 drivers/acpi/utils.c:553 acpi_is_video_device+0x71/0x150 drivers/acpi/scan.c:1222 acpi_set_pnp_ids drivers/acpi/scan.c:1361 [inline] acpi_init_device_object+0xc16/0x1710 drivers/acpi/scan.c:1755 acpi_add_single_object+0xdb/0x17b0 drivers/acpi/scan.c:1801 acpi_bus_check_add+0x176/0x470 drivers/acpi/scan.c:2060 acpi_bus_check_add_1+0x11/0x20 drivers/acpi/scan.c:2076 acpi_ns_walk_namespace+0x1c6/0x4c0 drivers/acpi/acpica/nswalk.c:233 acpi_walk_namespace drivers/acpi/acpica/nsxfeval.c:606 [inline] acpi_walk_namespace+0xc1/0xe0 drivers/acpi/acpica/nsxfeval.c:554 acpi_bus_scan+0x11a/0x160 drivers/acpi/scan.c:2373 acpi_scan_init+0x291/0x68d drivers/acpi/scan.c:2555 acpi_init+0x6fc/0x78b drivers/acpi/bus.c:1346 do_one_initcall+0x92/0x2d0 init/main.c:1299 do_initcall_level init/main.c:1372 [inline] do_initcalls init/main.c:1388 [inline] do_basic_setup init/main.c:1407 [inline] kernel_init_freeable+0x47c/0x4d7 init/main.c:1612 kernel_init+0x19/0x120 init/main.c:1503 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 The buggy address belongs to the object at ffff888106bd0d20 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 3 bytes inside of 8-byte region [ffff888106bd0d20, ffff888106bd0d28) The buggy address belongs to the page: page:ffffea00041af400 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888106bd0a50 pfn:0x106bd0 flags: 0x4000000000000200(slab|zone=1) raw: 4000000000000200 ffffea00041af8c8 ffffea00041aefc8 ffff888100042300 raw: ffff888106bd0a50 0000000000660006 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 1324629120, free_ts 1309061013 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook mm/page_alloc.c:2604 [inline] prep_new_page+0x1a2/0x310 mm/page_alloc.c:2610 get_page_from_freelist+0x1ce2/0x30a0 mm/page_alloc.c:4484 __alloc_pages+0x2d1/0x2620 mm/page_alloc.c:5776 __alloc_pages_node include/linux/gfp.h:591 [inline] alloc_pages_node include/linux/gfp.h:605 [inline] alloc_pages include/linux/gfp.h:618 [inline] alloc_slab_page mm/slub.c:1793 [inline] allocate_slab+0x39d/0x530 mm/slub.c:1932 new_slab mm/slub.c:1995 [inline] ___slab_alloc.constprop.0+0x3ca/0x890 mm/slub.c:3028 __slab_alloc.constprop.0+0x42/0x80 mm/slub.c:3115 slab_alloc_node mm/slub.c:3206 [inline] slab_alloc mm/slub.c:3248 [inline] __kmalloc+0x49f/0x4e0 mm/slub.c:4423 kmalloc include/linux/slab.h:608 [inline] kzalloc include/linux/slab.h:733 [inline] acpi_os_allocate_zeroed include/acpi/platform/aclinuxex.h:57 [inline] acpi_ns_internalize_name.part.0+0xad/0x150 drivers/acpi/acpica/nsutils.c:331 acpi_ns_internalize_name drivers/acpi/acpica/nsutils.c:659 [inline] acpi_ns_get_node_unlocked drivers/acpi/acpica/nsutils.c:666 [inline] acpi_ns_get_node_unlocked+0x112/0x2f0 drivers/acpi/acpica/nsutils.c:635 acpi_ns_get_node+0x3b/0x60 drivers/acpi/acpica/nsutils.c:726 acpi_ns_evaluate+0x6fb/0xb80 drivers/acpi/acpica/nseval.c:62 acpi_ut_evaluate_object+0xbd/0x430 drivers/acpi/acpica/uteval.c:60 acpi_ut_evaluate_numeric_object+0x7b/0x110 drivers/acpi/acpica/uteval.c:182 acpi_get_object_info+0xa29/0xe50 drivers/acpi/acpica/nsxfname.c:348 acpi_set_pnp_ids drivers/acpi/scan.c:1330 [inline] acpi_init_device_object+0x99b/0x1710 drivers/acpi/scan.c:1755 acpi_add_single_object+0xdb/0x17b0 drivers/acpi/scan.c:1801 page last free stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] free_pages_prepare mm/page_alloc.c:1471 [inline] free_pcp_prepare+0x1b6/0x4c0 mm/page_alloc.c:1543 free_unref_page_prepare mm/page_alloc.c:3533 [inline] free_unref_page+0x84/0x760 mm/page_alloc.c:3615 free_the_page mm/page_alloc.c:804 [inline] __free_pages+0xd7/0xf0 mm/page_alloc.c:5852 __free_slab+0xdb/0x1c0 mm/slub.c:2020 free_slab mm/slub.c:2035 [inline] discard_slab+0x2b/0x40 mm/slub.c:2041 __unfreeze_partials+0x1e2/0x230 mm/slub.c:2527 unfreeze_partials mm/slub.c:2546 [inline] flush_cpu_slab+0xb1/0xc0 mm/slub.c:2686 process_one_work+0x62c/0xec0 kernel/workqueue.c:2325 process_scheduled_works kernel/workqueue.c:2388 [inline] worker_thread+0x5b1/0xdb0 kernel/workqueue.c:2477 kthread+0x324/0x3e0 kernel/kthread.c:337 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 Memory state around the buggy address: ffff888106bd0c00: fc fb fc fc fc fc fb fc fc fc fc fb fc fc fc fc ffff888106bd0c80: fb fc fc fc fc fb fc fc fc fc fb fc fc fc fc fb >ffff888106bd0d00: fc fc fc fc fb fc fc fc fc fb fc fc fc fc fb fc ^ ffff888106bd0d80: fc fc fc fb fc fc fc fc fb fc fc fc fc fb fc fc ffff888106bd0e00: fc fc fb fc fc fc fc fb fc fc fc fc fb fc fc fc ================================================================== EXT4-fs error (device loop0): ext4_find_dest_de:2111: inode #12: block 7: comm syz-executor.0: bad entry in directory: rec_len % 4 != 0 - offset=0, inode=3089191003, rec_len=43069, size=56 fake=0