ci2 starts bisection 2023-06-01 08:00:37.372829467 +0000 UTC m=+44063.488954100
bisecting fixing commit since 7364b7abbafbeaab61d763c46d84145488b98a3c
building syzkaller on f325deb023e4e2fb9197004be1b3da738680429c
ensuring issue is reproducible on original commit 7364b7abbafbeaab61d763c46d84145488b98a3c
testing commit 7364b7abbafbeaab61d763c46d84145488b98a3c gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: d3dc5b0048184d7a6a830044f68d1e7c9e25aa7bd5e2319342f978c6b5a9271c
run #0: crashed: KASAN: use-after-free Read in ext4_find_extent
run #1: crashed: KASAN: use-after-free Read in ext4_find_extent
run #2: crashed: kernel BUG in ext4_writepages
run #3: crashed: KASAN: use-after-free Read in ext4_find_extent
run #4: crashed: KASAN: use-after-free Read in ext4_find_extent
run #5: crashed: kernel BUG in ext4_writepages
run #6: crashed: KASAN: use-after-free Read in ext4_find_extent
run #7: crashed: KASAN: use-after-free Read in ext4_find_extent
run #8: crashed: kernel BUG in ext4_writepages
run #9: crashed: kernel BUG in ext4_writepages
run #10: crashed: KASAN: use-after-free Read in ext4_find_extent
run #11: crashed: KASAN: use-after-free Read in ext4_find_extent
run #12: crashed: KASAN: use-after-free Read in ext4_find_extent
run #13: crashed: KASAN: use-after-free Read in ext4_find_extent
run #14: crashed: KASAN: use-after-free Read in ext4_find_extent
run #15: crashed: KASAN: use-after-free Read in ext4_find_extent
run #16: crashed: KASAN: use-after-free Read in ext4_find_extent
run #17: crashed: KASAN: use-after-free Read in ext4_find_extent
run #18: crashed: KASAN: use-after-free Read in ext4_find_extent
run #19: crashed: KASAN: use-after-free Read in ext4_find_extent
testing current HEAD 19c0ed55a470d1cd766484abab04871b648560fb
testing commit 19c0ed55a470d1cd766484abab04871b648560fb gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 63193140536e13e37f715953badbd52e8cb14a0a7f4408a6e147c3d597012120
run #0: crashed: KASAN: use-after-free Read in ext4_find_extent
run #1: crashed: kernel BUG in ext4_writepages
run #2: crashed: KASAN: use-after-free Read in ext4_find_extent
run #3: crashed: KASAN: use-after-free Read in ext4_find_extent
run #4: crashed: KASAN: use-after-free Read in ext4_find_extent
run #5: crashed: KASAN: use-after-free Read in ext4_find_extent
run #6: crashed: KASAN: use-after-free Read in ext4_find_extent
run #7: crashed: kernel BUG in ext4_writepages
run #8: crashed: kernel BUG in ext4_writepages
run #9: crashed: KASAN: use-after-free Read in ext4_find_extent
crash still not fixed/happens on the oldest tested release
revisions tested: 2, total time: 16m18.241482046s (build: 10m10.868338796s, test: 5m38.433702147s)
crash still not fixed on HEAD or HEAD had kernel test errors
commit msg: Merge 5.15.106 into android13-5.15-lts
crash: KASAN: use-after-free Read in ext4_find_extent
EXT4-fs error (device loop0): __ext4_get_inode_loc:4346: comm kworker/u4:0: Invalid inode table block 0 in block_group 0
==================================================================
BUG: KASAN: use-after-free in ext4_ext_binsearch fs/ext4/extents.c:827 [inline]
BUG: KASAN: use-after-free in ext4_find_extent+0xb41/0xc00 fs/ext4/extents.c:946
Read of size 4 at addr ffff88811e550058 by task kworker/u4:0/8
CPU: 1 PID: 8 Comm: kworker/u4:0 Not tainted 5.15.106-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
Workqueue: writeback wb_workfn (flush-7:0)
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x38/0x49 lib/dump_stack.c:106
print_address_description.constprop.0+0x24/0x160 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:427 [inline]
kasan_report.cold+0x82/0xdb mm/kasan/report.c:444
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
ext4_ext_binsearch fs/ext4/extents.c:827 [inline]
ext4_find_extent+0xb41/0xc00 fs/ext4/extents.c:946
ext4_ext_map_blocks+0x18f/0x51a0 fs/ext4/extents.c:4103
ext4_map_blocks+0x599/0x14c0 fs/ext4/inode.c:646
mpage_map_one_extent fs/ext4/inode.c:2419 [inline]
mpage_map_and_submit_extent fs/ext4/inode.c:2472 [inline]
ext4_writepages+0x1395/0x2b00 fs/ext4/inode.c:2840
do_writepages+0x18c/0x770 mm/page-writeback.c:2366
__writeback_single_inode+0x9d/0x760 fs/fs-writeback.c:1622
writeback_sb_inodes+0x4ab/0xe20 fs/fs-writeback.c:1905
wb_writeback+0x20c/0x6b0 fs/fs-writeback.c:2079
wb_do_writeback fs/fs-writeback.c:2222 [inline]
wb_workfn+0x247/0xe20 fs/fs-writeback.c:2263
process_one_work+0x66c/0xff0 kernel/workqueue.c:2313
worker_thread+0x55b/0xf30 kernel/workqueue.c:2460
kthread+0x35d/0x430 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
The buggy address belongs to the page:
page:ffffea0004795400 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x11e550
flags: 0x4000000000000000(zone=1)
raw: 4000000000000000 ffffea0004795448 ffffea00047953c8 0000000000000000
raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Movable, gfp_mask 0x100dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO), pid 310, ts 31525861003, free_ts 31720430025
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x13a/0x160 mm/page_alloc.c:2502
prep_new_page mm/page_alloc.c:2508 [inline]
get_page_from_freelist+0x1773/0x2890 mm/page_alloc.c:4291
__alloc_pages+0x272/0x580 mm/page_alloc.c:5569
__alloc_pages_node include/linux/gfp.h:591 [inline]
alloc_pages_node include/linux/gfp.h:605 [inline]
alloc_pages include/linux/gfp.h:618 [inline]
do_anonymous_page mm/memory.c:3974 [inline]
handle_pte_fault+0xacc/0x2180 mm/memory.c:4809
__handle_mm_fault+0x4aa/0x1380 mm/memory.c:4963
do_handle_mm_fault+0x4ab/0x730 mm/memory.c:5214
do_user_addr_fault+0x73d/0x1160 arch/x86/mm/fault.c:1365
handle_page_fault arch/x86/mm/fault.c:1549 [inline]
exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1605
asm_exc_page_fault+0x27/0x30 arch/x86/include/asm/idtentry.h:568
page last free stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
free_pages_prepare mm/page_alloc.c:1370 [inline]
free_pcp_prepare+0x1e3/0x4d0 mm/page_alloc.c:1442
free_unref_page_prepare mm/page_alloc.c:3441 [inline]
free_unref_page_list+0x1db/0xaf0 mm/page_alloc.c:3562
release_pages+0x389/0x1000 mm/swap.c:1009
free_pages_and_swap_cache+0x5d/0x80 mm/swap_state.c:320
tlb_batch_pages_flush mm/mmu_gather.c:49 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:240 [inline]
tlb_flush_mmu+0xbe/0x590 mm/mmu_gather.c:247
zap_pte_range mm/memory.c:1504 [inline]
zap_pmd_range mm/memory.c:1553 [inline]
zap_pud_range mm/memory.c:1582 [inline]
zap_p4d_range mm/memory.c:1603 [inline]
unmap_page_range+0x109c/0x1b10 mm/memory.c:1624
unmap_single_vma mm/memory.c:1669 [inline]
unmap_vmas+0x1dc/0x3a0 mm/memory.c:1701
exit_mmap+0x203/0x710 mm/mmap.c:3209
__mmput+0x70/0x3a0 kernel/fork.c:1171
mmput kernel/fork.c:1194 [inline]
mmput+0x35/0xf0 kernel/fork.c:1188
exit_mm kernel/exit.c:551 [inline]
do_exit+0x87d/0x2410 kernel/exit.c:862
do_group_exit+0xe6/0x290 kernel/exit.c:997
__do_sys_exit_group kernel/exit.c:1008 [inline]
__se_sys_exit_group kernel/exit.c:1006 [inline]
__x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1006
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
Memory state around the buggy address:
ffff88811e54ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88811e54ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88811e550000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff88811e550080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88811e550100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
EXT4-fs error (device loop0): ext4_map_blocks:726: inode #19: block 109261625582962: comm kworker/u4:0: lblock 0 mapped to illegal pblock 109261625582962 (length 16)
EXT4-fs (loop0): Delayed block allocation failed for inode 19 at logical offset 0 with max blocks 16 with error 117
EXT4-fs (loop0): This should not happen!! Data will be lost
EXT4-fs error (device loop0): __ext4_get_inode_loc:4346: comm kworker/u4:0: Invalid inode table block 0 in block_group 0
EXT4-fs error (device loop0): __ext4_get_inode_loc:4346: comm kworker/u4:0: Invalid inode table block 0 in block_group 0
------------[ cut here ]------------
kernel BUG at fs/ext4/inode.c:2431!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 8 Comm: kworker/u4:0 Tainted: G B 5.15.106-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
Workqueue: writeback wb_workfn (flush-7:0)
RIP: 0010:mpage_map_one_extent fs/ext4/inode.c:2431 [inline]
RIP: 0010:mpage_map_and_submit_extent fs/ext4/inode.c:2472 [inline]
RIP: 0010:ext4_writepages+0x2004/0x2b00 fs/ext4/inode.c:2840
Code: ff 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 84 2b ee ff ff 48 8b bd f0 fd ff ff e8 21 85 d0 ff e9 1a ee ff ff <0f> 0b 8b 85 20 fd ff ff 31 db 89 85 d0 fd ff ff e9 7e fc ff ff 49
RSP: 0018:ffffc90000087440 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000
RDX: 0000000000000001 RSI: 0000000000000008 RDI: 0000000000000001
RBP: ffffc90000087798 R08: 0000000000000001 R09: ffff88810930b5b7
R10: ffffed10212616b6 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88810930b618 R14: ffffc90000087770 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f7200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc804e9d48 CR3: 000000010c416000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
do_writepages+0x18c/0x770 mm/page-writeback.c:2366
__writeback_single_inode+0x9d/0x760 fs/fs-writeback.c:1622
writeback_sb_inodes+0x4ab/0xe20 fs/fs-writeback.c:1905
wb_writeback+0x20c/0x6b0 fs/fs-writeback.c:2079
wb_do_writeback fs/fs-writeback.c:2222 [inline]
wb_workfn+0x247/0xe20 fs/fs-writeback.c:2263
process_one_work+0x66c/0xff0 kernel/workqueue.c:2313
worker_thread+0x55b/0xf30 kernel/workqueue.c:2460
kthread+0x35d/0x430 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
Modules linked in:
---[ end trace 622df1dc3dfb9ecb ]---
RIP: 0010:mpage_map_one_extent fs/ext4/inode.c:2431 [inline]
RIP: 0010:mpage_map_and_submit_extent fs/ext4/inode.c:2472 [inline]
RIP: 0010:ext4_writepages+0x2004/0x2b00 fs/ext4/inode.c:2840
Code: ff 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 84 2b ee ff ff 48 8b bd f0 fd ff ff e8 21 85 d0 ff e9 1a ee ff ff <0f> 0b 8b 85 20 fd ff ff 31 db 89 85 d0 fd ff ff e9 7e fc ff ff 49
RSP: 0018:ffffc90000087440 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000
RDX: 0000000000000001 RSI: 0000000000000008 RDI: 0000000000000001
RBP: ffffc90000087798 R08: 0000000000000001 R09: ffff88810930b5b7
R10: ffffed10212616b6 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88810930b618 R14: ffffc90000087770 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f7300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c000e61000 CR3: 000000011e82f000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400