ci2 starts bisection 2023-10-23 19:44:47.506113566 +0000 UTC m=+28994.784759379
bisecting fixing commit since ea586874d2f9e501ef84b7e55036fc8965397d5d
building syzkaller on 0b6a67ac4b0dc26f43030c5edd01c9175f13b784
ensuring issue is reproducible on original commit ea586874d2f9e501ef84b7e55036fc8965397d5d
testing commit ea586874d2f9e501ef84b7e55036fc8965397d5d gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 8bc7974ce4ccd62d61e4f16dede119bfd0933592e00a0870eb9f47c7ee977beb
run #0: crashed: KASAN: use-after-free Read in ext4_find_extent
run #1: crashed: kernel BUG in ext4_writepages
run #2: crashed: KASAN: use-after-free Read in ext4_find_extent
run #3: crashed: kernel BUG in ext4_writepages
run #4: crashed: kernel BUG in ext4_writepages
run #5: crashed: KASAN: use-after-free Read in ext4_find_extent
run #6: crashed: kernel BUG in ext4_writepages
run #7: crashed: KASAN: use-after-free Read in ext4_find_extent
run #8: crashed: kernel BUG in ext4_writepages
run #9: crashed: KASAN: use-after-free Read in ext4_find_extent
run #10: crashed: KASAN: use-after-free Read in ext4_find_extent
run #11: crashed: kernel BUG in ext4_writepages
run #12: crashed: KASAN: use-after-free Read in ext4_find_extent
run #13: crashed: KASAN: use-after-free Read in ext4_find_extent
run #14: crashed: KASAN: use-after-free Read in ext4_find_extent
run #15: crashed: KASAN: use-after-free Read in ext4_find_extent
run #16: crashed: KASAN: use-after-free Read in ext4_find_extent
run #17: crashed: KASAN: use-after-free Read in ext4_find_extent
run #18: crashed: KASAN: use-after-free Read in ext4_find_extent
run #19: crashed: KASAN: use-after-free Read in ext4_find_extent
representative crash: KASAN: use-after-free Read in ext4_find_extent, types: [KASAN]
check whether we can drop unnecessary instrumentation
disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed
testing commit ea586874d2f9e501ef84b7e55036fc8965397d5d gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: b84d9a0d3da36eb2d122968c9d2aa442a129c282241cc6063ff5a555840649be
run #0: crashed: KASAN: use-after-free Read in ext4_find_extent
run #1: crashed: KASAN: use-after-free Read in ext4_find_extent
run #2: crashed: KASAN: use-after-free Read in ext4_find_extent
run #3: crashed: invalid opcode in ext4_writepages
run #4: crashed: KASAN: use-after-free Read in ext4_find_extent
run #5: crashed: invalid opcode in ext4_writepages
run #6: crashed: KASAN: use-after-free Read in ext4_find_extent
run #7: crashed: KASAN: use-after-free Read in ext4_find_extent
run #8: crashed: KASAN: use-after-free Read in ext4_find_extent
run #9: crashed: KASAN: use-after-free Read in ext4_find_extent
representative crash: KASAN: use-after-free Read in ext4_find_extent, types: [KASAN]
the bug reproduces without the instrumentation
disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN BUG LOCKDEP], they are not needed
kconfig minimization: base=4920 full=6163 leaves diff=241
split chunks (needed=false): <241>
split chunk #0 of len 241 into 5 parts
testing without sub-chunk 1/5
disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed
testing commit ea586874d2f9e501ef84b7e55036fc8965397d5d gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 683617f002fa684bccdb0a0615f8c5844ad9c837ae31e62a74652ec1d8144f90
all runs: crashed: KASAN: use-after-free Read in ext4_find_extent
representative crash: KASAN: use-after-free Read in ext4_find_extent, types: [KASAN]
the chunk can be dropped
testing without sub-chunk 2/5
disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed
testing commit ea586874d2f9e501ef84b7e55036fc8965397d5d gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 9e2e1542e14b00dba9e32c57add24a9da00c3b7ec0669d86d973993ecaaa6901
run #0: crashed: KASAN: use-after-free Read in ext4_find_extent
run #1: crashed: invalid opcode in ext4_writepages
run #2: crashed: invalid opcode in ext4_writepages
run #3: crashed: KASAN: use-after-free Read in ext4_find_extent
run #4: crashed: KASAN: use-after-free Read in ext4_find_extent
run #5: crashed: KASAN: use-after-free Read in ext4_find_extent
run #6: crashed: KASAN: use-after-free Read in ext4_find_extent
run #7: crashed: KASAN: use-after-free Read in ext4_find_extent
run #8: crashed: KASAN: use-after-free Read in ext4_find_extent
run #9: crashed: KASAN: use-after-free Read in ext4_find_extent
representative crash: KASAN: use-after-free Read in ext4_find_extent, types: [KASAN]
the chunk can be dropped
testing without sub-chunk 3/5
disabling configs for [BUG LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed
testing commit ea586874d2f9e501ef84b7e55036fc8965397d5d gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: de11e13611512cafca2feeabc668ead7dea37256a109642e25b6f70ca5dcaead
run #0: crashed: KASAN: use-after-free Read in ext4_find_extent
run #1: crashed: KASAN: use-after-free Read in ext4_find_extent
run #2: crashed: KASAN: use-after-free Read in ext4_find_extent
run #3: crashed: invalid opcode in ext4_writepages
run #4: crashed: KASAN: use-after-free Read in ext4_find_extent
run #5: crashed: invalid opcode in ext4_writepages
run #6: crashed: invalid opcode in ext4_writepages
run #7: crashed: KASAN: use-after-free Read in ext4_find_extent
run #8: crashed: invalid opcode in ext4_writepages
run #9: crashed: KASAN: use-after-free Read in ext4_find_extent
representative crash: KASAN: use-after-free Read in ext4_find_extent, types: [KASAN UNKNOWN]
the chunk can be dropped
testing without sub-chunk 4/5
disabling configs for [UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed
testing commit ea586874d2f9e501ef84b7e55036fc8965397d5d gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: e4f33763ad9e6f1e100f7a445c75143ec94994f61f8388f9153a8de4e46fb146
run #0: crashed: KASAN: use-after-free Read in ext4_find_extent
run #1: crashed: KASAN: use-after-free Read in ext4_find_extent
run #2: crashed: invalid opcode in ext4_writepages
run #3: crashed: KASAN: use-after-free Read in ext4_find_extent
run #4: crashed: invalid opcode in ext4_writepages
run #5: crashed: KASAN: use-after-free Read in ext4_find_extent
run #6: crashed: KASAN: use-after-free Read in ext4_find_extent
run #7: crashed: KASAN: use-after-free Read in ext4_find_extent
run #8: crashed: KASAN: use-after-free Read in ext4_find_extent
run #9: crashed: invalid opcode in ext4_writepages
representative crash: KASAN: use-after-free Read in ext4_find_extent, types: [KASAN UNKNOWN]
the chunk can be dropped
testing without sub-chunk 5/5
disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed
testing commit ea586874d2f9e501ef84b7e55036fc8965397d5d gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
failed building ea586874d2f9e501ef84b7e55036fc8965397d5d: net/socket.c:1172: undefined reference to `wext_handle_ioctl'
net/socket.c:3366: undefined reference to `compat_wext_handle_ioctl'
net/core/net-procfs.c:343: undefined reference to `wext_proc_exit'
net/core/net-procfs.c:327: undefined reference to `wext_proc_init'
minimized to 45 configs; suspects: [HID_ZEROPLUS USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL USB_SERIAL_FTDI_SIO USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_ZYDAS X86_X32 ZEROPLUS_FF]
disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed
testing current HEAD 754f8cc9b7de7629e6aefa505dfc24c36a36d236
testing commit 754f8cc9b7de7629e6aefa505dfc24c36a36d236 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 3f73b5c870683e6a521597931aca3ddcd1d218a241f727c137c17555acbac2b3
run #0: crashed: KASAN: use-after-free Read in ext4_find_extent
run #1: crashed: KASAN: use-after-free Read in ext4_find_extent
run #2: crashed: invalid opcode in ext4_writepages
run #3: crashed: invalid opcode in ext4_writepages
run #4: crashed: KASAN: use-after-free Read in ext4_find_extent
run #5: crashed: KASAN: use-after-free Read in ext4_find_extent
run #6: crashed: KASAN: use-after-free Read in ext4_find_extent
run #7: crashed: invalid opcode in ext4_writepages
run #8: crashed: KASAN: use-after-free Read in ext4_find_extent
run #9: crashed: invalid opcode in ext4_writepages
representative crash: KASAN: use-after-free Read in ext4_find_extent, types: [KASAN UNKNOWN]
crash still not fixed/happens on the oldest tested release
revisions tested: 7, total time: 42m19.001251076s (build: 19m59.949532109s, test: 20m38.302266093s)
crash still not fixed or there were kernel test errors
commit msg: Revert "pwm: atmel-tcb: Convert to platform remove callback returning void"
crash: KASAN: use-after-free Read in ext4_find_extent
==================================================================
BUG: KASAN: use-after-free in ext4_ext_binsearch fs/ext4/extents.c:827 [inline]
BUG: KASAN: use-after-free in ext4_find_extent+0xb6a/0xc30 fs/ext4/extents.c:946
Read of size 4 at addr ffff88812065f058 by task kworker/u4:0/8
CPU: 1 PID: 8 Comm: kworker/u4:0 Not tainted 5.15.132-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023
Workqueue: writeback wb_workfn (flush-7:0)
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x38/0x49 lib/dump_stack.c:106
print_address_description.constprop.0+0x24/0x160 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:427 [inline]
kasan_report.cold+0x82/0xdb mm/kasan/report.c:444
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
ext4_ext_binsearch fs/ext4/extents.c:827 [inline]
ext4_find_extent+0xb6a/0xc30 fs/ext4/extents.c:946
ext4_ext_map_blocks+0x18f/0x5100 fs/ext4/extents.c:4103
ext4_map_blocks+0x593/0x1450 fs/ext4/inode.c:646
mpage_map_one_extent fs/ext4/inode.c:2409 [inline]
mpage_map_and_submit_extent fs/ext4/inode.c:2462 [inline]
ext4_writepages+0x135a/0x2a80 fs/ext4/inode.c:2830
do_writepages+0x18c/0x770 mm/page-writeback.c:2366
__writeback_single_inode+0x6e/0x730 fs/fs-writeback.c:1625
writeback_sb_inodes+0x4ab/0xe20 fs/fs-writeback.c:1908
wb_writeback+0x20c/0x6b0 fs/fs-writeback.c:2082
wb_do_writeback fs/fs-writeback.c:2225 [inline]
wb_workfn+0x247/0xe20 fs/fs-writeback.c:2266
process_one_work+0x62c/0xec0 kernel/workqueue.c:2317
worker_thread+0x48e/0xdb0 kernel/workqueue.c:2464
kthread+0x324/0x3e0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
The buggy address belongs to the page:
page:ffffea00048197c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x12065f
flags: 0x4000000000000000(zone=1)
raw: 4000000000000000 ffffea0004819808 ffffea0004819788 0000000000000000
raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Movable, gfp_mask 0x112c4a(GFP_NOFS|__GFP_HIGHMEM|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL|__GFP_MOVABLE), pid 356, ts 40410137393, free_ts 40477920123
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook mm/page_alloc.c:2602 [inline]
prep_new_page+0x1a2/0x310 mm/page_alloc.c:2608
get_page_from_freelist+0x1ce2/0x30a0 mm/page_alloc.c:4482
__alloc_pages+0x217/0x2330 mm/page_alloc.c:5773
__alloc_pages_node include/linux/gfp.h:591 [inline]
alloc_pages_node include/linux/gfp.h:605 [inline]
alloc_pages include/linux/gfp.h:618 [inline]
__page_cache_alloc include/linux/pagemap.h:305 [inline]
page_cache_ra_unbounded+0x2f8/0x660 mm/readahead.c:227
do_page_cache_ra mm/readahead.c:280 [inline]
ondemand_readahead+0x683/0x1310 mm/readahead.c:565
page_cache_async_ra mm/readahead.c:624 [inline]
page_cache_async_ra+0x25a/0x2e0 mm/readahead.c:599
page_cache_async_readahead include/linux/pagemap.h:854 [inline]
filemap_readahead mm/filemap.c:2525 [inline]
filemap_get_pages+0x531/0x10a0 mm/filemap.c:2567
filemap_read+0x27e/0x950 mm/filemap.c:2634
generic_file_read_iter+0x293/0x4a0 mm/filemap.c:2785
ext4_file_read_iter fs/ext4/file.c:132 [inline]
ext4_file_read_iter+0x149/0x350 fs/ext4/file.c:115
call_read_iter include/linux/fs.h:2153 [inline]
generic_file_splice_read+0x35d/0x6c0 fs/splice.c:311
do_splice_to+0x170/0x240 fs/splice.c:796
splice_direct_to_actor+0x235/0x7e0 fs/splice.c:870
do_splice_direct+0x15a/0x2a0 fs/splice.c:979
do_sendfile+0xa31/0x15a0 fs/read_write.c:1249
__do_sys_sendfile64 fs/read_write.c:1317 [inline]
__se_sys_sendfile64 fs/read_write.c:1303 [inline]
__x64_sys_sendfile64+0x183/0x1d0 fs/read_write.c:1303
page last free stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
free_pages_prepare mm/page_alloc.c:1469 [inline]
free_pcp_prepare+0x1b6/0x4c0 mm/page_alloc.c:1541
free_unref_page_prepare mm/page_alloc.c:3531 [inline]
free_unref_page_list+0x1e3/0xcd0 mm/page_alloc.c:3668
release_pages+0x37f/0xff0 mm/swap.c:1009
__pagevec_release+0x5e/0xe0 mm/swap.c:1029
pagevec_release include/linux/pagevec.h:81 [inline]
truncate_inode_pages_range+0x28d/0xbe0 mm/truncate.c:329
truncate_inode_pages mm/truncate.c:425 [inline]
truncate_inode_pages_final+0x70/0x80 mm/truncate.c:464
ext4_evict_inode+0x118/0x1700 fs/ext4/inode.c:214
evict+0x2ab/0x610 fs/inode.c:587
dispose_list+0xf5/0x1a0 fs/inode.c:620
evict_inodes+0x2e6/0x3d0 fs/inode.c:670
generic_shutdown_super+0xa4/0x340 fs/super.c:454
kill_block_super+0x9a/0xd0 fs/super.c:1414
deactivate_locked_super+0x8b/0x130 fs/super.c:335
deactivate_super+0x71/0x80 fs/super.c:366
cleanup_mnt+0x2cf/0x400 fs/namespace.c:1143
__cleanup_mnt+0xd/0x10 fs/namespace.c:1150
Memory state around the buggy address:
ffff88812065ef00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88812065ef80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88812065f000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff88812065f080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88812065f100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 8 Comm: kworker/u4:0 Tainted: G B 5.15.132-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023
Workqueue: writeback wb_workfn (flush-7:0)
RIP: 0010:mpage_map_one_extent fs/ext4/inode.c:2421 [inline]
RIP: 0010:mpage_map_and_submit_extent fs/ext4/inode.c:2462 [inline]
RIP: 0010:ext4_writepages+0x1f2f/0x2a80 fs/ext4/inode.c:2830
Code: ff 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 84 ca ee ff ff 48 8b bd f0 fd ff ff e8 e6 d8 d0 ff e9 b9 ee ff ff <0f> 0b 8b 85 1c fd ff ff 31 db 89 85 c8 fd ff ff e9 70 fb ff ff 89
RSP: 0018:ffffc90000087450 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 1ffffffff0b1fc9c
RDX: 0000000000000001 RSI: 0000000000000008 RDI: 0000000000000001
RBP: ffffc900000877a0 R08: 0000000000000001 R09: ffff88810956de9f
R10: ffffed10212adbd3 R11: 0000000000000000 R12: ffff88810956ded8
R13: dffffc0000000000 R14: ffffc90000087778 R15: ffff88810956df00
FS: 0000000000000000(0000) GS:ffff8881f7400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fddda29152e CR3: 000000000500f000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
do_writepages+0x18c/0x770 mm/page-writeback.c:2366
__writeback_single_inode+0x6e/0x730 fs/fs-writeback.c:1625
writeback_sb_inodes+0x4ab/0xe20 fs/fs-writeback.c:1908
wb_writeback+0x20c/0x6b0 fs/fs-writeback.c:2082
wb_do_writeback fs/fs-writeback.c:2225 [inline]
wb_workfn+0x247/0xe20 fs/fs-writeback.c:2266
process_one_work+0x62c/0xec0 kernel/workqueue.c:2317
worker_thread+0x48e/0xdb0 kernel/workqueue.c:2464
kthread+0x324/0x3e0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
Modules linked in:
---[ end trace 20d24373b4f18b7a ]---
RIP: 0010:mpage_map_one_extent fs/ext4/inode.c:2421 [inline]
RIP: 0010:mpage_map_and_submit_extent fs/ext4/inode.c:2462 [inline]
RIP: 0010:ext4_writepages+0x1f2f/0x2a80 fs/ext4/inode.c:2830
Code: ff 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 84 ca ee ff ff 48 8b bd f0 fd ff ff e8 e6 d8 d0 ff e9 b9 ee ff ff <0f> 0b 8b 85 1c fd ff ff 31 db 89 85 c8 fd ff ff e9 70 fb ff ff 89
RSP: 0018:ffffc90000087450 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 1ffffffff0b1fc9c
RDX: 0000000000000001 RSI: 0000000000000008 RDI: 0000000000000001
RBP: ffffc900000877a0 R08: 0000000000000001 R09: ffff88810956de9f
R10: ffffed10212adbd3 R11: 0000000000000000 R12: ffff88810956ded8
R13: dffffc0000000000 R14: ffffc90000087778 R15: ffff88810956df00
FS: 0000000000000000(0000) GS:ffff8881f7500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055c320891078 CR3: 000000000500f000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400