ci2 starts bisection 2025-03-26 21:06:06.503362482 +0000 UTC m=+16670.034288709 bisecting fixing commit since 0a51d2d4527b43c5e467ffa6897deefeaf499358 building syzkaller on 5df2386563cbffa1bbbb9d0b8ec1eebb98d051ae ensuring issue is reproducible on original commit 0a51d2d4527b43c5e467ffa6897deefeaf499358 testing commit 0a51d2d4527b43c5e467ffa6897deefeaf499358 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: c45b347e9124b66b4336d3d382cee7364650080111969b464392decd2e71e024 all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] check whether we can drop unnecessary instrumentation disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed testing commit 0a51d2d4527b43c5e467ffa6897deefeaf499358 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: e83fb8868f48856fe5de87120b315e1ae69bcb2fa974cd9fbd1769c78513edae all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] the bug reproduces without the instrumentation disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed kconfig minimization: base=3706 full=7305 leaves diff=2038 split chunks (needed=false): <2038> split chunk #0 of len 2038 into 5 parts testing without sub-chunk 1/5 disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed testing commit 0a51d2d4527b43c5e467ffa6897deefeaf499358 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: eb7fefa3ba41a43ae65cd34c0b3cf45e0eb2ab0a0280c534e1e47c56d0504848 all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 0a51d2d4527b43c5e467ffa6897deefeaf499358 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: d1c4aed7465763c0cf3a51b391c700670d73b48f4067616c90a1af828a6d2678 all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [BUG LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed testing commit 0a51d2d4527b43c5e467ffa6897deefeaf499358 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: db8ec144564f399de67fe80de632af948d10e19898013e1d240b1fa3da84b18a all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 0a51d2d4527b43c5e467ffa6897deefeaf499358 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: c0b13513ced586411cd49e69e759139dcac9b904dc1b01c3ae858f3ca33af4ce all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed testing commit 0a51d2d4527b43c5e467ffa6897deefeaf499358 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 515bd9c32822fffe759ed782c7111afdfcecd06ec4da0b007ece7a580719fa7a all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] the chunk can be dropped disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing current HEAD 0c935c049b5c196b83b968c72d348ae6fff83ea2 testing commit 0c935c049b5c196b83b968c72d348ae6fff83ea2 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 89b2d1695918301d934050b606f0b224c9e6eef979b20520bfa13df06bbcd2a8 all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] crash still not fixed/happens on the oldest tested release revisions tested: 8, total time: 3h1m16.048500276s (build: 2h0m55.932555776s, test: 57m25.247679262s) crash still not fixed or there were kernel test errors commit msg: Linux 5.15.179 crash: KASAN: use-after-free Write in ext4_insert_dentry EXT4-fs error (device loop3): ext4_xattr_inode_iget:407: comm syz.3.16: error while reading EA inode 1 err=-117 EXT4-fs (loop3): 1 orphan inode deleted EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. ================================================================== BUG: KASAN: use-after-free in ext4_insert_dentry+0x375/0x640 fs/ext4/namei.c:2155 Write of size 250 at addr ffff888120f01f18 by task syz.3.16/2495 CPU: 0 PID: 2495 Comm: syz.3.16 Not tainted 5.15.179-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x41/0x5e lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x6c/0x309 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:451 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189 memcpy+0x39/0x60 mm/kasan/shadow.c:66 ext4_insert_dentry+0x375/0x640 fs/ext4/namei.c:2155 add_dirent_to_buf+0x1f2/0x700 fs/ext4/namei.c:2200 make_indexed_dir+0xd8c/0x1080 fs/ext4/namei.c:2398 ext4_add_entry+0x95f/0xbb0 fs/ext4/namei.c:2504 ext4_mkdir+0x366/0x860 fs/ext4/namei.c:3081 vfs_mkdir+0x1c4/0x3e0 fs/namei.c:4065 do_mkdirat+0x210/0x280 fs/namei.c:4090 __do_sys_mkdirat fs/namei.c:4105 [inline] __se_sys_mkdirat fs/namei.c:4103 [inline] __x64_sys_mkdirat+0xef/0x140 fs/namei.c:4103 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x33/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7ff2901e3809 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ff28fc62058 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 00007ff2903a8fa0 RCX: 00007ff2901e3809 RDX: 5be60480b9579340 RSI: 0000000020000940 RDI: ffffffffffffff9c RBP: 00007ff29025693e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007ff2903a8fa0 R15: 00007ffd47b37da8 The buggy address belongs to the page: page:ffffea000483c040 refcount:3 mapcount:0 mapping:ffff8881004d1308 index:0x3f pfn:0x120f01 memcg:ffff88811192a000 aops:def_blk_aops ino:700003 flags: 0x20000000000202a(referenced|dirty|active|private|node=0|zone=2) raw: 020000000000202a 0000000000000000 dead000000000122 ffff8881004d1308 raw: 000000000000003f ffff888100680570 00000003ffffffff ffff88811192a000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Movable, gfp_mask 0x108c48(GFP_NOFS|__GFP_NOFAIL|__GFP_HARDWALL|__GFP_MOVABLE), pid 2495, ts 67721290376, free_ts 61422449928 prep_new_page mm/page_alloc.c:2426 [inline] get_page_from_freelist+0x1319/0x2e50 mm/page_alloc.c:4192 __alloc_pages+0x2b3/0x590 mm/page_alloc.c:5466 pagecache_get_page+0x23f/0xc00 mm/filemap.c:1940 find_or_create_page include/linux/pagemap.h:420 [inline] grow_dev_page fs/buffer.c:949 [inline] grow_buffers fs/buffer.c:1014 [inline] __getblk_slow+0x1a6/0x7a0 fs/buffer.c:1041 sb_getblk include/linux/buffer_head.h:361 [inline] ext4_getblk+0x1a0/0x560 fs/ext4/inode.c:876 ext4_bread+0x8/0x120 fs/ext4/inode.c:922 ext4_append+0x1d9/0x490 fs/ext4/namei.c:83 make_indexed_dir+0x3de/0x1080 fs/ext4/namei.c:2318 ext4_add_entry+0x95f/0xbb0 fs/ext4/namei.c:2504 ext4_mkdir+0x366/0x860 fs/ext4/namei.c:3081 vfs_mkdir+0x1c4/0x3e0 fs/namei.c:4065 do_mkdirat+0x210/0x280 fs/namei.c:4090 __do_sys_mkdirat fs/namei.c:4105 [inline] __se_sys_mkdirat fs/namei.c:4103 [inline] __x64_sys_mkdirat+0xef/0x140 fs/namei.c:4103 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x33/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1340 [inline] free_pcp_prepare+0x34e/0x730 mm/page_alloc.c:1391 free_unref_page_prepare mm/page_alloc.c:3317 [inline] free_unref_page_list+0x168/0x9a0 mm/page_alloc.c:3433 release_pages+0x9f2/0x1100 mm/swap.c:963 tlb_batch_pages_flush mm/mmu_gather.c:49 [inline] tlb_flush_mmu_free mm/mmu_gather.c:240 [inline] tlb_flush_mmu mm/mmu_gather.c:247 [inline] tlb_finish_mmu+0x125/0x6c0 mm/mmu_gather.c:338 unmap_region+0x298/0x390 mm/mmap.c:2657 __do_munmap+0x47e/0x10d0 mm/mmap.c:2887 __vm_munmap+0xd2/0x1a0 mm/mmap.c:2940 __do_sys_munmap mm/mmap.c:2966 [inline] __se_sys_munmap mm/mmap.c:2962 [inline] __x64_sys_munmap+0x5d/0x80 mm/mmap.c:2962 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x33/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 Memory state around the buggy address: ffff888120f01f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888120f01f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888120f02000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff888120f02080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888120f02100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================