ci2 starts bisection 2023-04-08 18:08:21.658607985 +0000 UTC m=+76232.666948529 bisecting fixing commit since d9b4a0c83a2d405dd85bf32d672686146b9bedff building syzkaller on f08b59ac0d8759f409d594ddca4f08c920e23237 ensuring issue is reproducible on original commit d9b4a0c83a2d405dd85bf32d672686146b9bedff testing commit d9b4a0c83a2d405dd85bf32d672686146b9bedff gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: fdf06b03a0be944069e4e3b815f8c342b057360d6553716240359a5cf3d30254 run #0: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc001519090] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #1: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc002b01090] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #2: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc002b01180] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #3: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc000ae7db0] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #4: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc000ae7e50] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #5: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc000ae7f40] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #6: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc001519540] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #7: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc001519770] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #8: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc001519810] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #9: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc0015199f0] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #10: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc001519ae0] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #11: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc002b01770] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #12: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #13: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #14: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #15: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #16: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #17: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #18: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #19: crashed: KASAN: use-after-free Read in hfsplus_releasepage testing current HEAD d86dfc4d95cd218246b10ca7adf22c8626547599 testing commit d86dfc4d95cd218246b10ca7adf22c8626547599 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: e33b72c6c328497f67279b4fbd857fdad123c7d61a36f985dc543a38cd84c36f run #0: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc0014fd770] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect start d86dfc4d95cd218246b10ca7adf22c8626547599 d9b4a0c83a2d405dd85bf32d672686146b9bedff Bisecting: 605 revisions left to test after this (roughly 9 steps) [a27e95a6ff3fd633422ca44c6d571ef84392f5b8] um: virt-pci: properly remove PCI device from bus testing commit a27e95a6ff3fd633422ca44c6d571ef84392f5b8 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: d4578dfa22c2930fabe88b0a319cd50afd0e813c15877334a374bcf84b6da1f0 run #0: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc0009d07d0] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect bad a27e95a6ff3fd633422ca44c6d571ef84392f5b8 Bisecting: 302 revisions left to test after this (roughly 8 steps) [b1cdf1113e21a8e5e7f814376ca9a2ac03ca311e] firmware: stratix10-svc: add missing gen_pool_destroy() in stratix10_svc_drv_probe() testing commit b1cdf1113e21a8e5e7f814376ca9a2ac03ca311e gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 0efdff5867f7104d11f8d7069d722213ea8e96684c06c69f3fedc5620f91cef9 run #0: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc0026dea00] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #1: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc0025cc0f0] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #2: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #3: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #4: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #5: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #6: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #7: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #8: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #9: crashed: KASAN: use-after-free Read in hfsplus_releasepage # git bisect good b1cdf1113e21a8e5e7f814376ca9a2ac03ca311e Bisecting: 151 revisions left to test after this (roughly 7 steps) [6249f305cd341ee4f0e0ab63c4b84ebd47b84590] selftests/landlock: Skip overlayfs tests when not supported testing commit 6249f305cd341ee4f0e0ab63c4b84ebd47b84590 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 4d7121910c6cf5a4f2d24055ada780baac07ce200aebfc5320c27efacbdedae7 run #0: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc0026de9b0] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #1: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc0026debe0] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect bad 6249f305cd341ee4f0e0ab63c4b84ebd47b84590 Bisecting: 75 revisions left to test after this (roughly 6 steps) [38f564996906dd995f29cd10e74b2d171982c489] ice: restrict PTP HW clock freq adjustments to 100, 000, 000 PPB testing commit 38f564996906dd995f29cd10e74b2d171982c489 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 74c0f85701a04da7aa71671c3d5155711915b36e62b34673c668a9fc954cee6e run #0: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc000ae6fa0] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #1: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc002b00dc0] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #2: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #3: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #4: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #5: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #6: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #7: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #8: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #9: crashed: KASAN: use-after-free Read in hfsplus_releasepage # git bisect good 38f564996906dd995f29cd10e74b2d171982c489 Bisecting: 37 revisions left to test after this (roughly 5 steps) [52ea47a0ddfbc5fe05e873d3f5a59db4ba3e03fe] hwmon: (coretemp) Simplify platform device handling testing commit 52ea47a0ddfbc5fe05e873d3f5a59db4ba3e03fe gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 82b5e1ac707ea050ced4c22d720c00fd4bc8bebf77becdac2b3907088441b863 run #0: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc0000c79a0] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #1: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc000ae62d0] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #2: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #3: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #4: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #5: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #6: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #7: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #8: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #9: crashed: KASAN: use-after-free Read in hfsplus_releasepage # git bisect good 52ea47a0ddfbc5fe05e873d3f5a59db4ba3e03fe Bisecting: 18 revisions left to test after this (roughly 4 steps) [0eba9b4a86e8917820fe2094fbe6a7ab210f181d] cifs: Fix uninitialized memory read in smb3_qfs_tcon() testing commit 0eba9b4a86e8917820fe2094fbe6a7ab210f181d gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 34088628ae86cddc6b25e1558b5d57a30db4d120ff477a827f4f1ccf81d484c3 run #0: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc0025ccbe0] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #1: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc002b005f0] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #2: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #3: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #4: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #5: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #6: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #7: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #8: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #9: crashed: KASAN: use-after-free Read in hfsplus_releasepage # git bisect good 0eba9b4a86e8917820fe2094fbe6a7ab210f181d Bisecting: 9 revisions left to test after this (roughly 3 steps) [c2c3d86bd4a99a9d0a4d2087574d71a8071ef245] exfat: fix unexpected EOF while reading dir testing commit c2c3d86bd4a99a9d0a4d2087574d71a8071ef245 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: ebfb8d6f3890c6ff5779b0dc895d293607385ce534277da8c382ab07835842d7 run #0: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc0025cc960] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #1: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc0010be320] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect bad c2c3d86bd4a99a9d0a4d2087574d71a8071ef245 Bisecting: 4 revisions left to test after this (roughly 2 steps) [851c34f19c0a4357058e72b989bc9862632e2c27] ksmbd: do not allow the actual frame length to be smaller than the rfc1002 length testing commit 851c34f19c0a4357058e72b989bc9862632e2c27 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: cf9fbfc268731804971c3c437eb8d1c4f2e2482221ccf0d1396727f726cdc069 run #0: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc000647310] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #1: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc000869f90] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #2: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #3: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #4: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #5: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #6: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #7: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #8: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #9: crashed: KASAN: use-after-free Read in hfsplus_releasepage # git bisect good 851c34f19c0a4357058e72b989bc9862632e2c27 Bisecting: 2 revisions left to test after this (roughly 1 step) [2cab8db14566cf6a516c1f103a60cf6b7f54b1e5] hfs: fix missing hfs_bnode_get() in __hfs_bnode_create testing commit 2cab8db14566cf6a516c1f103a60cf6b7f54b1e5 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 7a9499cb80e951734edb11b90145b34fe51697c6c3543932d5f3beac76cfb2c5 run #0: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc0026de5f0] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #1: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc0026de7d0] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #2: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #3: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #4: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #5: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #6: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #7: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #8: crashed: KASAN: use-after-free Read in hfsplus_releasepage run #9: crashed: KASAN: use-after-free Read in hfsplus_releasepage # git bisect good 2cab8db14566cf6a516c1f103a60cf6b7f54b1e5 Bisecting: 0 revisions left to test after this (roughly 1 step) [0d3902cbcf80e50742a1bb7066668386a7284536] exfat: fix reporting fs error when reading dir beyond EOF testing commit 0d3902cbcf80e50742a1bb7066668386a7284536 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 1c2d0178c065b59b1b77488b05099b37aeadacec68f36f27cd188281725067d4 run #0: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc0025ccaa0] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #1: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc006cbc3c0] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect bad 0d3902cbcf80e50742a1bb7066668386a7284536 Bisecting: 0 revisions left to test after this (roughly 0 steps) [05103d88482dc3757db108415342fdd86821a79b] fs: hfsplus: fix UAF issue in hfsplus_put_super testing commit 05103d88482dc3757db108415342fdd86821a79b gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 1848c8005cefb26098fa432343dac9df988b6c03305169e9552a5d3810cf9c54 run #0: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc0009d1680] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #1: boot failed: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc0005ea0a0] Location: Message:Quota 'T2A_CPUS' exceeded. Limit: 64.0 in region us-central1. ForceSendFields:[] NullFields:[]}. run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect bad 05103d88482dc3757db108415342fdd86821a79b 05103d88482dc3757db108415342fdd86821a79b is the first bad commit commit 05103d88482dc3757db108415342fdd86821a79b Author: Dongliang Mu Date: Sun Feb 26 20:49:47 2023 +0800 fs: hfsplus: fix UAF issue in hfsplus_put_super commit 07db5e247ab5858439b14dd7cc1fe538b9efcf32 upstream. The current hfsplus_put_super first calls hfs_btree_close on sbi->ext_tree, then invokes iput on sbi->hidden_dir, resulting in an use-after-free issue in hfsplus_release_folio. As shown in hfsplus_fill_super, the error handling code also calls iput before hfs_btree_close. To fix this error, we move all iput calls before hfsplus_btree_close. Note that this patch is tested on Syzbot. Link: https://lkml.kernel.org/r/20230226124948.3175736-1-mudongliangabcd@gmail.com Reported-by: syzbot+57e3e98f7e3b80f64d56@syzkaller.appspotmail.com Tested-by: Dongliang Mu Signed-off-by: Dongliang Mu Cc: Bart Van Assche Cc: Jens Axboe Cc: Muchun Song Cc: Roman Gushchin Cc: "Theodore Ts'o" Cc: Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman fs/hfsplus/super.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) culprit signature: 1848c8005cefb26098fa432343dac9df988b6c03305169e9552a5d3810cf9c54 parent signature: 7a9499cb80e951734edb11b90145b34fe51697c6c3543932d5f3beac76cfb2c5 revisions tested: 13, total time: 6h21m17.151878302s (build: 4h56m51.577457836s, test: 1h13m0.024663719s) first good commit: 05103d88482dc3757db108415342fdd86821a79b fs: hfsplus: fix UAF issue in hfsplus_put_super recipients (to): ["akpm@linux-foundation.org" "gregkh@linuxfoundation.org" "mudongliangabcd@gmail.com"] recipients (cc): []