ci2 starts bisection 2025-04-28 23:49:16.815817512 +0000 UTC m=+18309.598139107 bisecting fixing commit since 0a51d2d4527b43c5e467ffa6897deefeaf499358 building syzkaller on 5df2386563cbffa1bbbb9d0b8ec1eebb98d051ae ensuring issue is reproducible on original commit 0a51d2d4527b43c5e467ffa6897deefeaf499358 testing commit 0a51d2d4527b43c5e467ffa6897deefeaf499358 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: c45b347e9124b66b4336d3d382cee7364650080111969b464392decd2e71e024 all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] check whether we can drop unnecessary instrumentation disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 0a51d2d4527b43c5e467ffa6897deefeaf499358 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: e83fb8868f48856fe5de87120b315e1ae69bcb2fa974cd9fbd1769c78513edae all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] the bug reproduces without the instrumentation disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed kconfig minimization: base=3707 full=7305 leaves diff=2040 split chunks (needed=false): <2040> split chunk #0 of len 2040 into 5 parts testing without sub-chunk 1/5 disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN BUG LOCKDEP], they are not needed testing commit 0a51d2d4527b43c5e467ffa6897deefeaf499358 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: e4acf8e516b59e33bd2f84447a9567b43c3cd81371333fe41b7d66c3673fc562 all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [BUG LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed testing commit 0a51d2d4527b43c5e467ffa6897deefeaf499358 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 39e885cd5ce522a4151af5a7a0d2ad2f83504cfbfa0f675a7ae6b3c3abaa329d all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN BUG LOCKDEP], they are not needed testing commit 0a51d2d4527b43c5e467ffa6897deefeaf499358 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: fda27a1f9c3aea326f5b9ba43a9e4776f39593f00afcdb63bef9335bb0964c7d all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing commit 0a51d2d4527b43c5e467ffa6897deefeaf499358 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: ca04c1a970e3caa7bed812dee62ca14839debbf2d43138fa1a37811be0549291 all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 0a51d2d4527b43c5e467ffa6897deefeaf499358 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 515bd9c32822fffe759ed782c7111afdfcecd06ec4da0b007ece7a580719fa7a all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] the chunk can be dropped disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing current HEAD f7347f4005727f3155551c0550f4deb9c40b56c2 testing commit f7347f4005727f3155551c0550f4deb9c40b56c2 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: fb798a1158fee706911e5f78047864401273fb2726b8e730da3975429a90cc07 all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] crash still not fixed/happens on the oldest tested release revisions tested: 8, total time: 2h38m43.037769229s (build: 1h54m48.663217852s, test: 41m7.81089589s) crash still not fixed or there were kernel test errors commit msg: Linux 5.15.180 crash: KASAN: use-after-free Write in ext4_insert_dentry EXT4-fs error (device loop3): ext4_xattr_inode_iget:404: comm syz.3.15: inode #1: comm syz.3.15: iget: illegal inode # EXT4-fs error (device loop3): ext4_xattr_inode_iget:407: comm syz.3.15: error while reading EA inode 1 err=-117 EXT4-fs (loop3): 1 orphan inode deleted EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. ================================================================== BUG: KASAN: use-after-free in ext4_insert_dentry+0x375/0x640 fs/ext4/namei.c:2155 Write of size 250 at addr ffff888120f6df18 by task syz.3.15/2494 CPU: 1 PID: 2494 Comm: syz.3.15 Not tainted 5.15.180-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x41/0x5e lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x6c/0x309 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:451 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189 memcpy+0x39/0x60 mm/kasan/shadow.c:66 ext4_insert_dentry+0x375/0x640 fs/ext4/namei.c:2155 add_dirent_to_buf+0x1f2/0x700 fs/ext4/namei.c:2200 make_indexed_dir+0xd8c/0x1080 fs/ext4/namei.c:2398 ext4_add_entry+0x95f/0xbb0 fs/ext4/namei.c:2504 ext4_mkdir+0x366/0x860 fs/ext4/namei.c:3081 vfs_mkdir+0x1c4/0x3e0 fs/namei.c:4065 do_mkdirat+0x210/0x280 fs/namei.c:4090 __do_sys_mkdirat fs/namei.c:4105 [inline] __se_sys_mkdirat fs/namei.c:4103 [inline] __x64_sys_mkdirat+0xef/0x140 fs/namei.c:4103 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x33/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f69b3e21809 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f69b38a0058 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 00007f69b3fe6fa0 RCX: 00007f69b3e21809 RDX: 5be60480b9579340 RSI: 0000000020000940 RDI: ffffffffffffff9c RBP: 00007f69b3e9493e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f69b3fe6fa0 R15: 00007fff4b3a3578 The buggy address belongs to the page: page:ffffea000483db40 refcount:3 mapcount:0 mapping:ffff888100481308 index:0x3f pfn:0x120f6d memcg:ffff88810aa9a000 aops:def_blk_aops ino:700003 flags: 0x20000000000202a(referenced|dirty|active|private|node=0|zone=2) raw: 020000000000202a 0000000000000000 dead000000000122 ffff888100481308 raw: 000000000000003f ffff88810067e1d0 00000003ffffffff ffff88810aa9a000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Movable, gfp_mask 0x108c48(GFP_NOFS|__GFP_NOFAIL|__GFP_HARDWALL|__GFP_MOVABLE), pid 2494, ts 67755550251, free_ts 67682832132 prep_new_page mm/page_alloc.c:2426 [inline] get_page_from_freelist+0x1319/0x2e50 mm/page_alloc.c:4192 __alloc_pages+0x2b3/0x590 mm/page_alloc.c:5466 pagecache_get_page+0x23f/0xc00 mm/filemap.c:1940 find_or_create_page include/linux/pagemap.h:420 [inline] grow_dev_page fs/buffer.c:949 [inline] grow_buffers fs/buffer.c:1014 [inline] __getblk_slow+0x1a6/0x7a0 fs/buffer.c:1041 sb_getblk include/linux/buffer_head.h:361 [inline] ext4_getblk+0x1a0/0x560 fs/ext4/inode.c:876 ext4_bread+0x8/0x120 fs/ext4/inode.c:922 ext4_append+0x1d9/0x490 fs/ext4/namei.c:83 make_indexed_dir+0x3de/0x1080 fs/ext4/namei.c:2318 ext4_add_entry+0x95f/0xbb0 fs/ext4/namei.c:2504 ext4_mkdir+0x366/0x860 fs/ext4/namei.c:3081 vfs_mkdir+0x1c4/0x3e0 fs/namei.c:4065 do_mkdirat+0x210/0x280 fs/namei.c:4090 __do_sys_mkdirat fs/namei.c:4105 [inline] __se_sys_mkdirat fs/namei.c:4103 [inline] __x64_sys_mkdirat+0xef/0x140 fs/namei.c:4103 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x33/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1340 [inline] free_pcp_prepare+0x34e/0x730 mm/page_alloc.c:1391 free_unref_page_prepare mm/page_alloc.c:3317 [inline] free_unref_page_list+0x168/0x9a0 mm/page_alloc.c:3433 release_pages+0x9f2/0x1100 mm/swap.c:963 tlb_batch_pages_flush mm/mmu_gather.c:49 [inline] tlb_flush_mmu_free mm/mmu_gather.c:240 [inline] tlb_flush_mmu mm/mmu_gather.c:247 [inline] tlb_finish_mmu+0x125/0x6c0 mm/mmu_gather.c:338 exit_mmap+0x185/0x580 mm/mmap.c:3206 __mmput kernel/fork.c:1127 [inline] mmput+0x90/0x390 kernel/fork.c:1148 exit_mm kernel/exit.c:550 [inline] do_exit+0x87f/0x21d0 kernel/exit.c:861 do_group_exit+0xe7/0x290 kernel/exit.c:996 __do_sys_exit_group kernel/exit.c:1007 [inline] __se_sys_exit_group kernel/exit.c:1005 [inline] __x64_sys_exit_group+0x35/0x40 kernel/exit.c:1005 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x33/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 Memory state around the buggy address: ffff888120f6df00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888120f6df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888120f6e000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff888120f6e080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888120f6e100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================