ci2 starts bisection 2025-01-31 20:09:03.66834309 +0000 UTC m=+14202.553821402 bisecting fixing commit since 853ec04e2de45ae6d1fc9476ce52d06582ad87ed building syzkaller on 9ac0fdc66500475f1914254ef369b32d51adbff9 ensuring issue is reproducible on original commit 853ec04e2de45ae6d1fc9476ce52d06582ad87ed testing commit 853ec04e2de45ae6d1fc9476ce52d06582ad87ed gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: bbc1d6b925de0c0559a91ac8cda0681c88fabb374c032c7699fd2eb50f9bd0dc all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] check whether we can drop unnecessary instrumentation disabling configs for [BUG LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed testing commit 853ec04e2de45ae6d1fc9476ce52d06582ad87ed gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: b58e9b6dae90e261218f10d967ff80f0e37bff590036ab40096cd400cab6ce9e all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] the bug reproduces without the instrumentation disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed kconfig minimization: base=5179 full=6547 leaves diff=264 split chunks (needed=false): <264> split chunk #0 of len 264 into 5 parts testing without sub-chunk 1/5 disabling configs for [UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing commit 853ec04e2de45ae6d1fc9476ce52d06582ad87ed gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: cd46311938258565574db7878e254909ede5eae0026fb76dcadeae040d5b625d all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing commit 853ec04e2de45ae6d1fc9476ce52d06582ad87ed gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 9a2358a217a5518866e49f32443c0aa7edb7b633d920e7ba214a8d56bd587937 all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 853ec04e2de45ae6d1fc9476ce52d06582ad87ed gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: fdce5c966f0cb581180ab411839918945cf6ec30a251b76a6fc291ad1675136b all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing commit 853ec04e2de45ae6d1fc9476ce52d06582ad87ed gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: e8602a6dab7f129558b044c0dcd96ea6239d6875f33229c3f75b516f9c2611d1 all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing commit 853ec04e2de45ae6d1fc9476ce52d06582ad87ed gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 failed building 853ec04e2de45ae6d1fc9476ce52d06582ad87ed: net/socket.c:1245: undefined reference to `wext_handle_ioctl' net/socket.c:3447: undefined reference to `compat_wext_handle_ioctl' net/core/net-procfs.c:329: undefined reference to `wext_proc_init' net/core/net-procfs.c:345: undefined reference to `wext_proc_exit' minimized to 52 configs; suspects: [HID_ZEROPLUS USB_NET_CDC_SUBSET USB_NET_CDC_SUBSET_ENABLE USB_NET_DM9601 USB_NET_GL620A USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM V4L2_ASYNC V4L2_FWNODE VIDEO_CAMERA_SENSOR WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_PURELIFI WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_SILABS WLAN_VENDOR_ZYDAS X86_X32_ABI ZEROPLUS_FF] disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing current HEAD 554eb9d61ac0a26a19ab5837f9d0daf83c9e3fa3 testing commit 554eb9d61ac0a26a19ab5837f9d0daf83c9e3fa3 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 28418dae51135f7772bda2ea76d2bf768a577d6b99d77a5dfac23c9687824761 all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] crash still not fixed/happens on the oldest tested release revisions tested: 7, total time: 56m2.284404585s (build: 25m46.380958732s, test: 27m3.479457839s) crash still not fixed or there were kernel test errors commit msg: ANDROID: KABI macros to release excess KABI fields for use with backports crash: KASAN: use-after-free Write in ext4_insert_dentry loop2: detected capacity change from 0 to 512 EXT4-fs (loop2): 1 truncate cleaned up EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. ================================================================== BUG: KASAN: use-after-free in ext4_insert_dentry+0x2ed/0x750 fs/ext4/namei.c:2155 Write of size 254 at addr ffff888127936f0c by task syz.2.15/455 CPU: 0 PID: 455 Comm: syz.2.15 Not tainted 6.1.124-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x105/0x148 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:316 [inline] print_report+0x158/0x4e0 mm/kasan/report.c:427 kasan_report+0x13c/0x170 mm/kasan/report.c:531 kasan_check_range+0x294/0x2a0 mm/kasan/generic.c:189 memcpy+0x44/0x70 mm/kasan/shadow.c:66 ext4_insert_dentry+0x2ed/0x750 fs/ext4/namei.c:2155 add_dirent_to_buf+0x2fd/0x540 fs/ext4/namei.c:2200 make_indexed_dir+0xb95/0x1170 fs/ext4/namei.c:2398 ext4_add_entry+0x926/0xba0 fs/ext4/namei.c:2504 __ext4_link+0x405/0x650 fs/ext4/namei.c:3522 ext4_link+0x150/0x1e0 fs/ext4/namei.c:3563 vfs_link+0x517/0x700 fs/namei.c:4598 do_linkat+0x2ed/0x820 fs/namei.c:4669 __do_sys_link fs/namei.c:4703 [inline] __se_sys_link fs/namei.c:4701 [inline] __x64_sys_link+0x81/0x90 fs/namei.c:4701 x64_sys_call+0x282/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:87 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f973e77fed9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f973f4ea058 EFLAGS: 00000246 ORIG_RAX: 0000000000000056 RAX: ffffffffffffffda RBX: 00007f973e945fa0 RCX: 00007f973e77fed9 RDX: 0000000000000000 RSI: 0000000020000bc0 RDI: 0000000020001240 RBP: 00007f973e7f3cc8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f973e945fa0 R15: 00007ffd986cf938 The buggy address belongs to the physical page: page:ffffea00049e4d80 refcount:3 mapcount:0 mapping:ffff8881005494d0 index:0x3f pfn:0x127936 memcg:ffff88810f390000 aops:def_blk_aops ino:700002 flags: 0x420000000000204a(referenced|dirty|workingset|private|zone=1) raw: 420000000000204a 0000000000000000 dead000000000122 ffff8881005494d0 raw: 000000000000003f ffff888123266dc8 00000003ffffffff ffff88810f390000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Movable, gfp_mask 0x148c48(GFP_NOFS|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL|__GFP_MOVABLE), pid 455, tgid 454 (syz.2.15), ts 58119118114, free_ts 58089329152 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook mm/page_alloc.c:2605 [inline] prep_new_page+0x512/0x5e0 mm/page_alloc.c:2612 get_page_from_freelist+0x2f97/0x3010 mm/page_alloc.c:4477 __alloc_pages+0x234/0x610 mm/page_alloc.c:5775 __folio_alloc+0x15/0x40 mm/page_alloc.c:5807 __folio_alloc_node include/linux/gfp.h:245 [inline] folio_alloc include/linux/gfp.h:274 [inline] filemap_alloc_folio include/linux/pagemap.h:513 [inline] __filemap_get_folio+0x53b/0x6a0 mm/filemap.c:2017 pagecache_get_page+0x15/0xb0 mm/folio-compat.c:110 find_or_create_page include/linux/pagemap.h:654 [inline] grow_dev_page fs/buffer.c:989 [inline] grow_buffers fs/buffer.c:1054 [inline] __getblk_slow fs/buffer.c:1081 [inline] __getblk_gfp+0x1ac/0x590 fs/buffer.c:1376 sb_getblk include/linux/buffer_head.h:356 [inline] ext4_getblk+0x25b/0x5f0 fs/ext4/inode.c:899 ext4_bread+0xe/0xe0 fs/ext4/inode.c:945 ext4_append+0x24d/0x480 fs/ext4/namei.c:83 make_indexed_dir+0x3d8/0x1170 fs/ext4/namei.c:2318 ext4_add_entry+0x926/0xba0 fs/ext4/namei.c:2504 __ext4_link+0x405/0x650 fs/ext4/namei.c:3522 ext4_link+0x150/0x1e0 fs/ext4/namei.c:3563 vfs_link+0x517/0x700 fs/namei.c:4598 do_linkat+0x2ed/0x820 fs/namei.c:4669 page last free stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] free_pages_prepare mm/page_alloc.c:1513 [inline] free_pcp_prepare mm/page_alloc.c:1587 [inline] free_unref_page_prepare+0x8c6/0x8d0 mm/page_alloc.c:3526 free_unref_page_list+0xf1/0x790 mm/page_alloc.c:3674 release_pages+0xca8/0xd00 mm/swap.c:1043 free_pages_and_swap_cache+0x68/0x80 mm/swap_state.c:315 tlb_batch_pages_flush mm/mmu_gather.c:59 [inline] tlb_flush_mmu_free mm/mmu_gather.c:254 [inline] tlb_flush_mmu mm/mmu_gather.c:261 [inline] tlb_finish_mmu+0x1ba/0x3b0 mm/mmu_gather.c:361 unmap_region+0x2a3/0x300 mm/mmap.c:2402 do_mas_align_munmap+0xba4/0x1130 mm/mmap.c:2668 do_mas_munmap+0x199/0x1e0 mm/mmap.c:2726 __vm_munmap+0x24e/0x360 mm/mmap.c:3025 __do_sys_munmap mm/mmap.c:3051 [inline] __se_sys_munmap mm/mmap.c:3047 [inline] __x64_sys_munmap+0x66/0x70 mm/mmap.c:3047 x64_sys_call+0x75/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:12 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Memory state around the buggy address: ffff888127936f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888127936f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888127937000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff888127937080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888127937100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================