ci2 starts bisection 2024-10-30 22:04:36.690661273 +0000 UTC m=+35640.366584877
bisecting fixing commit since 6364d594125d5489b4f160c055505ec08c68c4eb
building syzkaller on 3ce4924c386b24ce0dea10478efdecc852cda540
ensuring issue is reproducible on original commit 6364d594125d5489b4f160c055505ec08c68c4eb

testing commit 6364d594125d5489b4f160c055505ec08c68c4eb gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 3d58fceff6928334231b4cd3e3823558f4ba98dfc57ee75fcc51c2be5967c986
run #0: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #1: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #2: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #3: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #4: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #5: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #6: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #7: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #8: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #9: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #10: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #11: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #12: crashed: KASAN: out-of-bounds Read in ext4_convert_inline_data_nolock
run #13: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #14: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #15: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #16: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #17: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #18: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #19: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
representative crash: KASAN: use-after-free Read in ext4_convert_inline_data_nolock, types: [KASAN]
check whether we can drop unnecessary instrumentation
disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN BUG LOCKDEP], they are not needed
testing commit 6364d594125d5489b4f160c055505ec08c68c4eb gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: db58bcb2fb24f16240e3a17fa89e8aae2703e9de3ffd01682d981f3de1659294
all runs: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
representative crash: KASAN: use-after-free Read in ext4_convert_inline_data_nolock, types: [KASAN]
the bug reproduces without the instrumentation
disabling configs for [BUG LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed
kconfig minimization: base=5179 full=6494 leaves diff=257
split chunks (needed=false): <257>
split chunk #0 of len 257 into 5 parts
testing without sub-chunk 1/5
disabling configs for [UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed
testing commit 6364d594125d5489b4f160c055505ec08c68c4eb gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 8092c15882d23c293c0041aa1c3566e0dfb1447862c78ce1dae91eae9a161762
all runs: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
representative crash: KASAN: use-after-free Read in ext4_convert_inline_data_nolock, types: [KASAN]
the chunk can be dropped
testing without sub-chunk 2/5
disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed
testing commit 6364d594125d5489b4f160c055505ec08c68c4eb gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 20fafdcdc3f2f781f7797d1f967e8483864ff7fa4ebeb615fcd7b9ab186f3f62
all runs: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
representative crash: KASAN: use-after-free Read in ext4_convert_inline_data_nolock, types: [KASAN]
the chunk can be dropped
testing without sub-chunk 3/5
disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed
testing commit 6364d594125d5489b4f160c055505ec08c68c4eb gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: bb271b056f0e4d00234f766f517cc9578afacf3485e708c6e7409ca247c1e45b
run #0: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #1: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #2: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #3: crashed: KASAN: out-of-bounds Read in ext4_convert_inline_data_nolock
run #4: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #5: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #6: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #7: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #8: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #9: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
representative crash: KASAN: use-after-free Read in ext4_convert_inline_data_nolock, types: [KASAN]
the chunk can be dropped
testing without sub-chunk 4/5
disabling configs for [BUG LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed
testing commit 6364d594125d5489b4f160c055505ec08c68c4eb gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: ef49d1bd1d31cd902c2e63715fb5badb45abd159490b0a081832794e119b52f7
all runs: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
representative crash: KASAN: use-after-free Read in ext4_convert_inline_data_nolock, types: [KASAN]
the chunk can be dropped
testing without sub-chunk 5/5
disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed
testing commit 6364d594125d5489b4f160c055505ec08c68c4eb gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
failed building 6364d594125d5489b4f160c055505ec08c68c4eb: net/socket.c:1245: undefined reference to `wext_handle_ioctl'
net/socket.c:3442: undefined reference to `compat_wext_handle_ioctl'
net/core/net-procfs.c:329: undefined reference to `wext_proc_init'
net/core/net-procfs.c:345: undefined reference to `wext_proc_exit'
minimized to 49 configs; suspects: [HID_ZEROPLUS USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM V4L2_ASYNC V4L2_FWNODE VIDEO_CAMERA_SENSOR WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_PURELIFI WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_SILABS WLAN_VENDOR_ZYDAS X86_X32_ABI ZEROPLUS_FF]
disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN BUG LOCKDEP], they are not needed
testing current HEAD 19b68814b1cd60c40546f31f7cc5b7895c0b013b
testing commit 19b68814b1cd60c40546f31f7cc5b7895c0b013b gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 9f8f3f0188b8f1564c39c0a247021d8df94e6b411f803e7c0b46ad90518b8171
run #0: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #1: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #2: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #3: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #4: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #5: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #6: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #7: crashed: KASAN: out-of-bounds Read in ext4_convert_inline_data_nolock
run #8: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
run #9: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
representative crash: KASAN: use-after-free Read in ext4_convert_inline_data_nolock, types: [KASAN]
crash still not fixed/happens on the oldest tested release
revisions tested: 7, total time: 2h18m17.971185882s (build: 29m57.890884811s, test: 1h2m43.211673779s)
crash still not fixed or there were kernel test errors
commit msg: Merge tag 'android14-6.1.112_r00' into android14-6.1
crash: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
==================================================================
BUG: KASAN: use-after-free in ext4_read_inline_data fs/ext4/inline.c:210 [inline]
BUG: KASAN: use-after-free in ext4_convert_inline_data_nolock+0x280/0x980 fs/ext4/inline.c:1216
Read of size 68 at addr ffff888123a6c0cf by task syz-executor.1/399

CPU: 1 PID: 399 Comm: syz-executor.1 Not tainted 6.1.112-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x105/0x148 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:316 [inline]
 print_report+0x158/0x4e0 mm/kasan/report.c:427
 kasan_report+0x13c/0x170 mm/kasan/report.c:531
 kasan_check_range+0x294/0x2a0 mm/kasan/generic.c:189
 memcpy+0x2d/0x70 mm/kasan/shadow.c:65
 ext4_read_inline_data fs/ext4/inline.c:210 [inline]
 ext4_convert_inline_data_nolock+0x280/0x980 fs/ext4/inline.c:1216
 ext4_try_add_inline_entry+0x69e/0x9c0 fs/ext4/inline.c:1342
 ext4_add_entry+0x384/0xba0 fs/ext4/namei.c:2456
 ext4_mkdir+0x472/0xa50 fs/ext4/namei.c:3079
 vfs_mkdir+0x2ea/0x480 fs/namei.c:4107
 do_mkdirat+0x230/0x390 fs/namei.c:4132
 __do_sys_mkdirat fs/namei.c:4147 [inline]
 __se_sys_mkdirat fs/namei.c:4145 [inline]
 __x64_sys_mkdirat+0x84/0x90 fs/namei.c:4145
 x64_sys_call+0x6c6/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:259
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f07e1a7c9a7
Code: 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f07e2738ef8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007f07e2738f80 RCX: 00007f07e1a7c9a7
RDX: 00000000000001ff RSI: 0000000020000580 RDI: 00000000ffffff9c
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000580
R13: 00007f07e2738f40 R14: 0000000000000000 R15: 0000000000000000
 </TASK>

The buggy address belongs to the physical page:
page:ffffea00048e9b00 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x123a6c
flags: 0x4000000000000000(zone=1)
raw: 4000000000000000 ffffea00048e9b48 ffffea00048e9ac8 0000000000000000
raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)

Memory state around the buggy address:
 ffff888123a6bf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888123a6c000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888123a6c080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                              ^
 ffff888123a6c100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888123a6c180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
EXT4-fs error (device loop1): ext4_check_all_de:655: inode #12: block 5: comm syz-executor.1: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=124 fake=0