ci2 starts bisection 2026-09-18 22:10:11.934732437 +0000 UTC m=+54663.311407340
bisecting fixing commit since 92668decd5e08edc7a6c138256abd2c37c4970f2
building syzkaller on b13552fed1cdc2826f57a5741df12ca67130314a
ensuring issue is reproducible on original commit 92668decd5e08edc7a6c138256abd2c37c4970f2

testing commit 92668decd5e08edc7a6c138256abd2c37c4970f2 gcc
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
kernel signature: 602d286eae172b5fde71385add20356ad2c724378a193fe740386fd5640b11a7
run #0: crashed: KASAN: use-after-free Read in xattr_find_entry
run #1: crashed: KASAN: use-after-free Read in xattr_find_entry
run #2: crashed: KASAN: slab-out-of-bounds Read in xattr_find_entry
run #3: crashed: KASAN: use-after-free Read in xattr_find_entry
run #4: crashed: KASAN: use-after-free Read in xattr_find_entry
run #5: crashed: KASAN: use-after-free Read in xattr_find_entry
run #6: crashed: KASAN: use-after-free Read in xattr_find_entry
run #7: crashed: KASAN: use-after-free Read in xattr_find_entry
run #8: crashed: KASAN: use-after-free Read in xattr_find_entry
run #9: crashed: KASAN: use-after-free Read in xattr_find_entry
run #10: crashed: KASAN: slab-out-of-bounds Read in xattr_find_entry
run #11: crashed: KASAN: use-after-free Read in xattr_find_entry
run #12: crashed: KASAN: use-after-free Read in xattr_find_entry
run #13: crashed: KASAN: use-after-free Read in xattr_find_entry
run #14: crashed: KASAN: use-after-free Read in xattr_find_entry
run #15: crashed: KASAN: use-after-free Read in xattr_find_entry
run #16: crashed: KASAN: use-after-free Read in xattr_find_entry
run #17: crashed: KASAN: use-after-free Read in xattr_find_entry
run #18: crashed: KASAN: use-after-free Read in xattr_find_entry
run #19: crashed: KASAN: use-after-free Read in xattr_find_entry
representative crash: KASAN: use-after-free Read in xattr_find_entry, types: [KASAN-USE-AFTER-FREE-READ]
check whether we can drop unnecessary instrumentation
disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed
testing commit 92668decd5e08edc7a6c138256abd2c37c4970f2 gcc
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
kernel signature: fd8f48b484aeca031ca7d4845a573af925e24a0b12f1cd3b3ec57d4f31e5c290
all runs: crashed: KASAN: use-after-free Read in xattr_find_entry
representative crash: KASAN: use-after-free Read in xattr_find_entry, types: [KASAN-USE-AFTER-FREE-READ]
the bug reproduces without the instrumentation
disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed
kconfig minimization: base=5186 full=6558 leaves diff=267
split chunks (needed=false): <267>
split chunk #0 of len 267 into 5 parts
testing without sub-chunk 1/5
disabling configs for [atomic_sleep hang memleak ubsan bug_or_warning locking], they are not needed
testing commit 92668decd5e08edc7a6c138256abd2c37c4970f2 gcc
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
kernel signature: d5785565e19870cf2cd82bb2b750f56f43285c58c22e21e6acb8e39f92e77847
all runs: crashed: KASAN: use-after-free Read in xattr_find_entry
representative crash: KASAN: use-after-free Read in xattr_find_entry, types: [KASAN-USE-AFTER-FREE-READ]
the chunk can be dropped
testing without sub-chunk 2/5
disabling configs for [ubsan bug_or_warning locking atomic_sleep hang memleak], they are not needed
testing commit 92668decd5e08edc7a6c138256abd2c37c4970f2 gcc
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
kernel signature: c293e0d3168ccf1871af2bb140ac8a593ff4ef8e76045c553cc5444b950283da
all runs: crashed: KASAN: use-after-free Read in xattr_find_entry
representative crash: KASAN: use-after-free Read in xattr_find_entry, types: [KASAN-USE-AFTER-FREE-READ]
the chunk can be dropped
testing without sub-chunk 3/5
disabling configs for [memleak ubsan bug_or_warning locking atomic_sleep hang], they are not needed
testing commit 92668decd5e08edc7a6c138256abd2c37c4970f2 gcc
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
kernel signature: 931d97dae2390dd3dddd34a6df77de7f240d73bec96606faf9492b7ad7bbf01a
run #0: crashed: KASAN: slab-out-of-bounds Read in xattr_find_entry
run #1: crashed: KASAN: use-after-free Read in xattr_find_entry
run #2: crashed: KASAN: slab-out-of-bounds Read in xattr_find_entry
run #3: crashed: KASAN: use-after-free Read in xattr_find_entry
run #4: crashed: KASAN: use-after-free Read in xattr_find_entry
run #5: crashed: KASAN: use-after-free Read in xattr_find_entry
run #6: crashed: KASAN: use-after-free Read in xattr_find_entry
run #7: crashed: KASAN: use-after-free Read in xattr_find_entry
run #8: crashed: KASAN: use-after-free Read in xattr_find_entry
run #9: crashed: KASAN: use-after-free Read in xattr_find_entry
representative crash: KASAN: use-after-free Read in xattr_find_entry, types: [KASAN-USE-AFTER-FREE-READ]
the chunk can be dropped
testing without sub-chunk 4/5
disabling configs for [locking atomic_sleep hang memleak ubsan bug_or_warning], they are not needed
testing commit 92668decd5e08edc7a6c138256abd2c37c4970f2 gcc
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
kernel signature: 6e81e0a4d1c8a9dfffd7f03c058ebdaead8b6831450a017f088908a25168bb03
run #0: crashed: KASAN: use-after-free Read in xattr_find_entry
run #1: crashed: KASAN: use-after-free Read in xattr_find_entry
run #2: crashed: KASAN: use-after-free Read in xattr_find_entry
run #3: crashed: KASAN: slab-out-of-bounds Read in xattr_find_entry
run #4: crashed: KASAN: use-after-free Read in xattr_find_entry
run #5: crashed: KASAN: use-after-free Read in xattr_find_entry
run #6: crashed: KASAN: use-after-free Read in xattr_find_entry
run #7: crashed: KASAN: use-after-free Read in xattr_find_entry
run #8: crashed: KASAN: use-after-free Read in xattr_find_entry
run #9: crashed: KASAN: use-after-free Read in xattr_find_entry
representative crash: KASAN: use-after-free Read in xattr_find_entry, types: [KASAN-USE-AFTER-FREE-READ]
the chunk can be dropped
testing without sub-chunk 5/5
disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed
testing commit 92668decd5e08edc7a6c138256abd2c37c4970f2 gcc
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
failed building 92668decd5e08edc7a6c138256abd2c37c4970f2: ld.lld: error: undefined symbol: wext_proc_init
ld.lld: error: undefined symbol: wext_proc_exit
ld.lld: error: undefined symbol: wext_handle_ioctl
ld.lld: error: undefined symbol: compat_wext_handle_ioctl
minimized to 51 configs; suspects: [HAVE_CLK HID_ZEROPLUS USB_NET_CDC_SUBSET USB_NET_CDC_SUBSET_ENABLE USB_NET_DM9601 USB_NET_GL620A USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM V4L2_ASYNC V4L2_FWNODE VIDEO_CAMERA_SENSOR WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_PURELIFI WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_SILABS WLAN_VENDOR_ZYDAS ZEROPLUS_FF]
disabling configs for [locking atomic_sleep hang memleak ubsan bug_or_warning], they are not needed
testing current HEAD 8cef8b5b11b787631242c233cd45d2f0e112fbfb
testing commit 8cef8b5b11b787631242c233cd45d2f0e112fbfb gcc
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
kernel signature: 37f35698a06db4ad9b3ee654504a2ecf95edd68ce2f6485103380f8a464a7c86
run #0: crashed: KASAN: use-after-free Read in xattr_find_entry
run #1: crashed: KASAN: use-after-free Read in xattr_find_entry
run #2: crashed: KASAN: use-after-free Read in xattr_find_entry
run #3: crashed: KASAN: use-after-free Read in xattr_find_entry
run #4: crashed: KASAN: slab-out-of-bounds Read in xattr_find_entry
run #5: crashed: KASAN: use-after-free Read in xattr_find_entry
run #6: crashed: KASAN: use-after-free Read in xattr_find_entry
run #7: crashed: KASAN: use-after-free Read in xattr_find_entry
run #8: crashed: KASAN: use-after-free Read in xattr_find_entry
run #9: crashed: KASAN: use-after-free Read in xattr_find_entry
representative crash: KASAN: use-after-free Read in xattr_find_entry, types: [KASAN-USE-AFTER-FREE-READ]
crash still not fixed/happens on the oldest tested release
revisions tested: 7, total time: 1h33m17.339623924s (build: 24m21.586350076s, test: 41m59.841693454s)
crash still not fixed or there were kernel test errors
commit msg: ANDROID: fuse-bpf: Handle backing getattr errors
crash: KASAN: use-after-free Read in xattr_find_entry
==================================================================
BUG: KASAN: use-after-free in xattr_find_entry+0x280/0x290 fs/ext4/xattr.c:294
Read of size 4 at addr ffff88812cbe1004 by task syz.2.17/455

CPU: 0 PID: 455 Comm: syz.2.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 __dump_stack+0x19/0x1c lib/dump_stack.c:88
 dump_stack_lvl+0xcc/0x11c lib/dump_stack.c:106
 print_address_description+0x71/0x200 mm/kasan/report.c:316
 print_report+0x4a/0x60 mm/kasan/report.c:420
 kasan_report+0x122/0x150 mm/kasan/report.c:524
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:350
 xattr_find_entry+0x280/0x290 fs/ext4/xattr.c:294
 ext4_xattr_ibody_get+0x1e5/0x3d0 fs/ext4/xattr.c:601
 ext4_xattr_get+0xfb/0x530 fs/ext4/xattr.c:655
 ext4_get_acl+0x59/0x510 fs/ext4/acl.c:165
 get_acl+0x114/0x1d0 fs/posix_acl.c:153
 posix_acl_chmod+0xc5/0x1f0 fs/posix_acl.c:602
 ext4_setattr+0x80f/0x1600 fs/ext4/inode.c:5693
 notify_change+0x8d6/0xc40 fs/attr.c:499
 chmod_common+0x250/0x3a0 fs/open.c:607
 do_fchmodat+0xb5/0x150 fs/open.c:646
 __do_sys_fchmodat fs/open.c:659 [inline]
 __se_sys_fchmodat fs/open.c:656 [inline]
 __x64_sys_fchmodat+0x76/0x90 fs/open.c:656
 x64_sys_call+0x752/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:269
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f5da319e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5da3fe2028 EFLAGS: 00000246 ORIG_RAX: 000000000000010c
RAX: ffffffffffffffda RBX: 00007f5da3425fa0 RCX: 00007f5da319e0d9
RDX: 00000000ffffff50 RSI: 0000200000000300 RDI: ffffffffffffff9c
RBP: 00007f5da3235024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5da3426038 R14: 00007f5da3425fa0 R15: 00007ffce43aaf28
 </TASK>

The buggy address belongs to the physical page:
page:ffffea0004b2f840 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x12cbe1
flags: 0x4000000000000000(zone=1)
raw: 4000000000000000 ffffea0004b2f508 ffffea0004b2f908 0000000000000000
raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Movable, gfp_mask 0x8140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO|__GFP_CMA), pid 455, tgid 454 (syz.2.17), ts 37576093756, free_ts 37609318285
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook mm/page_alloc.c:2673 [inline]
 prep_new_page+0x594/0x660 mm/page_alloc.c:2680
 get_page_from_freelist+0x304b/0x30c0 mm/page_alloc.c:4587
 __alloc_pages+0x1fa/0x610 mm/page_alloc.c:5931
 __folio_alloc+0x12/0x40 mm/page_alloc.c:5964
 __folio_alloc_node include/linux/gfp.h:245 [inline]
 folio_alloc include/linux/gfp.h:274 [inline]
 alloc_page_vma include/linux/gfp.h:283 [inline]
 do_anonymous_page mm/memory.c:4286 [inline]
 handle_pte_fault mm/memory.c:5181 [inline]
 __handle_mm_fault mm/memory.c:5325 [inline]
 handle_mm_fault+0x10df/0x1b90 mm/memory.c:5465
 do_user_addr_fault+0x582/0x9b0 arch/x86/mm/fault.c:1321
 handle_page_fault arch/x86/mm/fault.c:1464 [inline]
 exc_page_fault+0x51/0xb0 arch/x86/mm/fault.c:1517
 asm_exc_page_fault+0x27/0x30 arch/x86/include/asm/idtentry.h:608
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 free_pages_prepare mm/page_alloc.c:1581 [inline]
 free_pcp_prepare mm/page_alloc.c:1655 [inline]
 free_unref_page_prepare+0x748/0x750 mm/page_alloc.c:3622
 free_unref_page_list+0x117/0x8c0 mm/page_alloc.c:3773
 release_pages+0x9c2/0xa20 mm/swap.c:1053
 free_pages_and_swap_cache+0x66/0x80 mm/swap_state.c:316
 tlb_batch_pages_flush mm/mmu_gather.c:59 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:254 [inline]
 tlb_flush_mmu mm/mmu_gather.c:261 [inline]
 tlb_finish_mmu+0x1b7/0x380 mm/mmu_gather.c:361
 unmap_region+0x2b5/0x320 mm/mmap.c:2419
 do_mas_align_munmap+0x9e4/0x1010 mm/mmap.c:2693
 do_mas_munmap+0x182/0x1f0 mm/mmap.c:2751
 __vm_munmap+0x197/0x2c0 mm/mmap.c:3050
 __do_sys_munmap mm/mmap.c:3076 [inline]
 __se_sys_munmap mm/mmap.c:3072 [inline]
 __x64_sys_munmap+0x66/0x70 mm/mmap.c:3072
 x64_sys_call+0x8a/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:12
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

Memory state around the buggy address:
 ffff88812cbe0f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88812cbe0f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88812cbe1000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                   ^
 ffff88812cbe1080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88812cbe1100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
EXT4-fs error (device loop2): xattr_find_entry:297: inode #12: comm syz.2.17: corrupted xattr entries
EXT4-fs (loop2): Remounting filesystem read-only