ci starts bisection 2023-09-29 08:42:21.199360124 +0000 UTC m=+21270.281562668 bisecting fixing commit since b6e6cc1f78c772e952495b7416c9ac9029f9390c building syzkaller on 35d9ecc508aef508b67ee7986a7abb0864e74f8e ensuring issue is reproducible on original commit b6e6cc1f78c772e952495b7416c9ac9029f9390c testing commit b6e6cc1f78c772e952495b7416c9ac9029f9390c gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: d24a485ac324fa3d30604699ee1720fbe8142b96a0650d0583b1020d090a0a26 run #0: crashed: general protection fault in put_prev_entity run #1: crashed: BUG: unable to handle kernel paging request in corrupted run #2: crashed: BUG: unable to handle kernel paging request in ext4_ext_remove_space run #3: crashed: general protection fault in rcu_core run #4: crashed: general protection fault in update_curr run #5: crashed: general protection fault in corrupted run #6: crashed: general protection fault in psi_task_switch run #7: crashed: KASAN: wild-memory-access Read in lockref_get run #8: crashed: general protection fault in update_curr run #9: crashed: general protection fault in cpuacct_account_field run #10: crashed: general protection fault in __hrtimer_run_queues run #11: crashed: KASAN: wild-memory-access Read in fsnotify_perm run #12: crashed: general protection fault in ext4_handle_error run #13: crashed: general protection fault in cpuacct_account_field run #14: crashed: general protection fault in cpuacct_account_field run #15: crashed: general protection fault in __hrtimer_run_queues run #16: crashed: general protection fault in debug_check_no_obj_freed run #17: crashed: general protection fault in descriptor_loc run #18: crashed: no output from test machine run #19: crashed: BUG: unable to handle kernel paging request in corrupted representative crash: general protection fault in put_prev_entity, types: [UNKNOWN] check whether we can drop unnecessary instrumentation disabling configs for [HANG LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit b6e6cc1f78c772e952495b7416c9ac9029f9390c gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 75ccc5aa9d0ca553cd96f4696abd7bbcce8111d49047e13515c2023901e2049a all runs: OK false negative chance: 0.000 kconfig minimization: base=3883 full=7652 leaves diff=1999 split chunks (needed=false): <1999> split chunk #0 of len 1999 into 5 parts testing without sub-chunk 1/5 testing commit b6e6cc1f78c772e952495b7416c9ac9029f9390c gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: db8d975a848171f8c11320e0cd307df27097c9eed8a50d0e773508ff5923d499 run #0: crashed: BUG: unable to handle kernel paging request in ext4_ext_remove_space run #1: crashed: general protection fault in anon_vma_interval_tree_remove run #2: crashed: BUG: unable to handle kernel paging request in ext4_ext_remove_space run #3: crashed: general protection fault in psi_account_irqtime run #4: crashed: general protection fault in __d_alloc run #5: crashed: kernel panic: Attempted to kill init! run #6: crashed: general protection fault in debug_check_no_obj_freed run #7: crashed: BUG: unable to handle kernel paging request in ext4_ext_remove_space run #8: crashed: general protection fault in rcu_core run #9: crashed: WARNING: locking bug in unlink_file_vma representative crash: BUG: unable to handle kernel paging request in ext4_ext_remove_space, types: [UNKNOWN] the chunk can be dropped testing without sub-chunk 2/5 testing commit b6e6cc1f78c772e952495b7416c9ac9029f9390c gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 178fd81cd4c78a0d77a9cfe2eb21642b844ad3cdf3948c6e039d26bc262f5a21 run #0: crashed: general protection fault in locks_remove_posix run #1: crashed: general protection fault in inode_permission run #2: crashed: kernel BUG in corrupted run #3: crashed: general protection fault in __hrtimer_run_queues run #4: crashed: kernel BUG in __phys_addr run #5: crashed: WARNING: locking bug in __lock_task_sighand run #6: OK run #7: crashed: general protection fault in __hrtimer_run_queues run #8: crashed: general protection fault in mm_update_next_owner run #9: crashed: general protection fault in cpuacct_charge representative crash: general protection fault in locks_remove_posix, types: [UNKNOWN BUG] the chunk can be dropped testing without sub-chunk 3/5 testing commit b6e6cc1f78c772e952495b7416c9ac9029f9390c gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 5347c867217ef1c6cb7739ca017e8db92fed1f7e3e7146af1519d37a34ce44fd run #0: crashed: KASAN: stack-out-of-bounds Read in timerqueue_del run #1: crashed: general protection fault in __d_alloc run #2: crashed: general protection fault in end_bio_bh_io_sync run #3: crashed: general protection fault in ext4_handle_error run #4: crashed: general protection fault in lookup_object_or_alloc run #5: crashed: general protection fault in __fput run #6: crashed: general protection fault in do_exit run #7: OK run #8: crashed: general protection fault in __fput run #9: OK representative crash: general protection fault in __d_alloc, types: [UNKNOWN] the chunk can be dropped testing without sub-chunk 4/5 testing commit b6e6cc1f78c772e952495b7416c9ac9029f9390c gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 4c5b961642edf527cab911ff7ea05ade85be48f155221dff116ded519ea031b1 run #0: crashed: general protection fault in __run_timers run #1: crashed: BUG: unable to handle kernel paging request in pid_task run #2: crashed: WARNING: locking bug in dput run #3: crashed: general protection fault in dequeue_task_fair run #4: crashed: WARNING: locking bug in dput run #5: crashed: kernel BUG in __phys_addr run #6: crashed: general protection fault in fsnotify_perm run #7: crashed: general protection fault in __es_tree_search run #8: crashed: general protection fault in unlink_anon_vmas run #9: crashed: KASAN: wild-memory-access Write in filemap_get_entry representative crash: general protection fault in __run_timers, types: [UNKNOWN LOCKDEP] the chunk can be dropped testing without sub-chunk 5/5 testing commit b6e6cc1f78c772e952495b7416c9ac9029f9390c gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 6d199d4af6278cdbf274451e030c6bd38a5546aaaf307a63f5e17c22dcf1da85 run #0: crashed: BUG: unable to handle kernel paging request in vfs_fsync run #1: crashed: KASAN: stack-out-of-bounds Read in timerqueue_del run #2: crashed: general protection fault in __fput run #3: crashed: BUG: corrupted list in dquot_disable run #4: crashed: general protection fault in fsnotify run #5: crashed: KFENCE: invalid read in ext4_ext_remove_space run #6: crashed: WARNING: locking bug in dput run #7: crashed: BUG: unable to handle kernel paging request in mempool_alloc run #8: crashed: kernel panic: corrupted stack end in corrupted run #9: OK representative crash: BUG: unable to handle kernel paging request in vfs_fsync, types: [UNKNOWN KASAN] the chunk can be dropped testing current HEAD 9ed22ae6be817d7a3f5c15ca22cbc9d3963b481d testing commit 9ed22ae6be817d7a3f5c15ca22cbc9d3963b481d gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: aeacbdacb79025e1bdbcd1b08dbccd894472cef414ed31954a8e518b0941c29e run #0: crashed: KFENCE: invalid read in ext4_ext_remove_space run #1: crashed: possible deadlock in try_to_wake_up run #2: crashed: general protection fault in pid_task run #3: crashed: kernel BUG in __phys_addr run #4: crashed: BUG: unable to handle kernel paging request in do_get_write_access run #5: crashed: BUG: unable to handle kernel paging request in corrupted run #6: crashed: general protection fault in rcu_core run #7: OK run #8: OK run #9: OK representative crash: KFENCE: invalid read in ext4_ext_remove_space, types: [UNKNOWN LOCKDEP] crash still not fixed/happens on the oldest tested release revisions tested: 8, total time: 2h16m52.03608008s (build: 55m56.622335392s, test: 1h16m17.082173691s) crash still not fixed or there were kernel test errors commit msg: Merge tag 'spi-fix-v6.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi crash: KFENCE: invalid read in ext4_ext_remove_space ================================================================== BUG: KFENCE: invalid read in memmove+0x4c/0x1b0 arch/x86/lib/memmove_64.S:69 Invalid read at 0xffff8881f6200000: memmove+0x4c/0x1b0 arch/x86/lib/memmove_64.S:69 ext4_ext_rm_leaf fs/ext4/extents.c:2736 [inline] ext4_ext_remove_space+0x117a/0x3f30 fs/ext4/extents.c:2958 ext4_punch_hole+0xb89/0xec0 fs/ext4/inode.c:4011 ext4_fallocate+0x3af/0x3010 fs/ext4/extents.c:4706 vfs_fallocate+0x296/0xbb0 fs/open.c:324 ioctl_preallocate+0x15b/0x1d0 fs/ioctl.c:291 file_ioctl fs/ioctl.c:334 [inline] do_vfs_ioctl+0x1336/0x14d0 fs/ioctl.c:850 __do_sys_ioctl fs/ioctl.c:869 [inline] __se_sys_ioctl fs/ioctl.c:857 [inline] __x64_sys_ioctl+0xcc/0x1a0 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd CPU: 0 PID: 6159 Comm: syz-executor.2 Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 RIP: 0010:memmove+0x4c/0x1b0 arch/x86/lib/memmove_64.S:70 Code: 01 00 00 66 0f 1f 44 00 00 48 81 fa a8 02 00 00 72 05 40 38 fe 74 47 48 83 ea 20 48 83 ea 20 4c 8b 1e 4c 8b 56 08 4c 8b 4e 10 <4c> 8b 46 18 48 8d 76 20 4c 89 1f 4c 89 57 08 4c 89 4f 10 4c 89 47 RSP: 0018:ffffc90004dbf838 EFLAGS: 00010286 RAX: ffff888128fb0078 RBX: ffff888128fb0002 RCX: ffff888128fb0000 RDX: ffffffff32daffe8 RSI: ffff8881f61fffe4 RDI: ffff8881f61fffd8 RBP: ffff888128fb0078 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff888128fb007c R14: dffffc0000000000 R15: dffffc0000000000 FS: 00007fbd3c3ac6c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff8881f6200000 CR3: 0000000100f1e000 CR4: 0000000000350ef0 Call Trace: ext4_ext_rm_leaf fs/ext4/extents.c:2736 [inline] ext4_ext_remove_space+0x117a/0x3f30 fs/ext4/extents.c:2958 ext4_punch_hole+0xb89/0xec0 fs/ext4/inode.c:4011 ext4_fallocate+0x3af/0x3010 fs/ext4/extents.c:4706 vfs_fallocate+0x296/0xbb0 fs/open.c:324 ioctl_preallocate+0x15b/0x1d0 fs/ioctl.c:291 file_ioctl fs/ioctl.c:334 [inline] do_vfs_ioctl+0x1336/0x14d0 fs/ioctl.c:850 __do_sys_ioctl fs/ioctl.c:869 [inline] __se_sys_ioctl fs/ioctl.c:857 [inline] __x64_sys_ioctl+0xcc/0x1a0 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fbd44c0ab29 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fbd3c3ac0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fbd44d2a050 RCX: 00007fbd44c0ab29 RDX: 0000000020000080 RSI: 000000004030582b RDI: 0000000000000004 RBP: 00007fbd44c5647a R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000006e R14: 00007fbd44d2a050 R15: 00007fffd97a2248 ================================================================== ---------------- Code disassembly (best guess), 1 bytes skipped: 0: 00 00 add %al,(%rax) 2: 66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1) 8: 48 81 fa a8 02 00 00 cmp $0x2a8,%rdx f: 72 05 jb 0x16 11: 40 38 fe cmp %dil,%sil 14: 74 47 je 0x5d 16: 48 83 ea 20 sub $0x20,%rdx 1a: 48 83 ea 20 sub $0x20,%rdx 1e: 4c 8b 1e mov (%rsi),%r11 21: 4c 8b 56 08 mov 0x8(%rsi),%r10 25: 4c 8b 4e 10 mov 0x10(%rsi),%r9 * 29: 4c 8b 46 18 mov 0x18(%rsi),%r8 <-- trapping instruction 2d: 48 8d 76 20 lea 0x20(%rsi),%rsi 31: 4c 89 1f mov %r11,(%rdi) 34: 4c 89 57 08 mov %r10,0x8(%rdi) 38: 4c 89 4f 10 mov %r9,0x10(%rdi) 3c: 4c rex.WR 3d: 89 .byte 0x89 3e: 47 rex.RXB