bisecting cause commit starting from 3b1f00aceb7a67bf079a5a64aa5c6baf78a8f442 building syzkaller on d4ea592f78feb8f04941a301b93e09880c3546a3 testing commit 3b1f00aceb7a67bf079a5a64aa5c6baf78a8f442 with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in do_mount run #1: crashed: KASAN: use-after-free Read in do_mount run #2: crashed: KASAN: use-after-free Read in do_mount run #3: crashed: KASAN: use-after-free Read in do_mount run #4: crashed: KASAN: use-after-free Read in do_mount run #5: crashed: KASAN: use-after-free Read in do_mount run #6: crashed: KASAN: use-after-free Read in do_mount run #7: crashed: KASAN: use-after-free Read in do_mount run #8: OK run #9: OK testing release v5.3 testing commit 4d856f72c10ecb060868ed10ff1b1453943fc6c8 with gcc (GCC) 8.1.0 all runs: OK # git bisect start 3b1f00aceb7a67bf079a5a64aa5c6baf78a8f442 v5.3 Bisecting: 6633 revisions left to test after this (roughly 13 steps) [81160dda9a7aad13c04e78bb2cfd3c4630e3afab] Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next testing commit 81160dda9a7aad13c04e78bb2cfd3c4630e3afab with gcc (GCC) 8.1.0 all runs: OK # git bisect good 81160dda9a7aad13c04e78bb2cfd3c4630e3afab Bisecting: 3292 revisions left to test after this (roughly 12 steps) [a703d279c57e1bfe2b6536c3a17c1c498b416d24] Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux testing commit a703d279c57e1bfe2b6536c3a17c1c498b416d24 with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in do_mount run #1: crashed: KASAN: use-after-free Read in do_mount run #2: crashed: KASAN: use-after-free Read in do_mount run #3: crashed: KASAN: use-after-free Read in do_mount run #4: crashed: KASAN: use-after-free Read in do_mount run #5: crashed: KASAN: use-after-free Read in do_mount run #6: OK run #7: OK run #8: OK run #9: OK # git bisect bad a703d279c57e1bfe2b6536c3a17c1c498b416d24 Bisecting: 1667 revisions left to test after this (roughly 11 steps) [29d9d76a72ce0d8485796c0f930007444684bff0] Merge tag 'drm-intel-next-2019-08-22' of git://anongit.freedesktop.org/drm/drm-intel into drm-next testing commit 29d9d76a72ce0d8485796c0f930007444684bff0 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 29d9d76a72ce0d8485796c0f930007444684bff0 Bisecting: 1008 revisions left to test after this (roughly 10 steps) [3c2edc36a77420d8be05d656019dbc8c31535992] Merge tag 'pinctrl-v5.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl testing commit 3c2edc36a77420d8be05d656019dbc8c31535992 with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in do_mount run #1: crashed: KASAN: use-after-free Read in do_mount run #2: crashed: KASAN: use-after-free Read in do_mount run #3: crashed: KASAN: use-after-free Read in do_mount run #4: crashed: KASAN: use-after-free Read in do_mount run #5: crashed: KASAN: use-after-free Read in do_mount run #6: crashed: KASAN: use-after-free Read in do_mount run #7: crashed: KASAN: use-after-free Read in do_mount run #8: OK run #9: OK # git bisect bad 3c2edc36a77420d8be05d656019dbc8c31535992 Bisecting: 345 revisions left to test after this (roughly 8 steps) [7a0d796100daa8e75cda2c166c85d57775704fd4] Merge tag 'for-linus-5.4-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux testing commit 7a0d796100daa8e75cda2c166c85d57775704fd4 with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in do_mount run #1: crashed: KASAN: use-after-free Read in do_mount run #2: crashed: KASAN: use-after-free Read in do_mount run #3: crashed: KASAN: use-after-free Read in do_mount run #4: crashed: KASAN: use-after-free Read in do_mount run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect bad 7a0d796100daa8e75cda2c166c85d57775704fd4 Bisecting: 174 revisions left to test after this (roughly 7 steps) [6af112b11a4bc1b560f60a618ac9c1dcefe9836e] btrfs: Relinquish CPUs in btrfs_compare_trees testing commit 6af112b11a4bc1b560f60a618ac9c1dcefe9836e with gcc (GCC) 8.1.0 all runs: OK # git bisect good 6af112b11a4bc1b560f60a618ac9c1dcefe9836e Bisecting: 89 revisions left to test after this (roughly 7 steps) [e6bc9de714972cac34daa1dc1567ee48a47a9342] Merge tag 'vfs-5.4-merge-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux testing commit e6bc9de714972cac34daa1dc1567ee48a47a9342 with gcc (GCC) 8.1.0 all runs: OK # git bisect good e6bc9de714972cac34daa1dc1567ee48a47a9342 Bisecting: 44 revisions left to test after this (roughly 6 steps) [14e15f1bcd738dc13dd7c1e78e4800e8bc577980] xfs: push the grant head when the log head moves forward testing commit 14e15f1bcd738dc13dd7c1e78e4800e8bc577980 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 14e15f1bcd738dc13dd7c1e78e4800e8bc577980 Bisecting: 22 revisions left to test after this (roughly 5 steps) [cfb82e1df8b7c76991ea12958855897c2fb4debc] Merge tag 'y2038-vfs' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/playground testing commit cfb82e1df8b7c76991ea12958855897c2fb4debc with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in do_mount run #1: crashed: KASAN: use-after-free Read in do_mount run #2: crashed: KASAN: use-after-free Read in do_mount run #3: crashed: KASAN: use-after-free Read in do_mount run #4: OK run #5: OK run #6: crashed: KASAN: use-after-free Read in do_mount run #7: OK run #8: OK run #9: OK # git bisect bad cfb82e1df8b7c76991ea12958855897c2fb4debc Bisecting: 10 revisions left to test after this (roughly 4 steps) [c0da64f6bb674d20a8e84bcd30679c1483668fb2] fs: fat: Initialize filesystem timestamp ranges testing commit c0da64f6bb674d20a8e84bcd30679c1483668fb2 with gcc (GCC) 8.1.0 all runs: OK # git bisect good c0da64f6bb674d20a8e84bcd30679c1483668fb2 Bisecting: 5 revisions left to test after this (roughly 3 steps) [8833293d0accf2b6a9ddaaafd198f7e1bf1d3dc6] fs: omfs: Initialize filesystem timestamp ranges testing commit 8833293d0accf2b6a9ddaaafd198f7e1bf1d3dc6 with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in do_mount run #1: OK run #2: crashed: KASAN: use-after-free Read in do_mount run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect bad 8833293d0accf2b6a9ddaaafd198f7e1bf1d3dc6 Bisecting: 2 revisions left to test after this (roughly 1 step) [452c2779410a03ac0c6be0a8a91c83aa80bdd7e5] fs: sysv: Initialize filesystem timestamp ranges testing commit 452c2779410a03ac0c6be0a8a91c83aa80bdd7e5 with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in do_mount run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect bad 452c2779410a03ac0c6be0a8a91c83aa80bdd7e5 Bisecting: 0 revisions left to test after this (roughly 0 steps) [487b25bc4be9c15a5edb81c4e52160b5e84d1c4f] fs: affs: Initialize filesystem timestamp ranges testing commit 487b25bc4be9c15a5edb81c4e52160b5e84d1c4f with gcc (GCC) 8.1.0 all runs: OK # git bisect good 487b25bc4be9c15a5edb81c4e52160b5e84d1c4f 452c2779410a03ac0c6be0a8a91c83aa80bdd7e5 is the first bad commit commit 452c2779410a03ac0c6be0a8a91c83aa80bdd7e5 Author: Deepa Dinamani Date: Fri Mar 8 12:40:03 2019 -0800 fs: sysv: Initialize filesystem timestamp ranges Fill in the appropriate limits to avoid inconsistencies in the vfs cached inode times when timestamps are outside the permitted range. Signed-off-by: Deepa Dinamani Acked-by: Jeff Layton Cc: hch@infradead.org :040000 040000 9ae44bb720f288d200da176b328e7b0dd405c219 98a6142c541c4f7427a535460a09b7e5458ad2b0 M fs revisions tested: 15, total time: 4h4m35.199662714s (build: 1h28m2.853891716s, test: 2h31m40.163045892s) first bad commit: 452c2779410a03ac0c6be0a8a91c83aa80bdd7e5 fs: sysv: Initialize filesystem timestamp ranges cc: ["akpm@osdl.org" "deepa.kernel@gmail.com" "hch@infradead.org" "jlayton@kernel.org" "linux-kernel@vger.kernel.org" "lkundrak@v3.sk" "tklauser@nuerscht.ch" "trond.myklebust@fys.uio.no" "viro@zeniv.linux.org.uk"] crash: KASAN: use-after-free Read in do_mount ================================================================== BUG: KASAN: use-after-free in do_new_mount_fc fs/namespace.c:2770 [inline] BUG: KASAN: use-after-free in do_new_mount fs/namespace.c:2824 [inline] BUG: KASAN: use-after-free in do_mount+0x19a7/0x1bd0 fs/namespace.c:3142 Read of size 8 at addr ffff88808f61b7e8 by task syz-executor.1/15103 CPU: 1 PID: 15103 Comm: syz-executor.1 Not tainted 5.3.0-rc6+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x113/0x167 lib/dump_stack.c:113 print_address_description.cold.8+0x9/0x318 mm/kasan/report.c:351 __kasan_report.cold.9+0x1b/0x3f mm/kasan/report.c:482 kasan_report+0x12/0x17 mm/kasan/common.c:618 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:132 do_new_mount_fc fs/namespace.c:2770 [inline] do_new_mount fs/namespace.c:2824 [inline] do_mount+0x19a7/0x1bd0 fs/namespace.c:3142 ksys_mount+0xba/0xe0 fs/namespace.c:3351 __do_sys_mount fs/namespace.c:3365 [inline] __se_sys_mount fs/namespace.c:3362 [inline] __x64_sys_mount+0xb9/0x150 fs/namespace.c:3362 do_syscall_64+0xd0/0x540 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x459a59 Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ff2ca5c6c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000459a59 RDX: 0000000020000a40 RSI: 00000000200005c0 RDI: 0000000000000000 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff2ca5c76d4 R13: 00000000004c62a4 R14: 00000000004db438 R15: 00000000ffffffff Allocated by task 15103: save_stack+0x21/0x90 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_kmalloc.constprop.9+0xc7/0xd0 mm/kasan/common.c:493 kasan_slab_alloc+0x12/0x20 mm/kasan/common.c:501 slab_post_alloc_hook mm/slab.h:520 [inline] slab_alloc mm/slab.c:3319 [inline] kmem_cache_alloc+0x121/0x750 mm/slab.c:3483 kmem_cache_zalloc include/linux/slab.h:738 [inline] alloc_vfsmnt+0x21/0x620 fs/namespace.c:177 vfs_create_mount+0x8a/0x4b0 fs/namespace.c:940 do_new_mount_fc fs/namespace.c:2760 [inline] do_new_mount fs/namespace.c:2824 [inline] do_mount+0x14c1/0x1bd0 fs/namespace.c:3142 ksys_mount+0xba/0xe0 fs/namespace.c:3351 __do_sys_mount fs/namespace.c:3365 [inline] __se_sys_mount fs/namespace.c:3362 [inline] __x64_sys_mount+0xb9/0x150 fs/namespace.c:3362 do_syscall_64+0xd0/0x540 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 16: save_stack+0x21/0x90 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:455 kasan_slab_free+0xe/0x10 mm/kasan/common.c:463 __cache_free mm/slab.c:3425 [inline] kmem_cache_free+0x83/0x320 mm/slab.c:3693 free_vfsmnt+0x62/0x80 fs/namespace.c:554 delayed_free_vfsmnt+0xd/0x10 fs/namespace.c:559 __rcu_reclaim kernel/rcu/rcu.h:222 [inline] rcu_do_batch kernel/rcu/tree.c:2114 [inline] rcu_core+0x65e/0x14c0 kernel/rcu/tree.c:2314 rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2323 __do_softirq+0x262/0x9a8 kernel/softirq.c:292 The buggy address belongs to the object at ffff88808f61b7c0 which belongs to the cache mnt_cache of size 312 The buggy address is located 40 bytes inside of 312-byte region [ffff88808f61b7c0, ffff88808f61b8f8) The buggy address belongs to the page: page:ffffea00023d86c0 refcount:1 mapcount:0 mapping:ffff8880aa593a80 index:0x0 flags: 0x1fffc0000000200(slab) raw: 01fffc0000000200 ffffea0002879148 ffffea0002593f48 ffff8880aa593a80 raw: 0000000000000000 ffff88808f61b040 000000010000000a 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88808f61b680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88808f61b700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc >ffff88808f61b780: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ^ ffff88808f61b800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88808f61b880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc ==================================================================