ci2 starts bisection 2024-11-17 18:17:50.088947567 +0000 UTC m=+174923.671940952
bisecting cause commit starting from b5a24181e461e8bfa8cdf35e1804679dc1bebcdd
building syzkaller on cfe3a04a188eb9a2c407783d8d6e6f55a4b30886
ensuring issue is reproducible on original commit b5a24181e461e8bfa8cdf35e1804679dc1bebcdd

testing commit b5a24181e461e8bfa8cdf35e1804679dc1bebcdd gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 51e67f16b12a7656c60d3fe23e860b3f011959193d88184a66e3a21cf367ecda
all runs: crashed: KASAN: use-after-free Read in nilfs_find_entry
representative crash: KASAN: use-after-free Read in nilfs_find_entry, types: [KASAN]
check whether we can drop unnecessary instrumentation
disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed
testing commit b5a24181e461e8bfa8cdf35e1804679dc1bebcdd gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 728e0de9b011a8f2567e8dbb5de329c982dfb5f35eaf8e21d94e4c5f59a387be
run #0: crashed: KASAN: use-after-free Read in nilfs_find_entry
run #1: crashed: KASAN: use-after-free Read in nilfs_find_entry
run #2: crashed: KASAN: use-after-free Read in nilfs_find_entry
run #3: crashed: KASAN: use-after-free Read in nilfs_find_entry
run #4: crashed: KASAN: out-of-bounds Read in nilfs_find_entry
run #5: crashed: KASAN: use-after-free Read in nilfs_find_entry
run #6: crashed: KASAN: use-after-free Read in nilfs_find_entry
run #7: crashed: KASAN: use-after-free Read in nilfs_find_entry
run #8: crashed: KASAN: use-after-free Read in nilfs_find_entry
run #9: crashed: KASAN: use-after-free Read in nilfs_find_entry
representative crash: KASAN: use-after-free Read in nilfs_find_entry, types: [KASAN]
the bug reproduces without the instrumentation
disabling configs for [BUG LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed
kconfig minimization: base=4037 full=8184 leaves diff=2110
split chunks (needed=false): <2110>
split chunk #0 of len 2110 into 5 parts
testing without sub-chunk 1/5
disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed
testing commit b5a24181e461e8bfa8cdf35e1804679dc1bebcdd gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: c76c791bb52f3dc84931c16ad01007842c5c92125b2b307dfedcbf80faefd1fc
all runs: crashed: KASAN: use-after-free Read in nilfs_find_entry
representative crash: KASAN: use-after-free Read in nilfs_find_entry, types: [KASAN]
the chunk can be dropped
testing without sub-chunk 2/5
disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed
testing commit b5a24181e461e8bfa8cdf35e1804679dc1bebcdd gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 814239bd4b3554338aa58911b0bbeecd68babf9ba7fdbc18c113364ebd593af0
all runs: crashed: KASAN: use-after-free Read in nilfs_find_entry
representative crash: KASAN: use-after-free Read in nilfs_find_entry, types: [KASAN]
the chunk can be dropped
testing without sub-chunk 3/5
disabling configs for [UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed
testing commit b5a24181e461e8bfa8cdf35e1804679dc1bebcdd gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 8a59a972d152d3100e749a394507db7f0726c6d75a58ef9e9af273030814268d
all runs: OK
false negative chance: 0.000
testing without sub-chunk 4/5
disabling configs for [BUG LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed
testing commit b5a24181e461e8bfa8cdf35e1804679dc1bebcdd gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 3d03aeb178ac485de4b184e6f743a17d8b1cdf15e1947449c072a6d3720ce0b0
all runs: crashed: KASAN: use-after-free Read in nilfs_find_entry
representative crash: KASAN: use-after-free Read in nilfs_find_entry, types: [KASAN]
the chunk can be dropped
testing without sub-chunk 5/5
disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed
testing commit b5a24181e461e8bfa8cdf35e1804679dc1bebcdd gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: b4fcbe5d9d1feffa2a8004af999be036d903f00517bb07663c3b3ba8ce68ef4c
all runs: crashed: KASAN: use-after-free Read in nilfs_find_entry
representative crash: KASAN: use-after-free Read in nilfs_find_entry, types: [KASAN]
the chunk can be dropped
minimized to 422 configs; suspects: [AX25 BRIDGE BRIDGE_NETFILTER CAN CFG80211 CHECKPOINT_RESTORE DVB_CORE FB_CORE HAMRADIO HID_NINTENDO HSR INFINIBAND INFINIBAND_ADDR_TRANS INFINIBAND_USER_ACCESS INPUT_JOYSTICK INPUT_MOUSE IP6_NF_RAW IPV6_MULTIPLE_TABLES IP_NF_RAW IP_SET IP_VS IP_VS_MH IP_VS_NFCT IP_VS_NQ IP_VS_OVF IP_VS_PE_SIP IP_VS_PROTO_AH IP_VS_PROTO_AH_ESP IP_VS_PROTO_ESP IP_VS_PROTO_SCTP IP_VS_PROTO_UDP IP_VS_RR IP_VS_SED IP_VS_SH IP_VS_TWOS IP_VS_WLC IP_VS_WRR IRQ_BYPASS_MANAGER IRQ_POLL IR_IGORPLUGUSB IR_IGUANA IR_IMON IR_IMON_RAW IR_MCEUSB IR_REDRAT3 IR_STREAMZAP IR_TOY IR_TTUSBIR ISDN ISDN_CAPI JFFS2_CMODE_PRIORITY JFFS2_COMPRESSION_OPTIONS JFFS2_FS JFFS2_FS_POSIX_ACL JFFS2_FS_SECURITY JFFS2_FS_WRITEBUFFER JFFS2_FS_XATTR JFFS2_LZO JFFS2_RTIME JFFS2_RUBIN JFFS2_SUMMARY JFFS2_ZLIB JFS_DEBUG JFS_FS JFS_POSIX_ACL JFS_SECURITY JOYSTICK_IFORCE JOYSTICK_IFORCE_USB JOYSTICK_PXRC JOYSTICK_XPAD JOYSTICK_XPAD_FF JOYSTICK_XPAD_LEDS KARMA_PARTITION KCOV KCOV_ENABLE_COMPARISONS KCOV_INSTRUMENT_ALL KEYS_REQUEST_CACHE KEY_DH_OPERATIONS KEY_NOTIFICATIONS KSM KVM KVM_AMD KVM_ASYNC_PF KVM_COMMON KVM_COMPAT KVM_GENERIC_DIRTYLOG_READ_PROTECT KVM_GENERIC_HARDWARE_ENABLING KVM_GENERIC_MEMORY_ATTRIBUTES KVM_GENERIC_MMU_NOTIFIER KVM_GENERIC_PRE_FAULT_MEMORY KVM_GENERIC_PRIVATE_MEM KVM_HYPERV KVM_MMIO KVM_PRIVATE_MEM KVM_PROVE_MMU KVM_SW_PROTECTED_VM KVM_VFIO KVM_X86 KVM_XEN KVM_XFER_TO_GUEST_WORK L2TP L2TP_ETH L2TP_IP L2TP_V3 LAPB LAPBETHER LDM_PARTITION LEGACY_PTYS LIBCRC32C LIBNVDIMM LINEAR_RANGES LLC LLC2 LOGIG940_FF LOGIRUMBLEPAD2_FF LOGO LOGO_LINUX_MONO LOGO_LINUX_VGA16 LPC_ICH LWTUNNEL LWTUNNEL_BPF LZ4HC_COMPRESS LZ4_COMPRESS MAC80211 MAC80211_HAS_RC MAC80211_HWSIM MAC80211_MESH MAC80211_RC_DEFAULT_MINSTREL MAC80211_RC_MINSTREL MACSEC MACVLAN MACVTAP MAC_PARTITION MAPPING_DIRTY_HELPERS MDIO_MVUSB MD_RAID0 MD_RAID1 MD_RAID10 MD_RAID456 MEDIA_ANALOG_TV_SUPPORT MEDIA_ATTACH MEDIA_CONTROLLER MEDIA_CONTROLLER_DVB MEDIA_DIGITAL_TV_SUPPORT MEDIA_RADIO_SUPPORT MEDIA_SDR_SUPPORT MEDIA_SUPPORT MEDIA_SUPPORT_FILTER MEDIA_TUNER MEDIA_TUNER_MSI001 MEMORY_BALLOON MEMORY_HOTPLUG MEMORY_HOTPLUG_DEFAULT_ONLINE MEMORY_ISOLATION MEMREGION MEMSTICK MEMSTICK_REALTEK_USB MEM_SOFT_DIRTY MFD_CORE MFD_SYSCON MHI_BUS MHI_WWAN_CTRL MHP_MEMMAP_ON_MEMORY MICROCHIP_PHY MINIX_FS MINIX_SUBPARTITION MISC_RTSX MISC_RTSX_USB MISDN MISDN_DSP MISDN_HFCUSB MISDN_L1OIP MKISS MLX4_CORE MLX4_INFINIBAND MMC MMC_REALTEK_USB MMC_USHC MMC_VUB300 MODULE_SRCVERSION_ALL MODVERSIONS MOST MOST_USB_HDM MOUSE_APPLETOUCH MOUSE_BCM5974 MOUSE_PS2 MOUSE_PS2_ALPS MOUSE_PS2_BYD MOUSE_PS2_CYPRESS MOUSE_PS2_FOCALTECH MOUSE_PS2_LIFEBOOK MOUSE_PS2_LOGIPS2PP MOUSE_PS2_SMBUS MOUSE_PS2_SYNAPTICS MOUSE_PS2_SYNAPTICS_SMBUS MOUSE_PS2_TRACKPOINT MOUSE_SYNAPTICS_USB MPLS MPLS_IPTUNNEL MPLS_ROUTING MPTCP MPTCP_IPV6 MRP MTD MTD_BLKDEVS MTD_BLOCK MTD_BLOCK2MTD MTD_CFI_I1 MTD_CFI_I2 MTD_MAP_BANK_WIDTH_1 MTD_MAP_BANK_WIDTH_2 MTD_MAP_BANK_WIDTH_4 MTD_MTDRAM MTD_PHRAM MTD_SLRAM MUSB_PIO_ONLY ND_BTT ND_CLAIM ND_PFN NETDEVSIM NETFILTER_ADVANCED NETFILTER_BPF_LINK NETFILTER_FAMILY_ARP NETFILTER_FAMILY_BRIDGE NETFILTER_NETLINK_ACCT NETFILTER_NETLINK_GLUE_CT NETFILTER_NETLINK_OSF NETFILTER_NETLINK_QUEUE NETFILTER_SYNPROXY NETFILTER_XTABLES_COMPAT NETFILTER_XT_CONNMARK NETFILTER_XT_MATCH_BPF NETFILTER_XT_MATCH_CGROUP NETFILTER_XT_MATCH_CLUSTER NETFILTER_XT_MATCH_COMMENT NETFILTER_XT_MATCH_CONNBYTES NETFILTER_XT_MATCH_CONNLABEL NETFILTER_XT_MATCH_CONNLIMIT NETFILTER_XT_MATCH_CONNMARK NETFILTER_XT_MATCH_CPU NETFILTER_XT_MATCH_DCCP NETFILTER_XT_MATCH_DEVGROUP NETFILTER_XT_MATCH_DSCP NETFILTER_XT_MATCH_ECN NETFILTER_XT_MATCH_ESP NETFILTER_XT_MATCH_HASHLIMIT NETFILTER_XT_MATCH_HELPER NETFILTER_XT_MATCH_HL NETFILTER_XT_MATCH_IPCOMP NETFILTER_XT_MATCH_IPRANGE NETFILTER_XT_MATCH_IPVS NETFILTER_XT_MATCH_L2TP NETFILTER_XT_MATCH_LENGTH NETFILTER_XT_MATCH_LIMIT NETFILTER_XT_MATCH_MAC NETFILTER_XT_MATCH_MARK NETFILTER_XT_MATCH_MULTIPORT NETFILTER_XT_MATCH_NFACCT NETFILTER_XT_MATCH_OSF NETFILTER_XT_MATCH_OWNER NETFILTER_XT_MATCH_PHYSDEV NETFILTER_XT_MATCH_PKTTYPE NETFILTER_XT_MATCH_QUOTA NETFILTER_XT_MATCH_RATEEST NETFILTER_XT_MATCH_REALM NETFILTER_XT_MATCH_RECENT NETFILTER_XT_MATCH_SCTP NETFILTER_XT_MATCH_SOCKET NETFILTER_XT_MATCH_STATISTIC NETFILTER_XT_MATCH_STRING NETFILTER_XT_MATCH_TCPMSS NETFILTER_XT_MATCH_TIME NETFILTER_XT_MATCH_U32 NETFILTER_XT_SET NETFILTER_XT_TARGET_AUDIT NETFILTER_XT_TARGET_CHECKSUM NETFILTER_XT_TARGET_CLASSIFY NETFILTER_XT_TARGET_CONNMARK NETFILTER_XT_TARGET_CT NETFILTER_XT_TARGET_DSCP NETFILTER_XT_TARGET_HL NETFILTER_XT_TARGET_HMARK NETFILTER_XT_TARGET_IDLETIMER NETFILTER_XT_TARGET_LED NETFILTER_XT_TARGET_MARK NETFILTER_XT_TARGET_NETMAP NETFILTER_XT_TARGET_NFQUEUE NETFILTER_XT_TARGET_NOTRACK NETFILTER_XT_TARGET_RATEEST NETFILTER_XT_TARGET_REDIRECT NETFILTER_XT_TARGET_TCPOPTSTRIP NETFILTER_XT_TARGET_TEE NETFILTER_XT_TARGET_TPROXY NETFILTER_XT_TARGET_TRACE NETLINK_DIAG NETROM NET_9P_RDMA NET_ACT_BPF NET_ACT_CONNMARK NET_ACT_CSUM NET_ACT_CT NET_ACT_CTINFO NET_ACT_GATE NET_ACT_IFE NET_ACT_MPLS NET_ACT_NAT NET_ACT_PEDIT NET_ACT_POLICE NET_ACT_SAMPLE NET_ACT_SIMP NET_ACT_SKBEDIT NET_ACT_SKBMOD NET_ACT_TUNNEL_KEY NET_ACT_VLAN NET_CLS_BASIC NET_CLS_BPF NET_CLS_FLOW NET_CLS_FLOWER NET_CLS_FW NET_CLS_MATCHALL NET_CLS_ROUTE4 NET_DEVLINK NET_DEVMEM NET_DROP_MONITOR NET_DSA NET_DSA_TAG_BRCM NET_DSA_TAG_BRCM_COMMON NET_DSA_TAG_BRCM_PREPEND NET_DSA_TAG_MTK NET_DSA_TAG_QCA NET_DSA_TAG_RTL4_A NET_EMATCH_CANID NET_EMATCH_CMP NET_EMATCH_IPSET NET_EMATCH_IPT NET_EMATCH_META NET_EMATCH_NBYTE NET_EMATCH_TEXT NET_EMATCH_U32 NET_FC NET_FOU NET_FOU_IP_TUNNELS NET_IFE NET_IFE_SKBMARK NET_IFE_SKBPRIO NET_IFE_SKBTCINDEX NET_IPGRE NET_IPGRE_BROADCAST NET_IPGRE_DEMUX NET_IPIP NET_IPVTI NET_KEY NET_KEY_MIGRATE NET_L3_MASTER_DEV NET_MPLS_GSO NET_NCSI NET_NSH NET_REDIRECT NET_SCH_CAKE NET_SCH_CBS NET_SCH_CHOKE NET_SCH_CODEL NET_SCH_DRR NET_SCH_ETF NET_SCH_ETS NET_SCH_FQ NET_SCH_FQ_CODEL NET_SCH_FQ_PIE NET_SCH_GRED NET_SCH_HFSC NET_SCH_HHF NET_SCH_HTB NET_SCH_INGRESS NET_SCH_MQPRIO NET_SCH_MQPRIO_LIB NET_SCH_MULTIQ NET_SCH_NETEM NET_SCH_PIE NET_SCH_PLUG NET_SCH_PRIO NET_SCH_QFQ NET_SCH_RED NET_SCH_SFB NET_SCH_SFQ NET_SCH_SKBPRIO NET_SCH_TAPRIO NET_SCH_TBF NET_SCH_TEQL NET_SOCK_MSG NET_SWITCHDEV NET_TC_SKB_EXT NET_TEAM NET_TEAM_MODE_ACTIVEBACKUP NET_TEAM_MODE_BROADCAST NET_TEAM_MODE_LOADBALANCE NET_TEAM_MODE_RANDOM NET_TEAM_MODE_ROUNDROBIN NET_UDP_TUNNEL NET_VRF NFC NFC_DIGITAL NFC_FDP NFC_HCI NFC_MRVL NFC_MRVL_USB NFC_NCI NFC_NCI_UART NFC_PN533 NFC_PN533_USB NFC_PORT100 NFC_SHDLC NFC_SIM NFC_VIRTUAL_NCI NFSD NFSD_BLOCKLAYOUT NFSD_FLEXFILELAYOUT NFSD_PNFS NFSD_SCSILAYOUT NFSD_V3_ACL NFSD_V4 NFSD_V4_2_INTER_SSC NFSD_V4_SECURITY_LABEL NFS_FSCACHE NFS_V4_1 NFS_V4_2 NFS_V4_2_READ_PLUS NFS_V4_2_SSC_HELPER NFS_V4_SECURITY_LABEL NFT_BRIDGE_META NFT_BRIDGE_REJECT NFT_COMPAT NFT_CONNLIMIT NFT_CT NFT_DUP_IPV4 NFT_DUP_IPV6 NFT_DUP_NETDEV NFT_FIB NFT_FIB_INET NFT_FIB_IPV4 NFT_FIB_IPV6 NFT_FIB_NETDEV NFT_FLOW_OFFLOAD NFT_HASH NFT_LIMIT NFT_LOG NFT_MASQ NFT_NAT NFT_NUMGEN NFT_OSF NFT_QUEUE NFT_QUOTA NFT_REDIR NFT_REJECT NFT_REJECT_INET NFT_REJECT_IPV4 NFT_REJECT_IPV6 NFT_REJECT_NETDEV NFT_SOCKET NFT_SYNPROXY NFT_TPROXY NFT_TUNNEL NFT_XFRM NF_CONNTRACK_AMANDA NF_CONNTRACK_BRIDGE NF_CONNTRACK_BROADCAST NF_CONNTRACK_EVENTS NF_CONNTRACK_H323 NF_CONNTRACK_LABELS NF_CONNTRACK_MARK NF_CONNTRACK_NETBIOS_NS NF_CONNTRACK_OVS NF_CONNTRACK_PPTP NF_CONNTRACK_SANE NF_CONNTRACK_SNMP NF_CONNTRACK_TFTP NF_CONNTRACK_TIMEOUT NF_CONNTRACK_TIMESTAMP NF_CONNTRACK_ZONES NF_CT_NETLINK_HELPER NF_CT_NETLINK_TIMEOUT NF_CT_PROTO_DCCP NF_CT_PROTO_GRE NF_CT_PROTO_SCTP NF_CT_PROTO_UDPLITE NF_DUP_IPV4 NF_DUP_IPV6 NF_DUP_NETDEV NF_FLOW_TABLE NF_FLOW_TABLE_INET NF_NAT_AMANDA NF_NAT_H323 NF_NAT_OVS NF_NAT_PPTP NF_NAT_REDIRECT NF_NAT_SNMP_BASIC NF_NAT_TFTP NF_SOCKET_IPV4 NF_SOCKET_IPV6 NF_TABLES NF_TABLES_BRIDGE NF_TABLES_INET NF_TABLES_IPV4 NF_TABLES_IPV6 NF_TABLES_NETDEV NF_TPROXY_IPV4 NF_TPROXY_IPV6 NILFS2_FS NINTENDO_FF NLMON NLS_CODEPAGE_1250 NLS_CODEPAGE_1251 NLS_CODEPAGE_737 NLS_CODEPAGE_775 NLS_CODEPAGE_850 NLS_CODEPAGE_852 NLS_CODEPAGE_855 NLS_CODEPAGE_857 NLS_CODEPAGE_860 PAGE_POOL PARTITION_ADVANCED PSAMPLE RC_CORE RC_DEVICES RFKILL SPI USB_GADGET USB_MUSB_HDRC VIDEO_DEV WAN WATCH_QUEUE WIRELESS WLAN WWAN X25 X86_X32_ABI]
disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN BUG LOCKDEP], they are not needed
picked [v6.11 v6.10 v6.9 v6.7 v6.5 v6.3 v6.1 v5.19 v5.16 v5.13 v5.10 v5.7 v5.4 v5.1 v4.19] out of 34 release tags
testing release v6.11
testing commit 98f7e32f20d28ec452afb208f9cffc08448a2652 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 4a0f31685ea593a1fd8eb3af129dd624fc032929ad3c7b7981d4977b87f9a0f6
all runs: crashed: KASAN: use-after-free Read in nilfs_find_entry
representative crash: KASAN: use-after-free Read in nilfs_find_entry, types: [KASAN]
testing release v6.10
testing commit 0c3836482481200ead7b416ca80c68a29cfdaabd gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: f185748406edbbce3ef8374783ac57eba806b08b0277df6c6b9612c63ebb226e
all runs: crashed: KASAN: use-after-free Read in nilfs_find_entry
representative crash: KASAN: use-after-free Read in nilfs_find_entry, types: [KASAN]
testing release v6.9
testing commit a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 82439ec40f827b488c1d20dbbeb178d079d0c911bb304877970908b3b1aa5ae0
all runs: crashed: KASAN: use-after-free Read in nilfs_find_entry
representative crash: KASAN: use-after-free Read in nilfs_find_entry, types: [KASAN]
testing release v6.7
testing commit 0dd3ee31125508cd67f7e7172247f05b7fd1753a gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 0110f1a7534440f02d2c8174ef71e81b6cb1fea085624fcec886e0da1af37d3b
all runs: crashed: KASAN: use-after-free Read in nilfs_find_entry
representative crash: KASAN: use-after-free Read in nilfs_find_entry, types: [KASAN]
testing release v6.5
testing commit 2dde18cd1d8fac735875f2e4987f11817cc0bc2c gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 8f323ddbab95819001273196d9031d6744f3df6400af620d68d35a949653d637
all runs: crashed: KASAN: use-after-free Read in nilfs_find_entry
representative crash: KASAN: use-after-free Read in nilfs_find_entry, types: [KASAN]
testing release v6.3
testing commit 457391b0380335d5e9a5babdec90ac53928b23b4 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: bf1d4449be61228e32eb51c4e8a9cb53f827f2143b564641edd97158348a6b68
all runs: crashed: KASAN: use-after-free Read in nilfs_find_entry
representative crash: KASAN: use-after-free Read in nilfs_find_entry, types: [KASAN]
testing release v6.1
testing commit 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: eda08ef155e107bfce8f067c4ba1044707e3b57c1f84476914376dc842060549
all runs: crashed: KASAN: use-after-free Read in nilfs_find_entry
representative crash: KASAN: use-after-free Read in nilfs_find_entry, types: [KASAN]
testing release v5.19
testing commit 3d7cb6b04c3f3115719235cc6866b10326de34cd gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 4029ae2766bcfef0e65abea0ff0e200eb91da4707f5b1bddab9a176c4ef3a2d2
all runs: crashed: KASAN: use-after-free Read in nilfs_find_entry
representative crash: KASAN: use-after-free Read in nilfs_find_entry, types: [KASAN]
testing release v5.16
testing commit df0cc57e057f18e44dac8e6c18aba47ab53202f9 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: bd6ef325ba687bdd385a04cbc59ec0e2e13cc99f0d40a00c508a2e20abdd0276
run #0: crashed: KASAN: use-after-free Read in nilfs_find_entry
run #1: crashed: KASAN: use-after-free Read in nilfs_find_entry
run #2: crashed: KASAN: use-after-free Read in nilfs_find_entry
run #3: crashed: KASAN: use-after-free Read in nilfs_find_entry
run #4: crashed: KASAN: use-after-free Read in nilfs_find_entry
run #5: crashed: KASAN: out-of-bounds Read in nilfs_find_entry
run #6: crashed: KASAN: use-after-free Read in nilfs_find_entry
run #7: crashed: KASAN: use-after-free Read in nilfs_find_entry
run #8: crashed: KASAN: use-after-free Read in nilfs_find_entry
run #9: crashed: KASAN: use-after-free Read in nilfs_find_entry
representative crash: KASAN: use-after-free Read in nilfs_find_entry, types: [KASAN]
testing release v5.13
testing commit 62fb9874f5da54fdb243003b386128037319b219 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 314dc3abf3faf4b0910860b6ce492ece3f95961e94d2a4198b72d245d33e0858
all runs: crashed: KASAN: use-after-free Read in nilfs_find_entry
representative crash: KASAN: use-after-free Read in nilfs_find_entry, types: [KASAN]
testing release v5.10
testing commit 2c85ebc57b3e1817b6ce1a6b703928e113a90442 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 065e795dadbe8375c8ac8e9f395d2433e119f19e43934571384fdfe1ece19b8a
all runs: crashed: KASAN: use-after-free Read in nilfs_find_entry
representative crash: KASAN: use-after-free Read in nilfs_find_entry, types: [KASAN]
testing release v5.7
testing commit 3d77e6a8804abcc0504c904bd6e5cdf3a5cf8162 gcc
compiler: gcc version 8.4.1 20210217 (GCC), GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 73bc94f9a879a1e2dcc003f71c9ee0be524956e93dc101547fd6fc6e503da4d1
run #0: crashed: KASAN: use-after-free Read in nilfs_find_entry
run #1: crashed: KASAN: use-after-free Read in nilfs_find_entry
run #2: crashed: general protection fault in percpu_counter_add_batch
run #3: crashed: general protection fault in percpu_counter_add_batch
run #4: crashed: general protection fault in percpu_counter_add_batch
run #5: crashed: general protection fault in percpu_counter_add_batch
run #6: crashed: general protection fault in percpu_counter_add_batch
run #7: crashed: general protection fault in percpu_counter_add_batch
run #8: crashed: general protection fault in percpu_counter_add_batch
run #9: crashed: KASAN: use-after-free Read in nilfs_find_entry
representative crash: general protection fault in percpu_counter_add_batch, types: [UNKNOWN KASAN]
testing release v5.4
testing commit 219d54332a09e8d8741c1e1982f5eae56099de85 gcc
compiler: gcc version 8.4.1 20210217 (GCC)
kernel signature: b91c155a66030319d0c113f733b6c108f2d94c3cc5be9e8f3d8ca2195bf669b7
run #0: crashed: KASAN: use-after-free Read in nilfs_find_entry
run #1: crashed: general protection fault in percpu_counter_add_batch
run #2: crashed: general protection fault in percpu_counter_add_batch
run #3: crashed: KASAN: use-after-free Read in nilfs_find_entry
run #4: crashed: KASAN: use-after-free Read in nilfs_find_entry
run #5: crashed: general protection fault in percpu_counter_add_batch
run #6: crashed: general protection fault in percpu_counter_add_batch
run #7: crashed: KASAN: use-after-free Read in nilfs_find_entry
run #8: crashed: general protection fault in percpu_counter_add_batch
run #9: crashed: KASAN: use-after-free Read in nilfs_find_entry
representative crash: KASAN: use-after-free Read in nilfs_find_entry, types: [KASAN UNKNOWN]
testing release v5.1
testing commit e93c9c99a629c61837d5a7fc2120cd2b6c70dbdd gcc
compiler: gcc version 8.4.1 20210217 (GCC)
kernel signature: 32d2de28acf560224612ec08929866e04790d25ce0fc3bd3507059ef254e8453
all runs: crashed: KASAN: use-after-free Read in nilfs_find_entry
representative crash: KASAN: use-after-free Read in nilfs_find_entry, types: [KASAN]
testing release v4.19
testing commit 84df9525b0c27f3ebc2ebb1864fa62a97fdedb7d gcc
compiler: gcc version 8.4.1 20210217 (GCC)
kernel signature: 313dfaef789b8a3615d63a2fcc54d397374cabfd5bab7726430f90119d9d1c3a
all runs: crashed: KASAN: use-after-free Read in nilfs_find_entry
representative crash: KASAN: use-after-free Read in nilfs_find_entry, types: [KASAN]
crash still not fixed/happens on the oldest tested release
revisions tested: 22, total time: 3h32m11.441423263s (build: 1h49m13.966616565s, test: 1h34m22.900701291s)
oldest tested release already had the bug or it had kernel test errors
commit msg: Linux 4.19
crash: KASAN: use-after-free Read in nilfs_find_entry
IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
==================================================================
BUG: KASAN: use-after-free in nilfs_find_entry+0x58a/0x6e0 fs/nilfs2/dir.c:356
Read of size 2 at addr ffff8801d6529008 by task syz.2.15/4008

CPU: 0 PID: 4008 Comm: syz.2.15 Not tainted 4.19.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x10c/0x17a lib/dump_stack.c:113
 print_address_description.cold.6+0x9/0x244 mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report mm/kasan/report.c:412 [inline]
 kasan_report.cold.7+0x242/0x305 mm/kasan/report.c:396
 __asan_report_load2_noabort+0x14/0x20 mm/kasan/report.c:431
 nilfs_find_entry+0x58a/0x6e0 fs/nilfs2/dir.c:356
 nilfs_inode_by_name+0x63/0x190 fs/nilfs2/dir.c:407
 nilfs_lookup fs/nilfs2/namei.c:62 [inline]
 nilfs_lookup+0x64/0x100 fs/nilfs2/namei.c:54
 lookup_open+0x5c5/0x1d20 fs/namei.c:3213
 do_last fs/namei.c:3324 [inline]
 path_openat+0xde7/0x2870 fs/namei.c:3534
 do_filp_open+0x177/0x250 fs/namei.c:3564
 do_sys_open+0x1dc/0x350 fs/open.c:1063
 __do_sys_openat fs/open.c:1090 [inline]
 __se_sys_openat fs/open.c:1084 [inline]
 __x64_sys_openat+0x98/0xf0 fs/open.c:1084
 do_syscall_64+0xd0/0x340 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fe96e421719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe96dea2038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fe96e5d8f80 RCX: 00007fe96e421719
RDX: 000000000000275a RSI: 0000000020000080 RDI: ffffffffffffff9c
RBP: 00007fe96e49475e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fe96e5d8f80 R15: 00007ffebb2bed18

The buggy address belongs to the page:
page:ffffea0007594a40 count:0 mapcount:0 mapping:0000000000000000 index:0x1
flags: 0x200000000000000()
raw: 0200000000000000 ffffea00074f65c8 ffffea00074d49c8 0000000000000000
raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not active (free page?)

Memory state around the buggy address:
 ffff8801d6528f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8801d6528f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8801d6529000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                      ^
 ffff8801d6529080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8801d6529100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================