ci2 starts bisection 2023-06-12 10:36:49.900104841 +0000 UTC m=+173185.349436700 bisecting fixing commit since 3a93e40326c8f470e71d20b4c42d36767450f38f building syzkaller on 47f3aaf18b57644f3c07714c9ce073a210f061b4 ensuring issue is reproducible on original commit 3a93e40326c8f470e71d20b4c42d36767450f38f testing commit 3a93e40326c8f470e71d20b4c42d36767450f38f gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 42e85527d0719502f516c47295f500da90203c7f5416ae2488b44dd67162053b run #0: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #1: crashed: KASAN: slab-use-after-free Read in ext4_convert_inline_data_nolock run #2: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #3: crashed: KASAN: slab-use-after-free Read in ext4_convert_inline_data_nolock run #4: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #5: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #6: crashed: KASAN: slab-use-after-free Read in ext4_convert_inline_data_nolock run #7: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #8: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #9: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #10: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #11: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #12: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #13: crashed: KASAN: out-of-bounds Read in ext4_convert_inline_data_nolock run #14: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #15: crashed: KASAN: slab-use-after-free Read in ext4_convert_inline_data_nolock run #16: crashed: KASAN: slab-use-after-free Read in ext4_convert_inline_data_nolock run #17: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #18: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #19: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock testing current HEAD 858fd168a95c5b9669aac8db6c14a9aeab446375 testing commit 858fd168a95c5b9669aac8db6c14a9aeab446375 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 67d246bbd429e399502f9a3be913d918b856e6375f695d1d239e84e4c4bf3cf2 run #0: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #1: crashed: KASAN: slab-use-after-free Read in ext4_convert_inline_data_nolock run #2: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #3: crashed: KASAN: slab-use-after-free Read in ext4_convert_inline_data_nolock run #4: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #5: crashed: KASAN: slab-use-after-free Read in ext4_convert_inline_data_nolock run #6: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #7: crashed: KASAN: slab-use-after-free Read in ext4_convert_inline_data_nolock run #8: crashed: KASAN: slab-use-after-free Read in ext4_convert_inline_data_nolock run #9: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock crash still not fixed/happens on the oldest tested release revisions tested: 2, total time: 36m55.58280827s (build: 29m52.872516818s, test: 6m31.383684528s) crash still not fixed on HEAD or HEAD had kernel test errors commit msg: Linux 6.4-rc6 crash: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock loop0: detected capacity change from 0 to 2048 EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. ================================================================== BUG: KASAN: slab-out-of-bounds in ext4_read_inline_data fs/ext4/inline.c:209 [inline] BUG: KASAN: slab-out-of-bounds in ext4_convert_inline_data_nolock+0x286/0xbf0 fs/ext4/inline.c:1213 Read of size 20 at addr ffff888079ec21a3 by task syz-executor.0/5408 CPU: 0 PID: 5408 Comm: syz-executor.0 Not tainted 6.4.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x167/0x220 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:351 [inline] print_report+0x163/0x540 mm/kasan/report.c:462 kasan_report+0x176/0x1b0 mm/kasan/report.c:572 kasan_check_range+0x283/0x290 mm/kasan/generic.c:187 __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105 ext4_read_inline_data fs/ext4/inline.c:209 [inline] ext4_convert_inline_data_nolock+0x286/0xbf0 fs/ext4/inline.c:1213 ext4_convert_inline_data+0x3c4/0x4e0 fs/ext4/inline.c:2074 ext4_fallocate+0x13f/0x1a10 fs/ext4/extents.c:4708 vfs_fallocate+0x3ae/0x530 fs/open.c:324 ksys_fallocate fs/open.c:347 [inline] __do_sys_fallocate fs/open.c:355 [inline] __se_sys_fallocate fs/open.c:353 [inline] __x64_sys_fallocate+0xaa/0xe0 fs/open.c:353 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f1e4728c0f9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f1e47efd168 EFLAGS: 00000246 ORIG_RAX: 000000000000011d RAX: ffffffffffffffda RBX: 00007f1e473abf80 RCX: 00007f1e4728c0f9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 RBP: 00007f1e472e7b39 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000008000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fff47648d8f R14: 00007f1e47efd300 R15: 0000000000022000 Allocated by task 5145: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4f/0x70 mm/kasan/common.c:52 __kasan_slab_alloc+0x66/0x70 mm/kasan/common.c:328 kasan_slab_alloc include/linux/kasan.h:186 [inline] slab_post_alloc_hook+0x68/0x3a0 mm/slab.h:711 slab_alloc_node mm/slub.c:3451 [inline] slab_alloc mm/slub.c:3459 [inline] __kmem_cache_alloc_lru mm/slub.c:3466 [inline] kmem_cache_alloc+0x11f/0x2e0 mm/slub.c:3475 getname_flags+0xa0/0x430 fs/namei.c:140 user_path_at_empty+0x22/0x140 fs/namei.c:2906 user_path_at include/linux/namei.h:57 [inline] do_faccessat+0x4e4/0x980 fs/open.c:483 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 5145: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4f/0x70 mm/kasan/common.c:52 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:521 ____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236 kasan_slab_free include/linux/kasan.h:162 [inline] slab_free_hook mm/slub.c:1781 [inline] slab_free_freelist_hook mm/slub.c:1807 [inline] slab_free mm/slub.c:3786 [inline] kmem_cache_free+0x297/0x520 mm/slub.c:3808 putname fs/namei.c:273 [inline] user_path_at_empty+0xf1/0x140 fs/namei.c:2909 user_path_at include/linux/namei.h:57 [inline] do_faccessat+0x4e4/0x980 fs/open.c:483 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The buggy address belongs to the object at ffff888079ec1100 which belongs to the cache names_cache of size 4096 The buggy address is located 163 bytes to the right of allocated 4096-byte region [ffff888079ec1100, ffff888079ec2100) The buggy address belongs to the physical page: page:ffffea0001e7b000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x79ec0 head:ffffea0001e7b000 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000010200 ffff8881400088c0 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000070007 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4438, tgid 4438 (udevd), ts 18198905479, free_ts 18192337523 prep_new_page mm/page_alloc.c:1738 [inline] get_page_from_freelist+0x321c/0x33a0 mm/page_alloc.c:3502 __alloc_pages+0x255/0x670 mm/page_alloc.c:4768 alloc_slab_page+0x6a/0x160 mm/slub.c:1851 allocate_slab mm/slub.c:1998 [inline] new_slab+0x84/0x2f0 mm/slub.c:2051 ___slab_alloc+0xa85/0x10a0 mm/slub.c:3192 __slab_alloc mm/slub.c:3291 [inline] __slab_alloc_node mm/slub.c:3344 [inline] slab_alloc_node mm/slub.c:3441 [inline] slab_alloc mm/slub.c:3459 [inline] __kmem_cache_alloc_lru mm/slub.c:3466 [inline] kmem_cache_alloc+0x1b9/0x2e0 mm/slub.c:3475 getname_flags+0xa0/0x430 fs/namei.c:140 vfs_fstatat fs/stat.c:275 [inline] __do_sys_newfstatat fs/stat.c:446 [inline] __se_sys_newfstatat fs/stat.c:440 [inline] __x64_sys_newfstatat+0x135/0x1c0 fs/stat.c:440 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1302 [inline] free_unref_page_prepare+0x8fe/0xa10 mm/page_alloc.c:2564 free_unref_page+0x37/0x3f0 mm/page_alloc.c:2659 discard_slab mm/slub.c:2097 [inline] __unfreeze_partials+0x1b1/0x1f0 mm/slub.c:2636 put_cpu_partial+0x116/0x180 mm/slub.c:2712 qlist_free_all+0x22/0x60 mm/kasan/quarantine.c:185 kasan_quarantine_reduce+0x14b/0x160 mm/kasan/quarantine.c:292 __kasan_slab_alloc+0x23/0x70 mm/kasan/common.c:305 kasan_slab_alloc include/linux/kasan.h:186 [inline] slab_post_alloc_hook+0x68/0x3a0 mm/slab.h:711 slab_alloc_node mm/slub.c:3451 [inline] slab_alloc mm/slub.c:3459 [inline] __kmem_cache_alloc_lru mm/slub.c:3466 [inline] kmem_cache_alloc+0x11f/0x2e0 mm/slub.c:3475 getname_flags+0xa0/0x430 fs/namei.c:140 user_path_at_empty+0x22/0x140 fs/namei.c:2906 do_readlinkat+0x107/0x310 fs/stat.c:477 __do_sys_readlink fs/stat.c:510 [inline] __se_sys_readlink fs/stat.c:507 [inline] __x64_sys_readlink+0x7a/0x90 fs/stat.c:507 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Memory state around the buggy address: ffff888079ec2080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888079ec2100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888079ec2180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff888079ec2200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888079ec2280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================