ci2 starts bisection 2025-06-24 11:35:27.584798694 +0000 UTC m=+50252.164424706 bisecting fixing commit since 3c6d0251e1fb722e884184d964421fe6f0586534 building syzkaller on ed351ea732d889c7798e7f0226bcaec65a8a6b52 ensuring issue is reproducible on original commit 3c6d0251e1fb722e884184d964421fe6f0586534 testing commit 3c6d0251e1fb722e884184d964421fe6f0586534 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 4bb17ead626dc27568a18859497777a1ac19fd52707c639832d1dfa71c897573 all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] check whether we can drop unnecessary instrumentation disabling configs for [BUG LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed testing commit 3c6d0251e1fb722e884184d964421fe6f0586534 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: bdb89f894c9b1acfe7c885737e40d1aad0495f277c5903c10fd5f25a5211fd9e all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] the bug reproduces without the instrumentation disabling configs for [BUG LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed kconfig minimization: base=5186 full=6555 leaves diff=264 split chunks (needed=false): <264> split chunk #0 of len 264 into 5 parts testing without sub-chunk 1/5 disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN BUG LOCKDEP], they are not needed testing commit 3c6d0251e1fb722e884184d964421fe6f0586534 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 1fa97e33e88a6bac56a75bf96cbca6993f393be6b973fbed2f4e5ef947d3f01f all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing commit 3c6d0251e1fb722e884184d964421fe6f0586534 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: c0e6c9607a1cee1a034db7c9f2f34d65de29868c3937d7da065bde936cb29b33 all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed testing commit 3c6d0251e1fb722e884184d964421fe6f0586534 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 5b14b67cdfbb3aee2acf1f5a9ebd59ccdc0a93f5fc6fa0b58801e307d1b6f4c0 all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing commit 3c6d0251e1fb722e884184d964421fe6f0586534 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 5fbc61ab0ca228c199faafe348f2c357d53c28540b620ba3f85df916c0270483 all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing commit 3c6d0251e1fb722e884184d964421fe6f0586534 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 failed building 3c6d0251e1fb722e884184d964421fe6f0586534: ld.lld: error: undefined symbol: wext_proc_init ld.lld: error: undefined symbol: wext_proc_exit ld.lld: error: undefined symbol: wext_handle_ioctl ld.lld: error: undefined symbol: compat_wext_handle_ioctl minimized to 52 configs; suspects: [HID_ZEROPLUS USB_NET_CDC_MBIM USB_NET_CDC_SUBSET USB_NET_CDC_SUBSET_ENABLE USB_NET_DM9601 USB_NET_GL620A USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM V4L2_ASYNC V4L2_FWNODE VIDEO_CAMERA_SENSOR WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_PURELIFI WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_SILABS WLAN_VENDOR_ZYDAS ZEROPLUS_FF] disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing current HEAD 45271a2c461a087166eae6cab372db94c4aa0aff testing commit 45271a2c461a087166eae6cab372db94c4aa0aff gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 64de03733b6ab7617edc017fb6db609eb15816355e3309274c79acbce2e66e28 all runs: OK false negative chance: 0.000 # git bisect start 45271a2c461a087166eae6cab372db94c4aa0aff 3c6d0251e1fb722e884184d964421fe6f0586534 Bisecting: 566 revisions left to test after this (roughly 9 steps) [de1067cc8cf0e8c11ae20cbe5c467aef19d04ded] bpf: Scrub packet on bpf_redirect_peer determine whether the revision contains the guilty commit checking the merge base 420102835862f49ec15c545594278dc5d2712f42 no existing result, test the revision testing commit 420102835862f49ec15c545594278dc5d2712f42 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: aedfbcbc53dc1450e83406c5dac0307d39d6e20dbb6bc5bf4e4beea30bc3f042 all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] testing commit de1067cc8cf0e8c11ae20cbe5c467aef19d04ded gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 86813abfeb58c4f50c29b34e104a3853c6ba97b593459abd173f84e87c9a147d all runs: OK false negative chance: 0.000 # git bisect bad de1067cc8cf0e8c11ae20cbe5c467aef19d04ded Bisecting: 282 revisions left to test after this (roughly 8 steps) [16c54d6a49011d77e9bbce679eed39f4e38e0a00] mm: fix apply_to_existing_page_range() determine whether the revision contains the guilty commit revision 420102835862f49ec15c545594278dc5d2712f42 crashed and is reachable testing commit 16c54d6a49011d77e9bbce679eed39f4e38e0a00 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: b6cc6fd0f7cd2a4963066984c2104dbde86a142c5a15e4c121cdcd84291ff3a4 all runs: OK false negative chance: 0.000 # git bisect bad 16c54d6a49011d77e9bbce679eed39f4e38e0a00 Bisecting: 141 revisions left to test after this (roughly 7 steps) [0642f87cbf61d99142f526702a6897bcf5c4105c] crypto: ccp - Fix check for the primary ASP device determine whether the revision contains the guilty commit revision 420102835862f49ec15c545594278dc5d2712f42 crashed and is reachable testing commit 0642f87cbf61d99142f526702a6897bcf5c4105c gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 5f6a34e921d657a78b3e337bfae66f5aef07fb194b90025f418abd181f11b784 all runs: OK false negative chance: 0.000 # git bisect bad 0642f87cbf61d99142f526702a6897bcf5c4105c Bisecting: 70 revisions left to test after this (roughly 6 steps) [660a53a0694d1f3789802509fe729dd4656fc5e0] fbdev: omapfb: Add 'plane' value check determine whether the revision contains the guilty commit revision 420102835862f49ec15c545594278dc5d2712f42 crashed and is reachable testing commit 660a53a0694d1f3789802509fe729dd4656fc5e0 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 420afe73634765b265c6960f9baff02f6eca17525564a28e474d2d9e52f0bb16 all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] # git bisect good 660a53a0694d1f3789802509fe729dd4656fc5e0 Bisecting: 35 revisions left to test after this (roughly 5 steps) [58f6dae9784ee2cb1e6866d5412b9f4b6822966c] clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup determine whether the revision contains the guilty commit revision 660a53a0694d1f3789802509fe729dd4656fc5e0 crashed and is reachable testing commit 58f6dae9784ee2cb1e6866d5412b9f4b6822966c gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 8a2f7174c43f12389b821339aba65d3d7a60d29ef078d558dbb388068285f3b8 all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] # git bisect good 58f6dae9784ee2cb1e6866d5412b9f4b6822966c Bisecting: 17 revisions left to test after this (roughly 4 steps) [855bf0aacd51fced11ea9aa0d5101ee0febaeadb] mptcp: fix NULL pointer in can_accept_new_subflow determine whether the revision contains the guilty commit revision 58f6dae9784ee2cb1e6866d5412b9f4b6822966c crashed and is reachable testing commit 855bf0aacd51fced11ea9aa0d5101ee0febaeadb gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 6528c3400167f15d191516612ac4b6e86cbf1bd39992bfb51836e3e90d0ec0a9 all runs: OK false negative chance: 0.000 # git bisect bad 855bf0aacd51fced11ea9aa0d5101ee0febaeadb Bisecting: 8 revisions left to test after this (roughly 3 steps) [d3071c1b7c1568ecc4deb6c576a85560fd1b7acf] vdpa/mlx5: Fix oversized null mkey longer than 32bit determine whether the revision contains the guilty commit revision 660a53a0694d1f3789802509fe729dd4656fc5e0 crashed and is reachable testing commit d3071c1b7c1568ecc4deb6c576a85560fd1b7acf gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 3eda30b5059ecf69e557b72980b045b371189bcb00c335d50a6bffa314cbcad5 all runs: OK false negative chance: 0.000 # git bisect bad d3071c1b7c1568ecc4deb6c576a85560fd1b7acf Bisecting: 4 revisions left to test after this (roughly 2 steps) [ad3f29747a0a8629d1391683d2194f6ee5c3f4be] ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment. determine whether the revision contains the guilty commit revision 660a53a0694d1f3789802509fe729dd4656fc5e0 crashed and is reachable testing commit ad3f29747a0a8629d1391683d2194f6ee5c3f4be gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: dfaae3c5c7a393b7b3e0a8c4a48ba0efa2ef99caf0ffe760c47eb43e62ba2cda all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] # git bisect good ad3f29747a0a8629d1391683d2194f6ee5c3f4be Bisecting: 2 revisions left to test after this (roughly 1 step) [8a021b7701e861f7ba581618e31b7ec5245f3b2e] ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path determine whether the revision contains the guilty commit revision 58f6dae9784ee2cb1e6866d5412b9f4b6822966c crashed and is reachable testing commit 8a021b7701e861f7ba581618e31b7ec5245f3b2e gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: f60f2e8025c8e6677edeb016c7b9795fe823b2da82f9a203eaf819c5e224d3cd all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] # git bisect good 8a021b7701e861f7ba581618e31b7ec5245f3b2e Bisecting: 0 revisions left to test after this (roughly 1 step) [35d0aa6db9d93307085871ceab8a729594a98162] ext4: fix off-by-one error in do_split determine whether the revision contains the guilty commit revision ad3f29747a0a8629d1391683d2194f6ee5c3f4be crashed and is reachable testing commit 35d0aa6db9d93307085871ceab8a729594a98162 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 994b3d15467b30593c5aa9b4d76d8b2bda28083dedb8f4be3b12f5b4c8fd8e7b all runs: OK false negative chance: 0.000 # git bisect bad 35d0aa6db9d93307085871ceab8a729594a98162 Bisecting: 0 revisions left to test after this (roughly 0 steps) [3e7ecf181cbdde9753204ada3883ca1704d8702b] bus: mhi: host: Fix race between unprepare and queue_buf determine whether the revision contains the guilty commit revision 58f6dae9784ee2cb1e6866d5412b9f4b6822966c crashed and is reachable testing commit 3e7ecf181cbdde9753204ada3883ca1704d8702b gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: c97aa8f904706659a8643e2e870bd16eb89aa3702371e764a91cf9b17d5736fb all runs: crashed: KASAN: use-after-free Write in ext4_insert_dentry representative crash: KASAN: use-after-free Write in ext4_insert_dentry, types: [KASAN] # git bisect good 3e7ecf181cbdde9753204ada3883ca1704d8702b 35d0aa6db9d93307085871ceab8a729594a98162 is the first bad commit commit 35d0aa6db9d93307085871ceab8a729594a98162 Author: Artem Sadovnikov Date: Fri Apr 4 08:28:05 2025 +0000 ext4: fix off-by-one error in do_split commit 94824ac9a8aaf2fb3c54b4bdde842db80ffa555d upstream. Syzkaller detected a use-after-free issue in ext4_insert_dentry that was caused by out-of-bounds access due to incorrect splitting in do_split. BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 Write of size 251 at addr ffff888074572f14 by task syz-executor335/5847 CPU: 0 UID: 0 PID: 5847 Comm: syz-executor335 Not tainted 6.12.0-rc6-syzkaller-00318-ga9cda7c0ffed #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106 ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 add_dirent_to_buf+0x3d9/0x750 fs/ext4/namei.c:2154 make_indexed_dir+0xf98/0x1600 fs/ext4/namei.c:2351 ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2455 ext4_add_nondir+0x8d/0x290 fs/ext4/namei.c:2796 ext4_symlink+0x920/0xb50 fs/ext4/namei.c:3431 vfs_symlink+0x137/0x2e0 fs/namei.c:4615 do_symlinkat+0x222/0x3a0 fs/namei.c:4641 __do_sys_symlink fs/namei.c:4662 [inline] __se_sys_symlink fs/namei.c:4660 [inline] __x64_sys_symlink+0x7a/0x90 fs/namei.c:4660 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The following loop is located right above 'if' statement. for (i = count-1; i >= 0; i--) { /* is more than half of this entry in 2nd half of the block? */ if (size + map[i].size/2 > blocksize/2) break; size += map[i].size; move++; } 'i' in this case could go down to -1, in which case sum of active entries wouldn't exceed half the block size, but previous behaviour would also do split in half if sum would exceed at the very last block, which in case of having too many long name files in a single block could lead to out-of-bounds access and following use-after-free. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Cc: stable@vger.kernel.org Fixes: 5872331b3d91 ("ext4: fix potential negative array index in do_split()") Signed-off-by: Artem Sadovnikov Reviewed-by: Jan Kara Link: https://patch.msgid.link/20250404082804.2567-3-a.sadovnikov@ispras.ru Signed-off-by: Theodore Ts'o Signed-off-by: Greg Kroah-Hartman fs/ext4/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) accumulated error probability: 0.00 culprit signature: 994b3d15467b30593c5aa9b4d76d8b2bda28083dedb8f4be3b12f5b4c8fd8e7b parent signature: c97aa8f904706659a8643e2e870bd16eb89aa3702371e764a91cf9b17d5736fb revisions tested: 19, total time: 5h48m55.065635532s (build: 2h41m35.453013419s, test: 2h57m44.208059392s) first good commit: 35d0aa6db9d93307085871ceab8a729594a98162 ext4: fix off-by-one error in do_split recipients (to): ["a.sadovnikov@ispras.ru" "gregkh@linuxfoundation.org" "jack@suse.cz" "tytso@mit.edu"] recipients (cc): []