ci2 starts bisection 2025-05-26 07:26:45.077606155 +0000 UTC m=+45955.747946722 bisecting cause commit starting from d0c22de9995b624f563bc5004d44ac2655712a56 building syzkaller on ed351ea732d889c7798e7f0226bcaec65a8a6b52 ensuring issue is reproducible on original commit d0c22de9995b624f563bc5004d44ac2655712a56 testing commit d0c22de9995b624f563bc5004d44ac2655712a56 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 30b8c5e34e664d1529bcf70584a1cf57c36aa92c325396b169ab6f541b5fad51 run #0: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #1: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #2: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #4: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #5: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #6: crashed: KASAN: slab-use-after-free Read in ext4_ext_correct_indexes run #7: crashed: KASAN: use-after-free Read in ext4_find_extent run #8: crashed: KASAN: slab-use-after-free Read in ext4_ext_insert_extent run #9: crashed: KASAN: use-after-free Read in ext4_find_extent run #10: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #11: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #12: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #13: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #14: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #15: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #16: crashed: KASAN: slab-out-of-bounds Read in ext4_ext_correct_indexes run #17: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #18: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #19: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent representative crash: KASAN: slab-use-after-free Read in ext4_find_extent, types: [KASAN] check whether we can drop unnecessary instrumentation disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing commit d0c22de9995b624f563bc5004d44ac2655712a56 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 02298ee553213bad5c0f064704cbeed734784017c496ef5440cbf4322f75f414 run #0: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #1: crashed: KASAN: use-after-free Read in ext4_find_extent run #2: crashed: KASAN: slab-use-after-free Read in ext4_ext_insert_extent run #3: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #4: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #5: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #6: crashed: KASAN: use-after-free Read in ext4_find_extent run #7: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #8: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #9: crashed: KASAN: slab-use-after-free Read in ext4_find_extent representative crash: KASAN: slab-out-of-bounds Read in ext4_find_extent, types: [KASAN] the bug reproduces without the instrumentation disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed kconfig minimization: base=4084 full=8326 leaves diff=2130 split chunks (needed=false): <2130> split chunk #0 of len 2130 into 5 parts testing without sub-chunk 1/5 disabling configs for [BUG LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed testing commit d0c22de9995b624f563bc5004d44ac2655712a56 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: ca944031c7e9d4e71941d4d235e7d70e166a63da3f911fb9112d7c842dc54332 run #0: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #1: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #2: crashed: KASAN: slab-use-after-free Read in ext4_ext_correct_indexes run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #4: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #5: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #6: crashed: KASAN: use-after-free Read in ext4_find_extent run #7: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #8: crashed: KASAN: use-after-free Read in ext4_ext_insert_extent run #9: crashed: KASAN: slab-out-of-bounds Read in ext4_ext_insert_extent representative crash: KASAN: slab-use-after-free Read in ext4_find_extent, types: [KASAN] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing commit d0c22de9995b624f563bc5004d44ac2655712a56 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 failed building d0c22de9995b624f563bc5004d44ac2655712a56: ld.lld: error: undefined symbol: devm_drm_of_get_bridge testing without sub-chunk 3/5 disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing commit d0c22de9995b624f563bc5004d44ac2655712a56 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 2c533345bb01d761e660dd4f2b5047909807dabc94c84234c4c8d3725fd312f3 run #0: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #1: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #2: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_ext_insert_extent run #4: crashed: KASAN: use-after-free Read in ext4_ext_correct_indexes run #5: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #6: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #7: crashed: KASAN: use-after-free Read in ext4_find_extent run #8: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #9: crashed: KASAN: use-after-free Read in ext4_find_extent representative crash: KASAN: slab-use-after-free Read in ext4_find_extent, types: [KASAN] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed testing commit d0c22de9995b624f563bc5004d44ac2655712a56 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: df80c3450e3d7d84d7fe7080acc55c3f3383202534306113f9f76d1c6746e2c4 all runs: OK false negative chance: 0.000 testing without sub-chunk 5/5 disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed testing commit d0c22de9995b624f563bc5004d44ac2655712a56 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: a45d9e4da9ed49b11882f63a60eac4e309a29831e80688bcc8cfbc230ddbd65f run #0: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #1: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #2: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #3: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #4: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #5: crashed: KASAN: slab-out-of-bounds Read in ext4_ext_insert_extent run #6: crashed: KASAN: slab-use-after-free Read in ext4_ext_insert_extent run #7: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #8: crashed: KASAN: use-after-free Read in ext4_ext_correct_indexes run #9: crashed: KASAN: slab-use-after-free Read in ext4_find_extent representative crash: KASAN: slab-out-of-bounds Read in ext4_find_extent, types: [KASAN] the chunk can be dropped minimized to 852 configs; suspects: [6LOWPAN AF_RXRPC ARCH_ENABLE_MEMORY_HOTREMOVE ASUS_WMI ATM AX25 BT BT_BREDR BT_HIDP BXT_WC_PMIC_OPREGION CFG80211 CHARGER_BQ24190 CMA COMMON_CLK DAX DLM DRM DRM_BRIDGE DRM_DEBUG_MM DRM_DISPLAY_DP_AUX_BUS DRM_DISPLAY_DP_HELPER DRM_DISPLAY_DSC_HELPER DRM_DISPLAY_HDCP_HELPER DRM_DISPLAY_HDMI_HELPER DRM_DISPLAY_HELPER DRM_GEM_SHMEM_HELPER DRM_GM12U320 DRM_GUD DRM_I915 DRM_I915_CAPTURE_ERROR DRM_I915_COMPRESS_ERROR DRM_I915_USERPTR DRM_KMS_HELPER DRM_MIPI_DSI DRM_PANEL DRM_PANEL_BRIDGE DRM_PANEL_EDP DRM_PANEL_ORIENTATION_QUIRKS DRM_SIMPLEDRM DRM_TTM DRM_TTM_HELPER DRM_UDL DRM_VGEM DRM_VIRTIO_GPU DRM_VIRTIO_GPU_KMS DRM_VKMS DRM_VMWGFX DUMMY DVB_AF9013 DVB_AF9033 DVB_AS102 DVB_AS102_FE DVB_B2C2_FLEXCOP DVB_B2C2_FLEXCOP_USB DVB_CORE DVB_DIB3000MB DVB_DIB3000MC DVB_EC100 DVB_GP8PSK_FE DVB_RTL2830 DVB_RTL2832 DVB_RTL2832_SDR DVB_TEST_DRIVERS DVB_TTUSB_BUDGET DVB_TTUSB_DEC DVB_USB DVB_USB_A800 DVB_USB_AF9005 DVB_USB_AF9005_REMOTE DVB_USB_AF9015 DVB_USB_AF9035 DVB_USB_ANYSEE DVB_USB_AU6610 DVB_USB_AZ6007 DVB_USB_AZ6027 DVB_USB_CE6230 DVB_USB_CINERGY_T2 DVB_USB_CXUSB DVB_USB_CXUSB_ANALOG DVB_USB_DIB0700 DVB_USB_DIB3000MC DVB_USB_DIBUSB_MB DVB_USB_DIBUSB_MC DVB_USB_DIGITV DVB_USB_DTT200U DVB_USB_DTV5100 DVB_USB_DVBSKY DVB_USB_DW2102 DVB_USB_EC168 DVB_USB_GL861 DVB_USB_GP8PSK DVB_USB_LME2510 DVB_USB_M920X DVB_USB_MXL111SF DVB_USB_NOVA_T_USB2 DVB_USB_OPERA1 DVB_USB_PCTV452E DVB_USB_RTL28XXU DVB_USB_TECHNISAT_USB2 DVB_USB_TTUSB2 DVB_USB_UMT_010 DVB_USB_V2 DVB_USB_VP702X DVB_USB_VP7045 DVB_USB_ZD1301 DVB_VIDTV DVB_ZL10353 ECRYPT_FS ECRYPT_FS_MESSAGING EDAC EFS_FS ENCRYPTED_KEYS EQUALIZER EROFS_FS EROFS_FS_POSIX_ACL EROFS_FS_SECURITY EROFS_FS_XATTR EROFS_FS_ZIP EVM EVM_ADD_XATTRS EVM_ATTR_FSUUID EVM_EXTRA_SMACK_XATTRS EXFAT_FS EXPORTFS_BLOCK_OPS EXT3_FS EXT3_FS_POSIX_ACL EXT3_FS_SECURITY EXTCON EXTCON_INTEL_CHT_WC EXTCON_PTN5150 EXTCON_USBC_TUSB320 F2FS_CHECK_FS F2FS_FAULT_INJECTION F2FS_FS F2FS_FS_COMPRESSION F2FS_FS_LZ4 F2FS_FS_LZ4HC F2FS_FS_LZO F2FS_FS_LZORLE F2FS_FS_POSIX_ACL F2FS_FS_SECURITY F2FS_FS_XATTR F2FS_FS_ZSTD F2FS_STAT_FS FANOTIFY FANOTIFY_ACCESS_PERMISSIONS FB FB_CFB_COPYAREA FB_CFB_FILLRECT FB_CFB_IMAGEBLIT FB_CORE FB_DEFERRED_IO FB_DEVICE FB_IOMEM_FOPS FB_IOMEM_HELPERS FB_NOTIFY FB_SYSMEM_FOPS FB_SYSMEM_HELPERS FB_SYSMEM_HELPERS_DEFERRED FB_SYS_COPYAREA FB_SYS_FILLRECT FB_SYS_IMAGEBLIT FB_TILEBLITTING FB_VESA FB_VGA16 FB_VIRTUAL FDDI FIREWIRE FIREWIRE_NET FIREWIRE_OHCI FIREWIRE_SBP2 FONT_8x16 FONT_8x8 FONT_SUPPORT FRAMEBUFFER_CONSOLE FRAMEBUFFER_CONSOLE_DETECT_PRIMARY FRAMEBUFFER_CONSOLE_ROTATION FS_DAX FS_DAX_PMD FS_ENCRYPTION FS_ENCRYPTION_ALGS FS_STACK FS_VERITY FS_VERITY_BUILTIN_SIGNATURES FTL FUSE_DAX FUSE_FS FW_LOADER_COMPRESS FW_LOADER_PAGED_BUF FW_LOADER_SYSFS FW_LOADER_USER_HELPER FW_LOADER_USER_HELPER_FALLBACK GACT_PROB GARP GENDWARFKSYMS GENERIC_PHY GENEVE GET_FREE_REGION GFS2_FS GFS2_FS_LOCKING_DLM GNSS GNSS_USB GOOGLE_COREBOOT_TABLE GOOGLE_FIRMWARE GOOGLE_MEMCONSOLE GOOGLE_MEMCONSOLE_COREBOOT GOOGLE_VPD GPIOLIB GPIOLIB_IRQCHIP GPIO_ACPI GPIO_DLN2 GPIO_LJCA GPIO_VIPERBOARD GREENASIA_FF GREYBUS GREYBUS_BRIDGED_PHY GREYBUS_ES2 GREYBUS_HID GREYBUS_USB GTP GUEST_PERF_EVENTS GVE HAMRADIO HAS_LTO_CLANG HAVE_ARCH_NODE_DEV_GROUP HAVE_ARCH_USERFAULTFD_MINOR HAVE_ARCH_USERFAULTFD_WP HAVE_BOOTMEM_INFO_NODE HAVE_CLK HAVE_CLK_PREPARE HAVE_KVM_CPU_RELAX_INTERCEPT HAVE_KVM_DIRTY_RING HAVE_KVM_DIRTY_RING_ACQ_REL HAVE_KVM_DIRTY_RING_TSO HAVE_KVM_IRQCHIP HAVE_KVM_IRQ_BYPASS HAVE_KVM_IRQ_ROUTING HAVE_KVM_MSI HAVE_KVM_NO_POLL HAVE_KVM_PFNCACHE HAVE_KVM_PM_NOTIFIER HAVE_KVM_READONLY_MEM HAVE_SCHED_AVG_IRQ HDLC HDLC_CISCO HDLC_FR HDLC_PPP HDLC_RAW HDLC_RAW_ETH HDLC_X25 HDMI HFSPLUS_FS HFS_FS HID_ACCUTOUCH HID_ACRUX HID_ACRUX_FF HID_ALPS HID_APPLEIR HID_ASUS HID_AUREAL HID_BATTERY_STRENGTH HID_BETOP_FF HID_BIGBEN_FF HID_CMEDIA HID_CORSAIR HID_COUGAR HID_CP2112 HID_CREATIVE_SB0540 HID_ELAN HID_ELECOM HID_ELO HID_EMS_FF HID_EVISION HID_FT260 HID_GEMBIRD HID_GFRM HID_GLORIOUS HID_GOOGLE_STADIA_FF HID_GREENASIA HID_GT683R HID_HOLTEK HID_ICADE HID_JABRA HID_KEYTOUCH HID_KYE HID_LCPOWER HID_LED HID_LENOVO HID_LETSKETCH HID_LOGITECH HID_LOGITECH_DJ HID_LOGITECH_HIDPP HID_MACALLY HID_MAGICMOUSE HID_MALTRON HID_MAYFLASH HID_MCP2200 HID_MCP2221 HID_MEGAWORLD_FF HID_MULTITOUCH HID_NINTENDO HID_NTI HID_NVIDIA_SHIELD HID_ORTEK HID_PENMOUNT HID_PICOLCD HID_PICOLCD_BACKLIGHT HID_PICOLCD_CIR HID_PICOLCD_FB HID_PICOLCD_LCD HID_PICOLCD_LEDS HID_PLANTRONICS HID_PLAYSTATION HID_PRIMAX HID_PRODIKEYS HID_PXRC HID_RAZER HID_RETRODE HID_RMI HID_ROCCAT HID_SAITEK HID_SEMITEK HID_SENSOR_ACCEL_3D HID_SENSOR_ALS HID_SENSOR_CUSTOM_INTEL_HINGE HID_SENSOR_CUSTOM_SENSOR HID_SENSOR_DEVICE_ROTATION HID_SENSOR_GYRO_3D HID_SENSOR_HUB HID_SENSOR_HUMIDITY HID_SENSOR_IIO_COMMON HID_SENSOR_IIO_TRIGGER HID_SENSOR_INCLINOMETER_3D HID_SENSOR_MAGNETOMETER_3D HID_SENSOR_PRESS HID_SENSOR_PROX HID_SENSOR_TEMP HID_SIGMAMICRO HID_SMARTJOYPLUS HID_SPEEDLINK HID_STEAM HID_STEELSERIES HID_THINGM HID_THRUSTMASTER HID_TIVO HID_TOPRE HID_TWINHAN HID_U2FZERO HID_UCLOGIC HID_UDRAW_PS3 HID_VIEWSONIC HID_VIVALDI HID_VIVALDI_COMMON HID_VRC2 HID_WACOM HID_WALTOP HID_WIIMOTE HID_XIAOMI HID_XINMO HID_ZYDACRON HMM_MIRROR HOLTEK_FF HOTPLUG_PCI_PCIE HPET_MMAP HPET_MMAP_DEFAULT HPFS_FS I2C_ALGOBIT I2C_CHARDEV I2C_CP2615 I2C_DESIGNWARE_CORE I2C_DESIGNWARE_PLATFORM I2C_DIOLAN_U2C I2C_DLN2 I2C_HID_ACPI I2C_HID_CORE I2C_HID_OF I2C_LJCA I2C_MUX I2C_MUX_REG I2C_ROBOTFUZZ_OSIF I2C_SI4713 I2C_SLAVE I2C_SLAVE_EEPROM I2C_TINY_USB I2C_VIPERBOARD IEEE802154 IEEE802154_6LOWPAN IEEE802154_ATUSB IEEE802154_DRIVERS IEEE802154_HWSIM IEEE802154_NL802154_EXPERIMENTAL IEEE802154_SOCKET IFB IIO IIO_BUFFER IIO_KFIFO_BUF IIO_TRIGGER IIO_TRIGGERED_BUFFER IKCONFIG IKCONFIG_PROC IMA IMA_APPRAISE IMA_APPRAISE_MODSIG IMA_DEFAULT_HASH_SHA256 IMA_LSM_RULES IMA_MEASURE_ASYMMETRIC_KEYS IMA_NG_TEMPLATE IMA_QUEUE_EARLY_BOOT_KEYS IMA_READ_POLICY IMA_WRITE_POLICY INET6_ESPINTCP INET6_ESP_OFFLOAD INET6_IPCOMP INET6_TUNNEL INET6_XFRM_TUNNEL INET_AH INET_DIAG INET_DIAG_DESTROY INET_ESP INET_ESPINTCP INET_ESP_OFFLOAD INET_IPCOMP INET_MPTCP_DIAG INET_RAW_DIAG INET_SCTP_DIAG INET_TCP_DIAG INET_UDP_DIAG INET_XFRM_TUNNEL INFINIBAND INFINIBAND_ADDR_TRANS INFINIBAND_ADDR_TRANS_CONFIGFS INFINIBAND_IPOIB INFINIBAND_IPOIB_CM INFINIBAND_IPOIB_DEBUG INFINIBAND_ISER INFINIBAND_ON_DEMAND_PAGING INFINIBAND_RTRS INFINIBAND_SRP INFINIBAND_USER_ACCESS INFINIBAND_USER_MAD INFINIBAND_USER_MEM INFINIBAND_VIRT_DMA INPUT_ATI_REMOTE2 INPUT_CM109 INPUT_IMS_PCU INPUT_JOYDEV INPUT_KEYSPAN_REMOTE INPUT_LEDS INPUT_MOUSEDEV INPUT_MOUSEDEV_PSAUX INPUT_POWERMATE INPUT_TABLET INPUT_TOUCHSCREEN INPUT_UINPUT INPUT_YEALINK INTEGRITY INTEGRITY_ASYMMETRIC_KEYS INTEGRITY_AUDIT INTEGRITY_SIGNATURE INTEGRITY_TRUSTED_KEYRING INTEL_CHTWC_INT33FE INTEL_IDMA64 INTEL_IOATDMA INTEL_IOMMU_DEFAULT_ON INTEL_IOMMU_SVM INTEL_ISHTP_ECLITE INTEL_ISH_FIRMWARE_DOWNLOADER INTEL_ISH_HID INTEL_SCU_IPC INTEL_SOC_PMIC_BXTWC INTEL_SOC_PMIC_CHTWC INTERVAL_TREE_SPAN_ITER IOMMUFD IOMMUFD_DRIVER IOMMUFD_DRIVER_CORE IOMMUFD_TEST IO_URING_ZCRX IP6_NF_MATCH_AH IP6_NF_MATCH_EUI64 IP6_NF_MATCH_FRAG IP6_NF_MATCH_HL IP6_NF_MATCH_MH IP6_NF_MATCH_OPTS IP6_NF_MATCH_RPFILTER IP6_NF_MATCH_RT IP6_NF_MATCH_SRH IP6_NF_NAT IP6_NF_RAW IP6_NF_SECURITY IP6_NF_TARGET_HL IP6_NF_TARGET_MASQUERADE IP6_NF_TARGET_NPT IP6_NF_TARGET_SYNPROXY IPV6_FOU IPV6_FOU_TUNNEL IPV6_GRE IPV6_ILA IPV6_MIP6 IPV6_MROUTE IPV6_MROUTE_MULTIPLE_TABLES IPV6_MULTIPLE_TABLES IPV6_OPTIMISTIC_DAD IPV6_PIMSM_V2 IPV6_ROUTER_PREF IPV6_ROUTE_INFO IPV6_RPL_LWTUNNEL IPV6_SEG6_BPF IPV6_SEG6_HMAC IPV6_SEG6_LWTUNNEL IPV6_SIT_6RD IPV6_SUBTREES IPV6_TUNNEL IPV6_VTI IPVLAN IPVLAN_L3S IPVTAP IP_FIB_TRIE_STATS IP_MROUTE_MULTIPLE_TABLES IP_NF_ARPFILTER IP_NF_ARPTABLES IP_NF_ARP_MANGLE IP_NF_MATCH_AH IP_NF_MATCH_ECN IP_NF_MATCH_RPFILTER IP_NF_MATCH_TTL IP_NF_RAW IP_NF_SECURITY IP_NF_TARGET_ECN IP_NF_TARGET_NETMAP IP_NF_TARGET_REDIRECT IP_NF_TARGET_SYNPROXY IP_NF_TARGET_TTL IP_ROUTE_CLASSID IP_SCTP IP_SET IP_SET_BITMAP_IP IP_SET_BITMAP_IPMAC IP_SET_BITMAP_PORT IP_SET_HASH_IP IP_SET_HASH_IPMAC IP_SET_HASH_IPMARK IP_SET_HASH_IPPORT IP_SET_HASH_IPPORTIP IP_SET_HASH_IPPORTNET IP_SET_HASH_MAC IP_SET_HASH_NET IP_SET_HASH_NETIFACE IRQ_TIME_ACCOUNTING L2TP LAPB LCD_CLASS_DEVICE LEDS_CLASS_MULTICOLOR LIBNVDIMM MAC80211 MAC802154 MEDIA_COMMON_OPTIONS MEDIA_DIGITAL_TV_SUPPORT MEDIA_PLATFORM_SUPPORT MEDIA_RADIO_SUPPORT MEDIA_SDR_SUPPORT MEDIA_SUPPORT MEDIA_TEST_SUPPORT MEDIA_USB_SUPPORT MEMORY_HOTPLUG MEMORY_HOTREMOVE MFD_DLN2 MFD_INTEL_PMC_BXT MFD_MT6360 MFD_MT6370 MFD_RETU MFD_VIPERBOARD MMC MODVERSIONS MPTCP MTD MTD_UBI NETFILTER_ADVANCED NETFILTER_CONNCOUNT NET_ACT_GACT NET_ACT_MIRRED NET_IPGRE NET_IPGRE_DEMUX NFS_V4_1 NFT_COMPAT NFT_COMPAT_ARP NFT_FWD_NETDEV NF_TABLES NF_TABLES_ARP NF_TABLES_NETDEV NF_TPROXY_IPV4 NF_TPROXY_IPV6 NILFS2_FS NINTENDO_FF NLMON NLS_CODEPAGE_1250 NLS_CODEPAGE_1251 NLS_CODEPAGE_737 NLS_CODEPAGE_775 NLS_CODEPAGE_850 NLS_CODEPAGE_852 NLS_CODEPAGE_855 NLS_CODEPAGE_857 NLS_CODEPAGE_860 NLS_CODEPAGE_861 NLS_CODEPAGE_862 NLS_CODEPAGE_863 NLS_CODEPAGE_864 NLS_CODEPAGE_865 NLS_CODEPAGE_866 NLS_CODEPAGE_869 NLS_CODEPAGE_874 NLS_CODEPAGE_932 NLS_CODEPAGE_936 NLS_CODEPAGE_949 NLS_CODEPAGE_950 NLS_ISO8859_13 NLS_ISO8859_14 NLS_ISO8859_15 NLS_ISO8859_2 NLS_ISO8859_3 NLS_ISO8859_4 NLS_ISO8859_5 NLS_ISO8859_6 NLS_ISO8859_7 NLS_ISO8859_8 NLS_ISO8859_9 NLS_KOI8_R NLS_KOI8_U NLS_MAC_CELTIC NLS_MAC_CENTEURO NLS_MAC_CROATIAN NLS_MAC_CYRILLIC NLS_MAC_GAELIC NLS_MAC_GREEK NLS_MAC_ICELAND NLS_MAC_INUIT NLS_MAC_ROMAN NLS_MAC_ROMANIAN NLS_MAC_TURKISH NLS_UCS2_UTILS NOZOMI NTFS3_FS NTFS3_FS_POSIX_ACL NTFS3_LZX_XPRESS NULL_TTY NUMA_BALANCING NUMA_BALANCING_DEFAULT_ENABLED NUMA_EMU NUMA_KEEP_MEMINFO NVDIMM_DAX NVDIMM_KEYS NVDIMM_PFN NVIDIA_SHIELD_FF NVME_CORE NVME_FABRICS NVME_FC NVME_MULTIPATH NVME_RDMA NVME_TARGET NVME_TARGET_FC NVME_TARGET_FCLOOP NVME_TARGET_LOOP NVME_TARGET_RDMA NVME_TARGET_TCP NVME_TCP N_GSM N_HDLC OCFS2_DEBUG_FS OCFS2_FS OCFS2_FS_O2CB OCFS2_FS_STATS OCFS2_FS_USERSPACE_CLUSTER OF_GPIO OF_PMEM OMFS_FS OPENVSWITCH OPENVSWITCH_GENEVE OPENVSWITCH_GRE OPENVSWITCH_VXLAN ORANGEFS_FS OSF_PARTITION OVERLAY_FS OVERLAY_FS_DEBUG OVERLAY_FS_INDEX OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW OVERLAY_FS_REDIRECT_DIR PACKET_DIAG PAGE_IDLE_FLAG PAGE_POOL PAGE_REPORTING PAHOLE_HAS_BTF_TAG PAHOLE_HAS_LANG_EXCLUDE PAHOLE_HAS_SPLIT_BTF PARPORT PARPORT_NOT_PC PARTITION_ADVANCED PCCARD PCCARD_NONSTATIC PCIEAER PCI_ENDPOINT PCI_IOV PCMCIA PCMCIA_LOAD_CIS PERCPU_STATS PERSISTENT_KEYRINGS PHYLINK PHY_CPCAP_USB PHY_QCOM_USB_HS PHY_QCOM_USB_HSIC PHY_SAMSUNG_USB2 PHY_TUSB1210 PKCS7_TEST_KEY PKCS8_PRIVATE_KEY_PARSER PLAYSTATION_FF PLFXLC PMIC_OPREGION PM_CLK PNFS_BLOCK PNFS_FILE_LAYOUT PNFS_FLEXFILE_LAYOUT PPP PPPOATM PPPOE PPPOE_HASH_BITS_1 PPPOL2TP PPP_ASYNC PPP_BSDCOMP PPP_DEFLATE PPP_FILTER PPP_MPPE PPP_MULTILINK PPP_SYNC_TTY PPTP PREEMPT PREEMPT_NOTIFIERS PROC_CHILDREN PSAMPLE PSI PSTORE PSTORE_COMPRESS QCOM_QMI_HELPERS QNX4FS_FS QNX6FS_FS QRTR QRTR_TUN RADIO_ADAPTERS RADIO_SHARK RADIO_SHARK2 RADIO_SI4713 RADIO_TEA575X RAID6_PQ RAID_ATTRS RAS RC_ATI_REMOTE RC_CORE RC_DEVICES RC_XBOX_DVD RDMA_RXE RDMA_SIW RDS RDS_RDMA RDS_TCP READ_ONLY_THP_FOR_FS REALTEK_AUTOPM REED_SOLOMON REED_SOLOMON_DEC8 REGMAP REGMAP_I2C REGMAP_IRQ REGMAP_MMIO REGMAP_SPI REGULATOR REGULATOR_FIXED_VOLTAGE REGULATOR_TWL4030 RESET_CONTROLLER RFKILL RFKILL_INPUT RFKILL_LEDS RMI4_2D_SENSOR RMI4_CORE RMI4_F03 RMI4_F03_SERIO RMI4_F11 RMI4_F12 RMI4_F30 RMI4_F3A ROMFS_BACKED_BY_BOTH ROMFS_FS ROMFS_ON_BLOCK ROMFS_ON_MTD ROSE RTC_DRV_HID_SENSOR_TIME RXKAD SCHED_CORE SCREEN_INFO SCSI_FC_ATTRS SCSI_HPSA SCSI_ISCSI_ATTRS SCSI_LOGGING SCSI_NETLINK SCSI_SAS_ATA SCSI_SAS_ATTRS SCSI_SAS_LIBSAS SCSI_SCAN_ASYNC SCSI_SRP_ATTRS SCTP_COOKIE_HMAC_MD5 SCTP_COOKIE_HMAC_SHA1 SCTP_DEFAULT_COOKIE_HMAC_MD5 SECONDARY_TRUSTED_KEYRING SECURITY_INFINIBAND SECURITY_NETWORK_XFRM SECURITY_SMACK_NETFILTER SENSORS_AQUACOMPUTER_D5NEXT SENSORS_CORSAIR_CPRO SENSORS_CORSAIR_PSU SENSORS_GIGABYTE_WATERFORCE SENSORS_NZXT_KRAKEN2 SENSORS_NZXT_SMART2 SENSORS_POWERZ SERIAL_DEV_BUS SERIAL_DEV_CTRL_TTYPORT SERIAL_MCTRL_GPIO SGI_PARTITION SIGNATURE SIGNED_PE_FILE_VERIFICATION SKB_DECRYPTED SLHC SLIP SLIP_COMPRESSED SLIP_MODE_SLIP6 SLIP_SMART SMARTJOYPLUS_FF SMBFS SMB_SERVER SMC SMC_DIAG SMSC_PHY SMS_SDIO_DRV SMS_SIANO_DEBUGFS SMS_SIANO_MDTV SMS_SIANO_RC SMS_USB_DRV SND SND_ALOOP SND_BCD2000 SND_CTL_FAST_LOOKUP SND_CTL_LED SND_DEBUG SND_DMA_SGBUF SND_DRIVERS SND_DUMMY SND_DYNAMIC_MINORS SND_HDA SND_HDA_CODEC_ANALOG SND_HDA_CODEC_CA0110 SND_HDA_CODEC_CA0132 SND_HDA_CODEC_CIRRUS SND_HDA_CODEC_CMEDIA SND_HDA_CODEC_CONEXANT SND_HDA_CODEC_HDMI SND_HDA_CODEC_REALTEK SND_HDA_CODEC_SI3054 SND_HDA_CODEC_SIGMATEL SND_HDA_CODEC_VIA SND_HDA_COMPONENT SND_HDA_CORE SND_HDA_GENERIC SND_HDA_GENERIC_LEDS SND_HDA_HWDEP SND_HDA_I915 SND_HDA_INPUT_BEEP SND_HDA_INTEL SND_HDA_PATCH_LOADER SND_HDA_RECONFIG SND_HDA_SCODEC_COMPONENT SND_HRTIMER SND_HWDEP SND_INTEL_DSP_CONFIG SND_INTEL_NHLT SND_INTEL_SOUNDWIRE_ACPI SND_JACK SND_JACK_INPUT_DEV SND_MIXER_OSS SND_OSSEMUL SND_PCI SND_PCM SND_PCMCIA SND_PCM_ELD SND_PCM_OSS SND_PCM_OSS_PLUGINS SND_PCM_TIMER SND_PCM_XRUN_DEBUG SND_PROC_FS SND_RAWMIDI SND_SEQUENCER SND_SEQUENCER_OSS SND_SEQ_DEVICE SND_SEQ_DUMMY SND_SEQ_HRTIMER_DEFAULT SND_SEQ_MIDI SND_SEQ_MIDI_EVENT SND_SEQ_VIRMIDI SND_SOC SND_SOC_I2C_AND_SPI SND_SOC_SDCA_OPTIONAL SND_SUPPORT_OLD_API SND_TIMER SND_UMP SND_UMP_LEGACY_RAWMIDI SND_USB SND_USB_6FIRE SND_USB_AUDIO SND_USB_AUDIO_MIDI_V2 SND_USB_AUDIO_USE_MEDIA_CONTROLLER SND_USB_CAIAQ SND_USB_CAIAQ_INPUT SND_USB_HIFACE SND_USB_LINE6 SND_USB_POD SND_USB_PODHD SND_USB_TONEPORT SND_USB_UA101 SND_USB_US122L SND_USB_USX2Y SND_USB_VARIAX SND_VERBOSE_PROCFS SND_VIRMIDI SND_VIRTIO SND_VMASTER SND_X86 SOCK_VALIDATE_XMIT SOLARIS_X86_PARTITION SONY_FF SOUND SOUNDWIRE SOUND_OSS_CORE SOUND_OSS_CORE_PRECLAIM SPI SPI_DLN2 SPI_DYNAMIC SPI_LJCA SPI_MASTER SQUASHFS SQUASHFS_4K_DEVBLK_SIZE SQUASHFS_COMPILE_DECOMP_MULTI SQUASHFS_DECOMP_MULTI SQUASHFS_FILE_DIRECT SQUASHFS_LZ4 SQUASHFS_LZO SQUASHFS_XATTR SQUASHFS_XZ SQUASHFS_ZLIB SQUASHFS_ZSTD SSB SSB_PCIHOST_POSSIBLE SSB_PCMCIAHOST_POSSIBLE SSB_SDIOHOST_POSSIBLE STAGING STEAM_FF STP STREAM_PARSER SUNRPC_BACKCHANNEL SUN_PARTITION SURFACE_AGGREGATOR SURFACE_AGGREGATOR_BUS SURFACE_AGGREGATOR_REGISTRY SURFACE_HID SURFACE_HID_CORE SURFACE_KBD SW_SYNC SYSFB SYSFS_SYSCALL SYSV68_PARTITION TABLET_USB_ACECAD TABLET_USB_AIPTEK TABLET_USB_HANWANG TABLET_USB_KBTAB TABLET_USB_PEGASUS TAHVO_USB TAHVO_USB_HOST_BY_DEFAULT TCG_CRB TCG_TIS TCG_TIS_CORE TCG_TPM TCP_CONG_BBR TCP_CONG_BIC TCP_CONG_CDG TCP_CONG_DCTCP TCP_CONG_HSTCP TCP_CONG_HTCP TCP_CONG_HYBLA TCP_CONG_ILLINOIS TCP_CONG_LP TCP_CONG_NV TCP_CONG_SCALABLE TCP_CONG_VEGAS TCP_CONG_VENO TCP_CONG_WESTWOOD TCP_CONG_YEAH TEE TEXTSEARCH TEXTSEARCH_BM TEXTSEARCH_FSM TEXTSEARCH_KMP THP_SWAP THRUSTMASTER_FF TIPC TIPC_CRYPTO TIPC_DIAG TIPC_MEDIA_IB TIPC_MEDIA_UDP TLS TLS_TOE TMPFS_QUOTA TOOLS_SUPPORT_RELR TOUCHSCREEN_SUR40 TOUCHSCREEN_USB_3M TOUCHSCREEN_USB_COMPOSITE TOUCHSCREEN_USB_DMC_TSC10 TOUCHSCREEN_USB_E2I TOUCHSCREEN_USB_EASYTOUCH TOUCHSCREEN_USB_EGALAX TOUCHSCREEN_USB_ELO TOUCHSCREEN_USB_ETT_TC45USB TOUCHSCREEN_USB_ETURBO TOUCHSCREEN_USB_GENERAL_TOUCH TOUCHSCREEN_USB_GOTOP TOUCHSCREEN_USB_GUNZE TOUCHSCREEN_USB_IDEALTEK TOUCHSCREEN_USB_IRTOUCH TOUCHSCREEN_USB_ITM TOUCHSCREEN_USB_JASTEC TOUCHSCREEN_USB_NEXIO TOUCHSCREEN_USB_PANJIT TOUCHSCREEN_USB_ZYTRONIC TRANSPARENT_HUGEPAGE TRANSPARENT_HUGEPAGE_MADVISE TTPCI_EEPROM TTY_PRINTK TUN_VNET_CROSS_LE TWL4030_CORE TYPEC TYPEC_ANX7411 TYPEC_DP_ALTMODE TYPEC_FUSB302 TYPEC_HD3SS3220 TYPEC_MT6360 TYPEC_MUX_FSA4480 TYPEC_MUX_GPIO_SBU TYPEC_MUX_INTEL_PMC TYPEC_MUX_NB7VPQ904M TYPEC_MUX_PI3USB30532 TYPEC_MUX_PTN36502 TYPEC_MUX_WCD939X_USBSS TYPEC_NVIDIA_ALTMODE TYPEC_RT1711H TYPEC_RT1719 TYPEC_STUSB160X TYPEC_TCPCI TYPEC_TCPCI_MAXIM TYPEC_TCPCI_MT6370 TYPEC_TCPM TYPEC_TPS6598X TYPEC_UCSI TYPEC_WCOVE TYPEC_WUSB3801 UBIFS_ATIME_SUPPORT UBIFS_FS UBIFS_FS_ADVANCED_COMPR UBIFS_FS_LZO UBIFS_FS_SECURITY UBIFS_FS_XATTR UBIFS_FS_ZLIB UBIFS_FS_ZSTD UCSI_ACPI UCSI_CCG UCSI_STM32G0 UDF_FS UDMABUF UFS_FS UFS_FS_WRITE UHID ULTRIX_PARTITION UNICODE UNIXWARE_DISKLABEL UNIX_DIAG USB4 USB4_NET USBIP_CORE USBIP_HOST USBIP_VHCI_HCD USBIP_VUDC USBPCWATCHDOG USB_ACM USB_ADUTUX USB_AIRSPY USB_ALI_M5632 USB_AN2720 USB_APPLEDISPLAY USB_ARMLINUX USB_DWC2 USB_GADGET USB_LJCA USB_MUSB_HDRC USB_NET_CDC_SUBSET USB_ROLES_INTEL_XHCI USB_ROLE_SWITCH USB_STORAGE_REALTEK USB_ULPI_BUS USB_USBNET VIDEO_DEV VIRTIO_FS VXLAN WAN WIRELESS WLAN WLAN_VENDOR_PURELIFI ZONE_DEVICE] disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed picked [v6.14 v6.13 v6.12 v6.10 v6.8 v6.6 v6.4 v6.2 v5.19 v5.16 v5.13 v5.10 v5.7 v5.4 v5.1 v4.19] out of 37 release tags testing release v6.14 testing commit 38fec10eb60d687e30c8c6b5420d86e8149f7557 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 8f538f7e6d56d63fbe490fc23c6a0472221f8741cf3ed3596eb6ded9a984cab0 run #0: crashed: KASAN: use-after-free Read in ext4_find_extent run #1: crashed: KASAN: use-after-free Read in ext4_find_extent run #2: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #4: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #5: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #6: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #7: crashed: KASAN: slab-use-after-free Read in ext4_ext_insert_extent run #8: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #9: crashed: KASAN: slab-use-after-free Read in ext4_ext_insert_extent representative crash: KASAN: use-after-free Read in ext4_find_extent, types: [KASAN] testing release v6.13 testing commit ffd294d346d185b70e28b1a28abe367bbfe53c04 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: fc3b0414c480a7800db9e9a0fcaa4d9d781cc854c45dacd596b29a18b3907977 all runs: OK false negative chance: 0.000 # git bisect start 38fec10eb60d687e30c8c6b5420d86e8149f7557 ffd294d346d185b70e28b1a28abe367bbfe53c04 Bisecting: 6039 revisions left to test after this (roughly 13 steps) [2c8d2a510c15c003749e43ac2b8e1bc79a7a00d6] Merge tag 'sound-6.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound testing commit 2c8d2a510c15c003749e43ac2b8e1bc79a7a00d6 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: bfdbcf2f0bbd3f24d69203e16e460882a44fff6780b165c06932cc6d619119d4 all runs: OK false negative chance: 0.000 # git bisect good 2c8d2a510c15c003749e43ac2b8e1bc79a7a00d6 Bisecting: 3064 revisions left to test after this (roughly 12 steps) [9ff28f2fad67e173ed25b8c3a183b15da5445d2d] Merge tag 'loongarch-6.14' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson testing commit 9ff28f2fad67e173ed25b8c3a183b15da5445d2d gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: a3d7ac730e8be917b4d81371f5d2e13007dce3a49a75d393ad308d334ece1058 all runs: OK false negative chance: 0.000 # git bisect good 9ff28f2fad67e173ed25b8c3a183b15da5445d2d Bisecting: 1532 revisions left to test after this (roughly 11 steps) [243899076c3efdf98d8e922a802896424a597580] Merge tag 'rust-fixes-6.14-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux testing commit 243899076c3efdf98d8e922a802896424a597580 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 2f6127155ee178cc92a0a10e4be3820024b1cf42ba37fae4a21c6ebd2f375177 all runs: OK false negative chance: 0.000 # git bisect good 243899076c3efdf98d8e922a802896424a597580 Bisecting: 764 revisions left to test after this (roughly 10 steps) [5872cca23a017aae01d0b2f82346907169f7aa01] Merge tag 'exfat-for-6.14-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat testing commit 5872cca23a017aae01d0b2f82346907169f7aa01 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 175795289a7fbc0a0e5d8e27308e5a2c2680b2226987124e017417174c0813c3 all runs: OK false negative chance: 0.000 # git bisect good 5872cca23a017aae01d0b2f82346907169f7aa01 Bisecting: 366 revisions left to test after this (roughly 9 steps) [4003c9e78778e93188a09d6043a74f7154449d43] Merge tag 'net-6.14-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net testing commit 4003c9e78778e93188a09d6043a74f7154449d43 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 9172eba3dfb37bef00d82a340df36dcec1e8bd566c1adb513a979050f2a1c91e all runs: OK false negative chance: 0.000 # git bisect good 4003c9e78778e93188a09d6043a74f7154449d43 Bisecting: 181 revisions left to test after this (roughly 8 steps) [41e09ef6c26f0bd89f93691ef967fd621a38d759] Merge tag 'amd-drm-fixes-6.14-2025-03-20' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes testing commit 41e09ef6c26f0bd89f93691ef967fd621a38d759 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 0ea1087e6483136f2b8f02828dc24104b01de1f6dcf6c309d948e7a5394cd78f all runs: OK false negative chance: 0.000 # git bisect good 41e09ef6c26f0bd89f93691ef967fd621a38d759 Bisecting: 87 revisions left to test after this (roughly 7 steps) [80c4c25460849f441d35810555539aa3adc52929] Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma testing commit 80c4c25460849f441d35810555539aa3adc52929 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 6bdaf61bc5618b54f0587d4d108fe602e8543ea08fb34e1345da5ae7a94b3a1e run #0: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #1: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #2: crashed: KASAN: slab-use-after-free Read in ext4_ext_insert_extent run #3: crashed: KASAN: slab-use-after-free Read in ext4_ext_correct_indexes run #4: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #5: crashed: KASAN: slab-out-of-bounds Read in ext4_ext_insert_extent run #6: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #7: crashed: KASAN: use-after-free Read in ext4_find_extent run #8: crashed: KASAN: use-after-free Read in ext4_find_extent run #9: crashed: KASAN: slab-use-after-free Read in ext4_find_extent representative crash: KASAN: slab-use-after-free Read in ext4_find_extent, types: [KASAN] # git bisect bad 80c4c25460849f441d35810555539aa3adc52929 Bisecting: 47 revisions left to test after this (roughly 6 steps) [45d5fe1c53baaed1fb3043f45d1e15ebb4bbe86a] ARM: davinci: da850: fix selecting ARCH_DAVINCI_DA8XX testing commit 45d5fe1c53baaed1fb3043f45d1e15ebb4bbe86a gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 003a8c1346ebe18fd8901a8960e52bb058108d4ce8dcb025083700bfa341429d all runs: OK false negative chance: 0.000 # git bisect good 45d5fe1c53baaed1fb3043f45d1e15ebb4bbe86a Bisecting: 24 revisions left to test after this (roughly 5 steps) [81e4f8d68c66da301bb881862735bd74c6241a19] Merge tag 'pmdomain-v6.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm testing commit 81e4f8d68c66da301bb881862735bd74c6241a19 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 93e0d12aa9e80fca85bb582f2c80103a34e737f9e4c09f7b6ac053a3c4166029 run #0: crashed: KASAN: use-after-free Read in ext4_ext_insert_extent run #1: crashed: KASAN: use-after-free Read in ext4_find_extent run #2: crashed: KASAN: slab-out-of-bounds Read in ext4_ext_insert_extent run #3: crashed: KASAN: use-after-free Read in ext4_find_extent run #4: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #5: crashed: KASAN: slab-out-of-bounds Read in ext4_ext_insert_extent run #6: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #7: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #8: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #9: crashed: KASAN: use-after-free Read in ext4_find_extent representative crash: KASAN: use-after-free Read in ext4_ext_insert_extent, types: [KASAN] # git bisect bad 81e4f8d68c66da301bb881862735bd74c6241a19 Bisecting: 11 revisions left to test after this (roughly 4 steps) [67a2f86846f244d81601cf2e1552c4656b8556d6] selftests/mm: run_vmtests.sh: fix half_ufd_size_MB calculation testing commit 67a2f86846f244d81601cf2e1552c4656b8556d6 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: f48941f74c0226b2534e531fc2c1354ea0c63b0f8d7c62a4abd1b802f4ef29fd run #0: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #1: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #2: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #4: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #5: crashed: KASAN: use-after-free Read in ext4_ext_insert_extent run #6: crashed: KASAN: use-after-free Read in ext4_ext_insert_extent run #7: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #8: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #9: crashed: KASAN: slab-use-after-free Read in ext4_find_extent representative crash: KASAN: slab-use-after-free Read in ext4_find_extent, types: [KASAN] # git bisect bad 67a2f86846f244d81601cf2e1552c4656b8556d6 Bisecting: 5 revisions left to test after this (roughly 3 steps) [cb402bbdabcaa5a765068c5b8673bbfc1c264242] mm/hugetlb: fix surplus pages in dissolve_free_huge_page() testing commit cb402bbdabcaa5a765068c5b8673bbfc1c264242 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 4c68a19aa2e4ab343b2e11684fc4261fb70d969fcfe2614e972d9f52d02ef8eb run #0: crashed: KASAN: use-after-free Read in ext4_find_extent run #1: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #2: crashed: KASAN: slab-use-after-free Read in ext4_ext_insert_extent run #3: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #4: crashed: KASAN: use-after-free Read in ext4_find_extent run #5: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #6: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #7: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #8: crashed: KASAN: slab-use-after-free Read in ext4_ext_insert_extent run #9: crashed: KASAN: use-after-free Read in ext4_find_extent representative crash: KASAN: use-after-free Read in ext4_find_extent, types: [KASAN] # git bisect bad cb402bbdabcaa5a765068c5b8673bbfc1c264242 Bisecting: 2 revisions left to test after this (roughly 1 step) [665575cff098b696995ddaddf4646a4099941f5e] filemap: move prefaulting out of hot write path testing commit 665575cff098b696995ddaddf4646a4099941f5e gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 45edb71e49e874dee80c16e3e44f5ed58f819f77ba38ab199ce48364e3b1cd29 run #0: crashed: KASAN: use-after-free Read in ext4_find_extent run #1: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #2: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #3: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #4: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #5: crashed: KASAN: slab-use-after-free Read in ext4_find_extent run #6: crashed: KASAN: slab-out-of-bounds Read in ext4_ext_correct_indexes run #7: crashed: KASAN: use-after-free Read in ext4_find_extent run #8: crashed: KASAN: slab-use-after-free Read in ext4_ext_insert_extent run #9: crashed: KASAN: slab-use-after-free Read in ext4_find_extent representative crash: KASAN: use-after-free Read in ext4_find_extent, types: [KASAN] # git bisect bad 665575cff098b696995ddaddf4646a4099941f5e Bisecting: 0 revisions left to test after this (roughly 0 steps) [654b33ada4ab5e926cd9c570196fefa7bec7c1df] proc: fix UAF in proc_get_inode() testing commit 654b33ada4ab5e926cd9c570196fefa7bec7c1df gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: c69ff4c676b7c016512bf46a3c2e7f960ac38702ce89aab91c19f516fcb7f7a9 all runs: OK false negative chance: 0.000 # git bisect good 654b33ada4ab5e926cd9c570196fefa7bec7c1df 665575cff098b696995ddaddf4646a4099941f5e is the first bad commit commit 665575cff098b696995ddaddf4646a4099941f5e Author: Dave Hansen Date: Fri Feb 28 12:37:22 2025 -0800 filemap: move prefaulting out of hot write path There is a generic anti-pattern that shows up in the VFS and several filesystems where the hot write paths touch userspace twice when they could get away with doing it once. Dave Chinner suggested that they should all be fixed up[1]. I agree[2]. But, the series to do that fixup spans a bunch of filesystems and a lot of people. This patch fixes common code that absolutely everyone uses. It has measurable performance benefits[3]. I think this patch can go in and not be held up by the others. I will post them separately to their separate maintainers for consideration. But, honestly, I'm not going to lose any sleep if the maintainers don't pick those up. 1. https://lore.kernel.org/all/Z5f-x278Z3wTIugL@dread.disaster.area/ 2. https://lore.kernel.org/all/20250129181749.C229F6F3@davehans-spike.ostc.intel.com/ 3. https://lore.kernel.org/all/202502121529.d62a409e-lkp@intel.com/ This patch: There is a bit of a sordid history here. I originally wrote 998ef75ddb57 ("fs: do not prefault sys_write() user buffer pages") to fix a performance issue that showed up on early SMAP hardware. But that was reverted with 00a3d660cbac because it exposed an underlying filesystem bug. This is a reimplementation of the original commit along with some simplification and comment improvements. The basic problem is that the generic write path has two userspace accesses: one to prefault the write source buffer and then another to perform the actual write. On x86, this means an extra STAC/CLAC pair. These are relatively expensive instructions because they function as barriers. Keep the prefaulting behavior but move it into the slow path that gets run when the write did not make any progress. This avoids livelocks that can happen when the write's source and destination target the same folio. Contrary to the existing comments, the fault-in does not prevent deadlocks. That's accomplished by using an "atomic" usercopy that disables page faults. The end result is that the generic write fast path now touches userspace once instead of twice. 0day has shown some improvements on a couple of microbenchmarks: https://lore.kernel.org/all/202502121529.d62a409e-lkp@intel.com/ Link: https://lkml.kernel.org/r/20250228203722.CAEB63AC@davehans-spike.ostc.intel.com Signed-off-by: Dave Hansen Link: https://lore.kernel.org/all/yxyuijjfd6yknryji2q64j3keq2ygw6ca6fs5jwyolklzvo45s@4u63qqqyosy2/ Cc: Ted Ts'o Cc: Matthew Wilcox Cc: Mateusz Guzik Cc: Dave Chinner Signed-off-by: Andrew Morton mm/filemap.c | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-) accumulated error probability: 0.00 culprit signature: 45edb71e49e874dee80c16e3e44f5ed58f819f77ba38ab199ce48364e3b1cd29 parent signature: c69ff4c676b7c016512bf46a3c2e7f960ac38702ce89aab91c19f516fcb7f7a9 revisions tested: 21, total time: 7h26m4.996155881s (build: 4h6m0.810572011s, test: 3h3m34.702837193s) first bad commit: 665575cff098b696995ddaddf4646a4099941f5e filemap: move prefaulting out of hot write path recipients (to): ["akpm@linux-foundation.org" "dave.hansen@linux.intel.com"] recipients (cc): [] crash: KASAN: use-after-free Read in ext4_find_extent ================================================================== BUG: KASAN: use-after-free in ext4_ext_binsearch fs/ext4/extents.c:840 [inline] BUG: KASAN: use-after-free in ext4_find_extent+0xad0/0xc50 fs/ext4/extents.c:955 Read of size 4 at addr ffff88805f29a8f8 by task syz.0.244/6343 CPU: 1 UID: 0 PID: 6343 Comm: syz.0.244 Not tainted 6.14.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: dump_stack_lvl+0xf5/0x170 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xb4/0x290 mm/kasan/report.c:521 kasan_report+0x118/0x150 mm/kasan/report.c:634 ext4_ext_binsearch fs/ext4/extents.c:840 [inline] ext4_find_extent+0xad0/0xc50 fs/ext4/extents.c:955 ext4_ext_map_blocks+0x1ff/0x5360 fs/ext4/extents.c:4205 ext4_map_create_blocks fs/ext4/inode.c:516 [inline] ext4_map_blocks+0x687/0x1710 fs/ext4/inode.c:702 _ext4_get_block+0x1a0/0x3d0 fs/ext4/inode.c:781 ext4_get_block_unwritten+0x17/0xa0 fs/ext4/inode.c:814 ext4_block_write_begin+0x36c/0xae0 fs/ext4/inode.c:1063 ext4_write_begin+0x5e3/0x1040 fs/ext4/inode.c:-1 ext4_da_write_begin+0x3e1/0x770 fs/ext4/inode.c:2925 generic_perform_write+0x29a/0x680 mm/filemap.c:4177 ext4_buffered_write_iter+0xaf/0x2c0 fs/ext4/file.c:299 ext4_file_write_iter+0x1c9/0x14f0 fs/ext4/file.c:-1 new_sync_write fs/read_write.c:586 [inline] vfs_write+0x838/0xac0 fs/read_write.c:679 ksys_pwrite64 fs/read_write.c:786 [inline] __do_sys_pwrite64 fs/read_write.c:794 [inline] __se_sys_pwrite64 fs/read_write.c:791 [inline] __x64_sys_pwrite64+0x13a/0x1c0 fs/read_write.c:791 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x8f/0x170 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb4f658e969 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fb4f731d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 RAX: ffffffffffffffda RBX: 00007fb4f67b5fa0 RCX: 00007fb4f658e969 RDX: 000000000000fdef RSI: 0000200000000140 RDI: 0000000000000004 RBP: 00007fb4f6610ab1 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000fecc R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fb4f67b5fa0 R15: 00007ffc0826a808 The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x51 pfn:0x5f29a flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 ffffea00017ca6c8 ffffea0001783648 0000000000000000 raw: 0000000000000051 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 6335, tgid 6331 (syz.6.241), ts 104219503317, free_ts 104453358490 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xec/0x120 mm/page_alloc.c:1551 prep_new_page mm/page_alloc.c:1559 [inline] get_page_from_freelist+0x2763/0x2800 mm/page_alloc.c:3477 __alloc_frozen_pages_noprof+0x1e4/0x430 mm/page_alloc.c:4740 alloc_pages_mpol+0x152/0x320 mm/mempolicy.c:2270 folio_alloc_mpol_noprof+0x10/0x40 mm/mempolicy.c:2289 shmem_alloc_folio mm/shmem.c:1863 [inline] shmem_alloc_and_add_folio+0x33c/0xd40 mm/shmem.c:1902 shmem_get_folio_gfp+0x39a/0xc40 mm/shmem.c:2545 shmem_get_folio mm/shmem.c:2651 [inline] shmem_write_begin+0xde/0x220 mm/shmem.c:3301 generic_perform_write+0x29a/0x680 mm/filemap.c:4177 shmem_file_write_iter+0xb2/0xd0 mm/shmem.c:3477 new_sync_write fs/read_write.c:586 [inline] vfs_write+0x838/0xac0 fs/read_write.c:679 ksys_write+0x111/0x1e0 fs/read_write.c:731 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x8f/0x170 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 3881 tgid 3881 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1127 [inline] free_unref_folios+0xb61/0x12c0 mm/page_alloc.c:2707 folios_put_refs+0x3e6/0x4c0 mm/swap.c:994 folio_batch_release include/linux/pagevec.h:101 [inline] shmem_undo_range+0x363/0xd10 mm/shmem.c:1112 shmem_truncate_range mm/shmem.c:1224 [inline] shmem_evict_inode+0x3b6/0x8f0 mm/shmem.c:1352 evict+0x440/0x940 fs/inode.c:796 __dentry_kill+0x194/0x5c0 fs/dcache.c:643 dput+0xa7/0xf0 fs/dcache.c:885 __fput+0x493/0x7a0 fs/file_table.c:472 task_work_run+0x14a/0x1e0 kernel/task_work.c:227 resume_user_mode_work+0x52/0x60 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x77/0xc0 kernel/entry/common.c:218 do_syscall_64+0x9c/0x170 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff88805f29a780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88805f29a800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff88805f29a880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88805f29a900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88805f29a980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================