bisecting fixing commit since cbfa1702aaf69b2311ea1b35e04f113c48368c67 building syzkaller on 2d5ea0cb6edb828803beea8af38dbc04dc80f028 testing commit cbfa1702aaf69b2311ea1b35e04f113c48368c67 with gcc (GCC) 8.1.0 kernel signature: f5b010a3115ed58c4a0cd0a2c7b68f8474432558c934a8a0985ea973bda0336a run #0: crashed: KASAN: out-of-bounds Read in leaf_paste_entries run #1: crashed: KASAN: out-of-bounds Read in leaf_paste_entries run #2: crashed: KASAN: out-of-bounds Read in leaf_paste_entries run #3: crashed: KASAN: out-of-bounds Read in leaf_paste_entries run #4: crashed: KASAN: use-after-free Read in leaf_paste_entries run #5: crashed: KASAN: out-of-bounds Read in leaf_paste_entries run #6: crashed: KASAN: out-of-bounds Read in leaf_paste_entries run #7: crashed: KASAN: use-after-free Read in search_by_entry_key run #8: crashed: KASAN: out-of-bounds Read in leaf_paste_entries run #9: crashed: KASAN: use-after-free Read in leaf_paste_entries testing current HEAD 1752938529c614a8ed4432ecce6ebc95d3b87207 testing commit 1752938529c614a8ed4432ecce6ebc95d3b87207 with gcc (GCC) 8.1.0 kernel signature: 35ae9e772b14297bba3a0df318711b043fe385c6b13f11f817431a773e05df7a run #0: crashed: KASAN: use-after-free Read in search_by_entry_key run #1: crashed: KASAN: out-of-bounds Read in leaf_paste_entries run #2: crashed: KASAN: out-of-bounds Read in leaf_paste_entries run #3: crashed: KASAN: out-of-bounds Read in leaf_paste_entries run #4: crashed: KASAN: out-of-bounds Read in leaf_paste_entries run #5: crashed: KASAN: use-after-free Read in search_by_entry_key run #6: crashed: KASAN: use-after-free Read in search_by_entry_key run #7: crashed: KASAN: out-of-bounds Read in leaf_paste_entries run #8: crashed: KASAN: out-of-bounds Read in leaf_paste_entries run #9: crashed: KASAN: out-of-bounds Read in leaf_paste_entries revisions tested: 2, total time: 24m32.481193968s (build: 18m10.024970213s, test: 5m46.363118013s) the crash still happens on HEAD commit msg: Linux 4.14.213 crash: KASAN: out-of-bounds Read in leaf_paste_entries IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready REISERFS (device loop3): checking transaction log (loop3) REISERFS (device loop1): Using r5 hash to sort names REISERFS (device loop1): using 3.5.x disk format ================================================================== BUG: KASAN: out-of-bounds in memmove include/linux/string.h:387 [inline] BUG: KASAN: out-of-bounds in leaf_paste_entries+0x3f7/0xa20 fs/reiserfs/lbalance.c:1378 Read of size 18446744073709473760 at addr ffff8881b4f39fbf by task syz-executor.1/7284 CPU: 1 PID: 7284 Comm: syz-executor.1 Not tainted 4.14.213-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x14b/0x1f1 lib/dump_stack.c:58 print_address_description.cold.6+0x9/0x1ca mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report.cold.7+0x11a/0x2d4 mm/kasan/report.c:409 check_memory_region_inline mm/kasan/kasan.c:260 [inline] check_memory_region+0x13c/0x1b0 mm/kasan/kasan.c:267 memmove+0x23/0x50 mm/kasan/kasan.c:293 memmove include/linux/string.h:387 [inline] leaf_paste_entries+0x3f7/0xa20 fs/reiserfs/lbalance.c:1378 balance_leaf_finish_node_paste_dirent fs/reiserfs/do_balan.c:1306 [inline] balance_leaf_finish_node_paste.isra.15+0x494/0x12b0 fs/reiserfs/do_balan.c:1332 balance_leaf_finish_node fs/reiserfs/do_balan.c:1375 [inline] balance_leaf fs/reiserfs/do_balan.c:1463 [inline] do_balance+0x257c/0x67e0 fs/reiserfs/do_balan.c:1899 reiserfs_paste_into_item+0x44f/0x570 fs/reiserfs/stree.c:2142 reiserfs_add_entry+0x6d5/0xa50 fs/reiserfs/namei.c:566 reiserfs_mkdir+0x586/0x820 fs/reiserfs/namei.c:858 xattr_mkdir.constprop.6+0x80/0xc0 fs/reiserfs/xattr.c:76 create_privroot fs/reiserfs/xattr.c:880 [inline] reiserfs_xattr_init+0x391/0x930 fs/reiserfs/xattr.c:1002 reiserfs_fill_super+0x199b/0x26e0 fs/reiserfs/super.c:2180 mount_bdev+0x26f/0x330 fs/super.c:1134 get_super_block+0x10/0x20 fs/reiserfs/super.c:2609 mount_fs+0x7f/0x269 fs/super.c:1237 vfs_kern_mount.part.9+0x58/0x3c0 fs/namespace.c:1046 vfs_kern_mount fs/namespace.c:1036 [inline] do_new_mount fs/namespace.c:2549 [inline] do_mount+0x352/0x2af0 fs/namespace.c:2879 SYSC_mount fs/namespace.c:3095 [inline] SyS_mount+0xb1/0xd0 fs/namespace.c:3072 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x460bca RSP: 002b:00007f42f5256a88 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f42f5256b20 RCX: 0000000000460bca RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f42f5256ae0 RBP: 00007f42f5256ae0 R08: 00007f42f5256b20 R09: 0000000020000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000000 R13: 0000000020000100 R14: 0000000020000140 R15: 0000000020000040 The buggy address belongs to the page: page:ffffea0006d3ce40 count:1 mapcount:0 mapping:ffff8881df368310 index:0x1561 flags: 0x17ffe000004003c(referenced|uptodate|dirty|lru|swapbacked) raw: 017ffe000004003c ffff8881df368310 0000000000001561 00000001ffffffff raw: ffffea0006d3ce20 ffffea0006d3cea0 0000000000000000 ffff8881f52c7300 page dumped because: kasan: bad access detected page->mem_cgroup:ffff8881f52c7300 Memory state around the buggy address: ffff8881b4f39e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8881b4f39f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8881b4f39f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffff8881b4f3a000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8881b4f3a080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================