ci starts bisection 2023-04-19 01:53:34.050585984 +0000 UTC m=+41954.680983572 bisecting fixing commit since 4a7d37e824f57dbace61abf62f53843800bd245c building syzkaller on 42a4d50890beed97e5e9868be922faa6285f4a12 ensuring issue is reproducible on original commit 4a7d37e824f57dbace61abf62f53843800bd245c testing commit 4a7d37e824f57dbace61abf62f53843800bd245c gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 7d1569c35e41f97e475fdc5a2bccb779d8451e6620bd59ab5e44ec3227fcc443 run #0: crashed: KASAN: slab-out-of-bounds Read in dtSearch run #1: crashed: KASAN: use-after-free Read in dtSearch run #2: crashed: KASAN: slab-out-of-bounds Read in dtSearch run #3: crashed: KASAN: slab-out-of-bounds Read in dtSearch run #4: crashed: KASAN: slab-out-of-bounds Read in dtSearch run #5: crashed: KASAN: slab-out-of-bounds Read in dtSearch run #6: crashed: KASAN: use-after-free Read in dtSearch run #7: crashed: KASAN: use-after-free Read in dtSearch run #8: crashed: KASAN: slab-out-of-bounds Read in dtSearch run #9: crashed: KASAN: use-after-free Read in dtSearch run #10: crashed: KASAN: use-after-free Read in dtSearch run #11: crashed: KASAN: slab-out-of-bounds Read in dtSearch run #12: crashed: KASAN: use-after-free Read in dtSearch run #13: crashed: KASAN: use-after-free Read in dtSearch run #14: crashed: KASAN: use-after-free Read in dtSearch run #15: crashed: KASAN: use-after-free Read in dtSearch run #16: crashed: KASAN: use-after-free Read in dtSearch run #17: crashed: KASAN: use-after-free Read in dtSearch run #18: crashed: KASAN: use-after-free Read in dtSearch run #19: crashed: KASAN: use-after-free Read in dtSearch testing current HEAD af67688dca57999fd848f051eeea1d375ba546b2 testing commit af67688dca57999fd848f051eeea1d375ba546b2 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: f195078a346b8e6a3d850a36fb4686ca1f5c17b41d394fa2c832b2051470d8bb run #0: crashed: KASAN: slab-out-of-bounds Read in dtSearch run #1: crashed: KASAN: slab-out-of-bounds Read in dtSearch run #2: crashed: KASAN: slab-out-of-bounds Read in dtSearch run #3: crashed: KASAN: slab-out-of-bounds Read in dtSearch run #4: crashed: KASAN: slab-out-of-bounds Read in dtSearch run #5: crashed: KASAN: slab-out-of-bounds Read in dtSearch run #6: crashed: KASAN: slab-out-of-bounds Read in dtSearch run #7: crashed: KASAN: slab-out-of-bounds Read in dtSearch run #8: crashed: KASAN: use-after-free Read in dtSearch run #9: crashed: KASAN: use-after-free Read in dtSearch revisions tested: 2, total time: 24m56.229182135s (build: 17m41.320172424s, test: 6m19.880709086s) the crash still happens on HEAD commit msg: Merge tag 'mmc-v6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc crash: KASAN: use-after-free Read in dtSearch loop0: detected capacity change from 0 to 14901 ================================================================== BUG: KASAN: use-after-free in ciCompare fs/jfs/jfs_dtree.c:3393 [inline] BUG: KASAN: use-after-free in dtSearch+0x1dac/0x21c0 fs/jfs/jfs_dtree.c:639 Read of size 1 at addr ffff888071d6f9f4 by task syz-executor.0/5747 CPU: 1 PID: 5747 Comm: syz-executor.0 Not tainted 6.3.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x64/0xb0 lib/dump_stack.c:106 print_address_description.constprop.0+0x2c/0x3c0 mm/kasan/report.c:319 print_report mm/kasan/report.c:430 [inline] kasan_report+0x11c/0x130 mm/kasan/report.c:536 ciCompare fs/jfs/jfs_dtree.c:3393 [inline] dtSearch+0x1dac/0x21c0 fs/jfs/jfs_dtree.c:639 jfs_lookup+0x14b/0x2a0 fs/jfs/namei.c:1454 lookup_open.isra.0+0x844/0x1510 fs/namei.c:3394 open_last_lookups fs/namei.c:3484 [inline] path_openat+0x7ad/0x2280 fs/namei.c:3712 do_filp_open+0x1a9/0x3e0 fs/namei.c:3742 do_sys_openat2+0x11e/0x3f0 fs/open.c:1348 do_sys_open fs/open.c:1364 [inline] __do_sys_open fs/open.c:1372 [inline] __se_sys_open fs/open.c:1368 [inline] __x64_sys_open+0x101/0x1a0 fs/open.c:1368 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fb2c988c0f9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fb2ca69e168 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 RAX: ffffffffffffffda RBX: 00007fb2c99abf80 RCX: 00007fb2c988c0f9 RDX: 0000000000000000 RSI: 000000000014da42 RDI: 00000000200000c0 RBP: 00007fb2c98e7ae9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffdec4e872f R14: 00007fb2ca69e300 R15: 0000000000022000 The buggy address belongs to the physical page: page:ffffea0001c75bc0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x71d6f flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000100 dead000000000122 0000000000000000 raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 5069, tgid 5062 (syz-fuzzer), ts 37076905567, free_ts 37934834898 prep_new_page mm/page_alloc.c:2553 [inline] get_page_from_freelist+0x1190/0x2e20 mm/page_alloc.c:4326 __alloc_pages+0x1cb/0x4a0 mm/page_alloc.c:5592 __folio_alloc+0x16/0x40 mm/page_alloc.c:5624 vma_alloc_folio+0x11a/0x690 mm/mempolicy.c:2244 do_anonymous_page mm/memory.c:4066 [inline] handle_pte_fault mm/memory.c:4921 [inline] __handle_mm_fault+0x107b/0x2ee0 mm/memory.c:5065 handle_mm_fault+0x23f/0x790 mm/memory.c:5211 do_user_addr_fault+0x2da/0xd00 arch/x86/mm/fault.c:1407 handle_page_fault arch/x86/mm/fault.c:1498 [inline] exc_page_fault+0x5e/0xc0 arch/x86/mm/fault.c:1554 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1454 [inline] free_pcp_prepare+0x5d5/0xa50 mm/page_alloc.c:1504 free_unref_page_prepare mm/page_alloc.c:3388 [inline] free_unref_page_list+0x176/0xbc0 mm/page_alloc.c:3529 release_pages+0x321/0x10e0 mm/swap.c:1042 tlb_batch_pages_flush+0x85/0x160 mm/mmu_gather.c:97 zap_pte_range mm/memory.c:1487 [inline] zap_pmd_range mm/memory.c:1536 [inline] zap_pud_range mm/memory.c:1565 [inline] zap_p4d_range mm/memory.c:1586 [inline] unmap_page_range+0x18f5/0x2d30 mm/memory.c:1607 unmap_vmas+0x22a/0x370 mm/memory.c:1692 exit_mmap+0x16c/0x640 mm/mmap.c:3031 __mmput+0xf3/0x440 kernel/fork.c:1207 exit_mm kernel/exit.c:563 [inline] do_exit+0x88d/0x2480 kernel/exit.c:856 do_group_exit+0xb4/0x250 kernel/exit.c:1019 get_signal+0x1d36/0x1fa0 kernel/signal.c:2859 arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd Memory state around the buggy address: ffff888071d6f880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888071d6f900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff888071d6f980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff888071d6fa00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888071d6fa80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================