ci starts bisection 2023-04-18 13:11:31.339003059 +0000 UTC m=+60535.835504684 bisecting fixing commit since a3671bd86a9770e34969522d29bb30a1b66fd88a building syzkaller on 7939252e4ddf50bbb9912069a40d32f6c83c4f8e ensuring issue is reproducible on original commit a3671bd86a9770e34969522d29bb30a1b66fd88a testing commit a3671bd86a9770e34969522d29bb30a1b66fd88a gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: a891eca39cb3584c13e140d2e4b26e9daac268a2d84e109d0fc11e8ffb48dfe6 run #0: crashed: KASAN: invalid-free in diUnmount run #1: crashed: KASAN: invalid-free in diUnmount run #2: crashed: WARNING in diUnmount run #3: crashed: WARNING in diUnmount run #4: crashed: KASAN: invalid-free in diUnmount run #5: crashed: KASAN: invalid-free in diUnmount run #6: crashed: KASAN: invalid-free in diUnmount run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK reproducer seems to be flaky testing current HEAD 6a8f57ae2eb07ab39a6f0ccad60c760743051026 testing commit 6a8f57ae2eb07ab39a6f0ccad60c760743051026 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 3cb3372012e2ce7d6670f947b85ab5a37e38ab45fb0b6a368feaeea101e417bb run #0: crashed: WARNING in diUnmount run #1: crashed: KASAN: invalid-free in diUnmount run #2: crashed: WARNING in diUnmount run #3: crashed: KASAN: slab-use-after-free Read in lbmIODone run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK Reproducer flagged being flaky revisions tested: 2, total time: 35m56.152120717s (build: 17m13.059955504s, test: 17m57.963574408s) the crash still happens on HEAD commit msg: Linux 6.3-rc7 crash: KASAN: slab-use-after-free Read in lbmIODone ================================================================== BUG: KASAN: slab-use-after-free in lbmIODone+0xbee/0xfb0 fs/jfs/jfs_logmgr.c:2179 Read of size 4 at addr ffff888072c12f08 by task ksoftirqd/1/21 CPU: 1 PID: 21 Comm: ksoftirqd/1 Not tainted 6.3.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x64/0xb0 lib/dump_stack.c:106 print_address_description.constprop.0+0x2c/0x3c0 mm/kasan/report.c:319 print_report mm/kasan/report.c:430 [inline] kasan_report+0x11c/0x130 mm/kasan/report.c:536 lbmIODone+0xbee/0xfb0 fs/jfs/jfs_logmgr.c:2179 req_bio_endio block/blk-mq.c:795 [inline] blk_update_request+0x2f2/0x1180 block/blk-mq.c:927 blk_mq_end_request+0x4a/0x80 block/blk-mq.c:1054 blk_complete_reqs+0xa0/0xd0 block/blk-mq.c:1132 __do_softirq+0x1d4/0x905 kernel/softirq.c:571 run_ksoftirqd kernel/softirq.c:934 [inline] run_ksoftirqd+0x31/0x60 kernel/softirq.c:926 smpboot_thread_fn+0x55c/0x8d0 kernel/smpboot.c:164 kthread+0x298/0x340 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 Allocated by task 10280: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:374 [inline] ____kasan_kmalloc mm/kasan/common.c:333 [inline] __kasan_kmalloc+0xa2/0xb0 mm/kasan/common.c:383 kmalloc include/linux/slab.h:580 [inline] lbmLogInit fs/jfs/jfs_logmgr.c:1822 [inline] lmLogInit+0x37f/0x1810 fs/jfs/jfs_logmgr.c:1270 open_inline_log fs/jfs/jfs_logmgr.c:1175 [inline] lmLogOpen+0x6da/0x11b0 fs/jfs/jfs_logmgr.c:1069 jfs_mount_rw+0x295/0x600 fs/jfs/jfs_mount.c:257 jfs_remount+0x450/0x5b0 fs/jfs/super.c:454 reconfigure_super+0x24c/0x8e0 fs/super.c:956 vfs_fsconfig_locked fs/fsopen.c:254 [inline] __do_sys_fsconfig+0x76a/0x970 fs/fsopen.c:439 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 10293: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:521 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200 kasan_slab_free include/linux/kasan.h:162 [inline] slab_free_hook mm/slub.c:1781 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807 slab_free mm/slub.c:3787 [inline] __kmem_cache_free+0xaf/0x2d0 mm/slub.c:3800 lbmLogShutdown fs/jfs/jfs_logmgr.c:1865 [inline] lmLogShutdown+0x30b/0x650 fs/jfs/jfs_logmgr.c:1684 lmLogClose+0x4ce/0x6a0 fs/jfs/jfs_logmgr.c:1460 jfs_remount+0x346/0x5b0 fs/jfs/super.c:466 reconfigure_super+0x24c/0x8e0 fs/super.c:956 do_remount fs/namespace.c:2704 [inline] path_mount+0x1338/0x1a30 fs/namespace.c:3364 do_mount fs/namespace.c:3385 [inline] __do_sys_mount fs/namespace.c:3594 [inline] __se_sys_mount fs/namespace.c:3571 [inline] __x64_sys_mount+0x1f9/0x270 fs/namespace.c:3571 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The buggy address belongs to the object at ffff888072c12f00 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 8 bytes inside of freed 192-byte region [ffff888072c12f00, ffff888072c12fc0) The buggy address belongs to the physical page: page:ffffea0001cb0480 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x72c12 flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 ffff888011441a00 ffffea0000a2ec00 dead000000000004 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5695, tgid 5695 (dhcpcd-run-hook), ts 65802065673, free_ts 65799570151 prep_new_page mm/page_alloc.c:2553 [inline] get_page_from_freelist+0x1190/0x2e20 mm/page_alloc.c:4326 __alloc_pages+0x1cb/0x4a0 mm/page_alloc.c:5592 __alloc_pages_node include/linux/gfp.h:237 [inline] alloc_slab_page mm/slub.c:1853 [inline] allocate_slab+0xa7/0x390 mm/slub.c:1998 new_slab mm/slub.c:2051 [inline] ___slab_alloc+0xa91/0x1400 mm/slub.c:3193 __slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3292 __slab_alloc_node mm/slub.c:3345 [inline] slab_alloc_node mm/slub.c:3442 [inline] __kmem_cache_alloc_node+0x136/0x320 mm/slub.c:3491 __do_kmalloc_node mm/slab_common.c:966 [inline] __kmalloc_node+0x51/0x1a0 mm/slab_common.c:974 kmalloc_array_node include/linux/slab.h:697 [inline] kcalloc_node include/linux/slab.h:702 [inline] memcg_alloc_slab_cgroups+0x8f/0x150 mm/memcontrol.c:2899 account_slab mm/slab.h:653 [inline] allocate_slab+0x2d6/0x390 mm/slub.c:2016 new_slab mm/slub.c:2051 [inline] ___slab_alloc+0xa91/0x1400 mm/slub.c:3193 __slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3292 __slab_alloc_node mm/slub.c:3345 [inline] slab_alloc_node mm/slub.c:3442 [inline] slab_alloc mm/slub.c:3460 [inline] __kmem_cache_alloc_lru mm/slub.c:3467 [inline] kmem_cache_alloc+0x38e/0x3b0 mm/slub.c:3476 vm_area_dup+0x1c/0x170 kernel/fork.c:466 dup_mmap+0x599/0x1130 kernel/fork.c:644 dup_mm kernel/fork.c:1548 [inline] copy_mm kernel/fork.c:1597 [inline] copy_process+0x3a61/0x6b50 kernel/fork.c:2267 kernel_clone+0xbc/0x640 kernel/fork.c:2682 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1454 [inline] free_pcp_prepare+0x5d5/0xa50 mm/page_alloc.c:1504 free_unref_page_prepare mm/page_alloc.c:3388 [inline] free_unref_page_list+0x176/0xbc0 mm/page_alloc.c:3529 release_pages+0x321/0x10e0 mm/swap.c:1042 tlb_batch_pages_flush+0x85/0x160 mm/mmu_gather.c:97 tlb_flush_mmu_free mm/mmu_gather.c:292 [inline] tlb_flush_mmu mm/mmu_gather.c:299 [inline] tlb_finish_mmu+0x114/0x6c0 mm/mmu_gather.c:391 exit_mmap+0x241/0x640 mm/mmap.c:3043 __mmput+0xf3/0x440 kernel/fork.c:1207 exit_mm kernel/exit.c:563 [inline] do_exit+0x88d/0x2480 kernel/exit.c:856 do_group_exit+0xb4/0x250 kernel/exit.c:1019 __do_sys_exit_group kernel/exit.c:1030 [inline] __se_sys_exit_group kernel/exit.c:1028 [inline] __x64_sys_exit_group+0x39/0x40 kernel/exit.c:1028 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Memory state around the buggy address: ffff888072c12e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888072c12e80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc >ffff888072c12f00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888072c12f80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff888072c13000: 00 00 00 00 00 fc fc 00 00 00 00 00 fc fc 00 00 ==================================================================