ci2 starts bisection 2024-12-02 20:53:04.065643204 +0000 UTC m=+33689.559995459 bisecting fixing commit since 910bfc26d16d07df5a2bfcbc63f0aa9d1397e2ef building syzkaller on 46eb10b79c61c4032281212d862c913683ab32a0 ensuring issue is reproducible on original commit 910bfc26d16d07df5a2bfcbc63f0aa9d1397e2ef testing commit 910bfc26d16d07df5a2bfcbc63f0aa9d1397e2ef gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 3fcad0303366897f54ae317a4974fa8402d4a9b86244348d6802326bc952af11 run #0: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #1: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #2: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #3: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #4: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #5: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #6: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #7: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #8: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir run #9: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #10: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir run #11: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #12: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir run #13: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #14: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #15: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #16: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #17: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #18: crashed: KASAN: use-after-free Read in ext4_read_inline_dir run #19: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir representative crash: KASAN: slab-use-after-free Read in ext4_read_inline_dir, types: [KASAN] check whether we can drop unnecessary instrumentation disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed testing commit 910bfc26d16d07df5a2bfcbc63f0aa9d1397e2ef gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: b8201a932f4a3760926e6c2c8df40c8813bdc028878ec623f7692967171acbe9 run #0: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #1: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir run #2: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir run #4: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #5: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #6: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #7: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #8: crashed: KASAN: use-after-free Read in ext4_read_inline_dir run #9: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir representative crash: KASAN: slab-use-after-free Read in ext4_read_inline_dir, types: [KASAN] the bug reproduces without the instrumentation disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed kconfig minimization: base=4037 full=8128 leaves diff=2104 split chunks (needed=false): <2104> split chunk #0 of len 2104 into 5 parts testing without sub-chunk 1/5 disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing commit 910bfc26d16d07df5a2bfcbc63f0aa9d1397e2ef gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 6fcf50719adc80953e7e83bbf5bee656dd95fcdb9b428f351d7df9765df9863b run #0: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir run #1: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #2: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #3: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #4: crashed: KASAN: use-after-free Read in ext4_read_inline_dir run #5: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #6: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir run #7: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #8: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #9: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir representative crash: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir, types: [KASAN] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing commit 910bfc26d16d07df5a2bfcbc63f0aa9d1397e2ef gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 674b8ff148595a86c0beddb9637f589b1861b61677c24097cc1ba5656848fbf7 run #0: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir run #1: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #2: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir run #4: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #5: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir run #6: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #7: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #8: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir run #9: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir representative crash: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir, types: [KASAN] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing commit 910bfc26d16d07df5a2bfcbc63f0aa9d1397e2ef gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 303b82ca1f5fccb11817733f359d7622b65f1b27534911cd85abb727ce1016d8 run #0: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #1: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir run #2: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir run #4: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir run #5: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir run #6: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir run #7: crashed: KASAN: use-after-free Read in ext4_read_inline_dir run #8: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir run #9: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir representative crash: KASAN: slab-use-after-free Read in ext4_read_inline_dir, types: [KASAN] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing commit 910bfc26d16d07df5a2bfcbc63f0aa9d1397e2ef gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 4c21a4e35ff22f3549b03fd516d03ba51188941a339be4760764834b0c18505e run #0: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #1: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir run #2: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir run #4: crashed: KASAN: use-after-free Read in ext4_read_inline_dir run #5: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir run #6: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #7: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #8: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #9: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir representative crash: KASAN: slab-use-after-free Read in ext4_read_inline_dir, types: [KASAN] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing commit 910bfc26d16d07df5a2bfcbc63f0aa9d1397e2ef gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 3dad9f3856b982d8a84b6437c903e0a3ad78475ca9d2188c56debf82b1fea1a8 run #0: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #1: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir run #2: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir run #3: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #4: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir run #5: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir run #6: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir run #7: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #8: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #9: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir representative crash: KASAN: slab-use-after-free Read in ext4_read_inline_dir, types: [KASAN] the chunk can be dropped disabling configs for [UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing current HEAD cdd30ebb1b9f36159d66f088b61aee264e649d7a testing commit cdd30ebb1b9f36159d66f088b61aee264e649d7a gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: cc1a112834f2ccd6e4f3da92c6f6d17104a8c448cfccf34a02ece2763441e85f run #0: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #1: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #2: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir run #4: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #5: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #6: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #7: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #8: crashed: KASAN: slab-use-after-free Read in ext4_read_inline_dir run #9: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_dir representative crash: KASAN: slab-use-after-free Read in ext4_read_inline_dir, types: [KASAN] crash still not fixed/happens on the oldest tested release revisions tested: 8, total time: 1h24m38.968810385s (build: 48m52.072357223s, test: 32m11.34417045s) crash still not fixed or there were kernel test errors commit msg: module: Convert symbol namespace to string literal crash: KASAN: slab-use-after-free Read in ext4_read_inline_dir EXT4-fs error (device loop0): ext4_readdir:261: inode #2: block 16: comm syz-executor: path /0/bus: bad entry in directory: rec_len is smaller than minimal - offset=980, inode=0, rec_len=0, size=1024 fake=0 ================================================================== BUG: KASAN: slab-use-after-free in ext4_read_inline_data fs/ext4/inline.c:209 [inline] BUG: KASAN: slab-use-after-free in ext4_read_inline_dir+0x455/0xc10 fs/ext4/inline.c:1485 Read of size 68 at addr ffff88811427c51a by task syz-executor/1951 CPU: 1 UID: 0 PID: 1951 Comm: syz-executor Not tainted 6.13.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x108/0x280 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105 ext4_read_inline_data fs/ext4/inline.c:209 [inline] ext4_read_inline_dir+0x455/0xc10 fs/ext4/inline.c:1485 ext4_readdir+0x291/0x2fe0 fs/ext4/dir.c:159 iterate_dir+0x18e/0x4a0 fs/readdir.c:108 __do_sys_getdents64 fs/readdir.c:403 [inline] __se_sys_getdents64+0x1b3/0x400 fs/readdir.c:389 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x8d/0x170 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f7897129333 Code: c1 66 0f 1f 44 00 00 48 83 c4 08 48 89 ef 5b 5d e9 02 45 f8 ff 66 90 b8 ff ff ff 7f 48 39 c2 48 0f 47 d0 b8 d9 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 c7 c2 a8 ff ff ff f7 d8 RSP: 002b:00007ffe81d3c538 EFLAGS: 00000293 ORIG_RAX: 00000000000000d9 RAX: ffffffffffffffda RBX: 0000555593193520 RCX: 00007f7897129333 RDX: 0000000000008000 RSI: 0000555593193520 RDI: 0000000000000006 RBP: 00005555931934f4 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000001000 R11: 0000000000000293 R12: ffffffffffffffa8 R13: 0000000000000016 R14: 00005555931934f0 R15: 00007ffe81d3f8d0 Allocated by task 1421: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:319 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:345 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4104 [inline] slab_alloc_node mm/slub.c:4153 [inline] kmem_cache_alloc_noprof+0x1b9/0x410 mm/slub.c:4160 sigqueue_alloc kernel/signal.c:454 [inline] __send_signal_locked+0x1c0/0xa10 kernel/signal.c:1086 do_send_sig_info kernel/signal.c:1268 [inline] do_send_specific+0x19b/0x210 kernel/signal.c:4091 do_tkill kernel/signal.c:4112 [inline] __do_sys_tgkill kernel/signal.c:4131 [inline] __se_sys_tgkill kernel/signal.c:4125 [inline] __x64_sys_tgkill+0x23d/0x340 kernel/signal.c:4125 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x8d/0x170 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 1420: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2338 [inline] slab_free mm/slub.c:4598 [inline] kmem_cache_free+0x17e/0x470 mm/slub.c:4700 collect_signal kernel/signal.c:586 [inline] __dequeue_signal+0x2ea/0x430 kernel/signal.c:608 dequeue_signal+0x16b/0x380 kernel/signal.c:628 get_signal+0x681/0x10f0 kernel/signal.c:2897 arch_do_signal_or_restart+0x91/0x610 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x64/0x1b0 kernel/entry/common.c:218 do_syscall_64+0x9a/0x170 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88811427c4d0 which belongs to the cache sigqueue of size 80 The buggy address is located 74 bytes inside of freed 80-byte region [ffff88811427c4d0, ffff88811427c520) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88811427cd90 pfn:0x11427c memcg:ffff88810c733801 flags: 0x200000000000000(node=0|zone=2) page_type: f5(slab) raw: 0200000000000000 ffff888100ac1500 dead000000000122 0000000000000000 raw: ffff88811427cd90 000000008024001f 00000001f5000000 ffff88810c733801 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 915, tgid 915 (syz-executor), ts 31269562139, free_ts 31251295920 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x10f/0x130 mm/page_alloc.c:1556 prep_new_page mm/page_alloc.c:1564 [inline] get_page_from_freelist+0x3b4a/0x3d80 mm/page_alloc.c:3474 __alloc_pages_noprof+0x256/0x650 mm/page_alloc.c:4751 alloc_pages_mpol_noprof+0x143/0x330 mm/mempolicy.c:2265 alloc_slab_page+0x6a/0x140 mm/slub.c:2408 allocate_slab+0x5d/0x290 mm/slub.c:2574 new_slab mm/slub.c:2627 [inline] ___slab_alloc+0xa7f/0x11e0 mm/slub.c:3815 __slab_alloc mm/slub.c:3905 [inline] __slab_alloc_node mm/slub.c:3980 [inline] slab_alloc_node mm/slub.c:4141 [inline] kmem_cache_alloc_noprof+0x279/0x410 mm/slub.c:4160 sigqueue_alloc kernel/signal.c:454 [inline] __send_signal_locked+0x1c0/0xa10 kernel/signal.c:1086 do_notify_parent+0x77f/0x990 kernel/signal.c:2242 do_exit+0x1359/0x2550 kernel/exit.c:958 do_group_exit+0x1ba/0x280 kernel/exit.c:1087 __do_sys_exit_group kernel/exit.c:1098 [inline] __se_sys_exit_group kernel/exit.c:1096 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1096 x64_sys_call+0x26a8/0x26b0 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x8d/0x170 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 912 tgid 912 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1127 [inline] free_unref_folios+0xc8f/0x1530 mm/page_alloc.c:2704 folios_put_refs+0x48e/0x570 mm/swap.c:962 free_pages_and_swap_cache+0x415/0x4e0 mm/swap_state.c:335 __tlb_batch_free_encoded_pages mm/mmu_gather.c:136 [inline] tlb_batch_pages_flush mm/mmu_gather.c:149 [inline] tlb_flush_mmu_free mm/mmu_gather.c:366 [inline] tlb_flush_mmu+0x2ad/0x4e0 mm/mmu_gather.c:373 tlb_finish_mmu+0xb6/0x1c0 mm/mmu_gather.c:465 exit_mmap+0x3b8/0x900 mm/mmap.c:1680 __mmput+0x61/0x290 kernel/fork.c:1353 exit_mm+0x114/0x1b0 kernel/exit.c:570 do_exit+0x7dd/0x2550 kernel/exit.c:925 do_group_exit+0x1ba/0x280 kernel/exit.c:1087 __do_sys_exit_group kernel/exit.c:1098 [inline] __se_sys_exit_group kernel/exit.c:1096 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1096 x64_sys_call+0x26a8/0x26b0 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x8d/0x170 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff88811427c400: fb fb fb fb fb fb fb fb fc fc fc fc fa fb fb fb ffff88811427c480: fb fb fb fb fb fb fc fc fc fc fa fb fb fb fb fb >ffff88811427c500: fb fb fb fb fc fc fc fc fa fb fb fb fb fb fb fb ^ ffff88811427c580: fb fb fc fc fc fc fa fb fb fb fb fb fb fb fb fb ffff88811427c600: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fc fc ==================================================================