ci2 starts bisection 2024-03-22 09:44:55.365731283 +0000 UTC m=+57906.205902741 bisecting fixing commit since fa74641fb6b93a19ccb50579886ecc98320230f9 building syzkaller on 4bce1a3e705a8b62de8194bdb28f5eef89c8feec ensuring issue is reproducible on original commit fa74641fb6b93a19ccb50579886ecc98320230f9 testing commit fa74641fb6b93a19ccb50579886ecc98320230f9 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 1459422d5f66d144fecd7006e59be4b5291ddddb0893c2a6d570a8716ff443bc run #0: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #1: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #2: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #4: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #5: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #6: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #7: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #8: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #9: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #10: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #11: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #12: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #13: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #14: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #15: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #16: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #17: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #18: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #19: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock representative crash: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock, types: [KASAN] check whether we can drop unnecessary instrumentation disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN BUG LOCKDEP], they are not needed testing commit fa74641fb6b93a19ccb50579886ecc98320230f9 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 2942b13ff6c1adb47eb04e1a6a204c8ec95f81938404e8d0d424485de582b2ad run #0: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #1: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #2: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #4: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #5: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #6: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #7: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #8: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #9: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock representative crash: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock, types: [KASAN] the bug reproduces without the instrumentation disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed kconfig minimization: base=3820 full=7524 leaves diff=1994 split chunks (needed=false): <1994> split chunk #0 of len 1994 into 5 parts testing without sub-chunk 1/5 disabling configs for [UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing commit fa74641fb6b93a19ccb50579886ecc98320230f9 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 4c002ab1721aa51ba23977f4168ffee150bec45a9ad1ec2d1216a0c94b7e2f39 run #0: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #1: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #2: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #4: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #5: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #6: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #7: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #8: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #9: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock representative crash: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock, types: [KASAN] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN BUG LOCKDEP], they are not needed testing commit fa74641fb6b93a19ccb50579886ecc98320230f9 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 9097d959b5e8058fe711038445e0bb6fa80eda9c97e310c275dbb83ce796ecd8 run #0: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #1: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #2: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #3: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #4: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #5: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #6: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #7: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #8: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #9: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock representative crash: KASAN: use-after-free Read in ext4_convert_inline_data_nolock, types: [KASAN] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing commit fa74641fb6b93a19ccb50579886ecc98320230f9 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: c4067fb0d5fe358f19bbf0bde393c97321417918f4661b515ebc9ff687565664 run #0: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #1: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #2: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #3: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #4: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #5: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #6: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #7: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #8: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #9: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock representative crash: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock, types: [KASAN] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing commit fa74641fb6b93a19ccb50579886ecc98320230f9 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 8819cdde3715acdf9d5799b495b1717f2e8da36d644493ccc118ba720fd399c5 run #0: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #1: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #2: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #3: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #4: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #5: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #6: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #7: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #8: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #9: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock representative crash: KASAN: use-after-free Read in ext4_convert_inline_data_nolock, types: [KASAN] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing commit fa74641fb6b93a19ccb50579886ecc98320230f9 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: ce58c6d9ebd4c33243b49dc9ab38d21171829126599d963e3eed64f0afaa5604 run #0: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #1: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #2: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #4: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #5: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #6: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #7: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #8: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #9: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock representative crash: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock, types: [KASAN] the chunk can be dropped disabling configs for [UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing current HEAD d7543167affd372819a94879b8b1e8b9b12547d9 testing commit d7543167affd372819a94879b8b1e8b9b12547d9 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: f92e7741a4b07432900f25ecd589f33040aea0f640656538fb55c5f4d618de37 run #0: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #1: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #2: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #4: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #5: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #6: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #7: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #8: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #9: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock representative crash: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock, types: [KASAN] crash still not fixed/happens on the oldest tested release revisions tested: 8, total time: 1h9m32.436509389s (build: 34m56.648413205s, test: 31m50.448105567s) crash still not fixed or there were kernel test errors commit msg: Linux 6.1.82 crash: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock loop0: detected capacity change from 0 to 2048 EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. ================================================================== BUG: KASAN: slab-out-of-bounds in ext4_read_inline_data fs/ext4/inline.c:210 [inline] BUG: KASAN: slab-out-of-bounds in ext4_convert_inline_data_nolock+0x282/0xc10 fs/ext4/inline.c:1216 Read of size 20 at addr ffff888119aa11a3 by task syz-executor.0/1510 CPU: 1 PID: 1510 Comm: syz-executor.0 Not tainted 6.1.82-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xf4/0x251 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x15f/0x4f0 mm/kasan/report.c:395 kasan_report+0x136/0x160 mm/kasan/report.c:495 kasan_check_range+0x27f/0x290 mm/kasan/generic.c:189 memcpy+0x25/0x60 mm/kasan/shadow.c:65 ext4_read_inline_data fs/ext4/inline.c:210 [inline] ext4_convert_inline_data_nolock+0x282/0xc10 fs/ext4/inline.c:1216 ext4_convert_inline_data+0x3b8/0x4d0 fs/ext4/inline.c:2077 ext4_fallocate+0x136/0x1790 fs/ext4/extents.c:4731 vfs_fallocate+0x30c/0x3d0 fs/open.c:323 ksys_fallocate fs/open.c:346 [inline] __do_sys_fallocate fs/open.c:354 [inline] __se_sys_fallocate fs/open.c:352 [inline] __x64_sys_fallocate+0xa6/0xd0 fs/open.c:352 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3d/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f60d8db5959 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f60d89380c8 EFLAGS: 00000246 ORIG_RAX: 000000000000011d RAX: ffffffffffffffda RBX: 00007f60d8ed4f80 RCX: 00007f60d8db5959 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 RBP: 00007f60d8e11c88 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000008000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000006 R14: 00007f60d8ed4f80 R15: 00007ffe4a68cb08 Allocated by task 1452: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:52 __kasan_slab_alloc+0x65/0x70 mm/kasan/common.c:328 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook+0x54/0x3e0 mm/slab.h:737 kmem_cache_alloc_bulk+0x2d4/0x360 mm/slub.c:3854 mt_alloc_bulk lib/maple_tree.c:157 [inline] mas_alloc_nodes+0x359/0x680 lib/maple_tree.c:1299 mas_node_count_gfp lib/maple_tree.c:1359 [inline] mas_preallocate+0xee/0x290 lib/maple_tree.c:5805 __vma_adjust+0x31c/0x12b0 mm/mmap.c:724 __split_vma+0x32f/0x4a0 do_mas_align_munmap+0x3fe/0x11e0 mm/mmap.c:2470 do_mas_munmap+0x195/0x1f0 mm/mmap.c:2640 mmap_region+0x708/0x1780 mm/mmap.c:2688 do_mmap+0x69e/0xb60 mm/mmap.c:1425 vm_mmap_pgoff+0x1b7/0x280 mm/util.c:520 ksys_mmap_pgoff+0x2cf/0x3b0 mm/mmap.c:1471 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3d/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 1452: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:52 kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:516 ____kasan_slab_free+0x122/0x1e0 mm/kasan/common.c:236 kasan_slab_free include/linux/kasan.h:177 [inline] slab_free_hook mm/slub.c:1724 [inline] slab_free_freelist_hook mm/slub.c:1750 [inline] slab_free mm/slub.c:3661 [inline] kmem_cache_free_bulk+0x582/0x770 mm/slub.c:3779 mt_free_bulk lib/maple_tree.c:162 [inline] mas_destroy+0x2730/0x2ec0 lib/maple_tree.c:5859 mas_store_prealloc+0x283/0x3b0 lib/maple_tree.c:5789 __vma_adjust+0xe31/0x12b0 mm/mmap.c:824 __split_vma+0x32f/0x4a0 do_mas_align_munmap+0x3fe/0x11e0 mm/mmap.c:2470 do_mas_munmap+0x195/0x1f0 mm/mmap.c:2640 mmap_region+0x708/0x1780 mm/mmap.c:2688 do_mmap+0x69e/0xb60 mm/mmap.c:1425 vm_mmap_pgoff+0x1b7/0x280 mm/util.c:520 ksys_mmap_pgoff+0x2cf/0x3b0 mm/mmap.c:1471 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3d/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x63/0xcd Last potentially related work creation: kasan_save_stack+0x3b/0x60 mm/kasan/common.c:45 __kasan_record_aux_stack+0xb0/0xc0 mm/kasan/generic.c:486 call_rcu+0x149/0x830 kernel/rcu/tree.c:2844 ma_free_rcu lib/maple_tree.c:182 [inline] mas_free lib/maple_tree.c:1341 [inline] mas_mat_free lib/maple_tree.c:1021 [inline] mas_wmb_replace+0x1346/0x19c0 lib/maple_tree.c:2819 mas_split lib/maple_tree.c:3606 [inline] mas_commit_b_node lib/maple_tree.c:3657 [inline] mas_wr_bnode lib/maple_tree.c:4382 [inline] mas_wr_modify+0x360b/0x6760 lib/maple_tree.c:4425 mas_store_prealloc+0x24e/0x3b0 lib/maple_tree.c:5787 __vma_adjust+0xc22/0x12b0 mm/mmap.c:797 __split_vma+0x32f/0x4a0 do_mas_align_munmap+0xd67/0x11e0 mm/mmap.c:2491 do_mas_munmap+0x195/0x1f0 mm/mmap.c:2640 mmap_region+0x708/0x1780 mm/mmap.c:2688 do_mmap+0x69e/0xb60 mm/mmap.c:1425 vm_mmap_pgoff+0x1b7/0x280 mm/util.c:520 ksys_mmap_pgoff+0x2cf/0x3b0 mm/mmap.c:1471 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3d/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x63/0xcd The buggy address belongs to the object at ffff888119aa1000 which belongs to the cache maple_node of size 256 The buggy address is located 163 bytes to the right of 256-byte region [ffff888119aa1000, ffff888119aa1100) The buggy address belongs to the physical page: page:ffffea000466a800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x119aa0 head:ffffea000466a800 order:1 compound_mapcount:0 compound_pincount:0 flags: 0x200000000010200(slab|head|node=0|zone=2) raw: 0200000000010200 ffffea00045ca000 dead000000000002 ffff8881000cd000 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 625, tgid 625 (modprobe), ts 25703010861, free_ts 25342997813 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x286/0x2b0 mm/page_alloc.c:2513 prep_new_page mm/page_alloc.c:2520 [inline] get_page_from_freelist+0x2ba7/0x2de0 mm/page_alloc.c:4279 __alloc_pages+0x251/0x640 mm/page_alloc.c:5545 alloc_slab_page+0x6a/0x150 mm/slub.c:1794 allocate_slab mm/slub.c:1939 [inline] new_slab+0x70/0x250 mm/slub.c:1992 ___slab_alloc+0x9df/0xe70 mm/slub.c:3180 kmem_cache_alloc_bulk+0x15c/0x360 mm/slub.c:3830 mt_alloc_bulk lib/maple_tree.c:157 [inline] mas_alloc_nodes+0x359/0x680 lib/maple_tree.c:1299 mas_node_count_gfp lib/maple_tree.c:1359 [inline] mas_preallocate+0xee/0x290 lib/maple_tree.c:5805 do_mas_align_munmap+0x2e5/0x11e0 mm/mmap.c:2443 do_mas_munmap+0x195/0x1f0 mm/mmap.c:2640 mmap_region+0x708/0x1780 mm/mmap.c:2688 do_mmap+0x69e/0xb60 mm/mmap.c:1425 vm_mmap_pgoff+0x1b7/0x280 mm/util.c:520 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3d/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x63/0xcd page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1440 [inline] free_pcp_prepare mm/page_alloc.c:1490 [inline] free_unref_page_prepare+0xca9/0xd80 mm/page_alloc.c:3358 free_unref_page+0x30/0x230 mm/page_alloc.c:3453 free_slab mm/slub.c:2031 [inline] discard_slab mm/slub.c:2037 [inline] __unfreeze_partials+0x1af/0x210 mm/slub.c:2586 put_cpu_partial+0x150/0x1a0 mm/slub.c:2662 qlink_free mm/kasan/quarantine.c:168 [inline] qlist_free_all+0x76/0xe0 mm/kasan/quarantine.c:187 kasan_quarantine_reduce+0x156/0x170 mm/kasan/quarantine.c:294 __kasan_slab_alloc+0x1f/0x70 mm/kasan/common.c:305 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook+0x54/0x3e0 mm/slab.h:737 slab_alloc_node mm/slub.c:3398 [inline] slab_alloc mm/slub.c:3406 [inline] __kmem_cache_alloc_lru mm/slub.c:3413 [inline] kmem_cache_alloc+0x10c/0x290 mm/slub.c:3422 kmem_cache_zalloc include/linux/slab.h:682 [inline] __alloc_file+0x21/0x200 fs/file_table.c:138 alloc_empty_file+0x59/0x110 fs/file_table.c:187 path_openat+0xfb/0x2410 fs/namei.c:3771 do_filp_open+0x226/0x430 fs/namei.c:3812 do_sys_openat2+0x10b/0x420 fs/open.c:1318 do_sys_open fs/open.c:1334 [inline] __do_sys_openat fs/open.c:1350 [inline] __se_sys_openat fs/open.c:1345 [inline] __x64_sys_openat+0x209/0x250 fs/open.c:1345 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3d/0x80 arch/x86/entry/common.c:81 Memory state around the buggy address: ffff888119aa1080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888119aa1100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888119aa1180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff888119aa1200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888119aa1280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================