ci2 starts bisection 2025-10-09 12:38:55.142394091 +0000 UTC m=+139604.615607548 bisecting fixing commit since f32b52534f1d4df1fc1a6afe6cf4639adebf8a63 building syzkaller on 807a3b61ca22f8988561c180eb47268ea6e244db ensuring issue is reproducible on original commit f32b52534f1d4df1fc1a6afe6cf4639adebf8a63 testing commit f32b52534f1d4df1fc1a6afe6cf4639adebf8a63 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: aded8a26333efb99bb168e9d452c834fd150c0728aa2662705de48dbe4affd23 all runs: crashed: kernel BUG in ext4_create_inline_data representative crash: kernel BUG in ext4_create_inline_data, types: [BUG] check whether we can drop unnecessary instrumentation disabling configs for [kasan locking atomic_sleep hang memleak ubsan], they are not needed testing commit f32b52534f1d4df1fc1a6afe6cf4639adebf8a63 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 938ac96824d406205259d225b6ce59c49ffb5987627453e228c9253d1cb928da all runs: crashed: kernel BUG in ext4_create_inline_data representative crash: kernel BUG in ext4_create_inline_data, types: [BUG] the bug reproduces without the instrumentation disabling configs for [ubsan kasan locking atomic_sleep hang memleak], they are not needed kconfig minimization: base=4921 full=6219 leaves diff=255 split chunks (needed=false): <255> split chunk #0 of len 255 into 5 parts testing without sub-chunk 1/5 disabling configs for [kasan locking atomic_sleep hang memleak ubsan], they are not needed testing commit f32b52534f1d4df1fc1a6afe6cf4639adebf8a63 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 8dae15a870ab0e85e4f14098288cba91f37f4ea1cc8165d1ee132e7b98627f76 all runs: crashed: kernel BUG in ext4_create_inline_data representative crash: kernel BUG in ext4_create_inline_data, types: [BUG] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [hang memleak ubsan kasan locking atomic_sleep], they are not needed testing commit f32b52534f1d4df1fc1a6afe6cf4639adebf8a63 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: d5a14b6a6cf2d36e327d3f7d1affb6e3da7ebfa920a97ab1e93120f2249251ed all runs: crashed: kernel BUG in ext4_create_inline_data representative crash: kernel BUG in ext4_create_inline_data, types: [BUG] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [kasan locking atomic_sleep hang memleak ubsan], they are not needed testing commit f32b52534f1d4df1fc1a6afe6cf4639adebf8a63 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: f2afa2a809dba7da783c2d0bf974efdb0635fa6f02436017e14b03883bc3ff7b all runs: crashed: kernel BUG in ext4_create_inline_data representative crash: kernel BUG in ext4_create_inline_data, types: [BUG] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [kasan locking atomic_sleep hang memleak ubsan], they are not needed testing commit f32b52534f1d4df1fc1a6afe6cf4639adebf8a63 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 38ea65f8fbf7804dbdaf759a4ff5a2630d5eeb851f55053859be627fc040aee0 all runs: crashed: kernel BUG in ext4_create_inline_data representative crash: kernel BUG in ext4_create_inline_data, types: [BUG] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [kasan locking atomic_sleep hang memleak ubsan], they are not needed testing commit f32b52534f1d4df1fc1a6afe6cf4639adebf8a63 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 failed building f32b52534f1d4df1fc1a6afe6cf4639adebf8a63: net/socket.c:1191: undefined reference to `wext_handle_ioctl' net/socket.c:3390: undefined reference to `compat_wext_handle_ioctl' net/core/net-procfs.c:343: undefined reference to `wext_proc_exit' net/core/net-procfs.c:327: undefined reference to `wext_proc_init' minimized to 51 configs; suspects: [HID_ZEROPLUS USB_LINK_LAYER_TEST USB_MON USB_NET_CDC_MBIM USB_NET_CDC_SUBSET USB_NET_CDC_SUBSET_ENABLE USB_NET_DM9601 USB_NET_GL620A USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL USB_SERIAL_FTDI_SIO USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM USB_XHCI_PCI_RENESAS WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_ZYDAS ZEROPLUS_FF] disabling configs for [hang memleak ubsan kasan locking atomic_sleep], they are not needed testing current HEAD bce84c40a40be5a627fa563399c00689829c705a testing commit bce84c40a40be5a627fa563399c00689829c705a gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: d56950746e7786c43681c08a43f552e42756c7cd33f4866930782bad7cbfbee3 run #0: basic kernel testing failed: failed to copy binary to VM: failed to run ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "IdentitiesOnly=yes" "-o" "BatchMode=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-v" "/tmp/syz-executor221583352" "root@10.128.1.195:./syz-executor221583352"]: exit status 255 run #1: basic kernel testing failed: failed to copy binary to VM: failed to run ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "IdentitiesOnly=yes" "-o" "BatchMode=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-v" "/tmp/syz-executor3014523979" "root@10.128.0.5:./syz-executor3014523979"]: exit status 255 run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK false negative chance: 0.000 # git bisect start bce84c40a40be5a627fa563399c00689829c705a f32b52534f1d4df1fc1a6afe6cf4639adebf8a63 Bisecting: 479 revisions left to test after this (roughly 9 steps) [93f1be8de86af67a689a13cb9bd32a8c03ab0e1d] mtd: spinand: propagate spinand_wait() errors from spinand_write_page() determine whether the revision contains the guilty commit checking the merge base c79648372d02944bf4a54d87e3901db05d0ac82e no existing result, test the revision testing commit c79648372d02944bf4a54d87e3901db05d0ac82e gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: f1c7d121d46f07414c6d004835739b5dc3ffeab4a86b0c5699d4526078459420 all runs: crashed: kernel BUG in ext4_create_inline_data representative crash: kernel BUG in ext4_create_inline_data, types: [BUG] testing commit 93f1be8de86af67a689a13cb9bd32a8c03ab0e1d gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: ca756efd33f7b261dbac74f27adbe343635183e46feb61e0e7e656ec7b3e18c2 run #0: basic kernel testing failed: failed to copy binary to VM: failed to run ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "IdentitiesOnly=yes" "-o" "BatchMode=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-v" "/tmp/syz-executor1578811363" "root@10.128.0.25:./syz-executor1578811363"]: exit status 255 run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK false negative chance: 0.000 # git bisect bad 93f1be8de86af67a689a13cb9bd32a8c03ab0e1d Bisecting: 239 revisions left to test after this (roughly 8 steps) [fb3854e76cd32392983e45feee4a992221fff5cb] smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already determine whether the revision contains the guilty commit revision c79648372d02944bf4a54d87e3901db05d0ac82e crashed and is reachable testing commit fb3854e76cd32392983e45feee4a992221fff5cb gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 97d2ea9a719b1b01fdf9f272a923cba2e6759eccda484954849054195602afcf all runs: crashed: kernel BUG in ext4_create_inline_data representative crash: kernel BUG in ext4_create_inline_data, types: [BUG] # git bisect good fb3854e76cd32392983e45feee4a992221fff5cb Bisecting: 119 revisions left to test after this (roughly 7 steps) [e03f9c0b9324ec57e1fd523ebc6d75848409a3d1] net: fec: allow disable coalescing determine whether the revision contains the guilty commit revision c79648372d02944bf4a54d87e3901db05d0ac82e crashed and is reachable testing commit e03f9c0b9324ec57e1fd523ebc6d75848409a3d1 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: c55c10800efd2e5e2128a6d7da809c02a1a5af7ff0e942ecf848d7fae2156d27 all runs: crashed: kernel BUG in ext4_create_inline_data representative crash: kernel BUG in ext4_create_inline_data, types: [BUG] # git bisect good e03f9c0b9324ec57e1fd523ebc6d75848409a3d1 Bisecting: 59 revisions left to test after this (roughly 6 steps) [237edd281d52840ba55e080cfcc9d99df53be8cb] scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans determine whether the revision contains the guilty commit revision e03f9c0b9324ec57e1fd523ebc6d75848409a3d1 crashed and is reachable testing commit 237edd281d52840ba55e080cfcc9d99df53be8cb gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: ae2e1a03883e5a3c759a2bf490e9c96986e6f6120195946f2bff9127cb1d703a run #0: basic kernel testing failed: failed to copy binary to VM: failed to run ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "IdentitiesOnly=yes" "-o" "BatchMode=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-v" "/tmp/syz-executor715269968" "root@10.128.0.185:./syz-executor715269968"]: exit status 255 run #1: basic kernel testing failed: failed to copy binary to VM: failed to run ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "IdentitiesOnly=yes" "-o" "BatchMode=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-v" "/tmp/syz-executor3423529978" "root@10.128.1.228:./syz-executor3423529978"]: exit status 255 run #2: basic kernel testing failed: failed to copy binary to VM: failed to run ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "IdentitiesOnly=yes" "-o" "BatchMode=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-v" "/tmp/syz-executor913637879" "root@10.128.1.238:./syz-executor913637879"]: exit status 255 run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK false negative chance: 0.000 # git bisect bad 237edd281d52840ba55e080cfcc9d99df53be8cb Bisecting: 29 revisions left to test after this (roughly 5 steps) [90c1295da0a78f3ed00388bb5f569d843b18c03d] MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} determine whether the revision contains the guilty commit revision fb3854e76cd32392983e45feee4a992221fff5cb crashed and is reachable testing commit 90c1295da0a78f3ed00388bb5f569d843b18c03d gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 3b960eb681574496819d20d55d0c40011ca850451c187f9eddc8966365e26c49 run #0: basic kernel testing failed: failed to copy binary to VM: failed to run ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "IdentitiesOnly=yes" "-o" "BatchMode=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-v" "/tmp/syz-executor4044557024" "root@10.128.1.253:./syz-executor4044557024"]: exit status 255 run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK false negative chance: 0.000 # git bisect bad 90c1295da0a78f3ed00388bb5f569d843b18c03d Bisecting: 14 revisions left to test after this (roughly 4 steps) [f531abcdfec2716b6c76b23d1228f9dc46b46c5e] net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 determine whether the revision contains the guilty commit revision fb3854e76cd32392983e45feee4a992221fff5cb crashed and is reachable testing commit f531abcdfec2716b6c76b23d1228f9dc46b46c5e gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 22d1ec3299921da82dfddc703429bcecf9fa205e670590ae8bb28a48f8e405c5 all runs: crashed: kernel BUG in ext4_create_inline_data representative crash: kernel BUG in ext4_create_inline_data, types: [BUG] # git bisect good f531abcdfec2716b6c76b23d1228f9dc46b46c5e Bisecting: 7 revisions left to test after this (roughly 3 steps) [1117260a5402be00b02f62b77e51422852bbe69f] vhost: fail early when __vhost_add_used() fails determine whether the revision contains the guilty commit revision f531abcdfec2716b6c76b23d1228f9dc46b46c5e crashed and is reachable testing commit 1117260a5402be00b02f62b77e51422852bbe69f gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 9faf8ee16a0ae5dddfa88aec8f08cd2b771efc296391524805ad02384b1d6b68 all runs: crashed: kernel BUG in ext4_create_inline_data representative crash: kernel BUG in ext4_create_inline_data, types: [BUG] # git bisect good 1117260a5402be00b02f62b77e51422852bbe69f Bisecting: 3 revisions left to test after this (roughly 2 steps) [7f322c12df7aeed1755acd3c6fab48c7807795fb] ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr determine whether the revision contains the guilty commit revision f531abcdfec2716b6c76b23d1228f9dc46b46c5e crashed and is reachable testing commit 7f322c12df7aeed1755acd3c6fab48c7807795fb gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 8711e8b3551cf08bb6173955f16887847a1be9a4968b4091196e3758b393c229 run #0: basic kernel testing failed: failed to copy binary to VM: failed to run ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "IdentitiesOnly=yes" "-o" "BatchMode=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-v" "/tmp/syz-executor2338809128" "root@10.128.1.174:./syz-executor2338809128"]: exit status 255 run #1: basic kernel testing failed: failed to copy binary to VM: failed to run ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "IdentitiesOnly=yes" "-o" "BatchMode=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-v" "/tmp/syz-executor3537986764" "root@10.128.1.139:./syz-executor3537986764"]: exit status 255 run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK false negative chance: 0.000 # git bisect bad 7f322c12df7aeed1755acd3c6fab48c7807795fb Bisecting: 1 revision left to test after this (roughly 1 step) [b06a3c552c0038331cc46b611db98538107fafe6] cifs: Fix calling CIFSFindFirst() for root path without msearch determine whether the revision contains the guilty commit revision 1117260a5402be00b02f62b77e51422852bbe69f crashed and is reachable testing commit b06a3c552c0038331cc46b611db98538107fafe6 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 4d2ecd8fef09525294e2af411025b54a6969126739b5bc75a015fbbaedd52e6b all runs: crashed: kernel BUG in ext4_create_inline_data representative crash: kernel BUG in ext4_create_inline_data, types: [BUG] # git bisect good b06a3c552c0038331cc46b611db98538107fafe6 Bisecting: 0 revisions left to test after this (roughly 0 steps) [79ec8dabf001fbc92cf6694f46e9e00ed3ac2d57] crypto: hisilicon/hpre - fix dma unmap sequence determine whether the revision contains the guilty commit revision fb3854e76cd32392983e45feee4a992221fff5cb crashed and is reachable testing commit 79ec8dabf001fbc92cf6694f46e9e00ed3ac2d57 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: bfcde79479ca503be9d0febc1dded2ee94af855d9d09e0905b77091a0344e26e all runs: crashed: kernel BUG in ext4_create_inline_data representative crash: kernel BUG in ext4_create_inline_data, types: [BUG] # git bisect good 79ec8dabf001fbc92cf6694f46e9e00ed3ac2d57 7f322c12df7aeed1755acd3c6fab48c7807795fb is the first bad commit commit 7f322c12df7aeed1755acd3c6fab48c7807795fb Author: Theodore Ts'o Date: Thu Jul 17 10:54:34 2025 -0400 ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr [ Upstream commit 099b847ccc6c1ad2f805d13cfbcc83f5b6d4bc42 ] A syzbot fuzzed image triggered a BUG_ON in ext4_update_inline_data() when an inode had the INLINE_DATA_FL flag set but was missing the system.data extended attribute. Since this can happen due to a maiciouly fuzzed file system, we shouldn't BUG, but rather, report it as a corrupted file system. Add similar replacements of BUG_ON with EXT4_ERROR_INODE() ii ext4_create_inline_data() and ext4_inline_data_truncate(). Reported-by: syzbot+544248a761451c0df72f@syzkaller.appspotmail.com Signed-off-by: Theodore Ts'o Signed-off-by: Sasha Levin fs/ext4/inline.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) accumulated error probability: 0.00 culprit signature: 8711e8b3551cf08bb6173955f16887847a1be9a4968b4091196e3758b393c229 parent signature: bfcde79479ca503be9d0febc1dded2ee94af855d9d09e0905b77091a0344e26e revisions tested: 18, total time: 3h46m29.855121805s (build: 1h23m32.36282018s, test: 2h17m10.658053061s) first good commit: 7f322c12df7aeed1755acd3c6fab48c7807795fb ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr recipients (to): ["sashal@kernel.org" "tytso@mit.edu"] recipients (cc): []