ci2 starts bisection 2024-10-20 09:45:35.019578392 +0000 UTC m=+134953.442952126 bisecting fixing commit since d2bafcf224f3911b183113b2fcb536c9e90684a3 building syzkaller on d7d323527f8e6073ec1da024a08c26f50626254f ensuring issue is reproducible on original commit d2bafcf224f3911b183113b2fcb536c9e90684a3 testing commit d2bafcf224f3911b183113b2fcb536c9e90684a3 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 2809ac7f70ba62fc0205d64f667d260ede579c3f1f73d3d1b372be2cd56b744e all runs: crashed: KASAN: use-after-free Read in ext4_inlinedir_to_tree representative crash: KASAN: use-after-free Read in ext4_inlinedir_to_tree, types: [KASAN] check whether we can drop unnecessary instrumentation disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed testing commit d2bafcf224f3911b183113b2fcb536c9e90684a3 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 50585f8e4f8b1b6bbf2159cdfa457cdcc420a53d17c7251826324bed25ccda21 all runs: crashed: KASAN: use-after-free Read in ext4_inlinedir_to_tree representative crash: KASAN: use-after-free Read in ext4_inlinedir_to_tree, types: [KASAN] the bug reproduces without the instrumentation disabling configs for [UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed kconfig minimization: base=4037 full=8129 leaves diff=2104 split chunks (needed=false): <2104> split chunk #0 of len 2104 into 5 parts testing without sub-chunk 1/5 disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN BUG LOCKDEP], they are not needed testing commit d2bafcf224f3911b183113b2fcb536c9e90684a3 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 35fabc5668463062d31a869ee667c75b2f9710d05314af3fe0dfdd9976823a1f all runs: crashed: KASAN: use-after-free Read in ext4_inlinedir_to_tree representative crash: KASAN: use-after-free Read in ext4_inlinedir_to_tree, types: [KASAN] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing commit d2bafcf224f3911b183113b2fcb536c9e90684a3 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 8393ab86faa9cbe4dcc731ac117fdeb6ceec6291daca862b40286084a9f2f6ac all runs: crashed: KASAN: use-after-free Read in ext4_inlinedir_to_tree representative crash: KASAN: use-after-free Read in ext4_inlinedir_to_tree, types: [KASAN] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing commit d2bafcf224f3911b183113b2fcb536c9e90684a3 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 49aae85c880f93df6c5048bfb8b65497bee8948aa2424bb042c0dd2a3ae8d791 all runs: crashed: KASAN: use-after-free Read in ext4_inlinedir_to_tree representative crash: KASAN: use-after-free Read in ext4_inlinedir_to_tree, types: [KASAN] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing commit d2bafcf224f3911b183113b2fcb536c9e90684a3 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 1626204894f66c6bd26964b818660a98ffa113145ec2b0fc7417aa80c811ea1b all runs: crashed: KASAN: use-after-free Read in ext4_inlinedir_to_tree representative crash: KASAN: use-after-free Read in ext4_inlinedir_to_tree, types: [KASAN] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing commit d2bafcf224f3911b183113b2fcb536c9e90684a3 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 4af108b6928b3bdd87fc5713f53b560765c8326c6e027e66126b0dab82190e98 all runs: crashed: KASAN: use-after-free Read in ext4_inlinedir_to_tree representative crash: KASAN: use-after-free Read in ext4_inlinedir_to_tree, types: [KASAN] the chunk can be dropped disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing current HEAD 715ca9dd687f89ddaac8ec8ccb3b5e5a30311a99 testing commit 715ca9dd687f89ddaac8ec8ccb3b5e5a30311a99 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: c64519dc7e2dbc08158814788f3183ea9c011077f0c921363fd305389195bb3f all runs: crashed: KASAN: use-after-free Read in ext4_inlinedir_to_tree representative crash: KASAN: use-after-free Read in ext4_inlinedir_to_tree, types: [KASAN] crash still not fixed/happens on the oldest tested release revisions tested: 8, total time: 1h57m39.676728919s (build: 1h3m12.586950664s, test: 46m3.656998965s) crash still not fixed or there were kernel test errors commit msg: Merge tag 'io_uring-6.12-20241019' of git://git.kernel.dk/linux crash: KASAN: use-after-free Read in ext4_inlinedir_to_tree EXT4-fs error (device loop0): htree_dirblock_to_tree:1112: inode #2: block 21: comm syz-executor: bad entry in directory: directory entry overrun - offset=1004, inode=0, rec_len=1000, size=1024 fake=0 ================================================================== BUG: KASAN: use-after-free in ext4_read_inline_data fs/ext4/inline.c:209 [inline] BUG: KASAN: use-after-free in ext4_inlinedir_to_tree+0x47e/0x1010 fs/ext4/inline.c:1366 Read of size 324 at addr ffff888127c84c05 by task syz-executor/2810 CPU: 0 UID: 0 PID: 2810 Comm: syz-executor Not tainted 6.12.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x108/0x280 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105 ext4_read_inline_data fs/ext4/inline.c:209 [inline] ext4_inlinedir_to_tree+0x47e/0x1010 fs/ext4/inline.c:1366 ext4_htree_fill_tree+0x4db/0x1240 fs/ext4/namei.c:1211 ext4_dx_readdir fs/ext4/dir.c:599 [inline] ext4_readdir+0x253c/0x2fe0 fs/ext4/dir.c:143 iterate_dir+0x18e/0x4a0 fs/readdir.c:108 __do_sys_getdents64 fs/readdir.c:407 [inline] __se_sys_getdents64+0x1b3/0x3e0 fs/readdir.c:392 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x8d/0x170 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff22988c013 Code: c1 66 0f 1f 44 00 00 48 83 c4 08 48 89 ef 5b 5d e9 52 43 f8 ff 66 90 b8 ff ff ff 7f 48 39 c2 48 0f 47 d0 b8 d9 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 c7 c2 a8 ff ff ff f7 d8 RSP: 002b:00007fffc264a4f8 EFLAGS: 00000293 ORIG_RAX: 00000000000000d9 RAX: ffffffffffffffda RBX: 0000555591fb1520 RCX: 00007ff22988c013 RDX: 0000000000008000 RSI: 0000555591fb1520 RDI: 0000000000000006 RBP: 0000555591fb14f4 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000001000 R11: 0000000000000293 R12: ffffffffffffffa8 R13: 0000000000000016 R14: 0000555591fb14f0 R15: 00007fffc264d890 The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x7ff46ff37 pfn:0x127c84 flags: 0x200000000000000(node=0|zone=2) raw: 0200000000000000 ffffea000495f788 ffffea0004a30348 0000000000000000 raw: 00000007ff46ff37 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 3251, tgid 3251 (modprobe), ts 71655636040, free_ts 71657089299 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x10f/0x130 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x39f2/0x3c30 mm/page_alloc.c:3457 __alloc_pages_noprof+0x256/0x650 mm/page_alloc.c:4733 alloc_pages_mpol_noprof+0x143/0x330 mm/mempolicy.c:2265 folio_alloc_mpol_noprof+0x14/0x100 mm/mempolicy.c:2283 vma_alloc_folio_noprof+0x2a6/0x390 mm/mempolicy.c:2314 folio_prealloc+0x26/0xf0 wp_page_copy mm/memory.c:3353 [inline] do_wp_page+0xb64/0x3520 mm/memory.c:3745 handle_pte_fault mm/memory.c:5771 [inline] __handle_mm_fault mm/memory.c:5898 [inline] handle_mm_fault+0x16e1/0x3620 mm/memory.c:6066 do_user_addr_fault arch/x86/mm/fault.c:1338 [inline] handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x3fa/0x780 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 page last free pid 3251 tgid 3251 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_folios+0xb78/0x1330 mm/page_alloc.c:2686 folios_put_refs+0x48e/0x570 mm/swap.c:1007 free_pages_and_swap_cache+0x27a/0x4e0 mm/swap_state.c:332 __tlb_batch_free_encoded_pages mm/mmu_gather.c:136 [inline] tlb_batch_pages_flush mm/mmu_gather.c:149 [inline] tlb_flush_mmu_free mm/mmu_gather.c:366 [inline] tlb_flush_mmu+0x2ad/0x4e0 mm/mmu_gather.c:373 tlb_finish_mmu+0xb6/0x1c0 mm/mmu_gather.c:465 exit_mmap+0x3b7/0x910 mm/mmap.c:1887 __mmput+0x61/0x250 kernel/fork.c:1347 exit_mm+0x114/0x1b0 kernel/exit.c:571 do_exit+0x7dd/0x2550 kernel/exit.c:926 do_group_exit+0x1ba/0x280 kernel/exit.c:1088 __do_sys_exit_group kernel/exit.c:1099 [inline] __se_sys_exit_group kernel/exit.c:1097 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1097 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x8d/0x170 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff888127c84b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888127c84b80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff888127c84c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff888127c84c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888127c84d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================