ci2 starts bisection 2023-01-30 21:40:55.861721385 +0000 UTC m=+40559.914781207 bisecting fixing commit since 7048384c9872ef19e8c44ca33cf06b602aaef255 building syzkaller on 67be1ae742603edad9c97d30b6ed69f9bbe2ffa8 ensuring issue is reproducible on original commit 7048384c9872ef19e8c44ca33cf06b602aaef255 testing commit 7048384c9872ef19e8c44ca33cf06b602aaef255 gcc compiler: Debian clang version 13.0.1-6~deb11u1, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: d3225140f32f28c64c3397d027a99228e54b52095c89754fdda5a01565d04607 all runs: crashed: general protection fault in ext4_xattr_set_entry testing current HEAD bfbd2237c1861a6580673946c1633d3533184659 testing commit bfbd2237c1861a6580673946c1633d3533184659 gcc compiler: Debian clang version 13.0.1-6~deb11u1, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: fb77dd3c30fa0d3a1e490360359e66f8d473cc58326a60489e3ab091e4fc40d6 all runs: crashed: general protection fault in ext4_xattr_set_entry revisions tested: 2, total time: 22m8.228839075s (build: 14m29.275067197s, test: 5m39.096627501s) the crash still happens on HEAD commit msg: Merge 5.15.83 into android13-5.15-lts crash: general protection fault in ext4_xattr_set_entry general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] CPU: 0 PID: 375 Comm: syz-executor.0 Not tainted 5.15.83-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 RIP: 0010:ext4_xattr_inode_create fs/ext4/xattr.c:1429 [inline] RIP: 0010:ext4_xattr_inode_lookup_create fs/ext4/xattr.c:1537 [inline] RIP: 0010:ext4_xattr_set_entry+0x1ace/0x3600 fs/ext4/xattr.c:1665 Code: 48 c1 e8 03 80 3c 10 00 74 12 48 89 df e8 da 0d c3 ff 48 ba 00 00 00 00 00 fc ff df 48 8b 1b 48 83 c3 30 48 89 d8 48 c1 e8 03 <80> 3c 10 00 74 12 48 89 df e8 b4 0d c3 ff 48 ba 00 00 00 00 00 fc RSP: 0018:ffffc900006371a0 EFLAGS: 00010206 RAX: 0000000000000006 RBX: 0000000000000030 RCX: 0000000000000001 RDX: dffffc0000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90000637450 R08: dffffc0000000000 R09: ffffffff85ce79d0 R10: ffffed1021cbc003 R11: 1ffff11021cbc002 R12: ffffffff85ce7980 R13: ffffc90000637334 R14: 0000000000000000 R15: ffff88810e300820 FS: 00005555567f1400(0000) GS:ffff8881f7200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005555567fa728 CR3: 000000011b414000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ext4_xattr_block_set+0xc41/0x35c0 fs/ext4/xattr.c:1971 ext4_xattr_move_to_block fs/ext4/xattr.c:2603 [inline] ext4_xattr_make_inode_space fs/ext4/xattr.c:2672 [inline] ext4_expand_extra_isize_ea+0x11f5/0x1c80 fs/ext4/xattr.c:2764 __ext4_expand_extra_isize+0x1ed/0x340 fs/ext4/inode.c:5826 ext4_try_to_expand_extra_isize fs/ext4/inode.c:5869 [inline] __ext4_mark_inode_dirty+0x3d8/0x650 fs/ext4/inode.c:5947 ext4_dirty_inode+0xab/0xe0 fs/ext4/inode.c:5979 __mark_inode_dirty+0x14c/0x700 fs/fs-writeback.c:2439 mark_inode_dirty_sync include/linux/fs.h:2443 [inline] iput+0xff/0x5d0 fs/inode.c:1686 dentry_unlink_inode+0x2d2/0x3c0 fs/dcache.c:376 __dentry_kill+0x329/0x4d0 fs/dcache.c:582 shrink_dentry_list+0x209/0x440 fs/dcache.c:1176 shrink_dcache_parent+0xb8/0x2f0 do_one_tree fs/dcache.c:1657 [inline] shrink_dcache_for_umount+0x67/0x160 fs/dcache.c:1674 generic_shutdown_super+0x63/0x270 fs/super.c:447 kill_block_super+0x78/0xc0 fs/super.c:1396 deactivate_locked_super+0x8b/0xe0 fs/super.c:335 deactivate_super+0x5c/0x80 fs/super.c:366 cleanup_mnt+0x3bd/0x460 fs/namespace.c:1143 __cleanup_mnt+0xd/0x10 fs/namespace.c:1150 task_work_run+0xd6/0x150 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0xfd/0x110 kernel/entry/common.c:175 exit_to_user_mode_prepare kernel/entry/common.c:207 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline] syscall_exit_to_user_mode+0x79/0xc0 kernel/entry/common.c:300 do_syscall_64+0x50/0xd0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f9e39195547 Code: ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffdacc38c98 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f9e39195547 RDX: 00007ffdacc38d69 RSI: 000000000000000a RDI: 00007ffdacc38d60 RBP: 00007ffdacc38d60 R08: 00000000ffffffff R09: 00007ffdacc38b30 R10: 00005555567f2793 R11: 0000000000000246 R12: 00007f9e391eeb24 R13: 00007ffdacc39e20 R14: 00005555567f26f0 R15: 00007ffdacc39e60 Modules linked in: ---[ end trace ff4c58ef1f8996c7 ]--- RIP: 0010:ext4_xattr_inode_create fs/ext4/xattr.c:1429 [inline] RIP: 0010:ext4_xattr_inode_lookup_create fs/ext4/xattr.c:1537 [inline] RIP: 0010:ext4_xattr_set_entry+0x1ace/0x3600 fs/ext4/xattr.c:1665 Code: 48 c1 e8 03 80 3c 10 00 74 12 48 89 df e8 da 0d c3 ff 48 ba 00 00 00 00 00 fc ff df 48 8b 1b 48 83 c3 30 48 89 d8 48 c1 e8 03 <80> 3c 10 00 74 12 48 89 df e8 b4 0d c3 ff 48 ba 00 00 00 00 00 fc RSP: 0018:ffffc900006371a0 EFLAGS: 00010206 RAX: 0000000000000006 RBX: 0000000000000030 RCX: 0000000000000001 RDX: dffffc0000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90000637450 R08: dffffc0000000000 R09: ffffffff85ce79d0 R10: ffffed1021cbc003 R11: 1ffff11021cbc002 R12: ffffffff85ce7980 R13: ffffc90000637334 R14: 0000000000000000 R15: ffff88810e300820 FS: 00005555567f1400(0000) GS:ffff8881f7200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005555567fa728 CR3: 000000011b414000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 48 c1 e8 03 shr $0x3,%rax 4: 80 3c 10 00 cmpb $0x0,(%rax,%rdx,1) 8: 74 12 je 0x1c a: 48 89 df mov %rbx,%rdi d: e8 da 0d c3 ff callq 0xffc30dec 12: 48 ba 00 00 00 00 00 movabs $0xdffffc0000000000,%rdx 19: fc ff df 1c: 48 8b 1b mov (%rbx),%rbx 1f: 48 83 c3 30 add $0x30,%rbx 23: 48 89 d8 mov %rbx,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 80 3c 10 00 cmpb $0x0,(%rax,%rdx,1) <-- trapping instruction 2e: 74 12 je 0x42 30: 48 89 df mov %rbx,%rdi 33: e8 b4 0d c3 ff callq 0xffc30dec 38: 48 rex.W 39: ba 00 00 00 00 mov $0x0,%edx 3e: 00 fc add %bh,%ah