ci starts bisection 2023-12-02 17:04:02.464849101 +0000 UTC m=+221151.864748479 bisecting cause commit starting from 994d5c58e50e91bb02c7be4a91d5186292a895c8 building syzkaller on f819d6f7cb99737851dcaaa51f11190138fd48d5 ensuring issue is reproducible on original commit 994d5c58e50e91bb02c7be4a91d5186292a895c8 testing commit 994d5c58e50e91bb02c7be4a91d5186292a895c8 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 3c064be2e42278cb832db754e69d91832f333ebdc993c6ae65cd81c818ebc2c4 all runs: crashed: kernel BUG in gfs2_quota_cleanup representative crash: kernel BUG in gfs2_quota_cleanup, types: [BUG] check whether we can drop unnecessary instrumentation disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN KASAN LOCKDEP], they are not needed testing commit 994d5c58e50e91bb02c7be4a91d5186292a895c8 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: e18bf5417ca22132d4a49690865e140087024c5716b1d940b7d9e1de077333a6 all runs: crashed: kernel BUG in gfs2_quota_cleanup representative crash: kernel BUG in gfs2_quota_cleanup, types: [BUG] the bug reproduces without the instrumentation disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN KASAN], they are not needed kconfig minimization: base=3915 full=7651 leaves diff=2007 split chunks (needed=false): <2007> split chunk #0 of len 2007 into 5 parts testing without sub-chunk 1/5 disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN KASAN], they are not needed testing commit 994d5c58e50e91bb02c7be4a91d5186292a895c8 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: a41f7ad8146dabbe855948df20a7111c11636ec52390aad2680ffdc0f3344388 all runs: crashed: kernel BUG in gfs2_quota_cleanup representative crash: kernel BUG in gfs2_quota_cleanup, types: [BUG] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [HANG LEAK UBSAN KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 994d5c58e50e91bb02c7be4a91d5186292a895c8 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 4501a9270f40f3dffe42dfd20596ed7c12117a8f4c4584bb0b0c0240383e11d1 all runs: OK false negative chance: 0.000 testing without sub-chunk 3/5 disabling configs for [KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed testing commit 994d5c58e50e91bb02c7be4a91d5186292a895c8 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: ce7f6f1bb1e73cf581b210543ef583949496fdb7ecc9e4cb8e544c53824fce07 all runs: crashed: kernel BUG in gfs2_quota_cleanup representative crash: kernel BUG in gfs2_quota_cleanup, types: [BUG] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN KASAN], they are not needed testing commit 994d5c58e50e91bb02c7be4a91d5186292a895c8 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 598355de5b7e630ee15ee3db56c66af445e5c5816972d339e55bf3e051e1663b all runs: crashed: kernel BUG in gfs2_quota_cleanup representative crash: kernel BUG in gfs2_quota_cleanup, types: [BUG] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [HANG LEAK UBSAN KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 994d5c58e50e91bb02c7be4a91d5186292a895c8 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: d2e7ec0eb93274b3a4a62d67536829f71374b976ed7bd6721f4b1d25c8ddcdbe all runs: crashed: kernel BUG in gfs2_quota_cleanup representative crash: kernel BUG in gfs2_quota_cleanup, types: [BUG] the chunk can be dropped minimized to 402 configs; suspects: [6LOWPAN ARCH_ENABLE_MEMORY_HOTREMOVE ASUS_WMI CMA COMMON_CLK DAX DLM DRM DRM_BRIDGE DRM_DEBUG_MM DRM_DISPLAY_DP_HELPER DRM_DISPLAY_HDCP_HELPER DRM_DISPLAY_HDMI_HELPER DRM_DISPLAY_HELPER DRM_DP_AUX_BUS DRM_DP_AUX_CHARDEV DRM_FBDEV_EMULATION DRM_GEM_SHMEM_HELPER DRM_I915 DRM_I915_CAPTURE_ERROR DRM_I915_COMPRESS_ERROR DRM_I915_USERPTR DRM_KMS_HELPER DRM_MIPI_DSI DRM_PANEL DRM_PANEL_BRIDGE DRM_PANEL_EDP DRM_PANEL_ORIENTATION_QUIRKS DRM_SIMPLEDRM DRM_TTM DRM_TTM_HELPER DRM_UDL DRM_VGEM DRM_VIRTIO_GPU DRM_VIRTIO_GPU_KMS DRM_VKMS DRM_VMWGFX DRM_VRAM_HELPER DUMMY DVB_AF9013 DVB_AF9033 DVB_AS102 DVB_AS102_FE DVB_B2C2_FLEXCOP DVB_B2C2_FLEXCOP_USB DVB_CORE DVB_DIB3000MB DVB_DIB3000MC DVB_EC100 DVB_GP8PSK_FE DVB_RTL2830 DVB_RTL2832 DVB_RTL2832_SDR DVB_TEST_DRIVERS DVB_TTUSB_BUDGET DVB_TTUSB_DEC DVB_USB DVB_USB_A800 DVB_USB_AF9005 DVB_USB_AF9005_REMOTE DVB_USB_AF9015 DVB_USB_AF9035 DVB_USB_ANYSEE DVB_USB_AU6610 DVB_USB_AZ6007 DVB_USB_AZ6027 DVB_USB_CE6230 DVB_USB_CINERGY_T2 DVB_USB_CXUSB DVB_USB_DIB0700 DVB_USB_DIB3000MC DVB_USB_DIBUSB_MB DVB_USB_DIBUSB_MC DVB_USB_DIGITV DVB_USB_DTT200U DVB_USB_DTV5100 DVB_USB_DVBSKY DVB_USB_DW2102 DVB_USB_EC168 DVB_USB_GL861 DVB_USB_GP8PSK DVB_USB_LME2510 DVB_USB_M920X DVB_USB_MXL111SF DVB_USB_NOVA_T_USB2 DVB_USB_OPERA1 DVB_USB_PCTV452E DVB_USB_RTL28XXU DVB_USB_TECHNISAT_USB2 DVB_USB_TTUSB2 DVB_USB_UMT_010 DVB_USB_V2 DVB_USB_VP702X DVB_USB_VP7045 DVB_USB_ZD1301 DVB_VIDTV DVB_ZL10353 ECRYPT_FS ECRYPT_FS_MESSAGING EDAC EEPROM_93CX6 EFS_FS ENCRYPTED_KEYS EQUALIZER EROFS_FS EROFS_FS_POSIX_ACL EROFS_FS_SECURITY EROFS_FS_XATTR EROFS_FS_ZIP EVM EVM_ADD_XATTRS EVM_ATTR_FSUUID EVM_EXTRA_SMACK_XATTRS EXFAT_FS EXPORTFS_BLOCK_OPS EXT3_FS EXT3_FS_POSIX_ACL EXT3_FS_SECURITY EXTCON EXTCON_INTEL_CHT_WC F2FS_CHECK_FS F2FS_FAULT_INJECTION F2FS_FS F2FS_FS_COMPRESSION F2FS_FS_LZ4 F2FS_FS_LZ4HC F2FS_FS_LZO F2FS_FS_LZORLE F2FS_FS_POSIX_ACL F2FS_FS_SECURITY F2FS_FS_XATTR F2FS_FS_ZSTD F2FS_STAT_FS FANOTIFY FANOTIFY_ACCESS_PERMISSIONS FB FB_CFB_COPYAREA FB_CFB_FILLRECT FB_CFB_IMAGEBLIT FB_CORE FB_DEFERRED_IO FB_IOMEM_FOPS FB_IOMEM_HELPERS FB_NOTIFY FB_SYSMEM_HELPERS FB_SYSMEM_HELPERS_DEFERRED FB_SYS_COPYAREA FB_SYS_FILLRECT FB_SYS_FOPS FB_SYS_IMAGEBLIT FB_TILEBLITTING FB_VESA FB_VGA16 FB_VIRTUAL FDDI FIREWIRE FIREWIRE_NET FIREWIRE_OHCI FIREWIRE_SBP2 FONT_8x16 FONT_8x8 FONT_SUPPORT FRAMEBUFFER_CONSOLE FRAMEBUFFER_CONSOLE_DETECT_PRIMARY FRAMEBUFFER_CONSOLE_ROTATION FS_DAX FS_DAX_PMD FS_ENCRYPTION FS_ENCRYPTION_ALGS FS_VERITY FS_VERITY_BUILTIN_SIGNATURES FTL FUSE_DAX FUSE_FS FW_LOADER_COMPRESS FW_LOADER_PAGED_BUF FW_LOADER_SYSFS FW_LOADER_USER_HELPER FW_LOADER_USER_HELPER_FALLBACK GACT_PROB GARP GENERIC_PHY GET_FREE_REGION GFS2_FS GFS2_FS_LOCKING_DLM GOOGLE_COREBOOT_TABLE GOOGLE_FIRMWARE GOOGLE_MEMCONSOLE GOOGLE_MEMCONSOLE_COREBOOT GOOGLE_VPD GPIOLIB GPIOLIB_IRQCHIP GPIO_ACPI GPIO_DLN2 GPIO_VIPERBOARD GREENASIA_FF GREYBUS GREYBUS_BRIDGED_PHY GREYBUS_ES2 GREYBUS_HID GREYBUS_USB GTP GUEST_PERF_EVENTS GVE HAVE_ARCH_NODE_DEV_GROUP HAVE_ARCH_USERFAULTFD_MINOR HAVE_ARCH_USERFAULTFD_WP HAVE_BOOTMEM_INFO_NODE HAVE_CLK_PREPARE HAVE_KVM_CPU_RELAX_INTERCEPT HAVE_KVM_DIRTY_RING HAVE_KVM_DIRTY_RING_ACQ_REL HAVE_KVM_DIRTY_RING_TSO HAVE_KVM_EVENTFD HAVE_KVM_IRQCHIP HAVE_KVM_IRQFD HAVE_KVM_IRQ_BYPASS HAVE_KVM_IRQ_ROUTING HAVE_KVM_MSI HAVE_KVM_NO_POLL HAVE_KVM_PFNCACHE HAVE_KVM_PM_NOTIFIER HAVE_SCHED_AVG_IRQ HDLC HDLC_CISCO HDLC_FR HDLC_PPP HDLC_RAW HDLC_RAW_ETH HDLC_X25 HDMI HFSPLUS_FS HFS_FS HID_ACCUTOUCH HID_ACRUX HID_ACRUX_FF HID_ALPS HID_APPLEIR HID_ASUS HID_AUREAL HID_BATTERY_STRENGTH HID_BETOP_FF HID_CMEDIA HID_CORSAIR HID_CP2112 HID_ELECOM HID_ELO HID_EMS_FF HID_GEMBIRD HID_GFRM HID_GREENASIA HID_GT683R HID_HOLTEK HID_ICADE HID_KEYTOUCH HID_KYE HID_LCPOWER HID_LED HID_LENOVO HID_LOGITECH_DJ HID_LOGITECH_HIDPP HID_MAGICMOUSE HID_MAYFLASH HID_MULTITOUCH HID_NTI HID_ORTEK HID_PENMOUNT HID_PICOLCD HID_PICOLCD_BACKLIGHT HID_PICOLCD_CIR HID_PICOLCD_FB HID_PICOLCD_LCD HID_PICOLCD_LEDS HID_PLANTRONICS HID_PRIMAX HID_PRODIKEYS HID_RETRODE HID_RMI HID_ROCCAT HID_SAITEK HID_SENSOR_ACCEL_3D HID_SENSOR_ALS HID_SENSOR_CUSTOM_SENSOR HID_SENSOR_DEVICE_ROTATION HID_SENSOR_GYRO_3D HID_SENSOR_HUB HID_SENSOR_HUMIDITY HID_SENSOR_IIO_COMMON HID_SENSOR_IIO_TRIGGER HID_SENSOR_INCLINOMETER_3D HID_SENSOR_MAGNETOMETER_3D HID_SENSOR_PRESS HID_SENSOR_PROX HID_SENSOR_TEMP HID_SPEEDLINK HID_STEELSERIES HID_THINGM HID_TIVO HID_TWINHAN HID_UCLOGIC HID_UDRAW_PS3 HID_WACOM HID_WALTOP HID_WIIMOTE HID_XINMO HID_ZYDACRON HMM_MIRROR HOLTEK_FF HOTPLUG_PCI_PCIE HPET_MMAP HPET_MMAP_DEFAULT HPFS_FS I2C_ALGOBIT I2C_CHARDEV I2C_DESIGNWARE_CORE I2C_DESIGNWARE_PLATFORM I2C_DIOLAN_U2C I2C_DLN2 I2C_MUX I2C_MUX_REG I2C_ROBOTFUZZ_OSIF I2C_SI4713 I2C_SLAVE I2C_SLAVE_EEPROM I2C_TINY_USB I2C_VIPERBOARD IEEE802154 IEEE802154_6LOWPAN IEEE802154_ATUSB IEEE802154_DRIVERS IEEE802154_HWSIM IEEE802154_NL802154_EXPERIMENTAL IEEE802154_SOCKET IFB IIO IIO_BUFFER IIO_KFIFO_BUF IIO_TRIGGER IIO_TRIGGERED_BUFFER IKCONFIG IKCONFIG_PROC IMA IMA_APPRAISE IMA_APPRAISE_MODSIG IMA_DEFAULT_HASH_SHA256 IMA_LSM_RULES IMA_MEASURE_ASYMMETRIC_KEYS IMA_NG_TEMPLATE IMA_QUEUE_EARLY_BOOT_KEYS IMA_READ_POLICY IMA_WRITE_POLICY INET6_ESPINTCP INET6_ESP_OFFLOAD INET6_IPCOMP INET6_TUNNEL INET6_XFRM_TUNNEL INET_AH INET_DCCP_DIAG INET_DIAG INET_DIAG_DESTROY INET_ESP INET_ESPINTCP INET_ESP_OFFLOAD INET_IPCOMP INET_MPTCP_DIAG INET_RAW_DIAG INET_SCTP_DIAG INET_TCP_DIAG INET_UDP_DIAG INET_XFRM_TUNNEL INFINIBAND INFINIBAND_ADDR_TRANS INFINIBAND_ADDR_TRANS_CONFIGFS INFINIBAND_IPOIB INFINIBAND_IPOIB_CM INFINIBAND_IPOIB_DEBUG INFINIBAND_ISER INFINIBAND_ON_DEMAND_PAGING INFINIBAND_RTRS INFINIBAND_SRP INFINIBAND_USER_ACCESS INFINIBAND_USER_MAD INFINIBAND_USER_MEM INPUT_ATI_REMOTE2 INPUT_CM109 INPUT_IMS_PCU INPUT_JOYDEV INPUT_KEYSPAN_REMOTE INPUT_LEDS INPUT_MOUSEDEV INPUT_MOUSEDEV_PSAUX INPUT_POWERMATE INPUT_UINPUT INPUT_YEALINK INTEGRITY INTEGRITY_ASYMMETRIC_KEYS INTEGRITY_AUDIT INTEGRITY_SIGNATURE INTEGRITY_TRUSTED_KEYRING INTEL_IDMA64 INTEL_IOATDMA INTEL_IOMMU_DEFAULT_ON INTEL_IOMMU_SVM INTEL_ISH_HID INTEL_SOC_PMIC_CHTWC INTERVAL_TREE INTERVAL_TREE_SPAN_ITER IOMMUFD IOMMUFD_DRIVER IOMMUFD_TEST IOMMU_SVA IP6_NF_MATCH_AH IP6_NF_MATCH_EUI64 IP6_NF_MATCH_FRAG IP6_NF_MATCH_HL IP6_NF_MATCH_MH IP6_NF_MATCH_OPTS IP6_NF_MATCH_RPFILTER IP6_NF_MATCH_RT IP6_NF_MATCH_SRH IP6_NF_NAT IP6_NF_RAW IP6_NF_SECURITY IP6_NF_TARGET_HL IP6_NF_TARGET_MASQUERADE IP6_NF_TARGET_NPT IP6_NF_TARGET_SYNPROXY IPV6_FOU IPV6_FOU_TUNNEL IPV6_GRE IPV6_ILA IPV6_MIP6 IPV6_MROUTE IPV6_MROUTE_MULTIPLE_TABLES IPV6_MULTIPLE_TABLES IPV6_OPTIMISTIC_DAD IPV6_PIMSM_V2 IPV6_ROUTER_PREF IPV6_ROUTE_INFO IPV6_RPL_LWTUNNEL IPV6_SEG6_BPF IPV6_SEG6_HMAC IPV6_SEG6_LWTUNNEL IPV6_SIT_6RD IPV6_SUBTREES IPV6_TUNNEL IPV6_VTI IPVLAN IPVLAN_L3S IPVTAP IP_DCCP IP_DCCP_CCID3 IP_DCCP_TFRC_LIB IP_FIB_TRIE_STATS IP_MROUTE_MULTIPLE_TABLES IP_NF_ARPFILTER IP_NF_ARPTABLES IP_NF_ARP_MANGLE IP_NF_MATCH_AH IP_NF_MATCH_ECN IP_NF_MATCH_RPFILTER IP_NF_MATCH_TTL IP_NF_RAW IP_NF_SECURITY IP_NF_TARGET_ECN IP_NF_TARGET_NETMAP IP_NF_TARGET_REDIRECT IP_NF_TARGET_SYNPROXY IP_NF_TARGET_TTL IP_ROUTE_CLASSID IP_SCTP IP_SET IP_SET_BITMAP_IP IP_SET_BITMAP_IPMAC IP_SET_BITMAP_PORT IP_SET_HASH_IP IP_SET_HASH_IPMAC IP_SET_HASH_IPMARK IP_SET_HASH_IPPORT IP_SET_HASH_IPPORTIP IP_SET_HASH_IPPORTNET IP_SET_HASH_MAC IP_SET_HASH_NET IP_SET_HASH_NETIFACE IP_SET_HASH_NETNET IP_SET_HASH_NETPORT IP_SET_HASH_NETPORTNET IP_SET_LIST_SET IP_VS IP_VS_DH IP_VS_FO IP_VS_FTP IP_VS_IPV6 IP_VS_LBLC IP_VS_LBLCR IP_VS_LC IP_VS_MH IP_VS_NFCT IP_VS_PROTO_TCP IRQ_TIME_ACCOUNTING LAPB LCD_CLASS_DEVICE MAC802154 MEDIA_DIGITAL_TV_SUPPORT MEDIA_RADIO_SUPPORT MEDIA_SDR_SUPPORT MEDIA_SUPPORT MEDIA_TEST_SUPPORT MEDIA_USB_SUPPORT MEMORY_HOTPLUG MEMORY_HOTREMOVE MFD_DLN2 MFD_VIPERBOARD MPTCP MTD NETFILTER_ADVANCED NET_ACT_GACT NET_ACT_MIRRED NET_IPGRE_DEMUX NFT_FWD_NETDEV NF_TABLES NF_TABLES_NETDEV RADIO_ADAPTERS RADIO_SI4713 RAS RC_CORE RFKILL SND SOUND STAGING TRANSPARENT_HUGEPAGE VIDEO_DEV VIRTIO_FS WAN ZONE_DEVICE] disabling configs for [KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed picked [v6.6 v6.5 v6.4 v6.2 v6.0 v5.18 v5.16 v5.14 v5.11 v5.8 v5.5 v5.2 v4.20 v4.19] out of 29 release tags testing release v6.6 testing commit ffc253263a1375a65fa6c9f62a893e9767fbebfa gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: a916118848a6fae92b375e9c1ddb6b845d0fbcd1d0e6162bd13858f54945eb77 all runs: OK false negative chance: 0.000 # git bisect start 994d5c58e50e91bb02c7be4a91d5186292a895c8 ffc253263a1375a65fa6c9f62a893e9767fbebfa Bisecting: 8328 revisions left to test after this (roughly 13 steps) [7d461b291e65938f15f56fe58da2303b07578a76] Merge tag 'drm-next-2023-10-31-1' of git://anongit.freedesktop.org/drm/drm testing commit 7d461b291e65938f15f56fe58da2303b07578a76 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 4a285562ced97e79766843f3229c31ed35fa6406e846b35c551ee2829c9839e2 all runs: OK false negative chance: 0.000 # git bisect good 7d461b291e65938f15f56fe58da2303b07578a76 Bisecting: 4159 revisions left to test after this (roughly 12 steps) [707df298cbde200b939c70be2577b20775fe3345] Merge tag 'powerpc-6.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux testing commit 707df298cbde200b939c70be2577b20775fe3345 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 098f1b6ec2a32ff9faa927a95d57420dfd72affc3f0cfa31da94286da6802838 all runs: OK false negative chance: 0.000 # git bisect good 707df298cbde200b939c70be2577b20775fe3345 Bisecting: 1948 revisions left to test after this (roughly 11 steps) [be3ca57cfb777ad820c6659d52e60bbdd36bf5ff] Merge tag 'media/v6.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media testing commit be3ca57cfb777ad820c6659d52e60bbdd36bf5ff gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: c2f3c519a8eb6212b24ad482f753ae81ad86b7ef8a60da7d506b0ddebf7ad429 all runs: OK false negative chance: 0.000 # git bisect good be3ca57cfb777ad820c6659d52e60bbdd36bf5ff Bisecting: 972 revisions left to test after this (roughly 10 steps) [b456259e1544daa337fa00cda8bd3bea04c8d914] Merge tag 'mmc-v6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc testing commit b456259e1544daa337fa00cda8bd3bea04c8d914 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: d6f920a6f4feef1d5d6823be4928d394ec2b817ea139f5e644fa053f9d27a469 all runs: crashed: kernel BUG in gfs2_quota_cleanup representative crash: kernel BUG in gfs2_quota_cleanup, types: [BUG] # git bisect bad b456259e1544daa337fa00cda8bd3bea04c8d914 Bisecting: 510 revisions left to test after this (roughly 9 steps) [6bc986ab839c844e78a2333a02e55f02c9e57935] Merge tag 'nfs-for-6.7-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs testing commit 6bc986ab839c844e78a2333a02e55f02c9e57935 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: a9fec677752312dada75134bf26d42ff4d77d9d65db7b413b4d458c61ab4282a all runs: crashed: kernel BUG in gfs2_quota_cleanup representative crash: kernel BUG in gfs2_quota_cleanup, types: [BUG] # git bisect bad 6bc986ab839c844e78a2333a02e55f02c9e57935 Bisecting: 227 revisions left to test after this (roughly 8 steps) [b8dd631fcabe2656c8d3751ad4836131d51fb63b] Merge tag 'rproc-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux testing commit b8dd631fcabe2656c8d3751ad4836131d51fb63b gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 39f7af2b0b5f5d7404e7e2ef6ececcf39de45b71b17028e4ebbb7664386dd8ac all runs: crashed: kernel BUG in gfs2_quota_cleanup representative crash: kernel BUG in gfs2_quota_cleanup, types: [BUG] # git bisect bad b8dd631fcabe2656c8d3751ad4836131d51fb63b Bisecting: 118 revisions left to test after this (roughly 7 steps) [062cca8915cad56aabb11206a4a5082856167fc0] Merge tag 'vfs-6.7.iomap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs testing commit 062cca8915cad56aabb11206a4a5082856167fc0 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: f573208024432684fdaad272410ce0927adacbe5c715b661e1e3105cc5dfa089 all runs: crashed: kernel BUG in gfs2_quota_cleanup representative crash: kernel BUG in gfs2_quota_cleanup, types: [BUG] # git bisect bad 062cca8915cad56aabb11206a4a5082856167fc0 Bisecting: 58 revisions left to test after this (roughly 6 steps) [0f0fc312380b93d203be3282b2cbaee7016f2b72] bcachefs: Move __bch2_members_v2_get_mut to sb-members.h testing commit 0f0fc312380b93d203be3282b2cbaee7016f2b72 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 85b858397e03a37bb70cea0f0de8f235cc76ac0482c8a6f10a8f38f1936bd8b3 all runs: OK false negative chance: 0.000 # git bisect good 0f0fc312380b93d203be3282b2cbaee7016f2b72 Bisecting: 27 revisions left to test after this (roughly 5 steps) [7f851936a0ca4b231224ee296cba28f9b1bc555e] Merge tag 'ovl-update-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs testing commit 7f851936a0ca4b231224ee296cba28f9b1bc555e gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 76594c22ff3e269137c12e61d667aac17526df79da42e6533d4d9ee98e82bbe8 all runs: OK false negative chance: 0.000 # git bisect good 7f851936a0ca4b231224ee296cba28f9b1bc555e Bisecting: 13 revisions left to test after this (roughly 4 steps) [4c7b3f7fb7c8c66d669d107e717f9de41ef81e92] gfs2: Get rid of gfs2_alloc_blocks generation parameter testing commit 4c7b3f7fb7c8c66d669d107e717f9de41ef81e92 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 76f7efe99b59e784faef2dc3c1c34abf0fad5909d31cb908d9b172515cdb1720 all runs: OK false negative chance: 0.000 # git bisect good 4c7b3f7fb7c8c66d669d107e717f9de41ef81e92 Bisecting: 6 revisions left to test after this (roughly 3 steps) [074d7306a4fe22fcac0b53f699f92757ab1cee99] gfs2: Silence "suspicious RCU usage in gfs2_permission" warning testing commit 074d7306a4fe22fcac0b53f699f92757ab1cee99 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: fa22b3eb82ef42e1866b7b523542fa17ecaa89430455d6f6963db424ebd156b2 all runs: OK false negative chance: 0.000 # git bisect good 074d7306a4fe22fcac0b53f699f92757ab1cee99 Bisecting: 3 revisions left to test after this (roughly 2 steps) [0cdc6f44e9fdc2d20d720145bf99a39f611f6d61] gfs2: don't withdraw if init_threads() got interrupted testing commit 0cdc6f44e9fdc2d20d720145bf99a39f611f6d61 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 748714800d716550fa92775ffb45ec9dddc1a9d66464eebd1756e6e5d01c7187 all runs: crashed: kernel BUG in gfs2_quota_cleanup representative crash: kernel BUG in gfs2_quota_cleanup, types: [BUG] # git bisect bad 0cdc6f44e9fdc2d20d720145bf99a39f611f6d61 Bisecting: 0 revisions left to test after this (roughly 1 step) [bb25b97562e52b2b5808b348db32568b1f5394b5] gfs2: remove dead code in add_to_queue testing commit bb25b97562e52b2b5808b348db32568b1f5394b5 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: b11863b5b7292f1802f0ea869349d2d33363b49ccc8d5e3a0f6cf22758024cda all runs: crashed: kernel BUG in gfs2_quota_cleanup representative crash: kernel BUG in gfs2_quota_cleanup, types: [BUG] # git bisect bad bb25b97562e52b2b5808b348db32568b1f5394b5 Bisecting: 0 revisions left to test after this (roughly 0 steps) [bdcb8aa434c6d36b5c215d02a9ef07551be25a37] gfs2: Fix slab-use-after-free in gfs2_qd_dealloc testing commit bdcb8aa434c6d36b5c215d02a9ef07551be25a37 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 6e31da60d1e957ed888ceff77e1ec63fdde38ddab8a89e3162c142d380b83f1a all runs: crashed: kernel BUG in gfs2_quota_cleanup representative crash: kernel BUG in gfs2_quota_cleanup, types: [BUG] # git bisect bad bdcb8aa434c6d36b5c215d02a9ef07551be25a37 bdcb8aa434c6d36b5c215d02a9ef07551be25a37 is the first bad commit commit bdcb8aa434c6d36b5c215d02a9ef07551be25a37 Author: Juntong Deng Date: Mon Oct 30 05:10:06 2023 +0800 gfs2: Fix slab-use-after-free in gfs2_qd_dealloc In gfs2_put_super(), whether withdrawn or not, the quota should be cleaned up by gfs2_quota_cleanup(). Otherwise, struct gfs2_sbd will be freed before gfs2_qd_dealloc (rcu callback) has run for all gfs2_quota_data objects, resulting in use-after-free. Also, gfs2_destroy_threads() and gfs2_quota_cleanup() is already called by gfs2_make_fs_ro(), so in gfs2_put_super(), after calling gfs2_make_fs_ro(), there is no need to call them again. Reported-by: syzbot+29c47e9e51895928698c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=29c47e9e51895928698c Signed-off-by: Juntong Deng Signed-off-by: Andreas Gruenbacher fs/gfs2/super.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) accumulated error probability: 0.00 culprit signature: 6e31da60d1e957ed888ceff77e1ec63fdde38ddab8a89e3162c142d380b83f1a parent signature: fa22b3eb82ef42e1866b7b523542fa17ecaa89430455d6f6963db424ebd156b2 revisions tested: 22, total time: 4h28m34.398442288s (build: 2h15m24.192322167s, test: 1h58m4.839901247s) first bad commit: bdcb8aa434c6d36b5c215d02a9ef07551be25a37 gfs2: Fix slab-use-after-free in gfs2_qd_dealloc recipients (to): ["agruenba@redhat.com" "agruenba@redhat.com" "gfs2@lists.linux.dev" "juntong.deng@outlook.com" "rpeterso@redhat.com"] recipients (cc): ["linux-kernel@vger.kernel.org"] crash: kernel BUG in gfs2_quota_cleanup ------------[ cut here ]------------ kernel BUG at fs/gfs2/quota.c:1494! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 1 PID: 2119 Comm: syz-executor.0 Not tainted 6.6.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 RIP: 0010:gfs2_quota_cleanup+0x25d/0x270 fs/gfs2/quota.c:1494 Code: c7 86 f8 0b 00 00 00 00 00 00 65 48 8b 04 25 28 00 00 00 48 3b 44 24 38 75 12 48 83 c4 40 5b 41 5c 41 5d 41 5e 41 5f 5d c3 90 <0f> 0b e8 cc 34 ec 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 66 0f 1f RSP: 0018:ffffc90000e9bd70 EFLAGS: 00010202 RAX: 02c28ac7d1230800 RBX: ffff888109b2c818 RCX: 0000000000000001 RDX: ffaf49cfd4e7bf87 RSI: ffffffff82cbc3f3 RDI: ffff888109b2c000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff888109b2c828 R13: ffff888109b2c818 R14: ffff888108efb000 R15: ffffc90000e9bd98 FS: 00005555567f3480(0000) GS:ffff888237d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe90c64c58 CR3: 0000000109b4a000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: gfs2_put_super+0xf0/0x2c0 fs/gfs2/super.c:611 generic_shutdown_super+0x78/0x110 fs/super.c:693 kill_block_super+0x16/0x40 fs/super.c:1646 deactivate_locked_super+0x2a/0x90 fs/super.c:481 cleanup_mnt+0xfe/0x150 fs/namespace.c:1254 task_work_run+0x7d/0xa0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xa4/0xb0 kernel/entry/common.c:171 exit_to_user_mode_prepare+0x64/0xe0 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x2d/0x220 kernel/entry/common.c:296 do_syscall_64+0x4f/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7ff2bce7de17 Code: b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b0 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffe90c65408 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007ff2bce7de17 RDX: 0000000000000000 RSI: 000000000000000a RDI: 00007ffe90c654c0 RBP: 00007ffe90c654c0 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffe90c66580 R13: 00007ff2bcec73b9 R14: 000000000000b00a R15: 0000000000000003 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:gfs2_quota_cleanup+0x25d/0x270 fs/gfs2/quota.c:1494 Code: c7 86 f8 0b 00 00 00 00 00 00 65 48 8b 04 25 28 00 00 00 48 3b 44 24 38 75 12 48 83 c4 40 5b 41 5c 41 5d 41 5e 41 5f 5d c3 90 <0f> 0b e8 cc 34 ec 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 66 0f 1f RSP: 0018:ffffc90000e9bd70 EFLAGS: 00010202 RAX: 02c28ac7d1230800 RBX: ffff888109b2c818 RCX: 0000000000000001 RDX: ffaf49cfd4e7bf87 RSI: ffffffff82cbc3f3 RDI: ffff888109b2c000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff888109b2c828 R13: ffff888109b2c818 R14: ffff888108efb000 R15: ffffc90000e9bd98 FS: 00005555567f3480(0000) GS:ffff888237d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe90c64c58 CR3: 0000000109b4a000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400