ci2 starts bisection 2023-08-18 01:46:49.480455898 +0000 UTC m=+104178.674050248 bisecting fixing commit since fa74641fb6b93a19ccb50579886ecc98320230f9 building syzkaller on 4bce1a3e705a8b62de8194bdb28f5eef89c8feec ensuring issue is reproducible on original commit fa74641fb6b93a19ccb50579886ecc98320230f9 testing commit fa74641fb6b93a19ccb50579886ecc98320230f9 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 421074328047ed973284e68c908e95a1b711e15df5de231ef99ee8e4298c2c7f run #0: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #1: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #2: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #3: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #4: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #5: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #6: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #7: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #8: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #9: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #10: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #11: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #12: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #13: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #14: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #15: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #16: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #17: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #18: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #19: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock representative crash: KASAN: use-after-free Read in ext4_convert_inline_data_nolock, types: [KASAN] check whether we can drop unnecessary instrumentation disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed testing commit fa74641fb6b93a19ccb50579886ecc98320230f9 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 34d5d5d8bb9212113342afb08824ca85fa27bf5f0d6455cd0f11b22b9e095b6e run #0: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #1: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #2: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #4: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #5: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #6: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #7: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #8: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #9: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock representative crash: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock, types: [KASAN] the bug reproduces without the instrumentation disabling configs for [UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed kconfig minimization: base=3820 full=7524 leaves diff=1994 split chunks (needed=false): <1994> split chunk #0 of len 1994 into 5 parts testing without sub-chunk 1/5 disabling configs for [BUG LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed testing commit fa74641fb6b93a19ccb50579886ecc98320230f9 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 735f829a7dcb213a09c6c81c4cd629635396ccf4942c423b569c848378de1f1c run #0: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #1: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #2: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #3: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #4: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #5: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #6: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #7: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #8: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #9: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock representative crash: KASAN: use-after-free Read in ext4_convert_inline_data_nolock, types: [KASAN] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing commit fa74641fb6b93a19ccb50579886ecc98320230f9 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 4e2a476716a25e7e4545d2ba361ffb331035a555b7b340f375af94b776161e07 run #0: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #1: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #2: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #3: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #4: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #5: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #6: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #7: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #8: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #9: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock representative crash: KASAN: use-after-free Read in ext4_convert_inline_data_nolock, types: [KASAN] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [BUG LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed testing commit fa74641fb6b93a19ccb50579886ecc98320230f9 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 213efc4381fc9c384cc589680bcfe5eac6d167ad5ff3666ac79c8f0a143eb055 run #0: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #1: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #2: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #4: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #5: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #6: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #7: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #8: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #9: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock representative crash: KASAN: use-after-free Read in ext4_convert_inline_data_nolock, types: [KASAN] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [BUG LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed testing commit fa74641fb6b93a19ccb50579886ecc98320230f9 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 283ad800d66e7b0873ef148f20ae9510ff491fae4f4447e3fd5e1ec0672e34d4 run #0: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #1: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #2: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #4: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #5: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #6: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #7: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #8: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #9: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock representative crash: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock, types: [KASAN] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed testing commit fa74641fb6b93a19ccb50579886ecc98320230f9 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: f04126dac35326891ab02e87f2c6bc53c1db10bbbb0a1036f9fdead549c4e03b run #0: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #1: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #2: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #4: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #5: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #6: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #7: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #8: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #9: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock representative crash: KASAN: use-after-free Read in ext4_convert_inline_data_nolock, types: [KASAN] the chunk can be dropped disabling configs for [UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing current HEAD 6c44e13dc284f7f4db17706ca48fd016d6b3d49a testing commit 6c44e13dc284f7f4db17706ca48fd016d6b3d49a gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: da07619ad93b67a93321826f4809188976843cd95ae488f8038de0650742480b run #0: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #1: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #2: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #4: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #5: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #6: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #7: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock run #8: crashed: KASAN: use-after-free Read in ext4_convert_inline_data_nolock run #9: crashed: KASAN: slab-out-of-bounds Read in ext4_convert_inline_data_nolock representative crash: KASAN: use-after-free Read in ext4_convert_inline_data_nolock, types: [KASAN] crash still not fixed/happens on the oldest tested release revisions tested: 8, total time: 2h6m30.045778364s (build: 1h36m1.063550577s, test: 25m4.413713817s) crash still not fixed on HEAD or HEAD had kernel test errors commit msg: Linux 6.1.46 crash: KASAN: use-after-free Read in ext4_convert_inline_data_nolock loop0: detected capacity change from 0 to 2048 EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. ================================================================== BUG: KASAN: use-after-free in ext4_read_inline_data fs/ext4/inline.c:210 [inline] BUG: KASAN: use-after-free in ext4_convert_inline_data_nolock+0x282/0xc10 fs/ext4/inline.c:1216 Read of size 20 at addr ffff888103fcc1a3 by task syz-executor.0/1513 CPU: 0 PID: 1513 Comm: syz-executor.0 Not tainted 6.1.46-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xf4/0x251 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x15f/0x4f0 mm/kasan/report.c:395 kasan_report+0x136/0x160 mm/kasan/report.c:495 kasan_check_range+0x27f/0x290 mm/kasan/generic.c:189 memcpy+0x25/0x60 mm/kasan/shadow.c:65 ext4_read_inline_data fs/ext4/inline.c:210 [inline] ext4_convert_inline_data_nolock+0x282/0xc10 fs/ext4/inline.c:1216 ext4_convert_inline_data+0x3b8/0x4d0 fs/ext4/inline.c:2077 ext4_fallocate+0x136/0x1790 fs/ext4/extents.c:4702 vfs_fallocate+0x30c/0x3d0 fs/open.c:323 ksys_fallocate fs/open.c:346 [inline] __do_sys_fallocate fs/open.c:354 [inline] __se_sys_fallocate fs/open.c:352 [inline] __x64_sys_fallocate+0xa6/0xd0 fs/open.c:352 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f2a009f3959 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f2a005760c8 EFLAGS: 00000246 ORIG_RAX: 000000000000011d RAX: ffffffffffffffda RBX: 00007f2a00b12f80 RCX: 00007f2a009f3959 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 RBP: 00007f2a00a4fc88 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000008000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000006 R14: 00007f2a00b12f80 R15: 00007ffd2385c5a8 The buggy address belongs to the physical page: page:ffffea00040ff300 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103fcc flags: 0x200000000000000(node=0|zone=2) raw: 0200000000000000 ffffea0004604248 ffffea00040cc4c8 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 0, migratetype Unmovable, gfp_mask 0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), pid 1045, tgid 1045 (syz-executor.0), ts 54128401343, free_ts 54188685643 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x286/0x2b0 mm/page_alloc.c:2533 prep_new_page mm/page_alloc.c:2540 [inline] get_page_from_freelist+0x2c71/0x2eb0 mm/page_alloc.c:4292 __alloc_pages+0x251/0x640 mm/page_alloc.c:5559 __get_free_pages mm/page_alloc.c:5609 [inline] get_zeroed_page+0x13/0x30 mm/page_alloc.c:5618 __pud_alloc_one include/asm-generic/pgalloc.h:156 [inline] pud_alloc_one include/asm-generic/pgalloc.h:171 [inline] __pud_alloc+0x87/0x1e0 mm/memory.c:5417 pud_alloc include/linux/mm.h:2312 [inline] copy_pud_range mm/memory.c:1184 [inline] copy_p4d_range mm/memory.c:1228 [inline] copy_page_range+0x326a/0x3690 mm/memory.c:1326 dup_mmap kernel/fork.c:696 [inline] dup_mm kernel/fork.c:1532 [inline] copy_mm+0xd9e/0x1570 kernel/fork.c:1581 copy_process+0x128e/0x3570 kernel/fork.c:2259 kernel_clone+0x18b/0x660 kernel/fork.c:2674 __do_sys_clone kernel/fork.c:2815 [inline] __se_sys_clone kernel/fork.c:2799 [inline] __x64_sys_clone+0x22c/0x270 kernel/fork.c:2799 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1460 [inline] free_pcp_prepare mm/page_alloc.c:1510 [inline] free_unref_page_prepare+0xca9/0xd80 mm/page_alloc.c:3388 free_unref_page_list+0xb7/0x570 mm/page_alloc.c:3530 release_pages+0x1763/0x1900 mm/swap.c:1055 tlb_batch_pages_flush mm/mmu_gather.c:59 [inline] tlb_flush_mmu_free mm/mmu_gather.c:254 [inline] tlb_flush_mmu+0x26f/0x3d0 mm/mmu_gather.c:261 tlb_finish_mmu+0xb0/0x1b0 mm/mmu_gather.c:361 exit_mmap+0x311/0x700 mm/mmap.c:3226 __mmput+0x61/0x290 kernel/fork.c:1191 exit_mm+0x122/0x1b0 kernel/exit.c:563 do_exit+0x81e/0x23a0 kernel/exit.c:856 do_group_exit+0x1b5/0x280 kernel/exit.c:1019 get_signal+0x1117/0x1260 kernel/signal.c:2862 arch_do_signal_or_restart+0xb3/0x1240 arch/x86/kernel/signal.c:871 exit_to_user_mode_loop+0x61/0xb0 kernel/entry/common.c:168 exit_to_user_mode_prepare+0x64/0xb0 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x27/0x1c0 kernel/entry/common.c:297 do_syscall_64+0x49/0x80 arch/x86/entry/common.c:86 Memory state around the buggy address: ffff888103fcc080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888103fcc100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff888103fcc180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff888103fcc200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888103fcc280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================