ci2 starts bisection 2023-10-10 01:27:47.764335982 +0000 UTC m=+105.461475213 bisecting fixing commit since 6c44e13dc284f7f4db17706ca48fd016d6b3d49a building syzkaller on d216d8a03b50bef82eac746d227230835f061640 ensuring issue is reproducible on original commit 6c44e13dc284f7f4db17706ca48fd016d6b3d49a testing commit 6c44e13dc284f7f4db17706ca48fd016d6b3d49a gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 3c57a86cb6f96998289aaad4b810212d720617e9c66e6265ba5b810c3c9e755d all runs: crashed: UBSAN: array-index-out-of-bounds in f2fs_iget representative crash: UBSAN: array-index-out-of-bounds in f2fs_iget, types: [UBSAN] check whether we can drop unnecessary instrumentation disabling configs for [KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK BUG], they are not needed testing commit 6c44e13dc284f7f4db17706ca48fd016d6b3d49a gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 51e3d1ee13582d2c31ef1486e2d7673eb53d257d2db13f828c68ba0145f8eb5d all runs: crashed: UBSAN: array-index-out-of-bounds in f2fs_iget representative crash: UBSAN: array-index-out-of-bounds in f2fs_iget, types: [UBSAN] the bug reproduces without the instrumentation disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK BUG KASAN], they are not needed kconfig minimization: base=7498 full=9694 leaves diff=1937 split chunks (needed=false): <1937> split chunk #0 of len 1937 into 5 parts testing without sub-chunk 1/5 disabling configs for [LEAK BUG KASAN LOCKDEP ATOMIC_SLEEP HANG], they are not needed testing commit 6c44e13dc284f7f4db17706ca48fd016d6b3d49a gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: d2c0b1234327cb1a2fb03de340fbe8f593e41ebc6dc423477fb4b671c3d8a9d8 all runs: crashed: UBSAN: array-index-out-of-bounds in f2fs_iget representative crash: UBSAN: array-index-out-of-bounds in f2fs_iget, types: [UBSAN] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [HANG LEAK BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 6c44e13dc284f7f4db17706ca48fd016d6b3d49a gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: d483c37b6a03b6d3bbe23a4bb18bab51d11d2a22f4a581ad5f70844260ba89f0 all runs: boot failed: can't ssh into the instance unable to determine the verdict: 0 good runs (wanted 5), for bad wanted 5 in total, got 0 testing without sub-chunk 3/5 disabling configs for [BUG KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing commit 6c44e13dc284f7f4db17706ca48fd016d6b3d49a gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 45af2469941162a027bac679af9dc5d22e6ffabb79054aefcedf5ba02315ab31 all runs: crashed: UBSAN: array-index-out-of-bounds in f2fs_iget representative crash: UBSAN: array-index-out-of-bounds in f2fs_iget, types: [UBSAN] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [BUG KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing commit 6c44e13dc284f7f4db17706ca48fd016d6b3d49a gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 55a3b886da87649d361dfae78ed2df71d67aa30c074c13ba14d890333616159a all runs: crashed: UBSAN: array-index-out-of-bounds in f2fs_iget representative crash: UBSAN: array-index-out-of-bounds in f2fs_iget, types: [UBSAN] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [HANG LEAK BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 6c44e13dc284f7f4db17706ca48fd016d6b3d49a gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: fbdb83803f174b68c6d74163bc69244a7158cb147bf4dab3c924f69f533cf65c all runs: crashed: UBSAN: array-index-out-of-bounds in f2fs_iget representative crash: UBSAN: array-index-out-of-bounds in f2fs_iget, types: [UBSAN] the chunk can be dropped minimized to 388 configs; suspects: [6LOWPAN ACPI_VIDEO DLM DRM DRM_TTM DRM_TTM_HELPER DRM_UDL DRM_V3D DRM_VC4 DRM_VGEM DRM_VIRTIO_GPU DRM_VKMS DRM_VRAM_HELPER DUMMY DVB_AF9013 DVB_AF9033 DVB_AS102 DVB_AS102_FE DVB_B2C2_FLEXCOP DVB_B2C2_FLEXCOP_USB DVB_DIB3000MB DVB_DIB3000MC DVB_EC100 DVB_GP8PSK_FE DVB_RTL2830 DVB_RTL2832 DVB_RTL2832_SDR DVB_TEST_DRIVERS DVB_TTUSB_BUDGET DVB_TTUSB_DEC DVB_USB DVB_USB_A800 DVB_USB_AF9005 DVB_USB_AF9005_REMOTE DVB_USB_AF9015 DVB_USB_AF9035 DVB_USB_ANYSEE DVB_USB_AU6610 DVB_USB_AZ6007 DVB_USB_AZ6027 DVB_USB_CE6230 DVB_USB_CINERGY_T2 DVB_USB_CXUSB DVB_USB_DIB0700 DVB_USB_DIB3000MC DVB_USB_DIBUSB_MB DVB_USB_DIBUSB_MC DVB_USB_DIGITV DVB_USB_DTT200U DVB_USB_DTV5100 DVB_USB_DVBSKY DVB_USB_DW2102 DVB_USB_EC168 DVB_USB_GL861 DVB_USB_GP8PSK DVB_USB_LME2510 DVB_USB_M920X DVB_USB_MXL111SF DVB_USB_NOVA_T_USB2 DVB_USB_OPERA1 DVB_USB_PCTV452E DVB_USB_RTL28XXU DVB_USB_TECHNISAT_USB2 DVB_USB_TTUSB2 DVB_USB_UMT_010 DVB_USB_V2 DVB_USB_VP702X DVB_USB_VP7045 DVB_USB_ZD1301 DVB_VIDTV DVB_ZL10353 E100 ECRYPT_FS ECRYPT_FS_MESSAGING EEPROM_93CX6 EFS_FS ENCRYPTED_KEYS EQUALIZER EROFS_FS EROFS_FS_POSIX_ACL EROFS_FS_SECURITY EROFS_FS_XATTR EROFS_FS_ZIP EVM EVM_ADD_XATTRS EVM_ATTR_FSUUID EXFAT_FS EXPORTFS_BLOCK_OPS EXT3_FS_POSIX_ACL EXT3_FS_SECURITY EXT4_FS_SECURITY F2FS_CHECK_FS F2FS_FAULT_INJECTION F2FS_FS F2FS_FS_COMPRESSION F2FS_FS_LZ4 F2FS_FS_LZ4HC F2FS_FS_LZO F2FS_FS_LZORLE F2FS_FS_POSIX_ACL F2FS_FS_SECURITY F2FS_FS_XATTR F2FS_FS_ZSTD F2FS_STAT_FS FB_DEFERRED_IO FB_SYS_COPYAREA FB_SYS_FILLRECT FB_SYS_FOPS FB_SYS_IMAGEBLIT FB_TILEBLITTING FB_VIRTUAL FDDI FIB_RULES FIREWIRE FIREWIRE_NET FIREWIRE_OHCI FIREWIRE_SBP2 FRAMEBUFFER_CONSOLE_ROTATION FRONTSWAP FS_DAX FS_DAX_PMD FS_ENCRYPTION FS_ENCRYPTION_ALGS FS_VERITY FS_VERITY_BUILTIN_SIGNATURES FTL FW_LOADER_COMPRESS FW_LOADER_USER_HELPER_FALLBACK GACT_PROB GET_FREE_REGION GFS2_FS GFS2_FS_LOCKING_DLM GOOGLE_COREBOOT_TABLE GOOGLE_FIRMWARE GOOGLE_MEMCONSOLE GOOGLE_MEMCONSOLE_COREBOOT GOOGLE_VPD GPIO_DLN2 GPIO_VIPERBOARD GREENASIA_FF GREYBUS GREYBUS_BRIDGED_PHY GREYBUS_ES2 GREYBUS_HID GREYBUS_USB GTP GVE HAVE_ARCH_USERFAULTFD_MINOR HAVE_IMA_KEXEC HDLC HDLC_CISCO HDLC_FR HDLC_PPP HDLC_RAW HDLC_RAW_ETH HDLC_X25 HDMI HFSPLUS_FS HFS_FS HIDRAW HID_ACCUTOUCH HID_ACRUX HID_ACRUX_FF HID_ALPS HID_APPLEIR HID_ASUS HID_AUREAL HID_BATTERY_STRENGTH HID_BETOP_FF HID_CMEDIA HID_CORSAIR HID_CP2112 HID_ELECOM HID_ELO HID_EMS_FF HID_GEMBIRD HID_GFRM HID_GREENASIA HID_GT683R HID_GYRATION HID_HOLTEK HID_ICADE HID_KEYTOUCH HID_KYE HID_LCPOWER HID_LED HID_LENOVO HID_LOGITECH_DJ HID_LOGITECH_HIDPP HID_MAGICMOUSE HID_MAYFLASH HID_NTI HID_NTRIG HID_ORTEK HID_PENMOUNT HID_PETALYNX HID_PICOLCD HID_PICOLCD_BACKLIGHT HID_PICOLCD_CIR HID_PICOLCD_FB HID_PICOLCD_LCD HID_PICOLCD_LEDS HID_PID HID_PLANTRONICS HID_PRIMAX HID_PRODIKEYS HID_RETRODE HID_RMI HID_ROCCAT HID_SAITEK HID_SAMSUNG HID_SENSOR_ACCEL_3D HID_SENSOR_ALS HID_SENSOR_CUSTOM_SENSOR HID_SENSOR_DEVICE_ROTATION HID_SENSOR_GYRO_3D HID_SENSOR_HUB HID_SENSOR_HUMIDITY HID_SENSOR_IIO_COMMON HID_SENSOR_IIO_TRIGGER HID_SENSOR_INCLINOMETER_3D HID_SENSOR_MAGNETOMETER_3D HID_SENSOR_PRESS HID_SENSOR_PROX HID_SENSOR_TEMP HID_SPEEDLINK HID_STEELSERIES HID_SUNPLUS HID_THINGM HID_TIVO HID_TOPSEED HID_TWINHAN HID_UCLOGIC HID_UDRAW_PS3 HID_WACOM HID_WALTOP HID_WIIMOTE HID_XINMO HID_ZYDACRON HMM_MIRROR HOLTEK_FF HOTPLUG_PCI_PCIE HPFS_FS I2C_DIOLAN_U2C I2C_DLN2 I2C_MUX_REG I2C_ROBOTFUZZ_OSIF I2C_SI4713 I2C_SLAVE_EEPROM I2C_TINY_USB I2C_VIPERBOARD IEEE802154 IEEE802154_6LOWPAN IEEE802154_ATUSB IEEE802154_DRIVERS IEEE802154_HWSIM IEEE802154_NL802154_EXPERIMENTAL IEEE802154_SOCKET IFB IMA IMA_APPRAISE IMA_APPRAISE_MODSIG IMA_DEFAULT_HASH_SHA256 IMA_LSM_RULES IMA_MEASURE_ASYMMETRIC_KEYS IMA_NG_TEMPLATE IMA_QUEUE_EARLY_BOOT_KEYS IMA_READ_POLICY IMA_WRITE_POLICY INET6_AH INET6_ESP INET6_ESPINTCP INET6_ESP_OFFLOAD INET6_IPCOMP INET6_TUNNEL INET6_XFRM_TUNNEL INET_AH INET_DCCP_DIAG INET_DIAG_DESTROY INET_ESP INET_ESPINTCP INET_ESP_OFFLOAD INET_IPCOMP INET_MPTCP_DIAG INET_RAW_DIAG INET_SCTP_DIAG INET_UDP_DIAG INET_XFRM_TUNNEL INFINIBAND INFINIBAND_ADDR_TRANS INFINIBAND_ADDR_TRANS_CONFIGFS INFINIBAND_IPOIB INFINIBAND_IPOIB_CM INFINIBAND_IPOIB_DEBUG INFINIBAND_ISER INFINIBAND_ON_DEMAND_PAGING INFINIBAND_RTRS INFINIBAND_SRP INFINIBAND_USER_ACCESS INFINIBAND_USER_MAD INFINIBAND_USER_MEM INPUT_ATI_REMOTE2 INPUT_CM109 INPUT_IMS_PCU INPUT_JOYDEV INPUT_JOYSTICK INPUT_KEYSPAN_REMOTE INPUT_LEDS INPUT_MOUSEDEV INPUT_MOUSEDEV_PSAUX INPUT_POWERMATE INPUT_UINPUT INPUT_YEALINK INTEGRITY INTEGRITY_ASYMMETRIC_KEYS INTEGRITY_AUDIT INTEGRITY_SIGNATURE INTEGRITY_TRUSTED_KEYRING IP6_NF_MATCH_AH IP6_NF_MATCH_EUI64 IP6_NF_MATCH_FRAG IP6_NF_MATCH_HL IP6_NF_MATCH_IPV6HEADER IP6_NF_MATCH_MH IP6_NF_MATCH_OPTS IP6_NF_MATCH_RPFILTER IP6_NF_MATCH_RT IP6_NF_MATCH_SRH IP6_NF_RAW IP6_NF_SECURITY IP6_NF_TARGET_HL IP6_NF_TARGET_NPT IP6_NF_TARGET_SYNPROXY IPV6_FOU IPV6_FOU_TUNNEL IPV6_GRE IPV6_ILA IPV6_MIP6 IPV6_MROUTE IPV6_MROUTE_MULTIPLE_TABLES IPV6_MULTIPLE_TABLES IPV6_OPTIMISTIC_DAD IPV6_PIMSM_V2 IPV6_ROUTER_PREF IPV6_ROUTE_INFO IPV6_RPL_LWTUNNEL IPV6_SEG6_BPF IPV6_SEG6_HMAC IPV6_SEG6_LWTUNNEL IPV6_SIT_6RD IPV6_SUBTREES IPV6_TUNNEL IPV6_VTI IPVLAN IPVLAN_L3S IPVTAP IP_ADVANCED_ROUTER IP_DCCP IP_DCCP_CCID3 IP_DCCP_TFRC_LIB IP_FIB_TRIE_STATS IP_MROUTE IP_MROUTE_COMMON IP_MROUTE_MULTIPLE_TABLES IP_NF_ARPFILTER IP_NF_ARPTABLES IP_NF_ARP_MANGLE IP_NF_MATCH_AH IP_NF_MATCH_ECN IP_NF_MATCH_RPFILTER IP_NF_MATCH_TTL IP_NF_RAW IP_NF_SECURITY IP_NF_TARGET_CLUSTERIP IP_NF_TARGET_ECN IP_NF_TARGET_NETMAP IP_NF_TARGET_REDIRECT IP_NF_TARGET_SYNPROXY IP_NF_TARGET_TTL IP_PIMSM_V1 IP_PIMSM_V2 IP_PNP_RARP IP_ROUTE_CLASSID IP_ROUTE_MULTIPATH IP_ROUTE_VERBOSE IP_SCTP IP_SET IP_SET_BITMAP_IP IP_SET_BITMAP_IPMAC IP_SET_BITMAP_PORT IP_SET_HASH_IP IP_SET_HASH_IPMAC IP_SET_HASH_IPMARK IP_SET_HASH_IPPORT IP_SET_HASH_IPPORTIP IP_SET_HASH_IPPORTNET IP_SET_HASH_MAC IP_SET_HASH_NET IP_SET_HASH_NETIFACE IP_SET_HASH_NETNET IP_SET_HASH_NETPORT IP_SET_HASH_NETPORTNET IP_SET_LIST_SET IP_VS_DH IP_VS_FO IP_VS_FTP IP_VS_IPV6 IP_VS_LBLC IP_VS_LBLCR IP_VS_LC IP_VS_MH IP_VS_NFCT IP_VS_NQ IP_VS_OVF IP_VS_PE_SIP IP_VS_PROTO_AH IP_VS_PROTO_AH_ESP IP_VS_PROTO_ESP IP_VS_PROTO_SCTP IP_VS_PROTO_TCP IP_VS_PROTO_UDP IP_VS_RR IP_VS_SED IP_VS_SH IP_VS_TWOS IP_VS_WLC IP_VS_WRR IR_IGORPLUGUSB IR_IGUANA IR_IMON IR_MCEUSB IR_REDRAT3 IR_STREAMZAP IR_TTUSBIR ISDN ISDN_CAPI_MIDDLEWARE ISO9660_FS JFFS2_CMODE_PRIORITY JFFS2_COMPRESSION_OPTIONS JFFS2_FS JFFS2_FS_POSIX_ACL JFFS2_FS_SECURITY JFFS2_FS_WRITEBUFFER JFFS2_FS_XATTR JFFS2_LZO JFFS2_RTIME JFFS2_RUBIN JFFS2_SUMMARY JFFS2_ZLIB JFS_DEBUG JFS_FS JFS_POSIX_ACL JFS_SECURITY JOLIET JOYSTICK_IFORCE JOYSTICK_IFORCE_USB JOYSTICK_XPAD JOYSTICK_XPAD_FF JOYSTICK_XPAD_LEDS KARMA_PARTITION KCOV KCOV_ENABLE_COMPARISONS KCOV_INSTRUMENT_ALL KEYS_REQUEST_CACHE KEY_DH_OPERATIONS LAPB LCD_CLASS_DEVICE MAC802154 MEDIA_RADIO_SUPPORT MEDIA_TEST_SUPPORT MFD_DLN2 MFD_VIPERBOARD MPTCP NET_IPGRE_DEMUX NFT_FWD_NETDEV NF_CONNTRACK_FTP NF_CONNTRACK_SIP NF_TABLES NF_TABLES_NETDEV PARTITION_ADVANCED RADIO_ADAPTERS RADIO_SI4713 RFKILL SND SND_SOC SOUND WAN XFRM ZONE_DEVICE] disabling configs for [BUG KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing current HEAD ecda77b46871007ab0e6c671fe9df5795dd8154a testing commit ecda77b46871007ab0e6c671fe9df5795dd8154a gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: d09d9fafe5919658567f21dc8ad2ab03147b169f9b4821ff918aea918c8db312 all runs: OK false negative chance: 0.000 # git bisect start ecda77b46871007ab0e6c671fe9df5795dd8154a 6c44e13dc284f7f4db17706ca48fd016d6b3d49a Bisecting: 788 revisions left to test after this (roughly 10 steps) [472f2497a4c8aa27220e276ff77d618bef482b2a] scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly determine whether the revision contains the guilty commit revision 6c44e13dc284f7f4db17706ca48fd016d6b3d49a crashed and is reachable testing commit 472f2497a4c8aa27220e276ff77d618bef482b2a gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: f586153aee923e7b32d91ad9e38595d2c652d2b350c3955bfc1ab8e27372a796 all runs: crashed: UBSAN: array-index-out-of-bounds in f2fs_iget representative crash: UBSAN: array-index-out-of-bounds in f2fs_iget, types: [UBSAN] # git bisect good 472f2497a4c8aa27220e276ff77d618bef482b2a Bisecting: 394 revisions left to test after this (roughly 9 steps) [e1f686930ee4b059c7baa3c3904b2401829f2589] ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer determine whether the revision contains the guilty commit revision 6c44e13dc284f7f4db17706ca48fd016d6b3d49a crashed and is reachable testing commit e1f686930ee4b059c7baa3c3904b2401829f2589 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 162eae59cc9560056a101b692d834d04976531fe05ea49e88da2bfbe15eb7289 all runs: OK false negative chance: 0.000 # git bisect bad e1f686930ee4b059c7baa3c3904b2401829f2589 Bisecting: 196 revisions left to test after this (roughly 8 steps) [f83c1b13f8154e0284448912756d0a351a1a602a] fbdev/ep93xx-fb: Do not assign to struct fb_info.dev determine whether the revision contains the guilty commit revision 6c44e13dc284f7f4db17706ca48fd016d6b3d49a crashed and is reachable testing commit f83c1b13f8154e0284448912756d0a351a1a602a gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 82493e1cf6d3ec4239dabd4f5693a694b324e58b1e911ab839655bfe52fb42ef all runs: OK false negative chance: 0.000 # git bisect bad f83c1b13f8154e0284448912756d0a351a1a602a Bisecting: 98 revisions left to test after this (roughly 7 steps) [157c46360cf3afc32c3864543301c6c3dd00b3a5] scsi: core: Fix the scsi_set_resid() documentation determine whether the revision contains the guilty commit revision 6c44e13dc284f7f4db17706ca48fd016d6b3d49a crashed and is reachable testing commit 157c46360cf3afc32c3864543301c6c3dd00b3a5 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 56bd6b84089111dfd17dc167da62fe32066409b32af5b1a795f950a55d8ec95e all runs: OK false negative chance: 0.000 # git bisect bad 157c46360cf3afc32c3864543301c6c3dd00b3a5 Bisecting: 48 revisions left to test after this (roughly 6 steps) [5fa1552877ce2b692781672a5f53bb76b8bd49f8] coresight: trbe: Fix TRBE potential sleep in atomic context determine whether the revision contains the guilty commit revision 6c44e13dc284f7f4db17706ca48fd016d6b3d49a crashed and is reachable testing commit 5fa1552877ce2b692781672a5f53bb76b8bd49f8 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: ed5c1c671a09c424bc15c06c846197a79a42a02b93159504a909dd5d24c9e407 all runs: OK false negative chance: 0.000 # git bisect bad 5fa1552877ce2b692781672a5f53bb76b8bd49f8 Bisecting: 24 revisions left to test after this (roughly 5 steps) [0294e2475092525075e1271d58f6283564a818a3] media: cec: core: add adap_unconfigured() callback determine whether the revision contains the guilty commit revision 6c44e13dc284f7f4db17706ca48fd016d6b3d49a crashed and is reachable testing commit 0294e2475092525075e1271d58f6283564a818a3 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 05e625bae80c55b62814a704a1ae942d76bb6d153208bf7d1a305dc8303425ff all runs: crashed: UBSAN: array-index-out-of-bounds in f2fs_iget representative crash: UBSAN: array-index-out-of-bounds in f2fs_iget, types: [UBSAN] # git bisect good 0294e2475092525075e1271d58f6283564a818a3 Bisecting: 12 revisions left to test after this (roughly 4 steps) [7263c39fd711da64cba94f6ebd30fcafc3b4f499] media: ov2680: Fix ov2680_bayer_order() determine whether the revision contains the guilty commit revision 0294e2475092525075e1271d58f6283564a818a3 crashed and is reachable testing commit 7263c39fd711da64cba94f6ebd30fcafc3b4f499 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 38c48ac8418f1738db653e2842a925ac0a20c0e21259bbe9710609ba7a0daafc all runs: crashed: UBSAN: array-index-out-of-bounds in f2fs_iget representative crash: UBSAN: array-index-out-of-bounds in f2fs_iget, types: [UBSAN] # git bisect good 7263c39fd711da64cba94f6ebd30fcafc3b4f499 Bisecting: 6 revisions left to test after this (roughly 3 steps) [86a41ad0128abd1014b4c30d0efd3b0bb5726bd4] media: ov2680: Fix regulators being left enabled on ov2680_power_on() errors determine whether the revision contains the guilty commit revision 0294e2475092525075e1271d58f6283564a818a3 crashed and is reachable testing commit 86a41ad0128abd1014b4c30d0efd3b0bb5726bd4 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: ec3d9aac3b18118ff6b4dc568e12656ff06cd4eb48e71960faab6539c913c2e3 all runs: crashed: UBSAN: array-index-out-of-bounds in f2fs_iget representative crash: UBSAN: array-index-out-of-bounds in f2fs_iget, types: [UBSAN] # git bisect good 86a41ad0128abd1014b4c30d0efd3b0bb5726bd4 Bisecting: 3 revisions left to test after this (roughly 2 steps) [33d4c00725b0deefdd1d25261a414456da708251] f2fs: judge whether discard_unit is section only when have CONFIG_BLK_DEV_ZONED determine whether the revision contains the guilty commit revision 86a41ad0128abd1014b4c30d0efd3b0bb5726bd4 crashed and is reachable testing commit 33d4c00725b0deefdd1d25261a414456da708251 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 06e3acde0ccdc639dae999c16f5e5793992338bfca14523b5187ec92e9731250 all runs: crashed: UBSAN: array-index-out-of-bounds in f2fs_iget representative crash: UBSAN: array-index-out-of-bounds in f2fs_iget, types: [UBSAN] # git bisect good 33d4c00725b0deefdd1d25261a414456da708251 Bisecting: 1 revision left to test after this (roughly 1 step) [0d545a8e77cbd1fbad311b18952e38e0f7672ab4] Revert "f2fs: fix to do sanity check on extent cache correctly" determine whether the revision contains the guilty commit revision 7263c39fd711da64cba94f6ebd30fcafc3b4f499 crashed and is reachable testing commit 0d545a8e77cbd1fbad311b18952e38e0f7672ab4 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 74c62928d9b2c31785047e4cfe1d27ea1261e0e7be4f3b7dc90261241e25e062 all runs: OK false negative chance: 0.000 # git bisect bad 0d545a8e77cbd1fbad311b18952e38e0f7672ab4 Bisecting: 0 revisions left to test after this (roughly 0 steps) [3f60a36ed6e37e254cb3f015ac46ea1cee66ac1e] f2fs: Only lfs mode is allowed with zoned block device feature determine whether the revision contains the guilty commit revision 7263c39fd711da64cba94f6ebd30fcafc3b4f499 crashed and is reachable testing commit 3f60a36ed6e37e254cb3f015ac46ea1cee66ac1e gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: e30d4b793e1562fcf1506f2d929305f48ab5ffba1c7e07fbc39420f974bf0066 all runs: crashed: UBSAN: array-index-out-of-bounds in f2fs_iget representative crash: UBSAN: array-index-out-of-bounds in f2fs_iget, types: [UBSAN] # git bisect good 3f60a36ed6e37e254cb3f015ac46ea1cee66ac1e 0d545a8e77cbd1fbad311b18952e38e0f7672ab4 is the first bad commit commit 0d545a8e77cbd1fbad311b18952e38e0f7672ab4 Author: Chao Yu Date: Thu Jul 20 19:29:53 2023 +0800 Revert "f2fs: fix to do sanity check on extent cache correctly" [ Upstream commit 958ccbbf1ce716d77c7cfa79ace50a421c1eed73 ] syzbot reports a f2fs bug as below: UBSAN: array-index-out-of-bounds in fs/f2fs/f2fs.h:3275:19 index 1409 is out of range for type '__le32[923]' (aka 'unsigned int[923]') Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 inline_data_addr fs/f2fs/f2fs.h:3275 [inline] __recover_inline_status fs/f2fs/inode.c:113 [inline] do_read_inode fs/f2fs/inode.c:480 [inline] f2fs_iget+0x4730/0x48b0 fs/f2fs/inode.c:604 f2fs_fill_super+0x640e/0x80c0 fs/f2fs/super.c:4601 mount_bdev+0x276/0x3b0 fs/super.c:1391 legacy_get_tree+0xef/0x190 fs/fs_context.c:611 vfs_get_tree+0x8c/0x270 fs/super.c:1519 do_new_mount+0x28f/0xae0 fs/namespace.c:3335 do_mount fs/namespace.c:3675 [inline] __do_sys_mount fs/namespace.c:3884 [inline] __se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3861 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The issue was bisected to: commit d48a7b3a72f121655d95b5157c32c7d555e44c05 Author: Chao Yu Date: Mon Jan 9 03:49:20 2023 +0000 f2fs: fix to do sanity check on extent cache correctly The root cause is we applied both v1 and v2 of the patch, v2 is the right fix, so it needs to revert v1 in order to fix reported issue. v1: commit d48a7b3a72f1 ("f2fs: fix to do sanity check on extent cache correctly") https://lore.kernel.org/lkml/20230109034920.492914-1-chao@kernel.org/ v2: commit 269d11948100 ("f2fs: fix to do sanity check on extent cache correctly") https://lore.kernel.org/lkml/20230207134808.1827869-1-chao@kernel.org/ Reported-by: syzbot+601018296973a481f302@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-f2fs-devel/000000000000fcf0690600e4d04d@google.com/ Fixes: d48a7b3a72f1 ("f2fs: fix to do sanity check on extent cache correctly") Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim Signed-off-by: Sasha Levin fs/f2fs/inode.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) accumulated error probability: 0.00 culprit signature: 74c62928d9b2c31785047e4cfe1d27ea1261e0e7be4f3b7dc90261241e25e062 parent signature: e30d4b793e1562fcf1506f2d929305f48ab5ffba1c7e07fbc39420f974bf0066 revisions tested: 19, total time: 3h49m45.778894292s (build: 1h22m49.806039173s, test: 1h45m29.8845853s) first good commit: 0d545a8e77cbd1fbad311b18952e38e0f7672ab4 Revert "f2fs: fix to do sanity check on extent cache correctly" recipients (to): ["chao@kernel.org" "jaegeuk@kernel.org" "sashal@kernel.org"] recipients (cc): []