ci2 starts bisection 2024-06-29 10:39:22.317118969 +0000 UTC m=+75712.815461873 bisecting fixing commit since ca87e77a2ef8b298aa9f69658d5898e72ee450fe building syzkaller on f3921d4d63f97d1f1fb49a69ea85744bb7ef184b ensuring issue is reproducible on original commit ca87e77a2ef8b298aa9f69658d5898e72ee450fe testing commit ca87e77a2ef8b298aa9f69658d5898e72ee450fe gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 45e03d270b3ece5673ca814e466fb5175dfb6056f144d5ba29b0a21525910251 run #0: crashed: KASAN: use-after-free Read in ext4_search_dir run #1: crashed: KASAN: use-after-free Read in ext4_search_dir run #2: crashed: KASAN: use-after-free Read in ext4_search_dir run #3: crashed: KASAN: use-after-free Read in ext4_search_dir run #4: crashed: KASAN: use-after-free Read in ext4_search_dir run #5: crashed: KASAN: use-after-free Read in ext4_search_dir run #6: crashed: KASAN: use-after-free Read in ext4_search_dir run #7: crashed: KASAN: use-after-free Read in ext4_search_dir run #8: crashed: KASAN: use-after-free Read in ext4_search_dir run #9: crashed: KASAN: use-after-free Read in ext4_search_dir run #10: crashed: KASAN: use-after-free Read in ext4_search_dir run #11: crashed: KASAN: out-of-bounds Read in ext4_search_dir run #12: crashed: KASAN: use-after-free Read in ext4_search_dir run #13: crashed: KASAN: use-after-free Read in ext4_search_dir run #14: crashed: KASAN: use-after-free Read in ext4_search_dir run #15: crashed: KASAN: use-after-free Read in ext4_search_dir run #16: crashed: KASAN: use-after-free Read in ext4_search_dir run #17: crashed: KASAN: use-after-free Read in ext4_search_dir run #18: crashed: KASAN: use-after-free Read in ext4_search_dir run #19: crashed: KASAN: use-after-free Read in ext4_search_dir representative crash: KASAN: use-after-free Read in ext4_search_dir, types: [KASAN] check whether we can drop unnecessary instrumentation disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing commit ca87e77a2ef8b298aa9f69658d5898e72ee450fe gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 66211abc3d46c25ffe121e459b3fc9e21d1a9f6f218b56b0a5ffe3c3f60fac1e run #0: crashed: KASAN: use-after-free Read in ext4_search_dir run #1: crashed: KASAN: out-of-bounds Read in ext4_search_dir run #2: crashed: KASAN: use-after-free Read in ext4_search_dir run #3: crashed: KASAN: use-after-free Read in ext4_search_dir run #4: crashed: KASAN: use-after-free Read in ext4_search_dir run #5: crashed: KASAN: use-after-free Read in ext4_search_dir run #6: crashed: KASAN: use-after-free Read in ext4_search_dir run #7: crashed: KASAN: use-after-free Read in ext4_search_dir run #8: crashed: KASAN: out-of-bounds Read in ext4_search_dir run #9: crashed: KASAN: use-after-free Read in ext4_search_dir representative crash: KASAN: use-after-free Read in ext4_search_dir, types: [KASAN] the bug reproduces without the instrumentation disabling configs for [BUG LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed kconfig minimization: base=3820 full=7523 leaves diff=1995 split chunks (needed=false): <1995> split chunk #0 of len 1995 into 5 parts testing without sub-chunk 1/5 disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing commit ca87e77a2ef8b298aa9f69658d5898e72ee450fe gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 98409bec48c2d25ac6666da3908b7a051cfdfcbab50a61077f9cb74ffcfe75a0 all runs: crashed: KASAN: use-after-free Read in ext4_search_dir representative crash: KASAN: use-after-free Read in ext4_search_dir, types: [KASAN] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed testing commit ca87e77a2ef8b298aa9f69658d5898e72ee450fe gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 48d1d15e0691548892c6e41624bc6f807a7fc019f483e760ea2ab7e14d085b4f run #0: crashed: KASAN: use-after-free Read in ext4_search_dir run #1: crashed: KASAN: use-after-free Read in ext4_search_dir run #2: crashed: KASAN: use-after-free Read in ext4_search_dir run #3: crashed: KASAN: use-after-free Read in ext4_search_dir run #4: crashed: KASAN: use-after-free Read in ext4_search_dir run #5: crashed: KASAN: use-after-free Read in ext4_search_dir run #6: crashed: KASAN: use-after-free Read in ext4_search_dir run #7: crashed: KASAN: use-after-free Read in ext4_search_dir run #8: crashed: KASAN: slab-out-of-bounds Read in ext4_search_dir run #9: crashed: KASAN: use-after-free Read in ext4_search_dir representative crash: KASAN: use-after-free Read in ext4_search_dir, types: [KASAN] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing commit ca87e77a2ef8b298aa9f69658d5898e72ee450fe gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 4a4b6479db7c1f3ee05332060119b67ad8809e5f3bf43e3991a524f79a0be699 run #0: crashed: KASAN: use-after-free Read in ext4_search_dir run #1: crashed: KASAN: use-after-free Read in ext4_search_dir run #2: crashed: KASAN: slab-out-of-bounds Read in ext4_search_dir run #3: crashed: KASAN: use-after-free Read in ext4_search_dir run #4: crashed: KASAN: use-after-free Read in ext4_search_dir run #5: crashed: KASAN: use-after-free Read in ext4_search_dir run #6: crashed: KASAN: use-after-free Read in ext4_search_dir run #7: crashed: KASAN: use-after-free Read in ext4_search_dir run #8: crashed: KASAN: use-after-free Read in ext4_search_dir run #9: crashed: KASAN: use-after-free Read in ext4_search_dir representative crash: KASAN: use-after-free Read in ext4_search_dir, types: [KASAN] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing commit ca87e77a2ef8b298aa9f69658d5898e72ee450fe gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 1de6d6f13207b6406927eb1f13cfc5f7b38b2d1573dd049ced681995f4504062 run #0: crashed: KASAN: use-after-free Read in ext4_search_dir run #1: crashed: KASAN: use-after-free Read in ext4_search_dir run #2: crashed: KASAN: use-after-free Read in ext4_search_dir run #3: crashed: KASAN: use-after-free Read in ext4_search_dir run #4: crashed: KASAN: use-after-free Read in ext4_search_dir run #5: crashed: KASAN: use-after-free Read in ext4_search_dir run #6: crashed: KASAN: out-of-bounds Read in ext4_search_dir run #7: crashed: KASAN: use-after-free Read in ext4_search_dir run #8: crashed: KASAN: use-after-free Read in ext4_search_dir run #9: crashed: KASAN: use-after-free Read in ext4_search_dir representative crash: KASAN: use-after-free Read in ext4_search_dir, types: [KASAN] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed testing commit ca87e77a2ef8b298aa9f69658d5898e72ee450fe gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 0cc71571148aa54329d5726930eb8d46efdef51407c2253bf70512abbc8cf58d run #0: crashed: KASAN: use-after-free Read in ext4_search_dir run #1: crashed: KASAN: use-after-free Read in ext4_search_dir run #2: crashed: KASAN: use-after-free Read in ext4_search_dir run #3: crashed: KASAN: use-after-free Read in ext4_search_dir run #4: crashed: KASAN: use-after-free Read in ext4_search_dir run #5: crashed: KASAN: use-after-free Read in ext4_search_dir run #6: crashed: KASAN: use-after-free Read in ext4_search_dir run #7: crashed: KASAN: use-after-free Read in ext4_search_dir run #8: crashed: KASAN: use-after-free Read in ext4_search_dir run #9: crashed: KASAN: slab-out-of-bounds Read in ext4_search_dir representative crash: KASAN: use-after-free Read in ext4_search_dir, types: [KASAN] the chunk can be dropped disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing current HEAD 99e6a620de00b96f059c9e7f14b5795ca0c6b125 testing commit 99e6a620de00b96f059c9e7f14b5795ca0c6b125 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 094ae6e9c1e6b7f68840314418263831c67d1e2ba2ab40becb8213a86bbc7cc2 all runs: crashed: KASAN: use-after-free Read in ext4_search_dir representative crash: KASAN: use-after-free Read in ext4_search_dir, types: [KASAN] crash still not fixed/happens on the oldest tested release revisions tested: 8, total time: 1h46m33.714185067s (build: 1h13m33.846478262s, test: 30m18.673656923s) crash still not fixed or there were kernel test errors commit msg: Linux 6.1.96 crash: KASAN: use-after-free Read in ext4_search_dir loop0: detected capacity change from 0 to 512 EXT4-fs: Ignoring removed bh option EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem EXT4-fs (loop0): 1 truncate cleaned up EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. ================================================================== BUG: KASAN: use-after-free in ext4_search_dir+0x148/0x250 fs/ext4/namei.c:1543 Read of size 1 at addr ffff88812352f3ed by task syz-executor.0/1412 CPU: 1 PID: 1412 Comm: syz-executor.0 Not tainted 6.1.96-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xf4/0x251 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x15f/0x4f0 mm/kasan/report.c:395 kasan_report+0x136/0x160 mm/kasan/report.c:495 ext4_search_dir+0x148/0x250 fs/ext4/namei.c:1543 ext4_find_inline_entry+0x367/0x540 fs/ext4/inline.c:1722 __ext4_find_entry+0x2dc/0x1a10 fs/ext4/namei.c:1616 ext4_lookup_entry fs/ext4/namei.c:1771 [inline] ext4_lookup+0x1ab/0x5f0 fs/ext4/namei.c:1839 lookup_open fs/namei.c:3462 [inline] open_last_lookups fs/namei.c:3552 [inline] path_openat+0xdb6/0x2410 fs/namei.c:3782 do_filp_open+0x226/0x430 fs/namei.c:3812 do_sys_openat2+0x10b/0x420 fs/open.c:1318 do_sys_open fs/open.c:1334 [inline] __do_sys_open fs/open.c:1342 [inline] __se_sys_open fs/open.c:1338 [inline] __x64_sys_open+0x1eb/0x240 fs/open.c:1338 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3b/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fb4167d7b29 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fb41635a0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 RAX: ffffffffffffffda RBX: 00007fb4168f6f80 RCX: 00007fb4167d7b29 RDX: 0000000000000000 RSI: 0000000000141042 RDI: 0000000020000100 RBP: 00007fb41682347a R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000006 R14: 00007fb4168f6f80 R15: 00007ffde665b1f8 The buggy address belongs to the physical page: page:ffffea00048d4bc0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x12352f flags: 0x200000000000000(node=0|zone=2) raw: 0200000000000000 ffffea00048d9548 ffffea00048d4588 0000000000000000 raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 1408, tgid 1407 (syz-executor.0), ts 52620810720, free_ts 52706549767 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x286/0x2b0 mm/page_alloc.c:2513 prep_new_page mm/page_alloc.c:2520 [inline] get_page_from_freelist+0x2ba7/0x2de0 mm/page_alloc.c:4279 __alloc_pages+0x251/0x640 mm/page_alloc.c:5547 vma_alloc_folio+0x689/0x870 mm/mempolicy.c:2243 shmem_alloc_folio mm/shmem.c:1589 [inline] shmem_alloc_and_acct_folio mm/shmem.c:1613 [inline] shmem_get_folio_gfp+0x7af/0x23b0 mm/shmem.c:1941 shmem_get_folio mm/shmem.c:2072 [inline] shmem_write_begin+0x159/0x400 mm/shmem.c:2559 generic_perform_write+0x2f1/0x530 mm/filemap.c:3817 __generic_file_write_iter+0x13e/0x2f0 mm/filemap.c:3945 generic_file_write_iter+0x99/0x230 mm/filemap.c:3977 call_write_iter include/linux/fs.h:2265 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x9c2/0xcf0 fs/read_write.c:584 ksys_write+0x15f/0x240 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3b/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1440 [inline] free_pcp_prepare mm/page_alloc.c:1490 [inline] free_unref_page_prepare+0xca9/0xd80 mm/page_alloc.c:3358 free_unref_page_list+0xaa/0x690 mm/page_alloc.c:3499 release_pages+0x1763/0x1900 mm/swap.c:1055 __pagevec_release+0x62/0xd0 mm/swap.c:1075 pagevec_release include/linux/pagevec.h:71 [inline] folio_batch_release include/linux/pagevec.h:135 [inline] shmem_undo_range+0x66b/0x1b00 mm/shmem.c:946 shmem_truncate_range mm/shmem.c:1062 [inline] shmem_evict_inode+0x354/0x860 mm/shmem.c:1171 evict+0x263/0x630 fs/inode.c:666 __dentry_kill+0x380/0x5d0 fs/dcache.c:607 dentry_kill+0xbb/0x1e0 dput+0x154/0x2d0 fs/dcache.c:914 __fput+0x4bd/0x700 fs/file_table.c:328 task_work_run+0x206/0x280 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xa9/0xc0 kernel/entry/common.c:177 exit_to_user_mode_prepare+0x64/0xb0 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x27/0x1b0 kernel/entry/common.c:303 do_syscall_64+0x47/0x80 arch/x86/entry/common.c:87 Memory state around the buggy address: ffff88812352f280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88812352f300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff88812352f380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88812352f400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88812352f480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================