ci2 starts bisection 2023-12-14 15:32:32.826467563 +0000 UTC m=+72915.815044392 bisecting fixing commit since cd94fe67fd3323953016b8193f5be75982da96c8 building syzkaller on 6654cf89a7909afd314ad8abd502bc0dd024112a ensuring issue is reproducible on original commit cd94fe67fd3323953016b8193f5be75982da96c8 testing commit cd94fe67fd3323953016b8193f5be75982da96c8 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 0498f15ad9e0abe1b2d1f069fc5d4da8b4554fcebb7c2722cc01be8473d9eb99 run #0: crashed: KASAN: use-after-free Read in ext4_find_extent run #1: crashed: KASAN: use-after-free Read in ext4_find_extent run #2: crashed: KASAN: use-after-free Read in ext4_find_extent run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #4: crashed: KASAN: use-after-free Read in ext4_find_extent run #5: crashed: KASAN: use-after-free Read in ext4_find_extent run #6: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #7: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #8: crashed: KASAN: use-after-free Read in ext4_find_extent run #9: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #10: crashed: KASAN: use-after-free Read in ext4_find_extent run #11: crashed: KASAN: use-after-free Read in ext4_find_extent run #12: crashed: KASAN: use-after-free Read in ext4_find_extent run #13: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #14: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #15: crashed: KASAN: use-after-free Read in ext4_find_extent run #16: crashed: KASAN: use-after-free Read in ext4_find_extent run #17: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #18: crashed: KASAN: use-after-free Read in ext4_find_extent run #19: crashed: KASAN: use-after-free Read in ext4_find_extent representative crash: KASAN: use-after-free Read in ext4_find_extent, types: [KASAN] check whether we can drop unnecessary instrumentation disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing commit cd94fe67fd3323953016b8193f5be75982da96c8 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 025db8054c4393fc83eaac8cb534564baa3cf25b3528a24e8cf2886b087651d3 all runs: crashed: KASAN: use-after-free Read in ext4_find_extent representative crash: KASAN: use-after-free Read in ext4_find_extent, types: [KASAN] the bug reproduces without the instrumentation disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed kconfig minimization: base=5179 full=6487 leaves diff=250 split chunks (needed=false): <250> split chunk #0 of len 250 into 5 parts testing without sub-chunk 1/5 disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing commit cd94fe67fd3323953016b8193f5be75982da96c8 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: f79f95325455a4da894a36c6620995004b16960140ff95e3c7b12a4531f4f437 run #0: crashed: invalid opcode in ext4_writepages run #1: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #2: crashed: KASAN: use-after-free Read in ext4_find_extent run #3: crashed: KASAN: use-after-free Read in ext4_find_extent run #4: crashed: KASAN: use-after-free Read in ext4_find_extent run #5: crashed: KASAN: use-after-free Read in ext4_find_extent run #6: crashed: KASAN: use-after-free Read in ext4_find_extent run #7: crashed: KASAN: use-after-free Read in ext4_find_extent run #8: crashed: KASAN: use-after-free Read in ext4_find_extent run #9: crashed: KASAN: use-after-free Read in ext4_find_extent representative crash: KASAN: slab-out-of-bounds Read in ext4_find_extent, types: [KASAN] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [BUG LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed testing commit cd94fe67fd3323953016b8193f5be75982da96c8 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 95d136119890998154fe81de4594c7d739f8bb623c6e863dd836696df9681759 run #0: crashed: KASAN: use-after-free Read in ext4_find_extent run #1: crashed: KASAN: use-after-free Read in ext4_find_extent run #2: crashed: KASAN: use-after-free Read in ext4_find_extent run #3: crashed: KASAN: use-after-free Read in ext4_find_extent run #4: crashed: KASAN: use-after-free Read in ext4_find_extent run #5: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #6: crashed: invalid opcode in ext4_writepages run #7: crashed: KASAN: use-after-free Read in ext4_ext_insert_extent run #8: crashed: KASAN: use-after-free Read in ext4_find_extent run #9: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent representative crash: KASAN: use-after-free Read in ext4_find_extent, types: [KASAN] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN BUG LOCKDEP], they are not needed testing commit cd94fe67fd3323953016b8193f5be75982da96c8 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 9e1e597ecd5a34f043f3f5a7702bac4793c76a3de5498a81e8b0d93f7ca40efa run #0: crashed: KASAN: use-after-free Read in ext4_find_extent run #1: crashed: KASAN: use-after-free Read in ext4_find_extent run #2: crashed: KASAN: use-after-free Read in ext4_find_extent run #3: crashed: KASAN: use-after-free Read in ext4_find_extent run #4: crashed: KASAN: use-after-free Read in ext4_find_extent run #5: crashed: KASAN: use-after-free Read in ext4_find_extent run #6: crashed: KASAN: use-after-free Read in ext4_find_extent run #7: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #8: crashed: invalid opcode in ext4_writepages run #9: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent representative crash: KASAN: use-after-free Read in ext4_find_extent, types: [KASAN] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing commit cd94fe67fd3323953016b8193f5be75982da96c8 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: fdd4efff4ac52c245c947f34fc218268a0d709a3125740d3ece57c4d649450d2 run #0: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #1: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #2: crashed: KASAN: use-after-free Read in ext4_find_extent run #3: crashed: invalid opcode in ext4_writepages run #4: crashed: KASAN: use-after-free Read in ext4_find_extent run #5: crashed: KASAN: use-after-free Read in ext4_find_extent run #6: crashed: invalid opcode in ext4_split_extent_at run #7: crashed: KASAN: use-after-free Read in ext4_find_extent run #8: crashed: KASAN: use-after-free Read in ext4_find_extent run #9: crashed: KASAN: use-after-free Read in ext4_find_extent representative crash: KASAN: slab-out-of-bounds Read in ext4_find_extent, types: [KASAN] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing commit cd94fe67fd3323953016b8193f5be75982da96c8 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 failed building cd94fe67fd3323953016b8193f5be75982da96c8: net/socket.c:1225: undefined reference to `wext_handle_ioctl' net/socket.c:3420: undefined reference to `compat_wext_handle_ioctl' net/core/net-procfs.c:329: undefined reference to `wext_proc_init' net/core/net-procfs.c:345: undefined reference to `wext_proc_exit' minimized to 50 configs; suspects: [HID_ZEROPLUS USB_NET_CDC_MBIM USB_NET_CDC_SUBSET USB_NET_CDC_SUBSET_ENABLE USB_NET_DM9601 USB_NET_GL620A USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_PURELIFI WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_SILABS WLAN_VENDOR_ZYDAS X86_X32_ABI ZEROPLUS_FF] disabling configs for [UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing current HEAD d8d2b95fd0b415ea700d02348ac852f463908950 testing commit d8d2b95fd0b415ea700d02348ac852f463908950 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: f0ab9c510a2be615fb6bddfafaeb27174bf1b85d840b40e2623fec10892d59ef run #0: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #1: crashed: KASAN: use-after-free Read in ext4_find_extent run #2: crashed: KASAN: use-after-free Read in ext4_find_extent run #3: crashed: KASAN: use-after-free Read in ext4_find_extent run #4: crashed: KASAN: use-after-free Read in ext4_find_extent run #5: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #6: crashed: invalid opcode in ext4_writepages run #7: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #8: crashed: KASAN: slab-out-of-bounds Read in ext4_find_extent run #9: crashed: KASAN: use-after-free Read in ext4_find_extent representative crash: KASAN: slab-out-of-bounds Read in ext4_find_extent, types: [KASAN] crash still not fixed/happens on the oldest tested release revisions tested: 7, total time: 57m32.948314999s (build: 26m4.109306987s, test: 28m26.099478997s) crash still not fixed or there were kernel test errors commit msg: ANDROID: ABI: update symbol list for galaxy crash: KASAN: slab-out-of-bounds Read in ext4_find_extent ================================================================== BUG: KASAN: slab-out-of-bounds in ext4_ext_binsearch fs/ext4/extents.c:837 [inline] BUG: KASAN: slab-out-of-bounds in ext4_find_extent+0xb60/0xd10 fs/ext4/extents.c:953 Read of size 4 at addr ffff8881102fffb4 by task kworker/u4:1/10 CPU: 1 PID: 10 Comm: kworker/u4:1 Not tainted 6.1.57-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 Workqueue: writeback wb_workfn (flush-7:0) Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x105/0x148 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:316 [inline] print_report+0x158/0x4e0 mm/kasan/report.c:427 kasan_report+0x13c/0x170 mm/kasan/report.c:531 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:350 ext4_ext_binsearch fs/ext4/extents.c:837 [inline] ext4_find_extent+0xb60/0xd10 fs/ext4/extents.c:953 ext4_ext_map_blocks+0x25d/0x64d0 fs/ext4/extents.c:4103 ext4_map_blocks+0x821/0x1890 fs/ext4/inode.c:651 mpage_map_one_extent fs/ext4/inode.c:2411 [inline] mpage_map_and_submit_extent fs/ext4/inode.c:2464 [inline] ext4_writepages+0x13f4/0x3120 fs/ext4/inode.c:2832 do_writepages+0x338/0x5b0 mm/page-writeback.c:2472 __writeback_single_inode+0x73/0x7a0 fs/fs-writeback.c:1590 writeback_sb_inodes+0x881/0x1500 fs/fs-writeback.c:1881 wb_writeback+0x357/0x810 fs/fs-writeback.c:2055 wb_do_writeback fs/fs-writeback.c:2198 [inline] wb_workfn+0x37d/0xdf0 fs/fs-writeback.c:2238 process_one_work+0x6de/0xd00 kernel/workqueue.c:2299 worker_thread+0x892/0xf20 kernel/workqueue.c:2446 kthread+0x215/0x270 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 Allocated by task 99: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:52 kasan_save_alloc_info+0x1f/0x30 mm/kasan/generic.c:505 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:333 kasan_slab_alloc include/linux/kasan.h:202 [inline] slab_post_alloc_hook+0x59/0x270 mm/slab.h:768 slab_alloc_node mm/slub.c:3421 [inline] slab_alloc mm/slub.c:3429 [inline] __kmem_cache_alloc_lru mm/slub.c:3436 [inline] kmem_cache_alloc+0x175/0x2c0 mm/slub.c:3445 skb_clone+0x19a/0x2e0 net/core/skbuff.c:1660 do_one_broadcast net/netlink/af_netlink.c:1456 [inline] netlink_broadcast+0x54c/0xdd0 net/netlink/af_netlink.c:1522 uevent_net_broadcast_untagged lib/kobject_uevent.c:331 [inline] kobject_uevent_net_broadcast+0x385/0x460 lib/kobject_uevent.c:409 kobject_uevent_env+0x3be/0x4f0 lib/kobject_uevent.c:593 kobject_synth_uevent+0x76e/0x900 lib/kobject_uevent.c:208 store_uevent+0x16/0x30 kernel/module/main.c:925 module_attr_store+0x52/0x70 kernel/params.c:919 sysfs_kf_write+0x101/0x120 fs/sysfs/file.c:136 kernfs_fop_write_iter+0x288/0x380 fs/kernfs/file.c:330 call_write_iter include/linux/fs.h:2215 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0xa13/0xd40 fs/read_write.c:584 ksys_write+0x15c/0x240 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x76/0x80 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The buggy address belongs to the object at ffff8881102ffdc0 which belongs to the cache skbuff_head_cache of size 248 The buggy address is located 252 bytes to the right of 248-byte region [ffff8881102ffdc0, ffff8881102ffeb8) The buggy address belongs to the physical page: page:ffffea000440bfc0 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8881102ffdc0 pfn:0x1102ff flags: 0x4000000000000200(slab|zone=1) raw: 4000000000000200 ffffea000440d0c8 ffffea000440c088 ffff888100216d80 raw: ffff8881102ffdc0 00000000000c0006 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 99, tgid 99 (udevadm), ts 4037388495, free_ts 0 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook mm/page_alloc.c:2566 [inline] prep_new_page+0x512/0x5e0 mm/page_alloc.c:2573 get_page_from_freelist+0x288b/0x2910 mm/page_alloc.c:4397 __alloc_pages+0x39f/0x780 mm/page_alloc.c:5684 alloc_slab_page+0x6c/0xf0 allocate_slab mm/slub.c:1962 [inline] new_slab+0x7b/0x370 mm/slub.c:2015 ___slab_alloc+0x611/0x9a0 mm/slub.c:3203 __slab_alloc+0x52/0x90 mm/slub.c:3302 slab_alloc_node mm/slub.c:3387 [inline] slab_alloc mm/slub.c:3429 [inline] __kmem_cache_alloc_lru mm/slub.c:3436 [inline] kmem_cache_alloc+0x1b9/0x2c0 mm/slub.c:3445 skb_clone+0x19a/0x2e0 net/core/skbuff.c:1660 do_one_broadcast net/netlink/af_netlink.c:1456 [inline] netlink_broadcast+0x54c/0xdd0 net/netlink/af_netlink.c:1522 uevent_net_broadcast_untagged lib/kobject_uevent.c:331 [inline] kobject_uevent_net_broadcast+0x385/0x460 lib/kobject_uevent.c:409 kobject_uevent_env+0x3be/0x4f0 lib/kobject_uevent.c:593 kobject_synth_uevent+0x76e/0x900 lib/kobject_uevent.c:208 store_uevent+0x16/0x30 kernel/module/main.c:925 module_attr_store+0x52/0x70 kernel/params.c:919 sysfs_kf_write+0x101/0x120 fs/sysfs/file.c:136 page_owner free stack trace missing Memory state around the buggy address: ffff8881102ffe80: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc ffff8881102fff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8881102fff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff888110300000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888110300080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc ================================================================== invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 10 Comm: kworker/u4:1 Tainted: G B 6.1.57-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 Workqueue: writeback wb_workfn (flush-7:0) RIP: 0010:mpage_map_one_extent fs/ext4/inode.c:2423 [inline] RIP: 0010:mpage_map_and_submit_extent fs/ext4/inode.c:2464 [inline] RIP: 0010:ext4_writepages+0x310e/0x3120 fs/ext4/inode.c:2832 Code: e9 45 89 f0 e8 a3 d0 06 00 65 ff 0d 74 2b 31 7e 49 bf 00 00 00 00 00 fc ff df 0f 85 7e fb ff ff e8 ff 22 2f ff e9 74 fb ff ff <0f> 0b 0f 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 55 48 89 e5 RSP: 0018:ffffc900000a7060 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 000000000000042b RCX: 1ffff92000014e6a RDX: 0000000000000001 RSI: 0000000000000008 RDI: 0000000000000001 RBP: ffffc900000a7450 R08: dffffc0000000000 R09: ffffed10200b1695 R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88810e4271f0 R13: ffffc900000a7320 R14: ffff88810058b4e0 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8881f7300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd4d6fcf98 CR3: 0000000109a08000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: do_writepages+0x338/0x5b0 mm/page-writeback.c:2472 __writeback_single_inode+0x73/0x7a0 fs/fs-writeback.c:1590 writeback_sb_inodes+0x881/0x1500 fs/fs-writeback.c:1881 wb_writeback+0x357/0x810 fs/fs-writeback.c:2055 wb_do_writeback fs/fs-writeback.c:2198 [inline] wb_workfn+0x37d/0xdf0 fs/fs-writeback.c:2238 process_one_work+0x6de/0xd00 kernel/workqueue.c:2299 worker_thread+0x892/0xf20 kernel/workqueue.c:2446 kthread+0x215/0x270 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:mpage_map_one_extent fs/ext4/inode.c:2423 [inline] RIP: 0010:mpage_map_and_submit_extent fs/ext4/inode.c:2464 [inline] RIP: 0010:ext4_writepages+0x310e/0x3120 fs/ext4/inode.c:2832 Code: e9 45 89 f0 e8 a3 d0 06 00 65 ff 0d 74 2b 31 7e 49 bf 00 00 00 00 00 fc ff df 0f 85 7e fb ff ff e8 ff 22 2f ff e9 74 fb ff ff <0f> 0b 0f 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 55 48 89 e5 RSP: 0018:ffffc900000a7060 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 000000000000042b RCX: 1ffff92000014e6a RDX: 0000000000000001 RSI: 0000000000000008 RDI: 0000000000000001 RBP: ffffc900000a7450 R08: dffffc0000000000 R09: ffffed10200b1695 R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88810e4271f0 R13: ffffc900000a7320 R14: ffff88810058b4e0 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8881f7300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd4d6fcf98 CR3: 0000000109a08000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400