ci starts bisection 2023-04-18 11:15:36.554761165 +0000 UTC m=+53581.051262793 bisecting fixing commit since 3ac88fa4605ec98e545fb3ad0154f575fda2de5f building syzkaller on 851bc19a3c4615f6653414b6deec9b9e84c8ca58 ensuring issue is reproducible on original commit 3ac88fa4605ec98e545fb3ad0154f575fda2de5f testing commit 3ac88fa4605ec98e545fb3ad0154f575fda2de5f gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 560e622c1ce54b7706257dbd5a9704c3fffc94bca3523678b4641255bfef57a4 run #0: crashed: KASAN: out-of-bounds Write in end_buffer_read_sync run #1: crashed: INFO: rcu detected stall in corrupted run #2: crashed: INFO: rcu detected stall in corrupted run #3: crashed: INFO: rcu detected stall in corrupted run #4: crashed: INFO: rcu detected stall in corrupted run #5: crashed: INFO: rcu detected stall in corrupted run #6: crashed: INFO: rcu detected stall in corrupted run #7: crashed: INFO: rcu detected stall in corrupted run #8: crashed: INFO: rcu detected stall in corrupted run #9: crashed: INFO: rcu detected stall in corrupted run #10: crashed: INFO: rcu detected stall in corrupted run #11: crashed: INFO: rcu detected stall in corrupted run #12: crashed: INFO: rcu detected stall in corrupted run #13: crashed: INFO: rcu detected stall in corrupted run #14: crashed: KASAN: out-of-bounds Write in end_buffer_read_sync run #15: crashed: KASAN: out-of-bounds Write in end_buffer_read_sync run #16: crashed: BUG: unable to handle kernel paging request in invalidate_inode_pages2_range run #17: crashed: KASAN: out-of-bounds Write in end_buffer_read_sync run #18: crashed: BUG: unable to handle kernel paging request in invalidate_inode_pages2_range run #19: crashed: BUG: unable to handle kernel paging request in invalidate_inode_pages2_range testing current HEAD 6a8f57ae2eb07ab39a6f0ccad60c760743051026 testing commit 6a8f57ae2eb07ab39a6f0ccad60c760743051026 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 2b22effc40dda0bfc6e319d1a32769fbdd2fc1515274d71e003ac876bb3c24e4 run #0: crashed: KASAN: out-of-bounds Write in end_buffer_read_sync run #1: crashed: KASAN: out-of-bounds Write in end_buffer_read_sync run #2: crashed: KASAN: out-of-bounds Write in end_buffer_read_sync run #3: crashed: WARNING: nested lock was not taken in filemap_get_read_batch run #4: crashed: KASAN: out-of-bounds Write in end_buffer_read_sync run #5: crashed: KASAN: out-of-bounds Write in end_buffer_read_sync run #6: crashed: KASAN: out-of-bounds Write in end_buffer_read_sync run #7: crashed: KASAN: out-of-bounds Write in end_buffer_read_sync run #8: crashed: kernel panic: stack is corrupted in validate_chain run #9: crashed: KASAN: out-of-bounds Write in end_buffer_read_sync revisions tested: 2, total time: 33m2.332247211s (build: 18m27.602988828s, test: 13m37.865040703s) the crash still happens on HEAD commit msg: Linux 6.3-rc7 crash: KASAN: out-of-bounds Write in end_buffer_read_sync ================================================================== BUG: KASAN: out-of-bounds in instrument_atomic_read_write include/linux/instrumented.h:102 [inline] BUG: KASAN: out-of-bounds in atomic_dec include/linux/atomic/atomic-instrumented.h:257 [inline] BUG: KASAN: out-of-bounds in put_bh include/linux/buffer_head.h:323 [inline] BUG: KASAN: out-of-bounds in end_buffer_read_sync+0x89/0x90 fs/buffer.c:161 Write of size 4 at addr ffffc900059671a0 by task ksoftirqd/0/15 CPU: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 6.3.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x167/0x220 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:319 [inline] print_report+0x163/0x540 mm/kasan/report.c:430 kasan_report+0x176/0x1b0 mm/kasan/report.c:536 kasan_check_range+0x283/0x290 mm/kasan/generic.c:187 instrument_atomic_read_write include/linux/instrumented.h:102 [inline] atomic_dec include/linux/atomic/atomic-instrumented.h:257 [inline] put_bh include/linux/buffer_head.h:323 [inline] end_buffer_read_sync+0x89/0x90 fs/buffer.c:161 end_bio_bh_io_sync+0x8d/0xe0 fs/buffer.c:2703 req_bio_endio block/blk-mq.c:795 [inline] blk_update_request+0x3a3/0x1000 block/blk-mq.c:927 blk_mq_end_request+0x39/0x60 block/blk-mq.c:1054 blk_complete_reqs block/blk-mq.c:1132 [inline] blk_done_softirq+0x83/0x120 block/blk-mq.c:1137 __do_softirq+0x2ab/0x908 kernel/softirq.c:571 run_ksoftirqd+0xc5/0x120 kernel/softirq.c:934 smpboot_thread_fn+0x534/0x890 kernel/smpboot.c:164 kthread+0x232/0x2b0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 The buggy address belongs to the virtual mapping at [ffffc90005960000, ffffc90005969000) created by: copy_process+0x3d5/0x3b10 kernel/fork.c:2098 The buggy address belongs to the physical page: page:ffffea00009cbd80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x272f6 memcg:ffff8880167ed882 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff ffff8880167ed882 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102dc2(GFP_HIGHUSER|__GFP_NOWARN|__GFP_ZERO), pid 9299, tgid 9299 (syz-executor.4), ts 268990501859, free_ts 268462913128 prep_new_page mm/page_alloc.c:2553 [inline] get_page_from_freelist+0x3246/0x33c0 mm/page_alloc.c:4326 __alloc_pages+0x255/0x670 mm/page_alloc.c:5592 vm_area_alloc_pages mm/vmalloc.c:2953 [inline] __vmalloc_area_node mm/vmalloc.c:3029 [inline] __vmalloc_node_range+0x7cc/0x10d0 mm/vmalloc.c:3201 alloc_thread_stack_node kernel/fork.c:311 [inline] dup_task_struct+0x575/0x690 kernel/fork.c:982 copy_process+0x3d5/0x3b10 kernel/fork.c:2098 kernel_clone+0x19a/0x5f0 kernel/fork.c:2682 __do_sys_clone kernel/fork.c:2823 [inline] __se_sys_clone kernel/fork.c:2807 [inline] __x64_sys_clone+0x230/0x280 kernel/fork.c:2807 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1454 [inline] free_pcp_prepare mm/page_alloc.c:1504 [inline] free_unref_page_prepare+0xe2f/0xe70 mm/page_alloc.c:3388 free_unref_page+0x37/0x3f0 mm/page_alloc.c:3483 mm_free_pgd kernel/fork.c:737 [inline] __mmdrop+0xad/0x2e0 kernel/fork.c:790 mmdrop include/linux/sched/mm.h:50 [inline] mmdrop_sched include/linux/sched/mm.h:78 [inline] finish_task_switch+0x202/0x610 kernel/sched/core.c:5211 context_switch kernel/sched/core.c:5310 [inline] __schedule+0x171f/0x45f0 kernel/sched/core.c:6625 schedule+0xc3/0x180 kernel/sched/core.c:6701 do_nanosleep+0x193/0x4d0 kernel/time/hrtimer.c:2044 hrtimer_nanosleep+0x1f2/0x400 kernel/time/hrtimer.c:2097 __do_sys_clock_nanosleep kernel/time/posix-timers.c:1277 [inline] __se_sys_clock_nanosleep+0x2a2/0x310 kernel/time/posix-timers.c:1254 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Memory state around the buggy address: ffffc90005967080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffc90005967100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffc90005967180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffffc90005967200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffc90005967280: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================