ci2 starts bisection 2023-12-21 23:06:24.527646641 +0000 UTC m=+56750.676143708
bisecting fixing commit since bf4ad6fa4e5332e53913b073d0219319a4091619
building syzkaller on 2b9ba477a18ed0cc53e6b29a9641292709a7ba24
ensuring issue is reproducible on original commit bf4ad6fa4e5332e53913b073d0219319a4091619
testing commit bf4ad6fa4e5332e53913b073d0219319a4091619 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 3ee19f2be8c5250da66d3dcef7fb0d462742b6e40cc5cf47fe1169372c6dc720
all runs: crashed: KASAN: stack-out-of-bounds Read in profile_pc
representative crash: KASAN: stack-out-of-bounds Read in profile_pc, types: [KASAN]
check whether we can drop unnecessary instrumentation
disabling configs for [UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed
testing commit bf4ad6fa4e5332e53913b073d0219319a4091619 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: c714dd5d88d470beb49cc1e36e75cb2742b4cbe17073e68621fe5597c0fac69e
all runs: crashed: KASAN: stack-out-of-bounds Read in profile_pc
representative crash: KASAN: stack-out-of-bounds Read in profile_pc, types: [KASAN]
the bug reproduces without the instrumentation
disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed
kconfig minimization: base=3820 full=7524 leaves diff=1994
split chunks (needed=false): <1994>
split chunk #0 of len 1994 into 5 parts
testing without sub-chunk 1/5
disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed
testing commit bf4ad6fa4e5332e53913b073d0219319a4091619 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 1b798a09ddce08d2cea74591e900eeee4b7579b1ab29116af2d2789fd3ceb1fe
all runs: crashed: KASAN: stack-out-of-bounds Read in profile_pc
representative crash: KASAN: stack-out-of-bounds Read in profile_pc, types: [KASAN]
the chunk can be dropped
testing without sub-chunk 2/5
disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed
testing commit bf4ad6fa4e5332e53913b073d0219319a4091619 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 51555a5b8a8e21c92236a0d77f7c5f414c51e2682c91698b1d0e991b05796811
all runs: crashed: KASAN: stack-out-of-bounds Read in profile_pc
representative crash: KASAN: stack-out-of-bounds Read in profile_pc, types: [KASAN]
the chunk can be dropped
testing without sub-chunk 3/5
disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed
testing commit bf4ad6fa4e5332e53913b073d0219319a4091619 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: a57ca416cd53bc904cf7a8d80dfa8a44dee085bf250240914f6c1f491f43509c
all runs: crashed: KASAN: stack-out-of-bounds Read in profile_pc
representative crash: KASAN: stack-out-of-bounds Read in profile_pc, types: [KASAN]
the chunk can be dropped
testing without sub-chunk 4/5
disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed
testing commit bf4ad6fa4e5332e53913b073d0219319a4091619 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 70ccb20083a528c65ad92546b2c1e2614578cdbf0e22d7a54ece5ff3d30424d1
all runs: crashed: KASAN: stack-out-of-bounds Read in profile_pc
representative crash: KASAN: stack-out-of-bounds Read in profile_pc, types: [KASAN]
the chunk can be dropped
testing without sub-chunk 5/5
disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed
testing commit bf4ad6fa4e5332e53913b073d0219319a4091619 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 921b5663f320944497217893b0e584fb96f6e4d554deb04411f1633acf5bc7be
all runs: crashed: KASAN: stack-out-of-bounds Read in profile_pc
representative crash: KASAN: stack-out-of-bounds Read in profile_pc, types: [KASAN]
the chunk can be dropped
disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN BUG LOCKDEP], they are not needed
testing current HEAD 4aa6747d935281df8a1888feeb6e22e0097d0b86
testing commit 4aa6747d935281df8a1888feeb6e22e0097d0b86 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 84531aeec11eb36f0e671e0354524b6017ea7af00869ae621dcd1d7d1a96793c
all runs: crashed: KASAN: stack-out-of-bounds Read in profile_pc
representative crash: KASAN: stack-out-of-bounds Read in profile_pc, types: [KASAN]
crash still not fixed/happens on the oldest tested release
revisions tested: 8, total time: 55m7.259663918s (build: 29m4.377038518s, test: 23m33.229813008s)
crash still not fixed or there were kernel test errors
commit msg: Linux 6.1.69
crash: KASAN: stack-out-of-bounds Read in profile_pc
==================================================================
BUG: KASAN: stack-out-of-bounds in profile_pc+0xa4/0xe0 arch/x86/kernel/time.c:42
Read of size 8 at addr ffffc900005a7c20 by task syz-executor.0/1044
CPU: 0 PID: 1044 Comm: syz-executor.0 Not tainted 6.1.69-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xf4/0x251 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:284 [inline]
print_report+0x15f/0x4f0 mm/kasan/report.c:395
kasan_report+0x136/0x160 mm/kasan/report.c:495
profile_pc+0xa4/0xe0 arch/x86/kernel/time.c:42
profile_tick+0x79/0xa0 kernel/profile.c:339
tick_sched_handle kernel/time/tick-sched.c:255 [inline]
tick_sched_timer+0x274/0x430 kernel/time/tick-sched.c:1501
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x40f/0x810 kernel/time/hrtimer.c:1749
hrtimer_interrupt+0x2e2/0xbc0 kernel/time/hrtimer.c:1811
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1095 [inline]
__sysvec_apic_timer_interrupt+0x121/0x400 arch/x86/kernel/apic/apic.c:1112
sysvec_apic_timer_interrupt+0x87/0xb0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xc6/0x130 kernel/locking/spinlock.c:194
Code: 9c 8f 44 24 20 42 80 3c 23 00 74 08 4c 89 ff e8 90 dc 4a fe f6 44 24 21 02 75 4e 41 f7 c6 00 02 00 00 74 01 fb bf 01 00 00 00 e5 9f fd fd 65 8b 05 c6 96 e3 7c 85 c0 74 3f 48 c7 04 24 0e 36
RSP: 0018:ffffc900005a7c20 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 1ffff920000b4f88 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001
RBP: ffffc900005a7cb8 R08: dffffc0000000000 R09: fffffbfff0b2c431
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: 1ffff920000b4f84 R14: 0000000000000246 R15: ffffc900005a7c40
debug_object_free+0x2bb/0x350 lib/debugobjects.c:889
destroy_hrtimer_on_stack kernel/time/hrtimer.c:452 [inline]
hrtimer_nanosleep+0x438/0x580 kernel/time/hrtimer.c:2112
__do_sys_clock_nanosleep kernel/time/posix-timers.c:1308 [inline]
__se_sys_clock_nanosleep+0x29e/0x310 kernel/time/posix-timers.c:1285
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3d/0x80 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f7d70847d33
Code: 00 00 00 00 0f 1f 00 83 ff 03 74 7b 83 ff 02 b8 fa ff ff ff 49 89 ca 0f 44 f8 80 3d ce 41 0d 00 00 74 14 b8 e6 00 00 00 0f 05 d8 c3 66 2e 0f 1f 84 00 00 00 00 00 48 83 ec 28 48 89 54 24 10
RSP: 002b:00007fffbf7b38c8 EFLAGS: 00000202 ORIG_RAX: 00000000000000e6
RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00007f7d70847d33
RDX: 00007fffbf7b38e0 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007fffbf7b396c R08: 00007fffbf7e60b0 R09: 0000000000000010
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 000000000000dc12 R14: 000000000000dc12 R15: 0000000000000000
The buggy address belongs to stack of task syz-executor.0/1044
and is located at offset 0 in frame:
_raw_spin_unlock_irqrestore+0x0/0x130 kernel/locking/spinlock.c:187
This frame has 1 object:
[32, 40) 'flags.i.i.i.i'
The buggy address belongs to the virtual mapping at
[ffffc900005a0000, ffffc900005a9000) created by:
copy_process+0x44b/0x3510 kernel/fork.c:2098
The buggy address belongs to the physical page:
page:ffffea00046c76c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11b1db
flags: 0x200000000000000(node=0|zone=2)
raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102dc2(GFP_HIGHUSER|__GFP_NOWARN|__GFP_ZERO), pid 1041, tgid 1041 (syz-executor.0), ts 51030682736, free_ts 44374105995
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x286/0x2b0 mm/page_alloc.c:2513
prep_new_page mm/page_alloc.c:2520 [inline]
get_page_from_freelist+0x2ba7/0x2de0 mm/page_alloc.c:4279
__alloc_pages+0x251/0x640 mm/page_alloc.c:5545
vm_area_alloc_pages mm/vmalloc.c:2983 [inline]
__vmalloc_area_node mm/vmalloc.c:3051 [inline]
__vmalloc_node_range+0x6da/0x1090 mm/vmalloc.c:3223
alloc_thread_stack_node kernel/fork.c:311 [inline]
dup_task_struct+0x798/0x890 kernel/fork.c:988
copy_process+0x44b/0x3510 kernel/fork.c:2098
kernel_clone+0x190/0x680 kernel/fork.c:2682
__do_sys_clone kernel/fork.c:2823 [inline]
__se_sys_clone kernel/fork.c:2807 [inline]
__x64_sys_clone+0x22c/0x270 kernel/fork.c:2807
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3d/0x80 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1440 [inline]
free_pcp_prepare mm/page_alloc.c:1490 [inline]
free_unref_page_prepare+0xca9/0xd80 mm/page_alloc.c:3358
free_unref_page+0x30/0x230 mm/page_alloc.c:3453
pipe_buf_release include/linux/pipe_fs_i.h:183 [inline]
pipe_read+0x502/0xde0 fs/pipe.c:324
call_read_iter include/linux/fs.h:2242 [inline]
new_sync_read fs/read_write.c:389 [inline]
vfs_read+0x780/0x9a0 fs/read_write.c:470
ksys_read+0x15f/0x240 fs/read_write.c:613
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3d/0x80 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Memory state around the buggy address:
ffffc900005a7b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffffc900005a7b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc900005a7c00: 00 00 00 00 f1 f1 f1 f1 00 f3 f3 f3 00 00 00 00
^
ffffc900005a7c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffffc900005a7d00: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
==================================================================
----------------
Code disassembly (best guess):
0: 9c pushf
1: 8f 44 24 20 pop 0x20(%rsp)
5: 42 80 3c 23 00 cmpb $0x0,(%rbx,%r12,1)
a: 74 08 je 0x14
c: 4c 89 ff mov %r15,%rdi
f: e8 90 dc 4a fe call 0xfe4adca4
14: f6 44 24 21 02 testb $0x2,0x21(%rsp)
19: 75 4e jne 0x69
1b: 41 f7 c6 00 02 00 00 test $0x200,%r14d
22: 74 01 je 0x25
24: fb sti
25: bf 01 00 00 00 mov $0x1,%edi
* 2a: e8 e5 9f fd fd call 0xfdfda014 <-- trapping instruction
2f: 65 8b 05 c6 96 e3 7c mov %gs:0x7ce396c6(%rip),%eax # 0x7ce396fc
36: 85 c0 test %eax,%eax
38: 74 3f je 0x79
3a: 48 rex.W
3b: c7 .byte 0xc7
3c: 04 24 add $0x24,%al
3e: 0e (bad)
3f: 36 ss