ci2 starts bisection 2023-12-21 23:06:24.527646641 +0000 UTC m=+56750.676143708 bisecting fixing commit since bf4ad6fa4e5332e53913b073d0219319a4091619 building syzkaller on 2b9ba477a18ed0cc53e6b29a9641292709a7ba24 ensuring issue is reproducible on original commit bf4ad6fa4e5332e53913b073d0219319a4091619 testing commit bf4ad6fa4e5332e53913b073d0219319a4091619 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 3ee19f2be8c5250da66d3dcef7fb0d462742b6e40cc5cf47fe1169372c6dc720 all runs: crashed: KASAN: stack-out-of-bounds Read in profile_pc representative crash: KASAN: stack-out-of-bounds Read in profile_pc, types: [KASAN] check whether we can drop unnecessary instrumentation disabling configs for [UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing commit bf4ad6fa4e5332e53913b073d0219319a4091619 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: c714dd5d88d470beb49cc1e36e75cb2742b4cbe17073e68621fe5597c0fac69e all runs: crashed: KASAN: stack-out-of-bounds Read in profile_pc representative crash: KASAN: stack-out-of-bounds Read in profile_pc, types: [KASAN] the bug reproduces without the instrumentation disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed kconfig minimization: base=3820 full=7524 leaves diff=1994 split chunks (needed=false): <1994> split chunk #0 of len 1994 into 5 parts testing without sub-chunk 1/5 disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed testing commit bf4ad6fa4e5332e53913b073d0219319a4091619 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 1b798a09ddce08d2cea74591e900eeee4b7579b1ab29116af2d2789fd3ceb1fe all runs: crashed: KASAN: stack-out-of-bounds Read in profile_pc representative crash: KASAN: stack-out-of-bounds Read in profile_pc, types: [KASAN] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing commit bf4ad6fa4e5332e53913b073d0219319a4091619 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 51555a5b8a8e21c92236a0d77f7c5f414c51e2682c91698b1d0e991b05796811 all runs: crashed: KASAN: stack-out-of-bounds Read in profile_pc representative crash: KASAN: stack-out-of-bounds Read in profile_pc, types: [KASAN] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed testing commit bf4ad6fa4e5332e53913b073d0219319a4091619 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: a57ca416cd53bc904cf7a8d80dfa8a44dee085bf250240914f6c1f491f43509c all runs: crashed: KASAN: stack-out-of-bounds Read in profile_pc representative crash: KASAN: stack-out-of-bounds Read in profile_pc, types: [KASAN] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing commit bf4ad6fa4e5332e53913b073d0219319a4091619 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 70ccb20083a528c65ad92546b2c1e2614578cdbf0e22d7a54ece5ff3d30424d1 all runs: crashed: KASAN: stack-out-of-bounds Read in profile_pc representative crash: KASAN: stack-out-of-bounds Read in profile_pc, types: [KASAN] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed testing commit bf4ad6fa4e5332e53913b073d0219319a4091619 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 921b5663f320944497217893b0e584fb96f6e4d554deb04411f1633acf5bc7be all runs: crashed: KASAN: stack-out-of-bounds Read in profile_pc representative crash: KASAN: stack-out-of-bounds Read in profile_pc, types: [KASAN] the chunk can be dropped disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN BUG LOCKDEP], they are not needed testing current HEAD 4aa6747d935281df8a1888feeb6e22e0097d0b86 testing commit 4aa6747d935281df8a1888feeb6e22e0097d0b86 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 84531aeec11eb36f0e671e0354524b6017ea7af00869ae621dcd1d7d1a96793c all runs: crashed: KASAN: stack-out-of-bounds Read in profile_pc representative crash: KASAN: stack-out-of-bounds Read in profile_pc, types: [KASAN] crash still not fixed/happens on the oldest tested release revisions tested: 8, total time: 55m7.259663918s (build: 29m4.377038518s, test: 23m33.229813008s) crash still not fixed or there were kernel test errors commit msg: Linux 6.1.69 crash: KASAN: stack-out-of-bounds Read in profile_pc ================================================================== BUG: KASAN: stack-out-of-bounds in profile_pc+0xa4/0xe0 arch/x86/kernel/time.c:42 Read of size 8 at addr ffffc900005a7c20 by task syz-executor.0/1044 CPU: 0 PID: 1044 Comm: syz-executor.0 Not tainted 6.1.69-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xf4/0x251 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x15f/0x4f0 mm/kasan/report.c:395 kasan_report+0x136/0x160 mm/kasan/report.c:495 profile_pc+0xa4/0xe0 arch/x86/kernel/time.c:42 profile_tick+0x79/0xa0 kernel/profile.c:339 tick_sched_handle kernel/time/tick-sched.c:255 [inline] tick_sched_timer+0x274/0x430 kernel/time/tick-sched.c:1501 __run_hrtimer kernel/time/hrtimer.c:1685 [inline] __hrtimer_run_queues+0x40f/0x810 kernel/time/hrtimer.c:1749 hrtimer_interrupt+0x2e2/0xbc0 kernel/time/hrtimer.c:1811 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1095 [inline] __sysvec_apic_timer_interrupt+0x121/0x400 arch/x86/kernel/apic/apic.c:1112 sysvec_apic_timer_interrupt+0x87/0xb0 arch/x86/kernel/apic/apic.c:1106 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:653 RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0xc6/0x130 kernel/locking/spinlock.c:194 Code: 9c 8f 44 24 20 42 80 3c 23 00 74 08 4c 89 ff e8 90 dc 4a fe f6 44 24 21 02 75 4e 41 f7 c6 00 02 00 00 74 01 fb bf 01 00 00 00 e5 9f fd fd 65 8b 05 c6 96 e3 7c 85 c0 74 3f 48 c7 04 24 0e 36 RSP: 0018:ffffc900005a7c20 EFLAGS: 00000206 RAX: 0000000000000001 RBX: 1ffff920000b4f88 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 RBP: ffffc900005a7cb8 R08: dffffc0000000000 R09: fffffbfff0b2c431 R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000 R13: 1ffff920000b4f84 R14: 0000000000000246 R15: ffffc900005a7c40 debug_object_free+0x2bb/0x350 lib/debugobjects.c:889 destroy_hrtimer_on_stack kernel/time/hrtimer.c:452 [inline] hrtimer_nanosleep+0x438/0x580 kernel/time/hrtimer.c:2112 __do_sys_clock_nanosleep kernel/time/posix-timers.c:1308 [inline] __se_sys_clock_nanosleep+0x29e/0x310 kernel/time/posix-timers.c:1285 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3d/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f7d70847d33 Code: 00 00 00 00 0f 1f 00 83 ff 03 74 7b 83 ff 02 b8 fa ff ff ff 49 89 ca 0f 44 f8 80 3d ce 41 0d 00 00 74 14 b8 e6 00 00 00 0f 05 d8 c3 66 2e 0f 1f 84 00 00 00 00 00 48 83 ec 28 48 89 54 24 10 RSP: 002b:00007fffbf7b38c8 EFLAGS: 00000202 ORIG_RAX: 00000000000000e6 RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00007f7d70847d33 RDX: 00007fffbf7b38e0 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007fffbf7b396c R08: 00007fffbf7e60b0 R09: 0000000000000010 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 R13: 000000000000dc12 R14: 000000000000dc12 R15: 0000000000000000 The buggy address belongs to stack of task syz-executor.0/1044 and is located at offset 0 in frame: _raw_spin_unlock_irqrestore+0x0/0x130 kernel/locking/spinlock.c:187 This frame has 1 object: [32, 40) 'flags.i.i.i.i' The buggy address belongs to the virtual mapping at [ffffc900005a0000, ffffc900005a9000) created by: copy_process+0x44b/0x3510 kernel/fork.c:2098 The buggy address belongs to the physical page: page:ffffea00046c76c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11b1db flags: 0x200000000000000(node=0|zone=2) raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102dc2(GFP_HIGHUSER|__GFP_NOWARN|__GFP_ZERO), pid 1041, tgid 1041 (syz-executor.0), ts 51030682736, free_ts 44374105995 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x286/0x2b0 mm/page_alloc.c:2513 prep_new_page mm/page_alloc.c:2520 [inline] get_page_from_freelist+0x2ba7/0x2de0 mm/page_alloc.c:4279 __alloc_pages+0x251/0x640 mm/page_alloc.c:5545 vm_area_alloc_pages mm/vmalloc.c:2983 [inline] __vmalloc_area_node mm/vmalloc.c:3051 [inline] __vmalloc_node_range+0x6da/0x1090 mm/vmalloc.c:3223 alloc_thread_stack_node kernel/fork.c:311 [inline] dup_task_struct+0x798/0x890 kernel/fork.c:988 copy_process+0x44b/0x3510 kernel/fork.c:2098 kernel_clone+0x190/0x680 kernel/fork.c:2682 __do_sys_clone kernel/fork.c:2823 [inline] __se_sys_clone kernel/fork.c:2807 [inline] __x64_sys_clone+0x22c/0x270 kernel/fork.c:2807 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3d/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x63/0xcd page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1440 [inline] free_pcp_prepare mm/page_alloc.c:1490 [inline] free_unref_page_prepare+0xca9/0xd80 mm/page_alloc.c:3358 free_unref_page+0x30/0x230 mm/page_alloc.c:3453 pipe_buf_release include/linux/pipe_fs_i.h:183 [inline] pipe_read+0x502/0xde0 fs/pipe.c:324 call_read_iter include/linux/fs.h:2242 [inline] new_sync_read fs/read_write.c:389 [inline] vfs_read+0x780/0x9a0 fs/read_write.c:470 ksys_read+0x15f/0x240 fs/read_write.c:613 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3d/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x63/0xcd Memory state around the buggy address: ffffc900005a7b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffc900005a7b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffc900005a7c00: 00 00 00 00 f1 f1 f1 f1 00 f3 f3 f3 00 00 00 00 ^ ffffc900005a7c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffc900005a7d00: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 ================================================================== ---------------- Code disassembly (best guess): 0: 9c pushf 1: 8f 44 24 20 pop 0x20(%rsp) 5: 42 80 3c 23 00 cmpb $0x0,(%rbx,%r12,1) a: 74 08 je 0x14 c: 4c 89 ff mov %r15,%rdi f: e8 90 dc 4a fe call 0xfe4adca4 14: f6 44 24 21 02 testb $0x2,0x21(%rsp) 19: 75 4e jne 0x69 1b: 41 f7 c6 00 02 00 00 test $0x200,%r14d 22: 74 01 je 0x25 24: fb sti 25: bf 01 00 00 00 mov $0x1,%edi * 2a: e8 e5 9f fd fd call 0xfdfda014 <-- trapping instruction 2f: 65 8b 05 c6 96 e3 7c mov %gs:0x7ce396c6(%rip),%eax # 0x7ce396fc 36: 85 c0 test %eax,%eax 38: 74 3f je 0x79 3a: 48 rex.W 3b: c7 .byte 0xc7 3c: 04 24 add $0x24,%al 3e: 0e (bad) 3f: 36 ss