ci2 starts bisection 2026-08-07 12:20:37.626011734 +0000 UTC m=+8746.264828215 bisecting fixing commit since a64de05eba09515a3ca4721c5596929477e466b8 building syzkaller on fcece630c57bf5ca85bc6ae6a3e8c6f4400dc209 ensuring issue is reproducible on original commit a64de05eba09515a3ca4721c5596929477e466b8 testing commit a64de05eba09515a3ca4721c5596929477e466b8 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: c88235244602f2bc7035d442963b6f195cf90be9ab8b47fb8cf383fc4757f7cb run #0: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #1: crashed: KASAN: out-of-bounds Read in ext4_read_inline_data run #2: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #3: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #4: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_data run #5: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #6: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_data run #7: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #8: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #9: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #10: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #11: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #12: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_data run #13: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_data run #14: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #15: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_data run #16: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #17: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_data run #18: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #19: crashed: KASAN: use-after-free Read in ext4_read_inline_data representative crash: KASAN: use-after-free Read in ext4_read_inline_data, types: [KASAN-USE-AFTER-FREE-READ KASAN-READ] check whether we can drop unnecessary instrumentation disabling configs for [bug_or_warning locking atomic_sleep hang memleak ubsan], they are not needed testing commit a64de05eba09515a3ca4721c5596929477e466b8 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: ae2e5a3e9dae55c2c56d0b7aff8e5f535cd48d97bd5ecfe995e2976b39288237 run #0: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_data run #1: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #2: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_data run #4: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #5: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #6: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_data run #7: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #8: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #9: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_data representative crash: KASAN: use-after-free Read in ext4_read_inline_data, types: [KASAN-USE-AFTER-FREE-READ KASAN-READ] the bug reproduces without the instrumentation disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed kconfig minimization: base=4921 full=6218 leaves diff=256 split chunks (needed=false): <256> split chunk #0 of len 256 into 5 parts testing without sub-chunk 1/5 disabling configs for [bug_or_warning locking atomic_sleep hang memleak ubsan], they are not needed testing commit a64de05eba09515a3ca4721c5596929477e466b8 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 0cf4d5359e009a83f8dd7a3a5e96a42466d1914eae43c8070bbdf3e5859a7587 run #0: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #1: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #2: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_data run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_data run #4: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_data run #5: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #6: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #7: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_data run #8: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #9: crashed: KASAN: use-after-free Read in ext4_read_inline_data representative crash: KASAN: use-after-free Read in ext4_read_inline_data, types: [KASAN-USE-AFTER-FREE-READ KASAN-READ] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed testing commit a64de05eba09515a3ca4721c5596929477e466b8 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 5241e5da018331323a0aca2536d2fa1684959388f8a7d93098d791a375c22549 run #0: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_data run #1: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #2: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #3: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #4: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #5: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #6: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_data run #7: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #8: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_data run #9: crashed: KASAN: use-after-free Read in ext4_read_inline_data representative crash: KASAN: use-after-free Read in ext4_read_inline_data, types: [KASAN-USE-AFTER-FREE-READ KASAN-READ] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [ubsan bug_or_warning locking atomic_sleep hang memleak], they are not needed testing commit a64de05eba09515a3ca4721c5596929477e466b8 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 9c716956ee953c59f8733c14b26d3d0caa879cb84d487050bcdb07b851fbb318 run #0: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #1: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #2: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_data run #4: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #5: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_data run #6: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #7: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #8: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #9: crashed: KASAN: use-after-free Read in ext4_read_inline_data representative crash: KASAN: use-after-free Read in ext4_read_inline_data, types: [KASAN-USE-AFTER-FREE-READ] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed testing commit a64de05eba09515a3ca4721c5596929477e466b8 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: f12a2760b64a6c71fbd3849d0218426d3f5ab5fa571a83dfd8ce0613c50accfb run #0: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #1: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #2: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #3: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #4: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #5: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_data run #6: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_data run #7: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #8: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #9: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_data representative crash: KASAN: use-after-free Read in ext4_read_inline_data, types: [KASAN-USE-AFTER-FREE-READ KASAN-READ] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [locking atomic_sleep hang memleak ubsan bug_or_warning], they are not needed testing commit a64de05eba09515a3ca4721c5596929477e466b8 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 failed building a64de05eba09515a3ca4721c5596929477e466b8: net/socket.c:1188:(.text+0x6d1a): undefined reference to `wext_handle_ioctl' net/socket.c:3389:(.text+0x7314): undefined reference to `compat_wext_handle_ioctl' net/core/net-procfs.c:343:(.text+0x33b): undefined reference to `wext_proc_exit' net/core/net-procfs.c:327:(.text+0x4e2): undefined reference to `wext_proc_init' minimized to 48 configs; suspects: [HID_ZEROPLUS USB_NET_CDC_SUBSET USB_NET_CDC_SUBSET_ENABLE USB_NET_DM9601 USB_NET_GL620A USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL USB_SERIAL_FTDI_SIO USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM USB_XHCI_PCI_RENESAS WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_ZYDAS ZEROPLUS_FF] disabling configs for [locking atomic_sleep hang memleak ubsan bug_or_warning], they are not needed testing current HEAD 6148a1b6bae4b45b3b53c2efe726b15e4956baa9 testing commit 6148a1b6bae4b45b3b53c2efe726b15e4956baa9 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 954f215e93d76392939563925db2e32d472c09bc61d700ba61a0dbff9be85831 run #0: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #1: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #2: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #3: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_data run #4: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #5: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #6: crashed: KASAN: slab-out-of-bounds Read in ext4_read_inline_data run #7: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #8: crashed: KASAN: use-after-free Read in ext4_read_inline_data run #9: crashed: KASAN: use-after-free Read in ext4_read_inline_data representative crash: KASAN: use-after-free Read in ext4_read_inline_data, types: [KASAN-USE-AFTER-FREE-READ] crash still not fixed/happens on the oldest tested release revisions tested: 7, total time: 1h2m31.973276503s (build: 15m46.397116041s, test: 30m37.930679503s) crash still not fixed or there were kernel test errors commit msg: Merge 203355010cb2 ("net/sched: act_pedit: use NLA_POLICY for parsing 'ex' keys") into android13-5.15-lts crash: KASAN: use-after-free Read in ext4_read_inline_data EXT4-fs (loop2): 1 truncate cleaned up EXT4-fs (loop2): mounted filesystem without journal. Opts: noblock_validity,max_batch_time=0x0000000000000002,lazytime,block_validity,stripe=0x000000000000000d,nombcache,,errors=continue. Quota mode: none. ================================================================== BUG: KASAN: use-after-free in ext4_read_inline_data fs/ext4/inline.c:210 [inline] BUG: KASAN: use-after-free in ext4_read_inline_data+0x1f3/0x2d0 fs/ext4/inline.c:178 Read of size 68 at addr ffff88811eff9c80 by task syz.2.19/460 CPU: 1 PID: 460 Comm: syz.2.19 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x38/0x49 lib/dump_stack.c:106 print_address_description.constprop.0+0x24/0x160 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:427 [inline] kasan_report.cold+0x82/0xdb mm/kasan/report.c:444 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x148/0x190 mm/kasan/generic.c:189 memcpy+0x24/0x60 mm/kasan/shadow.c:65 ext4_read_inline_data fs/ext4/inline.c:210 [inline] ext4_read_inline_data+0x1f3/0x2d0 fs/ext4/inline.c:178 ext4_convert_inline_data_nolock+0x100/0xc40 fs/ext4/inline.c:1263 ext4_try_add_inline_entry+0x418/0x870 fs/ext4/inline.c:1389 ext4_add_entry+0x7f1/0x11f0 fs/ext4/namei.c:2458 ext4_mkdir+0x392/0x890 fs/ext4/namei.c:3081 vfs_mkdir+0x1d5/0x430 fs/namei.c:4073 do_mkdirat+0x152/0x2c0 fs/namei.c:4098 __do_sys_mkdirat fs/namei.c:4113 [inline] __se_sys_mkdirat fs/namei.c:4111 [inline] __x64_sys_mkdirat+0xf4/0x140 fs/namei.c:4111 x64_sys_call+0x2e4/0x990 arch/x86/include/generated/asm/syscalls_64.h:259 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x33/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f8b7d835cc7 Code: 00 66 90 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 db f7 ff ff 66 2e 0f 1f 84 00 00 00 00 00 90 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f8b7d697e58 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 00007f8b7d697ee0 RCX: 00007f8b7d835cc7 RDX: 00000000000001ff RSI: 0000200000000080 RDI: 00000000ffffff9c RBP: 0000200000000140 R08: 0000200000000080 R09: 0000000000000000 R10: 0000200000000140 R11: 0000000000000246 R12: 0000200000000080 R13: 00007f8b7d697ea0 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 367: kasan_save_stack+0x26/0x50 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:433 [inline] __kasan_slab_alloc+0x94/0xc0 mm/kasan/common.c:466 kasan_slab_alloc include/linux/kasan.h:217 [inline] slab_post_alloc_hook mm/slab.h:550 [inline] kmem_cache_alloc_bulk+0x206/0x3b0 mm/slub.c:3743 napi_skb_cache_get+0xd0/0x150 net/core/skbuff.c:179 __alloc_skb+0x54/0x250 net/core/skbuff.c:414 __napi_alloc_skb+0x48/0x2b0 net/core/skbuff.c:569 napi_alloc_skb include/linux/skbuff.h:3102 [inline] page_to_skb+0x41a/0xa80 drivers/net/virtio_net.c:474 receive_mergeable drivers/net/virtio_net.c:1102 [inline] receive_buf+0x2241/0x4b70 drivers/net/virtio_net.c:1212 virtnet_receive drivers/net/virtio_net.c:1504 [inline] virtnet_poll+0x574/0x11c0 drivers/net/virtio_net.c:1617 __napi_poll+0xa4/0x440 net/core/dev.c:7109 napi_poll net/core/dev.c:7176 [inline] net_rx_action+0x2f3/0xb00 net/core/dev.c:7266 handle_softirqs+0x1c5/0x510 kernel/softirq.c:583 __do_softirq kernel/softirq.c:621 [inline] invoke_softirq kernel/softirq.c:443 [inline] __irq_exit_rcu kernel/softirq.c:670 [inline] irq_exit_rcu+0x66/0x110 kernel/softirq.c:682 common_interrupt+0xc2/0xe0 arch/x86/kernel/irq.c:242 asm_common_interrupt+0x27/0x40 arch/x86/include/asm/idtentry.h:667 Freed by task 367: kasan_save_stack+0x26/0x50 mm/kasan/common.c:38 kasan_set_track+0x25/0x30 mm/kasan/common.c:45 kasan_set_free_info+0x24/0x40 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:365 [inline] ____kasan_slab_free mm/kasan/common.c:327 [inline] __kasan_slab_free+0x111/0x150 mm/kasan/common.c:373 kasan_slab_free include/linux/kasan.h:193 [inline] slab_free_hook mm/slub.c:1728 [inline] slab_free_freelist_hook+0x94/0x1a0 mm/slub.c:1754 slab_free mm/slub.c:3526 [inline] kmem_cache_free+0x105/0x2a0 mm/slub.c:3544 kfree_skbmem+0x95/0x140 net/core/skbuff.c:701 __kfree_skb net/core/skbuff.c:758 [inline] kfree_skb_partial+0x64/0x80 net/core/skbuff.c:5466 tcp_add_backlog+0x165a/0x1fb0 net/ipv4/tcp_ipv4.c:1913 tcp_v4_rcv+0x2790/0x3880 net/ipv4/tcp_ipv4.c:2140 ip_protocol_deliver_rcu+0x50/0x570 net/ipv4/ip_input.c:204 ip_local_deliver_finish net/ipv4/ip_input.c:231 [inline] NF_HOOK include/linux/netfilter.h:305 [inline] NF_HOOK include/linux/netfilter.h:299 [inline] ip_local_deliver+0x42f/0x5e0 net/ipv4/ip_input.c:252 dst_input include/net/dst.h:463 [inline] ip_sublist_rcv_finish+0x11c/0x1d0 net/ipv4/ip_input.c:577 ip_list_rcv_finish net/ipv4/ip_input.c:628 [inline] ip_sublist_rcv+0x3be/0x660 net/ipv4/ip_input.c:636 ip_list_rcv+0x2e8/0x4e0 net/ipv4/ip_input.c:671 __netif_receive_skb_list_ptype net/core/dev.c:5602 [inline] __netif_receive_skb_list_core+0x4d6/0x9e0 net/core/dev.c:5650 __netif_receive_skb_list net/core/dev.c:5702 [inline] netif_receive_skb_list_internal+0x5ff/0xdf0 net/core/dev.c:5793 gro_normal_list net/core/dev.c:5947 [inline] gro_normal_list net/core/dev.c:5943 [inline] napi_complete_done+0x184/0x5c0 net/core/dev.c:6685 virtqueue_napi_complete drivers/net/virtio_net.c:357 [inline] virtnet_poll+0xb51/0x11c0 drivers/net/virtio_net.c:1624 __napi_poll+0xa4/0x440 net/core/dev.c:7109 napi_poll net/core/dev.c:7176 [inline] net_rx_action+0x2f3/0xb00 net/core/dev.c:7266 handle_softirqs+0x1c5/0x510 kernel/softirq.c:583 __do_softirq kernel/softirq.c:621 [inline] invoke_softirq kernel/softirq.c:443 [inline] __irq_exit_rcu kernel/softirq.c:670 [inline] irq_exit_rcu+0x66/0x110 kernel/softirq.c:682 common_interrupt+0xc2/0xe0 arch/x86/kernel/irq.c:242 asm_common_interrupt+0x27/0x40 arch/x86/include/asm/idtentry.h:667 The buggy address belongs to the object at ffff88811eff9c80 which belongs to the cache skbuff_head_cache of size 240 The buggy address is located 0 bytes inside of 240-byte region [ffff88811eff9c80, ffff88811eff9d70) The buggy address belongs to the page: page:ffffea00047bfe40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11eff9 flags: 0x4000000000000200(slab|zone=1) raw: 4000000000000200 0000000000000000 dead000000000122 ffff888107fb8a80 raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL), pid 367, ts 28184549171, free_ts 28184480146 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook mm/page_alloc.c:2607 [inline] prep_new_page+0x1a2/0x310 mm/page_alloc.c:2613 get_page_from_freelist+0x1ce2/0x30a0 mm/page_alloc.c:4487 __alloc_pages+0x300/0x2d60 mm/page_alloc.c:5824 __alloc_pages_node include/linux/gfp.h:595 [inline] alloc_pages_node include/linux/gfp.h:609 [inline] alloc_pages include/linux/gfp.h:622 [inline] alloc_slab_page mm/slub.c:1798 [inline] allocate_slab+0x39d/0x530 mm/slub.c:1937 new_slab mm/slub.c:2000 [inline] ___slab_alloc.constprop.0+0x3ca/0x890 mm/slub.c:3033 __slab_alloc.constprop.0+0x42/0x80 mm/slub.c:3120 slab_alloc_node mm/slub.c:3211 [inline] slab_alloc mm/slub.c:3255 [inline] kmem_cache_alloc+0x48d/0x4d0 mm/slub.c:3260 skb_clone+0x131/0x310 net/core/skbuff.c:1547 dev_queue_xmit_nit+0x286/0x930 net/core/dev.c:2362 xmit_one net/core/dev.c:3665 [inline] dev_hard_start_xmit+0x96/0x520 net/core/dev.c:3686 sch_direct_xmit+0x1d8/0xad0 net/sched/sch_generic.c:345 __dev_xmit_skb net/core/dev.c:3905 [inline] __dev_queue_xmit+0xf06/0x2db0 net/core/dev.c:4274 dev_queue_xmit+0xb/0x10 net/core/dev.c:4355 neigh_hh_output include/net/neighbour.h:501 [inline] neigh_output include/net/neighbour.h:515 [inline] ip_finish_output2+0xccf/0x1850 net/ipv4/ip_output.c:228 __ip_finish_output net/ipv4/ip_output.c:306 [inline] __ip_finish_output+0x330/0xa50 net/ipv4/ip_output.c:288 ip_finish_output+0x25/0x170 net/ipv4/ip_output.c:316 page last free stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] free_pages_prepare mm/page_alloc.c:1474 [inline] free_pcp_prepare+0x263/0x660 mm/page_alloc.c:1546 free_unref_page_prepare mm/page_alloc.c:3536 [inline] free_unref_page+0x84/0x760 mm/page_alloc.c:3618 __put_single_page mm/swap.c:98 [inline] __put_page+0xdb/0x110 mm/swap.c:129 put_page include/linux/mm.h:1306 [inline] anon_pipe_buf_release+0x128/0x1a0 fs/pipe.c:137 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_read+0x574/0xdf0 fs/pipe.c:323 call_read_iter include/linux/fs.h:2206 [inline] new_sync_read+0x489/0x6d0 fs/read_write.c:404 vfs_read+0x34a/0x4b0 fs/read_write.c:485 ksys_read+0x192/0x210 fs/read_write.c:623 __do_sys_read fs/read_write.c:633 [inline] __se_sys_read fs/read_write.c:631 [inline] __x64_sys_read+0x6e/0xb0 fs/read_write.c:631 x64_sys_call+0x982/0x990 arch/x86/include/generated/asm/syscalls_64.h:1 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x33/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 Memory state around the buggy address: ffff88811eff9b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811eff9c00: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc >ffff88811eff9c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88811eff9d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc ffff88811eff9d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ================================================================== EXT4-fs error (device loop2): ext4_check_all_de:666: inode #12: block 7: comm syz.2.19: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0