ci2 starts bisection 2023-03-02 16:31:12.923144073 +0000 UTC m=+73287.861833437 bisecting fixing commit since 7048384c9872ef19e8c44ca33cf06b602aaef255 building syzkaller on 67be1ae742603edad9c97d30b6ed69f9bbe2ffa8 ensuring issue is reproducible on original commit 7048384c9872ef19e8c44ca33cf06b602aaef255 testing commit 7048384c9872ef19e8c44ca33cf06b602aaef255 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: f4331c477d955cb5e395460f844fef34aa46d2749d3c004176d1d256baaf37bb all runs: crashed: general protection fault in ext4_xattr_set_entry testing current HEAD 5448b2fda85f2d90de03f053226f721ba2f7e731 testing commit 5448b2fda85f2d90de03f053226f721ba2f7e731 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: b1d97d92bdd0ebfcc33eba07c76b93ca847fb5aaeb750b25f19e9a6b9bcd80f0 all runs: crashed: general protection fault in ext4_xattr_set_entry revisions tested: 2, total time: 25m14.044118976s (build: 16m13.009388005s, test: 6m17.145020417s) the crash still happens on HEAD commit msg: Merge 5.15.94 into android13-5.15-lts crash: general protection fault in ext4_xattr_set_entry general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] CPU: 1 PID: 396 Comm: syz-executor.0 Not tainted 5.15.94-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/16/2023 RIP: 0010:ext4_xattr_inode_create fs/ext4/xattr.c:1429 [inline] RIP: 0010:ext4_xattr_inode_lookup_create fs/ext4/xattr.c:1540 [inline] RIP: 0010:ext4_xattr_set_entry+0x12af/0x3660 fs/ext4/xattr.c:1668 Code: 4c 8b ac 24 a0 00 00 00 74 12 48 89 df e8 59 f8 c3 ff 48 ba 00 00 00 00 00 fc ff df 48 8b 1b 48 83 c3 30 48 89 d8 48 c1 e8 03 <80> 3c 10 00 74 12 48 89 df e8 33 f8 c3 ff 48 ba 00 00 00 00 00 fc RSP: 0018:ffffc900005a7140 EFLAGS: 00010206 RAX: 0000000000000006 RBX: 0000000000000030 RCX: 0000000000000001 RDX: dffffc0000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc900005a73f0 R08: dffffc0000000000 R09: ffffed1021cd6003 R10: 0000000000000000 R11: dffffc0000000001 R12: ffffffff85ae84e0 R13: 1ffff920000b4ea8 R14: 0000000000000000 R15: ffff88810e674020 FS: 0000555555cde400(0000) GS:ffff8881f7300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555555ce7728 CR3: 000000012212e000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ext4_xattr_block_set+0xbf0/0x3480 fs/ext4/xattr.c:1974 ext4_xattr_move_to_block fs/ext4/xattr.c:2598 [inline] ext4_xattr_make_inode_space fs/ext4/xattr.c:2667 [inline] ext4_expand_extra_isize_ea+0xff1/0x1a30 fs/ext4/xattr.c:2759 __ext4_expand_extra_isize+0x217/0x360 fs/ext4/inode.c:5856 ext4_try_to_expand_extra_isize fs/ext4/inode.c:5899 [inline] __ext4_mark_inode_dirty+0x3e4/0x660 fs/ext4/inode.c:5977 ext4_dirty_inode+0xac/0xe0 fs/ext4/inode.c:6009 __mark_inode_dirty+0x14c/0x710 fs/fs-writeback.c:2439 mark_inode_dirty_sync include/linux/fs.h:2457 [inline] iput+0xfd/0x5d0 fs/inode.c:1686 dentry_unlink_inode+0x2d8/0x3c0 fs/dcache.c:376 __dentry_kill+0x38b/0x550 fs/dcache.c:582 shrink_dentry_list+0x206/0x440 fs/dcache.c:1176 shrink_dcache_parent+0xaf/0x2e0 do_one_tree+0x1f/0xd0 fs/dcache.c:1657 shrink_dcache_for_umount+0x67/0xf0 fs/dcache.c:1674 generic_shutdown_super+0x63/0x260 fs/super.c:447 kill_block_super+0x79/0xc0 fs/super.c:1396 deactivate_locked_super+0x7d/0xe0 fs/super.c:335 deactivate_super+0x5d/0x80 fs/super.c:366 cleanup_mnt+0x3b2/0x450 fs/namespace.c:1143 __cleanup_mnt+0xd/0x10 fs/namespace.c:1150 task_work_run+0xcc/0x140 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0xc4/0xe0 kernel/entry/common.c:175 exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:207 __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline] syscall_exit_to_user_mode+0x26/0x160 kernel/entry/common.c:300 do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f33096b5547 Code: ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd56692dc8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f33096b5547 RDX: 00007ffd56692e99 RSI: 000000000000000a RDI: 00007ffd56692e90 RBP: 00007ffd56692e90 R08: 00000000ffffffff R09: 00007ffd56692c60 R10: 0000555555cdf793 R11: 0000000000000246 R12: 00007f330970eb24 R13: 00007ffd56693f50 R14: 0000555555cdf6f0 R15: 00007ffd56693f90 Modules linked in: ---[ end trace 4c2b5dbeb25d5e6c ]--- RIP: 0010:ext4_xattr_inode_create fs/ext4/xattr.c:1429 [inline] RIP: 0010:ext4_xattr_inode_lookup_create fs/ext4/xattr.c:1540 [inline] RIP: 0010:ext4_xattr_set_entry+0x12af/0x3660 fs/ext4/xattr.c:1668 Code: 4c 8b ac 24 a0 00 00 00 74 12 48 89 df e8 59 f8 c3 ff 48 ba 00 00 00 00 00 fc ff df 48 8b 1b 48 83 c3 30 48 89 d8 48 c1 e8 03 <80> 3c 10 00 74 12 48 89 df e8 33 f8 c3 ff 48 ba 00 00 00 00 00 fc RSP: 0018:ffffc900005a7140 EFLAGS: 00010206 RAX: 0000000000000006 RBX: 0000000000000030 RCX: 0000000000000001 RDX: dffffc0000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc900005a73f0 R08: dffffc0000000000 R09: ffffed1021cd6003 R10: 0000000000000000 R11: dffffc0000000001 R12: ffffffff85ae84e0 R13: 1ffff920000b4ea8 R14: 0000000000000000 R15: ffff88810e674020 FS: 0000555555cde400(0000) GS:ffff8881f7200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f7f25a0068 CR3: 000000012212e000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 4c 8b ac 24 a0 00 00 mov 0xa0(%rsp),%r13 7: 00 8: 74 12 je 0x1c a: 48 89 df mov %rbx,%rdi d: e8 59 f8 c3 ff callq 0xffc3f86b 12: 48 ba 00 00 00 00 00 movabs $0xdffffc0000000000,%rdx 19: fc ff df 1c: 48 8b 1b mov (%rbx),%rbx 1f: 48 83 c3 30 add $0x30,%rbx 23: 48 89 d8 mov %rbx,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 80 3c 10 00 cmpb $0x0,(%rax,%rdx,1) <-- trapping instruction 2e: 74 12 je 0x42 30: 48 89 df mov %rbx,%rdi 33: e8 33 f8 c3 ff callq 0xffc3f86b 38: 48 rex.W 39: ba 00 00 00 00 mov $0x0,%edx 3e: 00 fc add %bh,%ah