Re: [syzbot] [ext4?] KASAN: slab-use-after-free Write in do_split

[Qu Wenruo]

在 2026/9/29 10:02, syzbot 写道:
> syzbot has bisected this issue to:
>
> commit 3f757b56f1c4579fe32b810bce1d39f202964412
> Author: Filipe Manana <fdmanana@xxxxxxxx>
> Date:   Fri May 16 16:07:40 2025 +0000
>
>      btrfs: unfold transaction aborts at btrfs_create_new_inode()

This bisection doesn't make any sense.

The console output is showing ext4_add_entry()->do_split() causing the 
KASAN.

Furthermore, there is no btrfs in the whole console output.

There must be some randomness in the reproducer.

> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=16bbf315580000
> start commit:   72d3fcf802c4 Linux 7.3-rc5
> git tree:       upstream
> final oops:     https://syzkaller.appspot.com/x/report.txt?x=15bbf315580000
> console output: https://syzkaller.appspot.com/x/log.txt?x=11bbf315580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=718e346eb0b8f38
> dashboard link: https://syzkaller.appspot.com/bug?extid=09bec78ee77613a3efdd
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=12379605580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=127f6325580000
>
> Reported-by: syzbot+09bec78ee77613a3efdd@xxxxxxxxxxxxxxxxxxxxxxxxx
> Fixes: 3f757b56f1c4 ("btrfs: unfold transaction aborts at btrfs_create_new_inode()")
>
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection