ci2 starts bisection 2026-10-31 12:17:49.873416798 +0000 UTC m=+13295.776870305 bisecting cause commit starting from bd5c762ac0519a8c62141751c893cd25a1ad8940 building syzkaller on 0ec395f82e0a11e4947104cf3f42b9d9391020ff ensuring issue is reproducible on original commit bd5c762ac0519a8c62141751c893cd25a1ad8940 testing commit bd5c762ac0519a8c62141751c893cd25a1ad8940 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 7a0d8471222c0b732ed3ca8d997549808edd8208273dbd656b836a32953df2b0 all runs: crashed: WARNING in io_sq_thread_stop representative crash: WARNING in io_sq_thread_stop, types: [WARNING] check whether we can drop unnecessary instrumentation disabling configs for [ubsan kasan locking atomic_sleep hang memleak], they are not needed testing commit bd5c762ac0519a8c62141751c893cd25a1ad8940 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 77948edfde14187276cbb1b173ab65174145977b7cfc71bd13d362b604c3919d all runs: crashed: WARNING in io_sq_thread_stop representative crash: WARNING in io_sq_thread_stop, types: [WARNING] the bug reproduces without the instrumentation disabling configs for [atomic_sleep hang memleak ubsan kasan locking], they are not needed kconfig minimization: base=4206 full=8516 leaves diff=2103 split chunks (needed=false): <2103> split chunk #0 of len 2103 into 5 parts testing without sub-chunk 1/5 disabling configs for [locking atomic_sleep hang memleak ubsan kasan], they are not needed testing commit bd5c762ac0519a8c62141751c893cd25a1ad8940 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 87500a3e7ba430b2cdf06268e59ce2b72df50b12caa3163eb72e6a97d1f073bb all runs: crashed: WARNING in io_sq_thread_stop representative crash: WARNING in io_sq_thread_stop, types: [WARNING] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [locking atomic_sleep hang memleak ubsan kasan], they are not needed testing commit bd5c762ac0519a8c62141751c893cd25a1ad8940 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 060af77121b4f8ce161b4d08f3e7afbf9e4ca9a2e48418ff1ff539276796360c all runs: crashed: WARNING in io_sq_thread_stop representative crash: WARNING in io_sq_thread_stop, types: [WARNING] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [kasan locking atomic_sleep hang memleak ubsan], they are not needed testing commit bd5c762ac0519a8c62141751c893cd25a1ad8940 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: fbe43bfe35d60816919981448bc5277ab956a378a1bb8e312ea165a1c79e2b1a run #0: crashed: WARNING in io_sq_thread_stop run #1: crashed: WARNING in io_sq_thread_stop run #2: crashed: WARNING in corrupted run #3: crashed: WARNING in io_sq_thread_stop run #4: crashed: WARNING in io_sq_thread_stop run #5: crashed: WARNING in corrupted run #6: crashed: WARNING in io_sq_thread_stop run #7: crashed: WARNING in io_sq_thread_stop run #8: crashed: WARNING in io_sq_thread_stop run #9: crashed: WARNING in io_sq_thread_stop representative crash: WARNING in io_sq_thread_stop, types: [WARNING] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [kasan locking atomic_sleep hang memleak ubsan], they are not needed testing commit bd5c762ac0519a8c62141751c893cd25a1ad8940 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: fe684bc6bea29cf152cd68f1367a7da406e998e9b84a24b6101ed0152089c930 all runs: crashed: WARNING in io_sq_thread_stop representative crash: WARNING in io_sq_thread_stop, types: [WARNING] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [kasan locking atomic_sleep hang memleak ubsan], they are not needed testing commit bd5c762ac0519a8c62141751c893cd25a1ad8940 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 1779795700814d0df6c3a71324803a293afe52deb069956be08a9dcbb265e264 all runs: crashed: WARNING in io_sq_thread_stop representative crash: WARNING in io_sq_thread_stop, types: [WARNING] the chunk can be dropped disabling configs for [atomic_sleep hang memleak ubsan kasan locking], they are not needed picked [v7.3 v7.2 v7.1 v6.19 v6.17 v6.15 v6.13 v6.11 v6.8 v6.5 v6.2 v5.19 v5.16 v5.13 v5.10 v5.7 v5.4 v5.1 v4.19] out of 46 release tags testing release v7.3 testing commit c03c1a14507dfaf8b856c2608f9ac216021fc222 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 10211ab22116cfdee7d3eaff6fb0b70f10ef92adbbb7a1e59a7ad1e8c0cdc398 all runs: OK false negative chance: 0.000 # git bisect start bd5c762ac0519a8c62141751c893cd25a1ad8940 c03c1a14507dfaf8b856c2608f9ac216021fc222 Bisecting: 9349 revisions left to test after this (roughly 13 steps) [26344c0dd32af8790d8474d233619db825441138] Merge tag 'vfio-v7.4-rc1' of https://github.com/awilliam/linux-vfio testing commit 26344c0dd32af8790d8474d233619db825441138 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: a1d6e33f142cd74cc99b4e8ed6766c0daee002bd61d3839d9fba2f6681c2f601 all runs: OK false negative chance: 0.000 # git bisect good 26344c0dd32af8790d8474d233619db825441138 Bisecting: 4420 revisions left to test after this (roughly 12 steps) [75c1cb8178fe84403fd95236ddf21754f0a4156c] Merge tag 'sound-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound testing commit 75c1cb8178fe84403fd95236ddf21754f0a4156c gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 803a5bd5c207003d737dc9f7603da576e3141b1149546193ed69e500fff3dd28 all runs: OK false negative chance: 0.000 # git bisect good 75c1cb8178fe84403fd95236ddf21754f0a4156c Bisecting: 2219 revisions left to test after this (roughly 11 steps) [62c457528529cdcfa32bc52b331ceca10f3937b6] Merge tag 'vfs-7.4-rc1.keyring' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs testing commit 62c457528529cdcfa32bc52b331ceca10f3937b6 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 77070f002a66d1d65724f5078d8ea02560f5400448c728add3e8bbcf728b28fa all runs: OK false negative chance: 0.000 # git bisect good 62c457528529cdcfa32bc52b331ceca10f3937b6 Bisecting: 1011 revisions left to test after this (roughly 10 steps) [c339f4010dea8b0d754f84ace70cd1b089878ef8] Merge tag 'platform-drivers-x86-v7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 testing commit c339f4010dea8b0d754f84ace70cd1b089878ef8 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 886e84af50a3c332d4dc3a8a007350cef10f3ad161aba98dc9d6034c9461ad7a all runs: OK false negative chance: 0.000 # git bisect good c339f4010dea8b0d754f84ace70cd1b089878ef8 Bisecting: 592 revisions left to test after this (roughly 9 steps) [d89e1d186ec9271bf78e62771779e9fc03bf0fc3] Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux testing commit d89e1d186ec9271bf78e62771779e9fc03bf0fc3 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 385585243edb1149da610c5b3eb5165c4097cd95858e4d197f4d8f825f58da17 all runs: OK false negative chance: 0.000 # git bisect good d89e1d186ec9271bf78e62771779e9fc03bf0fc3 Bisecting: 253 revisions left to test after this (roughly 8 steps) [0d9678b125d8315d62de1261bee67c7e6f21457e] Merge branches 'clk-renesas', 'clk-samsung', 'clk-starfive', 'clk-tenstorrent' and 'clk-pile' into clk-next testing commit 0d9678b125d8315d62de1261bee67c7e6f21457e gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: b795d97309b7afb1a29b958f9ba1936c32d7a94e37aacf56af1ec2a0c2468f24 all runs: OK false negative chance: 0.000 # git bisect good 0d9678b125d8315d62de1261bee67c7e6f21457e Bisecting: 142 revisions left to test after this (roughly 7 steps) [c8c53d669d4e45b3a804013251a34387d7e11bfb] blk-crypto: fix NULL deref and UAF in __blk_crypto_evict_key() testing commit c8c53d669d4e45b3a804013251a34387d7e11bfb gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 059b93742a10e68a636bc03952a00040e7102edecc75361aaf6eec1f2d35e620 all runs: OK false negative chance: 0.000 # git bisect good c8c53d669d4e45b3a804013251a34387d7e11bfb Bisecting: 63 revisions left to test after this (roughly 6 steps) [db8b4d2bf2d3e02b4ff78bbf69d00e11795840de] Merge patch series "scsi: Enable context analysis for most drivers" testing commit db8b4d2bf2d3e02b4ff78bbf69d00e11795840de gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 58fdbc28cf3c3cb687fce39eba735474fbb44287dbf97c88bc751d8fef91c1cd all runs: OK false negative chance: 0.000 # git bisect good db8b4d2bf2d3e02b4ff78bbf69d00e11795840de Bisecting: 31 revisions left to test after this (roughly 5 steps) [9ed11143be5ed8d9ffa36907f24f4aca889d185e] Merge tag 'io_uring-7.4-20261029' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux testing commit 9ed11143be5ed8d9ffa36907f24f4aca889d185e gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 56ef5e8bd64f137530dd7d3623db09507cc44a1abb1ae38ef5538af9536778a6 all runs: crashed: WARNING in io_sq_thread_stop representative crash: WARNING in io_sq_thread_stop, types: [WARNING] # git bisect bad 9ed11143be5ed8d9ffa36907f24f4aca889d185e Bisecting: 15 revisions left to test after this (roughly 4 steps) [37e425460b7c41687e51e3254b1eb1d799da9614] io_uring/io-wq: save worker type before dropping its reference testing commit 37e425460b7c41687e51e3254b1eb1d799da9614 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 3558e0c7ddcc8bf3f8d0c5e1502d9b21c57e5b3eb18056a92bf0a853f02efc74 run #0: ignore: lost connection to test machine run #1: ignore: lost connection to test machine run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK false negative chance: 0.000 # git bisect good 37e425460b7c41687e51e3254b1eb1d799da9614 Bisecting: 7 revisions left to test after this (roughly 3 steps) [01d1204582f16e8b7bfce29648e5cf77a585d962] fbdev: atmel_lcdfb: fix list_first_entry() on possibly empty modelist in probe testing commit 01d1204582f16e8b7bfce29648e5cf77a585d962 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 182a4a35a4118fef6b8d973dc394ac4e89d3c72c8cab8ee2dee60c86afe4494f all runs: OK false negative chance: 0.000 # git bisect good 01d1204582f16e8b7bfce29648e5cf77a585d962 Bisecting: 3 revisions left to test after this (roughly 2 steps) [3e3aebb7570ccdde5cc49c9bfc8fd3a436b71b0c] io_uring/net: fix multishot recv length limit accounting testing commit 3e3aebb7570ccdde5cc49c9bfc8fd3a436b71b0c gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: cf47a1aa85a35af05531bfa5d9b08eed0bf867e973fc70c7b77c3cbcf2410406 all runs: OK false negative chance: 0.000 # git bisect good 3e3aebb7570ccdde5cc49c9bfc8fd3a436b71b0c Bisecting: 1 revision left to test after this (roughly 1 step) [67f1f9b38c15b54d257a1efc544873b53905737f] Merge tag 'fbdev-for-7.4-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev testing commit 67f1f9b38c15b54d257a1efc544873b53905737f gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: e11574d0f9e35170a8bab2b8c700dc8a03082403036fd92bd7c4b974e81e6d4e all runs: OK false negative chance: 0.000 # git bisect good 67f1f9b38c15b54d257a1efc544873b53905737f Bisecting: 0 revisions left to test after this (roughly 0 steps) [22d9db9fd64a493525d692b32c556875b7254665] io_uring/sqpoll: don't attach to a thread that is canceling testing commit 22d9db9fd64a493525d692b32c556875b7254665 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 76b66f587d67c74509abd108fdb45f45d34e8ee1313099c32be3cf5ebe0d0e97 all runs: crashed: WARNING in io_sq_thread_stop representative crash: WARNING in io_sq_thread_stop, types: [WARNING] # git bisect bad 22d9db9fd64a493525d692b32c556875b7254665 22d9db9fd64a493525d692b32c556875b7254665 is the first bad commit commit 22d9db9fd64a493525d692b32c556875b7254665 Author: Jens Axboe Date: Fri Oct 30 07:27:28 2026 -0600 io_uring/sqpoll: don't attach to a thread that is canceling io_sq_offload_create() refuses to attach a ring to an SQPOLL thread that has already gone, by checking sqd->thread under sqd->lock. Since the thread drops the lock while io_uring_cancel_generic() waits for its requests, that check can run while the thread is on its way out and still see it. The new ring is then added to ctx_list, io_uring_setup() succeeds, the thread finishes canceling and exits without ever having looked at the ring, and io_uring_enter() fails with -EOWNERDEAD. Only a thread that exits on a fatal signal can be caught like this, as the stop bit is set once the last ring has let go of the sqd, when no fd is left to attach through. A fatal signal is group wide and attaching needs the same thread group, so the attacher is on its way out as well. Still, make the check see it: set the stop bit before canceling, whatever the reason for the exit, and test it when attaching. Reported-by: Karl Mehltretter Fixes: cb0306c52ffa ("io_uring/cancel: drop sqd->lock while SQPOLL waits") Signed-off-by: Jens Axboe io_uring/sqpoll.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) accumulated error probability: 0.00 culprit signature: 76b66f587d67c74509abd108fdb45f45d34e8ee1313099c32be3cf5ebe0d0e97 parent signature: cf47a1aa85a35af05531bfa5d9b08eed0bf867e973fc70c7b77c3cbcf2410406 revisions tested: 22, total time: 7h3m10.083084054s (build: 1h55m8.412416624s, test: 4h9m30.115676194s) first bad commit: 22d9db9fd64a493525d692b32c556875b7254665 io_uring/sqpoll: don't attach to a thread that is canceling recipients (to): ["axboe@kernel.dk"] recipients (cc): [] crash: WARNING in io_sq_thread_stop ------------[ cut here ]------------ test_bit(IO_SQ_THREAD_SHOULD_STOP, &sqd->state) WARNING: io_uring/sqpoll.c:88 at io_sq_thread_stop+0x58/0x70 io_uring/sqpoll.c:88, CPU#1: kworker/u8:5/647 Modules linked in: CPU: 1 UID: 0 PID: 647 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT(lazy) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 Workqueue: iou_exit io_ring_exit_work RIP: 0010:io_sq_thread_stop+0x58/0x70 io_uring/sqpoll.c:88 Code: 49 8b be a8 00 00 00 48 85 ff 74 12 65 48 8b 05 36 7e c0 01 48 39 c7 74 16 e8 e4 27 a2 ff 48 89 df 5b 41 5e e9 59 df 7e 00 90 <0f> 0b 90 eb ba 90 0f 0b 90 eb e4 66 66 66 66 2e 0f 1f 84 00 00 00 RSP: 0018:ffffc90001373d00 EFLAGS: 00010202 RAX: 0000000000000001 RBX: ffff888101ff4400 RCX: 0000000000000001 RDX: e4de76305a5c8f01 RSI: ffffffff827f6426 RDI: ffff888101ff4400 RBP: ffff8881000ad800 R08: 0000000000000000 R09: 00000000000004f0 R10: 0000000000080000 R11: ffffffff8128a570 R12: ffff888101f304d8 R13: ffff888101f30678 R14: ffff888101ff4400 R15: ffff888101ff4410 FS: 0000000000000000(0000) GS:ffff8882b482d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055557c6da918 CR3: 0000000002a48000 CR4: 00000000003506f0 Call Trace: io_put_sq_data+0x24/0x70 io_uring/sqpoll.c:105 io_sq_thread_finish+0x11e/0x150 io_uring/sqpoll.c:130 io_ring_ctx_free+0xb/0x240 io_uring/io_uring.c:2322 io_ring_exit_work+0x228/0x260 io_uring/io_uring.c:2658 process_one_work kernel/workqueue.c:3495 [inline] process_scheduled_works+0x309/0x5a0 kernel/workqueue.c:3578 worker_thread+0x22d/0x350 kernel/workqueue.c:3659 kthread+0x10d/0x140 kernel/kthread.c:436 ret_from_fork+0xf4/0x290 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245