ci2 starts bisection 2026-09-21 04:23:56.716238591 +0000 UTC m=+249888.092913494 bisecting fixing commit since 92668decd5e08edc7a6c138256abd2c37c4970f2 building syzkaller on 905244d6537a0eefec986eb013d2066d6db33d15 ensuring issue is reproducible on original commit 92668decd5e08edc7a6c138256abd2c37c4970f2 testing commit 92668decd5e08edc7a6c138256abd2c37c4970f2 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 461e38b277306a627ee0e2bff7d17c497dd2ee9e156850fd266b9dba99a52d07 all runs: crashed: general protection fault in __is_local_mountpoint representative crash: general protection fault in __is_local_mountpoint, types: [DoS] check whether we can drop unnecessary instrumentation disabling configs for [bug_or_warning kasan locking atomic_sleep hang memleak ubsan], they are not needed testing commit 92668decd5e08edc7a6c138256abd2c37c4970f2 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 7ff400d86e4034f7dec83f409931420a6e1c28af1f01dbd149b439e7b2b92b02 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint representative crash: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint, types: [NULL-POINTER-DEREFERENCE] the bug reproduces without the instrumentation disabling configs for [hang memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed kconfig minimization: base=5186 full=6558 leaves diff=267 split chunks (needed=false): <267> split chunk #0 of len 267 into 5 parts testing without sub-chunk 1/5 disabling configs for [hang memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed testing commit 92668decd5e08edc7a6c138256abd2c37c4970f2 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 3aafe04d5816fae0fc5a82b1481d5ab21d8fa640c5ad5c5cabc951b95f408c67 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint representative crash: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint, types: [NULL-POINTER-DEREFERENCE] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [hang memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed testing commit 92668decd5e08edc7a6c138256abd2c37c4970f2 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 71b119936438f2be7c6b9a78ea39305de2094f74904ef136b8b68a3945e0cbf4 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint representative crash: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint, types: [NULL-POINTER-DEREFERENCE] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [hang memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed testing commit 92668decd5e08edc7a6c138256abd2c37c4970f2 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 5a036272b4ddf9cfe5868470cec963685db3006fda3d75e5d05cb0d976658710 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint representative crash: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint, types: [NULL-POINTER-DEREFERENCE] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [hang memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed testing commit 92668decd5e08edc7a6c138256abd2c37c4970f2 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 2645c28b3aa2d61a145bf6e5e6d6e27f1ea33497aa43ca4c75f23c8b6c7fe60b all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint representative crash: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint, types: [NULL-POINTER-DEREFERENCE] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [hang memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed testing commit 92668decd5e08edc7a6c138256abd2c37c4970f2 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 failed building 92668decd5e08edc7a6c138256abd2c37c4970f2: ld.lld: error: undefined symbol: wext_proc_init ld.lld: error: undefined symbol: wext_proc_exit ld.lld: error: undefined symbol: wext_handle_ioctl ld.lld: error: undefined symbol: compat_wext_handle_ioctl minimized to 51 configs; suspects: [HAVE_CLK HID_ZEROPLUS USB_NET_CDC_SUBSET USB_NET_CDC_SUBSET_ENABLE USB_NET_DM9601 USB_NET_GL620A USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM V4L2_ASYNC V4L2_FWNODE VIDEO_CAMERA_SENSOR WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_PURELIFI WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_SILABS WLAN_VENDOR_ZYDAS ZEROPLUS_FF] disabling configs for [ubsan bug_or_warning kasan locking atomic_sleep hang memleak], they are not needed testing current HEAD 8cef8b5b11b787631242c233cd45d2f0e112fbfb testing commit 8cef8b5b11b787631242c233cd45d2f0e112fbfb gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 9ec253306f41ef04aed62318d990c3c6ff602469205af2e4a1df0957bc372e95 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint representative crash: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint, types: [NULL-POINTER-DEREFERENCE] crash still not fixed/happens on the oldest tested release revisions tested: 7, total time: 2h21m18.817839609s (build: 1h7m46.377355213s, test: 55m11.762794522s) crash still not fixed or there were kernel test errors commit msg: ANDROID: fuse-bpf: Handle backing getattr errors crash: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint BUG: kernel NULL pointer dereference, address: 0000000000000018 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP CPU: 0 PID: 477 Comm: syz.2.19 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:__is_local_mountpoint+0x1b/0x80 fs/namespace.c:749 Code: 90 90 90 90 90 90 90 90 90 90 b8 68 f8 85 c5 55 48 89 e5 41 57 41 56 53 49 89 fe 65 48 8b 05 2c bd bb 7e 48 8b 80 38 08 00 00 <4c> 8b 78 18 48 c7 c7 90 69 2f 83 e8 f5 5e c5 00 49 8d 5f 30 48 89 RSP: 0018:ffffc90000a2bbc8 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffff88810d90edd0 RCX: 0000000000000000 RDX: 00000000ffff992d RSI: 0000000500000000 RDI: ffff88810d90edd0 RBP: ffffc90000a2bbe0 R08: 0000000010000004 R09: 0000000000000000 R10: ffffc90000a2bb00 R11: ffffffff8168e140 R12: ffff8881003433e0 R13: 0000000000000000 R14: ffff88810d90edd0 R15: ffff88810db96628 FS: 0000000000000000(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000018 CR3: 000000010bb07000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: is_local_mountpoint fs/mount.h:141 [inline] vfs_rmdir+0x5d/0x170 fs/namei.c:4190 incfs_kill_sb+0x4e/0x90 fs/incfs/vfs.c:1995 deactivate_locked_super+0x40/0x90 fs/super.c:336 deactivate_super+0x37/0x40 fs/super.c:367 cleanup_mnt+0xde/0x120 fs/namespace.c:1192 __cleanup_mnt+0xd/0x10 fs/namespace.c:1199 task_work_run+0x90/0xb0 kernel/task_work.c:203 exit_task_work include/linux/task_work.h:39 [inline] do_exit+0x2cb/0xb20 kernel/exit.c:896 do_group_exit+0x98/0xa0 kernel/exit.c:1040 get_signal+0x68b/0x770 kernel/signal.c:2904 arch_do_signal_or_restart+0x8b/0x640 arch/x86/kernel/signal.c:871 exit_to_user_mode_loop+0x7a/0xb0 kernel/entry/common.c:174 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fb5cd59e0d9 Code: Unable to access opcode bytes at 0x7fb5cd59e0af. RSP: 002b:00007fb5ce4130e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007fb5cd825fa8 RCX: 00007fb5cd59e0d9 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fb5cd825fa8 RBP: 00007fb5cd825fa0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fb5cd826038 R14: 00007ffd5b815fa0 R15: 00007ffd5b816088 Modules linked in: CR2: 0000000000000018 ---[ end trace 0000000000000000 ]--- RIP: 0010:__is_local_mountpoint+0x1b/0x80 fs/namespace.c:749 Code: 90 90 90 90 90 90 90 90 90 90 b8 68 f8 85 c5 55 48 89 e5 41 57 41 56 53 49 89 fe 65 48 8b 05 2c bd bb 7e 48 8b 80 38 08 00 00 <4c> 8b 78 18 48 c7 c7 90 69 2f 83 e8 f5 5e c5 00 49 8d 5f 30 48 89 RSP: 0018:ffffc90000a2bbc8 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffff88810d90edd0 RCX: 0000000000000000 RDX: 00000000ffff992d RSI: 0000000500000000 RDI: ffff88810d90edd0 RBP: ffffc90000a2bbe0 R08: 0000000010000004 R09: 0000000000000000 R10: ffffc90000a2bb00 R11: ffffffff8168e140 R12: ffff8881003433e0 R13: 0000000000000000 R14: ffff88810d90edd0 R15: ffff88810db96628 FS: 0000000000000000(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000018 CR3: 000000010bb07000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 90 nop 1: 90 nop 2: 90 nop 3: 90 nop 4: 90 nop 5: 90 nop 6: 90 nop 7: 90 nop 8: 90 nop 9: 90 nop a: b8 68 f8 85 c5 mov $0xc585f868,%eax f: 55 push %rbp 10: 48 89 e5 mov %rsp,%rbp 13: 41 57 push %r15 15: 41 56 push %r14 17: 53 push %rbx 18: 49 89 fe mov %rdi,%r14 1b: 65 48 8b 05 2c bd bb mov %gs:0x7ebbbd2c(%rip),%rax # 0x7ebbbd4f 22: 7e 23: 48 8b 80 38 08 00 00 mov 0x838(%rax),%rax * 2a: 4c 8b 78 18 mov 0x18(%rax),%r15 <-- trapping instruction 2e: 48 c7 c7 90 69 2f 83 mov $0xffffffff832f6990,%rdi 35: e8 f5 5e c5 00 call 0xc55f2f 3a: 49 8d 5f 30 lea 0x30(%r15),%rbx 3e: 48 rex.W 3f: 89 .byte 0x89