ci2 starts bisection 2025-08-16 21:46:59.232089952 +0000 UTC m=+156436.784566514
bisecting cause commit starting from ee94b00c1a648530333d9734200be7a45e6e00cd
building syzkaller on 1804e95e3ff848c11e87e8efe7560f03c011c081
ensuring issue is reproducible on original commit ee94b00c1a648530333d9734200be7a45e6e00cd

testing commit ee94b00c1a648530333d9734200be7a45e6e00cd gcc
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
kernel signature: c1d85b15211ee4dc2689fd1c7996db1d0d70f530be0e02d52518a20ab8ab119f
run #0: crashed: BUG: unable to handle kernel paging request in preempt_schedule_irq
run #1: crashed: KASAN: stack-out-of-bounds Write in end_buffer_read_sync
run #2: crashed: KASAN: stack-out-of-bounds Write in end_buffer_read_sync
run #3: crashed: KASAN: slab-out-of-bounds Write in ntfs_read_run_nb
run #4: crashed: KASAN: slab-out-of-bounds Write in ntfs_read_run_nb
run #5: crashed: KASAN: slab-out-of-bounds Write in ntfs_read_run_nb
run #6: crashed: BUG: unable to handle kernel paging request in inode_insert5
run #7: crashed: KASAN: stack-out-of-bounds Write in end_buffer_read_sync
run #8: OK
run #9: OK
run #10: crashed: BUG: unable to handle kernel paging request in corrupted
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: stack-out-of-bounds Write in end_buffer_read_sync, types: [KASAN-WRITE MEMORY_SAFETY_BUG]
check whether we can drop unnecessary instrumentation
disabling configs for [hang memleak ubsan locking atomic_sleep], they are not needed
testing commit ee94b00c1a648530333d9734200be7a45e6e00cd gcc
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
kernel signature: a11adcfcbad374068e85bf2ad0bc03e9bafad33befe0a35bebb5d4937636dc38
run #0: crashed: KASAN: stack-out-of-bounds Write in end_buffer_read_sync
run #1: crashed: general protection fault in ntfs_iget5
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: stack-out-of-bounds Write in end_buffer_read_sync, types: [KASAN-WRITE DoS]
unable to determine the verdict: 18 good runs (wanted 15), for bad wanted 10 in total, got 20
kconfig minimization: base=4092 full=8349 leaves diff=2175
split chunks (needed=false): <2175>
split chunk #0 of len 2175 into 5 parts
testing without sub-chunk 1/5
testing commit ee94b00c1a648530333d9734200be7a45e6e00cd gcc
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
kernel signature: add5d602b36ee34e044b8db68078cd843c7f3dd26418e8a2dc1f981eaa37968a
run #0: crashed: invalid opcode in inode_insert5
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: invalid opcode in inode_insert5, types: [DoS]
unable to determine the verdict: 19 good runs (wanted 15), for bad wanted 10 in total, got 20
testing without sub-chunk 2/5
testing commit ee94b00c1a648530333d9734200be7a45e6e00cd gcc
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
kernel signature: 6a3bb2e22ffed18bbfcfaa834b5d0066bc60a2f635bea3e33ddda378ecfd78ec
run #0: crashed: KASAN: slab-out-of-bounds Write in ntfs_read_run_nb
run #1: crashed: KASAN: stack-out-of-bounds Write in end_buffer_read_sync
run #2: crashed: kernel panic: stack is corrupted in debug_object_activate
run #3: crashed: BUG: unable to handle kernel paging request in inode_insert5
run #4: crashed: KASAN: slab-out-of-bounds Write in ntfs_read_run_nb
run #5: crashed: KASAN: out-of-bounds Write in end_buffer_read_sync
run #6: crashed: KASAN: stack-out-of-bounds Write in end_buffer_read_sync
run #7: crashed: KASAN: stack-out-of-bounds Write in end_buffer_read_sync
run #8: crashed: general protection fault in rtlock_slowlock_locked
run #9: crashed: KASAN: stack-out-of-bounds Write in end_buffer_read_sync
run #10: crashed: KASAN: stack-out-of-bounds Write in end_buffer_read_sync
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: slab-out-of-bounds Write in ntfs_read_run_nb, types: [KASAN-WRITE]
the chunk can be dropped
testing without sub-chunk 3/5
testing commit ee94b00c1a648530333d9734200be7a45e6e00cd gcc
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
kernel signature: fa2ab62544e84ac2ab570d28eba335ca1b3c7d4d61a40c4860c43f34a91f8c1c
run #0: crashed: KASAN: stack-out-of-bounds Write in end_buffer_read_sync
run #1: crashed: KASAN: stack-out-of-bounds Write in end_buffer_read_sync
run #2: crashed: WARNING: stack going in the wrong direction? at asm_exc_general_protection
run #3: crashed: WARNING: stack going in the wrong direction? at asm_exc_general_protection
run #4: crashed: KASAN: stack-out-of-bounds Write in end_buffer_read_sync
run #5: crashed: BUG: unable to handle kernel paging request in preempt_schedule_irq
run #6: crashed: general protection fault in call_rcu
run #7: crashed: general protection fault in call_rcu
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: stack-out-of-bounds Write in end_buffer_read_sync, types: [KASAN-WRITE WARNING DoS]
the chunk can be dropped
testing without sub-chunk 4/5
testing commit ee94b00c1a648530333d9734200be7a45e6e00cd gcc
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
kernel signature: 38a4c02ed26aa91d64ede46d75d9afe4ba044e8c44bdec8374c72f88e3157165
all runs: OK
false negative chance: 0.000
testing without sub-chunk 5/5
testing commit ee94b00c1a648530333d9734200be7a45e6e00cd gcc
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
kernel signature: dedf82ffebb6c9fa09c641eedfbeca7a9946bf6acb97e49cd14bc28c1a8c10bd
run #0: crashed: BUG: unable to handle kernel paging request in preempt_schedule_irq
run #1: crashed: KASAN: stack-out-of-bounds Write in end_buffer_read_sync
run #2: crashed: KASAN: stack-out-of-bounds Write in end_buffer_read_sync
run #3: crashed: KASAN: slab-out-of-bounds Write in ntfs_read_run_nb
run #4: crashed: KASAN: slab-out-of-bounds Write in ntfs_read_run_nb
run #5: crashed: BUG: unable to handle kernel paging request in corrupted
run #6: crashed: general protection fault in call_rcu
run #7: crashed: KASAN: slab-out-of-bounds Write in ntfs_read_run_nb
run #8: crashed: BUG: unable to handle kernel paging request in preempt_schedule_irq
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: stack-out-of-bounds Write in end_buffer_read_sync, types: [KASAN-WRITE MEMORY_SAFETY_BUG]
the chunk can be dropped
minimized to 870 configs; suspects: [6LOWPAN 6LOWPAN_GHC_EXT_HDR_DEST 6LOWPAN_GHC_EXT_HDR_FRAG 6LOWPAN_GHC_EXT_HDR_HOP 6LOWPAN_GHC_EXT_HDR_ROUTE 6LOWPAN_GHC_ICMPV6 6LOWPAN_GHC_UDP 6LOWPAN_NHC 6LOWPAN_NHC_DEST 6LOWPAN_NHC_FRAGMENT 6LOWPAN_NHC_HOP 6LOWPAN_NHC_IPV6 6LOWPAN_NHC_MOBILITY 6LOWPAN_NHC_ROUTING 6LOWPAN_NHC_UDP 6PACK 842_COMPRESS 842_DECOMPRESS 9P_FSCACHE 9P_FS_POSIX_ACL 9P_FS_SECURITY ACORN_PARTITION ACORN_PARTITION_ADFS ACORN_PARTITION_CUMANA ACORN_PARTITION_EESOX ACORN_PARTITION_ICS ACORN_PARTITION_POWERTEC ACORN_PARTITION_RISCIX ACPI_NFIT ACPI_NHLT ACPI_PLATFORM_PROFILE ADFS_FS AFFS_FS AFS_FS AFS_FSCACHE AF_KCM AF_RXRPC AF_RXRPC_IPV6 AIX_PARTITION AMD_SFH_HID AMIGA_PARTITION ANDROID_BINDERFS ANDROID_BINDER_IPC ANON_VMA_NAME APERTURE_HELPERS APPLE_MFI_FASTCHARGE AR5523 ARCH_ENABLE_MEMORY_HOTREMOVE ARCH_HAS_CPU_ATTACK_VECTORS ARCH_HAS_USER_SHADOW_STACK ARCH_SUPPORTS_HUGETLBFS ASM_MODVERSIONS ASUS_TF103C_DOCK ASYNC_CORE ASYNC_MEMCPY ASYNC_PQ ASYNC_RAID6_RECOV ASYNC_TX_DMA ASYNC_XOR ATARI_PARTITION ATA_GENERIC ATA_OVER_ETH ATH10K ATH10K_CE ATH10K_LEDS ATH10K_PCI ATH10K_USB ATH11K ATH6KL ATH6KL_USB ATH9K ATH9K_AHB ATH9K_BTCOEX_SUPPORT ATH9K_CHANNEL_CONTEXT ATH9K_COMMON ATH9K_COMMON_DEBUG ATH9K_COMMON_SPECTRAL ATH9K_DEBUGFS ATH9K_DYNACK ATH9K_HTC ATH9K_HTC_DEBUGFS ATH9K_HW ATH9K_PCI ATH9K_PCOEM ATH9K_RFKILL ATH_COMMON ATM ATM_BR2684 ATM_CLIP ATM_DRIVERS ATM_LANE ATM_MPOA ATM_TCP AUXILIARY_BUS AX25 AX25_DAMA_SLAVE AX88796B_PHY BAREUDP BATMAN_ADV BATMAN_ADV_BATMAN_V BATMAN_ADV_BLA BATMAN_ADV_DAT BATMAN_ADV_MCAST BATMAN_ADV_NC BCACHE BCACHEFS_DEBUG BCACHEFS_ERASURE_CODING BCACHEFS_FS BCACHEFS_POSIX_ACL BCACHEFS_QUOTA BCACHEFS_SIX_OPTIMISTIC_SPIN BCMA BCMA_HOST_PCI_POSSIBLE BEFS_FS BFQ_CGROUP_DEBUG BFQ_GROUP_IOSCHED BFS_FS BIG_KEYS BLK_CGROUP_PUNT_BIO BLK_CGROUP_RWSTAT BLK_DEV_BSGLIB BLK_DEV_INITRD BLK_DEV_INTEGRITY BLK_DEV_NBD BLK_DEV_NULL_BLK BLK_DEV_NULL_BLK_FAULT_INJECTION BLK_DEV_NVME BLK_DEV_PMEM BLK_DEV_RAM BLK_DEV_RNBD BLK_DEV_RNBD_CLIENT BLK_DEV_THROTTLING BLK_ICQ BLK_INLINE_ENCRYPTION BLK_INLINE_ENCRYPTION_FALLBACK BLK_WBT BLK_WBT_MQ BONDING BOOT_VESA_SUPPORT BPF_EVENTS BPF_JIT BPF_JIT_ALWAYS_ON BPF_JIT_DEFAULT_ON BPF_LSM BPF_PRELOAD BPF_PRELOAD_UMD BPF_SYSCALL BPQETHER BRIDGE BRIDGE_CFM BRIDGE_EBT_802_3 BRIDGE_EBT_AMONG BRIDGE_EBT_ARP BRIDGE_EBT_ARPREPLY BRIDGE_EBT_DNAT BRIDGE_EBT_IP BRIDGE_EBT_IP6 BRIDGE_EBT_LIMIT BRIDGE_EBT_LOG BRIDGE_EBT_MARK BRIDGE_EBT_MARK_T BRIDGE_EBT_NFLOG BRIDGE_EBT_PKTTYPE BRIDGE_EBT_REDIRECT BRIDGE_EBT_SNAT BRIDGE_EBT_STP BRIDGE_EBT_VLAN BRIDGE_IGMP_SNOOPING BRIDGE_MRP BRIDGE_NF_EBTABLES BRIDGE_VLAN_FILTERING BSD_DISKLABEL BSD_PROCESS_ACCT_V3 BT BTRFS_ASSERT BTRFS_FS BTRFS_FS_POSIX_ACL BTRFS_FS_REF_VERIFY BTT BT_6LOWPAN BT_ATH3K BT_BCM BT_BNEP BT_BNEP_MC_FILTER BT_BNEP_PROTO_FILTER BT_BREDR BT_HCIBCM203X BT_HCIBFUSB BT_HCIBPA10X BT_HCIBTUSB BT_HCIBTUSB_AUTOSUSPEND BT_HCIBTUSB_BCM BT_HCIBTUSB_MTK BT_HCIBTUSB_POLL_SYNC BT_HCIBTUSB_RTL BT_HCIUART BT_HCIUART_3WIRE BT_HCIUART_AG6XX BT_HCIUART_BCSP BT_HCIUART_H4 BT_HCIUART_LL BT_HCIUART_MRVL BT_HCIUART_QCA BT_HCIUART_SERDEV BT_HCIVHCI BT_HIDP BT_INTEL BT_LE BT_LEDS BT_LE_L2CAP_ECRED BT_MRVL BT_MRVL_SDIO BT_MSFTEXT BT_MTK BT_MTKSDIO BT_MTKUART BT_QCA BT_RFCOMM BT_RFCOMM_TTY BT_RTL BXT_WC_PMIC_OPREGION CACHEFILES CAIF CAIF_DEBUG CAIF_DRIVERS CAIF_NETDEV CAIF_TTY CAIF_USB CAIF_VIRTIO CAN CAN_8DEV_USB CAN_BCM CAN_CALC_BITTIMING CAN_DEV CAN_EMS_USB CAN_ESD_USB CAN_ETAS_ES58X CAN_F81604 CAN_GS_USB CAN_GW CAN_IFI_CANFD CAN_ISOTP CAN_J1939 CAN_KVASER_USB CAN_MCBA_USB CAN_NETLINK CAN_PEAK_USB CAN_RAW CAN_RX_OFFLOAD CAN_SLCAN CAN_UCAN CAN_VCAN CAN_VXCAN CARL9170 CARL9170_HWRNG CARL9170_LEDS CARL9170_WPC CEC_CORE CEPH_FS CEPH_FSCACHE CEPH_FS_POSIX_ACL CEPH_LIB CEPH_LIB_USE_DNS_RESOLVER CFG80211 CFG80211_CRDA_SUPPORT CFG80211_DEBUGFS CFG80211_DEFAULT_PS CFG80211_REQUIRE_SIGNED_REGDB CFG80211_USE_KERNEL_REGDB_KEYS CFG80211_WEXT CFS_BANDWIDTH CHARGER_ISP1704 CHR_DEV_ST CIFS CIFS_ALLOW_INSECURE_LEGACY CIFS_DEBUG CIFS_DFS_UPCALL CIFS_FSCACHE CIFS_POSIX CIFS_SMB_DIRECT CIFS_SWN_UPCALL CIFS_UPCALL CIFS_XATTR CLOSURES CLS_U32_MARK CLS_U32_PERF CMA CMA_SIZE_SEL_MAX CMDLINE_PARTITION COMEDI COMEDI_8254 COMEDI_8255 COMEDI_8255_PCI COMEDI_8255_SA COMEDI_ADL_PCI9118 COMEDI_ADQ12B COMEDI_AIO_AIO12_8 COMEDI_AIO_IIRO_16 COMEDI_AMPLC_DIO200 COMEDI_AMPLC_DIO200_ISA COMEDI_AMPLC_PC236 COMEDI_AMPLC_PC236_ISA COMEDI_AMPLC_PC263_ISA COMEDI_BOND COMEDI_C6XDIGIO COMEDI_DAC02 COMEDI_DAS08 COMEDI_DAS08_ISA COMEDI_DAS16M1 COMEDI_DAS1800 COMEDI_DAS6402 COMEDI_DAS800 COMEDI_DMM32AT COMEDI_DT2801 COMEDI_DT2811 COMEDI_DT2814 COMEDI_DT2815 COMEDI_DT2817 COMEDI_DT282X COMEDI_DT9812 COMEDI_FL512 COMEDI_ISADMA COMEDI_ISA_DRIVERS COMEDI_KCOMEDILIB COMEDI_MISC_DRIVERS COMEDI_MPC624 COMEDI_MULTIQ3 COMEDI_NI_ATMIO16D COMEDI_NI_AT_A2150 COMEDI_NI_AT_AO COMEDI_NI_DAQ_700_CS COMEDI_NI_LABPC COMEDI_NI_LABPC_CS COMEDI_NI_LABPC_ISA COMEDI_NI_LABPC_ISADMA COMEDI_NI_LABPC_PCI COMEDI_NI_USB6501 COMEDI_PARPORT COMEDI_PCI_DRIVERS COMEDI_PCL711 COMEDI_PCL724 COMEDI_PCL726 COMEDI_PCL730 COMEDI_PCL812 COMEDI_PCL816 COMEDI_PCL818 COMEDI_PCM3724 COMEDI_PCMAD COMEDI_PCMCIA_DRIVERS COMEDI_PCMDA12 COMEDI_PCMMIO COMEDI_PCMUIO COMEDI_RTI800 COMEDI_RTI802 COMEDI_S526 COMEDI_TEST COMEDI_USBDUX COMEDI_USBDUXFAST COMEDI_USBDUXSIGMA COMEDI_USB_DRIVERS COMEDI_VMK80XX COMPAT_NETLINK_MESSAGES COUNTER CRAMFS CRAMFS_BLOCKDEV CRAMFS_MTD CRC64 CRC64_ARCH CRC8 CRC_ITU_T CRC_T10DIF CRC_T10DIF_ARCH CRYPTO_842 CRYPTO_ADIANTUM CRYPTO_AEGIS128 CRYPTO_AEGIS128_AESNI_SSE2 CRYPTO_AES_NI_INTEL CRYPTO_AES_TI CRYPTO_ANSI_CPRNG CRYPTO_ANUBIS CRYPTO_ARC4 CRYPTO_ARCH_HAVE_LIB_BLAKE2S CRYPTO_ARCH_HAVE_LIB_CHACHA CRYPTO_ARCH_HAVE_LIB_CURVE25519 CRYPTO_ARCH_HAVE_LIB_POLY1305 CRYPTO_ARIA CRYPTO_ARIA_AESNI_AVX_X86_64 CRYPTO_BLAKE2B CRYPTO_BLAKE2S_X86 CRYPTO_BLOWFISH CRYPTO_BLOWFISH_COMMON CRYPTO_BLOWFISH_X86_64 CRYPTO_CAMELLIA CRYPTO_CAMELLIA_AESNI_AVX2_X86_64 CRYPTO_CAMELLIA_AESNI_AVX_X86_64 CRYPTO_CAMELLIA_X86_64 CRYPTO_CAST5 CRYPTO_CAST5_AVX_X86_64 CRYPTO_CAST6 CRYPTO_CAST6_AVX_X86_64 CRYPTO_CAST_COMMON CRYPTO_CHACHA20 CRYPTO_CHACHA20POLY1305 CRYPTO_CHACHA20_X86_64 CRYPTO_CRC32C CRYPTO_CRYPTD CRYPTO_CTS CRYPTO_CURVE25519 CRYPTO_CURVE25519_X86 CRYPTO_DEFLATE CRYPTO_DES CRYPTO_DES3_EDE_X86_64 CRYPTO_DEV_CCP CRYPTO_DEV_CCP_DD CRYPTO_DEV_PADLOCK CRYPTO_DEV_PADLOCK_AES CRYPTO_DEV_PADLOCK_SHA CRYPTO_DEV_QAT CRYPTO_DEV_QAT_C3XXX CRYPTO_DEV_QAT_C3XXXVF CRYPTO_DEV_QAT_C62X CRYPTO_DEV_QAT_C62XVF CRYPTO_DEV_QAT_DH895xCC CRYPTO_DEV_QAT_DH895xCCVF CRYPTO_DEV_VIRTIO CRYPTO_DH CRYPTO_DRBG_CTR CRYPTO_DRBG_HASH CRYPTO_ECDH CRYPTO_ECRDSA CRYPTO_ENGINE CRYPTO_ESSIV CRYPTO_FCRYPT CRYPTO_GHASH_CLMUL_NI_INTEL CRYPTO_HCTR2 CRYPTO_HKDF CRYPTO_KDF800108_CTR CRYPTO_KHAZAD CRYPTO_KPP CRYPTO_KRB5 CRYPTO_KRB5ENC CRYPTO_LIB_ARC4 CRYPTO_LIB_CHACHA CRYPTO_LIB_CHACHA20POLY1305 CRYPTO_LIB_CHACHA_GENERIC CRYPTO_LIB_CURVE25519 CRYPTO_LIB_CURVE25519_GENERIC CRYPTO_LIB_CURVE25519_INTERNAL CRYPTO_LIB_DES CRYPTO_LIB_POLY1305 CRYPTO_LIB_POLY1305_GENERIC CRYPTO_LIB_SHA1_ARCH CRYPTO_LIB_SHA256_ARCH CRYPTO_LIB_SHA512 CRYPTO_LIB_SHA512_ARCH CRYPTO_LIB_SM3 CRYPTO_LRW CRYPTO_LZ4 CRYPTO_LZ4HC CRYPTO_MICHAEL_MIC CRYPTO_NHPOLY1305 CRYPTO_NHPOLY1305_AVX2 CRYPTO_NHPOLY1305_SSE2 CRYPTO_PCBC CRYPTO_PCRYPT CRYPTO_POLY1305_X86_64 CRYPTO_POLYVAL CRYPTO_POLYVAL_CLMUL_NI CRYPTO_RMD160 CRYPTO_SEED CRYPTO_SERPENT CRYPTO_SERPENT_AVX2_X86_64 CRYPTO_SERPENT_AVX_X86_64 CRYPTO_SERPENT_SSE2_X86_64 CRYPTO_SM3_AVX_X86_64 CRYPTO_SM4 CRYPTO_SM4_AESNI_AVX2_X86_64 CRYPTO_SM4_AESNI_AVX_X86_64 CRYPTO_SM4_GENERIC CRYPTO_STREEBOG CRYPTO_TEA CRYPTO_TWOFISH CRYPTO_TWOFISH_AVX_X86_64 CRYPTO_TWOFISH_COMMON CRYPTO_TWOFISH_X86_64 CRYPTO_TWOFISH_X86_64_3WAY CRYPTO_USER CRYPTO_USER_API CRYPTO_USER_API_AEAD CRYPTO_USER_API_ENABLE_OBSOLETE CRYPTO_USER_API_HASH CRYPTO_USER_API_RNG CRYPTO_USER_API_SKCIPHER CRYPTO_WP512 CRYPTO_XCBC CRYPTO_XCTR CRYPTO_XTS CRYPTO_XXHASH CRYPTO_ZSTD CUSE CYPRESS_FIRMWARE DAMON DAMON_PADDR DAMON_RECLAIM DAMON_VADDR DAX DCA DCB DEBUG_VFS DEFAULT_CODEL DEVICE_MIGRATION DLM DMA_CMA DRM DVB_CORE ENCRYPTED_KEYS EXTCON FSCACHE FUSE_FS GENEVE GPIOLIB HAMRADIO HAVE_CLK HID_NINTENDO HID_NVIDIA_SHIELD HID_PLAYSTATION HID_SENSOR_HUB HID_SMARTJOYPLUS HID_STEAM HID_THRUSTMASTER IIO INFINIBAND INFINIBAND_ADDR_TRANS INFINIBAND_IPOIB INFINIBAND_RTRS_CLIENT INFINIBAND_USER_ACCESS INFINIBAND_VIRT_DMA INPUT_TABLET INPUT_TOUCHSCREEN INTEL_SCU_IPC INTEL_SOC_PMIC_BXTWC IOSCHED_BFQ IP_SCTP ISA_BUS L2TP LEDS_CLASS_MULTICOLOR LIBNVDIMM MAC80211 MAC80211_DEBUGFS MAC80211_LEDS MEDIA_COMMON_OPTIONS MEDIA_DIGITAL_TV_SUPPORT MEDIA_PLATFORM_SUPPORT MEDIA_RADIO_SUPPORT MEDIA_SUPPORT MEDIA_USB_SUPPORT MEMORY_HOTPLUG MEMORY_HOTREMOVE MFD_DLN2 MFD_INTEL_PMC_BXT MFD_MT6360 MFD_MT6370 MFD_RETU MMC MTD MTD_UBI NETFILTER_CONNCOUNT NET_CLS_U32 NET_IPGRE NET_IPGRE_DEMUX NET_SCH_DEFAULT NFS_V4_1 NF_NAT_TFTP NF_SOCKET_IPV4 NF_SOCKET_IPV6 NF_TPROXY_IPV4 NF_TPROXY_IPV6 NILFS2_FS NINTENDO_FF NLMON NLS_CODEPAGE_1250 NLS_CODEPAGE_1251 NLS_CODEPAGE_737 NLS_CODEPAGE_775 NLS_CODEPAGE_850 NLS_CODEPAGE_852 NLS_CODEPAGE_855 NLS_CODEPAGE_857 NLS_CODEPAGE_860 NLS_CODEPAGE_861 NLS_CODEPAGE_862 NLS_CODEPAGE_863 NLS_CODEPAGE_864 NLS_CODEPAGE_865 NLS_CODEPAGE_866 NLS_CODEPAGE_869 NLS_CODEPAGE_874 NLS_CODEPAGE_932 NLS_CODEPAGE_936 NLS_CODEPAGE_949 NLS_CODEPAGE_950 NLS_ISO8859_13 NLS_ISO8859_14 NLS_ISO8859_15 NLS_ISO8859_2 NLS_ISO8859_3 NLS_ISO8859_4 NLS_ISO8859_5 NLS_ISO8859_6 NLS_ISO8859_7 NLS_ISO8859_8 NLS_ISO8859_9 NLS_KOI8_R NLS_KOI8_U NLS_MAC_CELTIC NLS_MAC_CENTEURO NLS_MAC_CROATIAN NLS_MAC_CYRILLIC NLS_MAC_GAELIC NLS_MAC_GREEK NLS_MAC_ICELAND NLS_MAC_INUIT NLS_MAC_ROMAN NLS_MAC_ROMANIAN NLS_MAC_TURKISH NLS_UCS2_UTILS NOZOMI NTFS3_FS NTFS3_FS_POSIX_ACL NTFS3_LZX_XPRESS NULL_TTY NUMA_EMU NUMA_KEEP_MEMINFO NVDIMM_DAX NVDIMM_KEYS NVDIMM_PFN NVIDIA_SHIELD_FF NVME_CORE NVME_FABRICS NVME_FC NVME_MULTIPATH NVME_RDMA NVME_TARGET NVME_TARGET_FC NVME_TARGET_FCLOOP NVME_TARGET_LOOP NVME_TARGET_RDMA NVME_TARGET_TCP NVME_TCP N_GSM N_HDLC OCFS2_DEBUG_FS OCFS2_FS OCFS2_FS_O2CB OCFS2_FS_STATS OCFS2_FS_USERSPACE_CLUSTER OF_GPIO OF_PMEM OMFS_FS OPENVSWITCH OPENVSWITCH_GENEVE OPENVSWITCH_GRE OPENVSWITCH_VXLAN ORANGEFS_FS OSF_PARTITION OVERLAY_FS OVERLAY_FS_DEBUG OVERLAY_FS_INDEX OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW OVERLAY_FS_REDIRECT_DIR PACKET_DIAG PAGE_IDLE_FLAG PAGE_REPORTING PAHOLE_HAS_BTF_TAG PAHOLE_HAS_LANG_EXCLUDE PAHOLE_HAS_SPLIT_BTF PARPORT PARPORT_NOT_PC PARTITION_ADVANCED PCCARD PCCARD_NONSTATIC PCIEAER PCI_ENDPOINT PCI_IOV PCMCIA PCMCIA_LOAD_CIS PERCPU_STATS PERSISTENT_KEYRINGS PHYLINK PHY_CPCAP_USB PHY_QCOM_USB_HS PHY_QCOM_USB_HSIC PHY_SAMSUNG_USB2 PHY_TUSB1210 PKCS7_TEST_KEY PKCS8_PRIVATE_KEY_PARSER PLAYSTATION_FF PLFXLC PMIC_OPREGION PM_CLK PNFS_BLOCK PNFS_FILE_LAYOUT PNFS_FLEXFILE_LAYOUT PPP PPPOATM PPPOE PPPOE_HASH_BITS_1 PPPOL2TP PPP_ASYNC PPP_BSDCOMP PPP_DEFLATE PPP_FILTER PPP_MPPE PPP_MULTILINK PPP_SYNC_TTY PPTP PREEMPT PREEMPT_NOTIFIERS PREEMPT_RT PROC_CHILDREN PSAMPLE PSI PSTORE PSTORE_COMPRESS QCOM_QMI_HELPERS QNX4FS_FS QNX6FS_FS QRTR QRTR_TUN RADIO_ADAPTERS RADIO_SHARK RADIO_SHARK2 RADIO_TEA575X RAID6_PQ RAID_ATTRS RC_ATI_REMOTE RC_CORE RC_DEVICES RC_XBOX_DVD RDMA_RXE RDMA_SIW RDS RDS_RDMA RDS_TCP REALTEK_AUTOPM REED_SOLOMON REED_SOLOMON_DEC8 REGMAP REGMAP_I2C REGMAP_IRQ REGMAP_MMIO REGMAP_SPI REGULATOR REGULATOR_FIXED_VOLTAGE REGULATOR_TWL4030 RESET_CONTROLLER RFKILL RFKILL_INPUT RFKILL_LEDS RMI4_2D_SENSOR RMI4_CORE RMI4_F03 RMI4_F03_SERIO RMI4_F11 RMI4_F12 RMI4_F30 RMI4_F3A ROMFS_BACKED_BY_BOTH ROMFS_FS ROMFS_ON_BLOCK ROMFS_ON_MTD ROSE RTC_DRV_HID_SENSOR_TIME RXKAD SCHED_CORE SCREEN_INFO SCSI_FC_ATTRS SCSI_HPSA SCSI_ISCSI_ATTRS SCSI_LOGGING SCSI_NETLINK SCSI_SAS_ATA SCSI_SAS_ATTRS SCSI_SAS_LIBSAS SCSI_SCAN_ASYNC SCSI_SRP_ATTRS SCTP_COOKIE_HMAC_MD5 SCTP_COOKIE_HMAC_SHA1 SCTP_DEFAULT_COOKIE_HMAC_MD5 SECONDARY_TRUSTED_KEYRING SECURITY_INFINIBAND SECURITY_NETWORK_XFRM SECURITY_SMACK_NETFILTER SENSORS_AQUACOMPUTER_D5NEXT SENSORS_CORSAIR_CPRO SENSORS_CORSAIR_PSU SENSORS_GIGABYTE_WATERFORCE SENSORS_NZXT_KRAKEN2 SENSORS_NZXT_SMART2 SENSORS_POWERZ SERIAL_DEV_BUS SERIAL_DEV_CTRL_TTYPORT SERIAL_MCTRL_GPIO SGI_PARTITION SIGNATURE SIGNED_PE_FILE_VERIFICATION SKB_DECRYPTED SLHC SLIP SLIP_COMPRESSED SLIP_MODE_SLIP6 SLIP_SMART SMARTJOYPLUS_FF SMBFS SMB_SERVER SMC SMC_DIAG SMSC_PHY SMS_SDIO_DRV SMS_SIANO_DEBUGFS SMS_SIANO_MDTV SMS_SIANO_RC SMS_USB_DRV SND SND_ALOOP SND_BCD2000 SND_CTL_FAST_LOOKUP SND_CTL_LED SND_DEBUG SND_DMA_SGBUF SND_DRIVERS SND_DUMMY SND_DYNAMIC_MINORS SND_HDA SND_HDA_CODEC_ALC260 SND_HDA_CODEC_ALC262 SND_HDA_CODEC_ALC268 SND_HDA_CODEC_ALC269 SND_HDA_CODEC_ALC662 SND_HDA_CODEC_ALC680 SND_HDA_CODEC_ALC861 SND_HDA_CODEC_ALC861VD SND_HDA_CODEC_ALC880 SND_HDA_CODEC_ALC882 SND_HDA_CODEC_ANALOG SND_HDA_CODEC_CA0110 SND_HDA_CODEC_CA0132 SND_HDA_CODEC_CIRRUS SND_HDA_CODEC_CMEDIA SND_HDA_CODEC_CONEXANT SND_HDA_CODEC_CS420X SND_HDA_CODEC_CS421X SND_HDA_CODEC_HDMI SND_HDA_CODEC_HDMI_ATI SND_HDA_CODEC_HDMI_GENERIC SND_HDA_CODEC_HDMI_INTEL SND_HDA_CODEC_HDMI_NVIDIA SND_HDA_CODEC_HDMI_NVIDIA_MCP SND_HDA_CODEC_HDMI_SIMPLE SND_HDA_CODEC_HDMI_TEGRA SND_HDA_CODEC_REALTEK SND_HDA_CODEC_REALTEK_LIB SND_HDA_CODEC_SI3054 SND_HDA_CODEC_SIGMATEL SND_HDA_CODEC_VIA SND_HDA_CORE SND_HDA_GENERIC SND_HDA_GENERIC_LEDS SND_HDA_HWDEP SND_HDA_INPUT_BEEP SND_HDA_INTEL SND_HDA_PATCH_LOADER SND_HDA_RECONFIG SND_HDA_SCODEC_COMPONENT SND_HRTIMER SND_HWDEP SND_INTEL_DSP_CONFIG SND_INTEL_NHLT SND_INTEL_SOUNDWIRE_ACPI SND_JACK SND_JACK_INPUT_DEV SND_MIXER_OSS SND_OSSEMUL SND_PCI SND_PCM SND_PCMCIA SND_PCM_ELD SND_PCM_OSS SND_PCM_OSS_PLUGINS SND_PCM_TIMER SND_PCM_XRUN_DEBUG SND_PROC_FS SND_RAWMIDI SND_SEQUENCER SND_SEQUENCER_OSS SND_SEQ_DEVICE SND_SEQ_DUMMY SND_SEQ_HRTIMER_DEFAULT SND_SEQ_MIDI SND_SEQ_MIDI_EVENT SND_SEQ_VIRMIDI SND_SOC SND_SOC_I2C_AND_SPI SND_SOC_SDCA_OPTIONAL SND_SUPPORT_OLD_API SND_TIMER SND_UMP SND_UMP_LEGACY_RAWMIDI SND_USB SND_USB_6FIRE SND_USB_AUDIO SND_USB_AUDIO_MIDI_V2 SND_USB_AUDIO_USE_MEDIA_CONTROLLER SND_USB_CAIAQ SND_USB_CAIAQ_INPUT SND_USB_HIFACE SND_USB_LINE6 SND_USB_POD SND_USB_PODHD SND_USB_TONEPORT SND_USB_UA101 SND_USB_US122L SND_USB_USX2Y SND_USB_VARIAX SND_VERBOSE_PROCFS SND_VIRMIDI SND_VIRTIO SND_VMASTER SND_X86 SOCK_VALIDATE_XMIT SOLARIS_X86_PARTITION SONY_FF SOUND SOUNDWIRE SOUND_OSS_CORE SOUND_OSS_CORE_PRECLAIM SPI SPI_DLN2 SPI_DYNAMIC SPI_LJCA SPI_MASTER SQUASHFS SQUASHFS_4K_DEVBLK_SIZE SQUASHFS_COMPILE_DECOMP_MULTI SQUASHFS_DECOMP_MULTI SQUASHFS_FILE_DIRECT SQUASHFS_LZ4 SQUASHFS_LZO SQUASHFS_XATTR SQUASHFS_XZ SQUASHFS_ZLIB SQUASHFS_ZSTD SSB SSB_PCIHOST_POSSIBLE SSB_PCMCIAHOST_POSSIBLE SSB_SDIOHOST_POSSIBLE STEAM_FF STP STREAM_PARSER SUNRPC_BACKCHANNEL SUN_PARTITION SURFACE_AGGREGATOR SURFACE_AGGREGATOR_BUS SURFACE_AGGREGATOR_REGISTRY SURFACE_HID SURFACE_HID_CORE SURFACE_KBD SW_SYNC SYSFB SYSFS_SYSCALL SYSV68_PARTITION TABLET_USB_ACECAD TABLET_USB_AIPTEK TABLET_USB_HANWANG TABLET_USB_KBTAB TABLET_USB_PEGASUS TAHVO_USB TAHVO_USB_HOST_BY_DEFAULT TCG_CRB TCG_TIS TCG_TIS_CORE TCG_TPM TCP_CONG_BBR TCP_CONG_BIC TCP_CONG_CDG TCP_CONG_DCTCP TCP_CONG_HSTCP TCP_CONG_HTCP TCP_CONG_HYBLA TCP_CONG_ILLINOIS TCP_CONG_LP TCP_CONG_NV TCP_CONG_SCALABLE TCP_CONG_VEGAS TCP_CONG_VENO TCP_CONG_WESTWOOD TCP_CONG_YEAH TEE TEXTSEARCH TEXTSEARCH_BM TEXTSEARCH_FSM TEXTSEARCH_KMP THRUSTMASTER_FF TIPC TIPC_CRYPTO TIPC_DIAG TIPC_MEDIA_IB TIPC_MEDIA_UDP TLS TLS_DEVICE TLS_TOE TMPFS_QUOTA TOOLS_SUPPORT_RELR TOUCHSCREEN_SUR40 TOUCHSCREEN_USB_3M TOUCHSCREEN_USB_COMPOSITE TOUCHSCREEN_USB_DMC_TSC10 TOUCHSCREEN_USB_E2I TOUCHSCREEN_USB_EASYTOUCH TOUCHSCREEN_USB_EGALAX TOUCHSCREEN_USB_ELO TOUCHSCREEN_USB_ETT_TC45USB TOUCHSCREEN_USB_ETURBO TOUCHSCREEN_USB_GENERAL_TOUCH TOUCHSCREEN_USB_GOTOP TOUCHSCREEN_USB_GUNZE TOUCHSCREEN_USB_IDEALTEK TOUCHSCREEN_USB_IRTOUCH TOUCHSCREEN_USB_ITM TOUCHSCREEN_USB_JASTEC TOUCHSCREEN_USB_NEXIO TOUCHSCREEN_USB_PANJIT TOUCHSCREEN_USB_ZYTRONIC TRACEFS_AUTOMOUNT_DEPRECATED TTPCI_EEPROM TTY_PRINTK TUN_VNET_CROSS_LE TWL4030_CORE TYPEC TYPEC_ANX7411 TYPEC_DP_ALTMODE TYPEC_FUSB302 TYPEC_HD3SS3220 TYPEC_MT6360 TYPEC_MUX_FSA4480 TYPEC_MUX_GPIO_SBU TYPEC_MUX_INTEL_PMC TYPEC_MUX_NB7VPQ904M TYPEC_MUX_PTN36502 TYPEC_MUX_WCD939X_USBSS TYPEC_NVIDIA_ALTMODE TYPEC_RT1711H TYPEC_RT1719 TYPEC_STUSB160X TYPEC_TCPCI TYPEC_TCPCI_MAXIM TYPEC_TCPCI_MT6370 TYPEC_TCPM TYPEC_TPS6598X TYPEC_UCSI TYPEC_WCOVE TYPEC_WUSB3801 UBIFS_ATIME_SUPPORT UBIFS_FS UBIFS_FS_ADVANCED_COMPR UBIFS_FS_LZO UBIFS_FS_SECURITY UBIFS_FS_XATTR UBIFS_FS_ZLIB UBIFS_FS_ZSTD UCSI_ACPI UCSI_CCG UCSI_STM32G0 UDF_FS UDMABUF UFS_FS UFS_FS_WRITE UHID ULTRIX_PARTITION UNICODE UNIXWARE_DISKLABEL UNIX_DIAG USB4 USB4_NET USBIP_CORE USBIP_HOST USBIP_VHCI_HCD USBIP_VUDC USBPCWATCHDOG USB_DWC2 USB_GADGET USB_LJCA USB_MUSB_HDRC USB_PHY USB_ROLE_SWITCH USB_STORAGE_REALTEK USB_ULPI_BUS VIDEO_DEV VLAN_8021Q VXLAN WANT_COMPAT_NETLINK_MESSAGES WEXT_CORE WIRELESS WLAN WLAN_VENDOR_ATH WLAN_VENDOR_PURELIFI ZONE_DEVICE]
picked [v6.16 v6.15 v6.14 v6.12 v6.10 v6.8 v6.6 v6.4 v6.1 v5.18 v5.15 v5.12 v5.9 v5.6 v5.3 v5.0 v4.19] out of 39 release tags
testing release v6.16
testing commit 038d61fd642278bab63ee8ef722c50d10ab01e8f gcc
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
kernel signature: 9fa45b510b7cf28916378e387abcbee4914813f44e77af75fcbfb1697d8c43de
run #0: crashed: KASAN: slab-out-of-bounds Write in ntfs_read_run_nb
run #1: crashed: KASAN: slab-out-of-bounds Write in ntfs_read_run_nb
run #2: crashed: BUG: unable to handle kernel paging request in preempt_schedule_irq
run #3: crashed: general protection fault in call_rcu
run #4: crashed: KASAN: stack-out-of-bounds Write in __unwind_start
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: slab-out-of-bounds Write in ntfs_read_run_nb, types: [KASAN-WRITE MEMORY_SAFETY_BUG]
testing release v6.15
testing commit 0ff41df1cb268fc69e703a08a57ee14ae967d0ca gcc
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
failed building 0ff41df1cb268fc69e703a08a57ee14ae967d0ca: ld.lld: error: undefined symbol: devm_drm_of_get_bridge
testing release v6.14
testing commit 38fec10eb60d687e30c8c6b5420d86e8149f7557 gcc
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
failed building 38fec10eb60d687e30c8c6b5420d86e8149f7557: ld.lld: error: undefined symbol: devm_drm_of_get_bridge
testing release v6.12
testing commit adc218676eef25575469234709c2d87185ca223a gcc
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
failed building adc218676eef25575469234709c2d87185ca223a: ld.lld: error: undefined symbol: devm_drm_of_get_bridge
testing release v6.10
testing commit 0c3836482481200ead7b416ca80c68a29cfdaabd gcc
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
failed building 0c3836482481200ead7b416ca80c68a29cfdaabd: ld.lld: error: undefined symbol: devm_drm_of_get_bridge
testing release v6.8
testing commit e8f897f4afef0031fe618a8e94127a0934896aba gcc
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
failed building e8f897f4afef0031fe618a8e94127a0934896aba: ./include/linux/thread_info.h:244:4: error: call to '__bad_copy_from' declared with 'error' attribute: copy source size is too small
drivers/nvme/target/fc.c:151:2: warning: 'counted_by' should not be applied to an array with element of unknown size because 'struct nvmet_fc_fcp_iod' is a struct type with a flexible array member. This will be an error in a future compiler version [-Wbounds-safety-counted-by-elt-type-unknown-size]
testing release v6.6
testing commit ffc253263a1375a65fa6c9f62a893e9767fbebfa gcc
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
failed building ffc253263a1375a65fa6c9f62a893e9767fbebfa: ./include/linux/thread_info.h:244:4: error: call to '__bad_copy_from' declared with 'error' attribute: copy source size is too small
testing release v6.4
testing commit 6995e2de6891c724bfeb2db33d7b87775f913ad1 gcc
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
failed building 6995e2de6891c724bfeb2db33d7b87775f913ad1: ./include/linux/thread_info.h:244:4: error: call to '__bad_copy_from' declared with 'error' attribute: copy source size is too small
testing release v6.1
testing commit 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 gcc
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
failed building 830b3c68c1fb1e9176028d02ef86f3cf76aa2476: ld.lld: error: version script assignment of 'LINUX_2.6' to symbol '__vdso_sgx_enter_enclave' failed: symbol not defined
llvm-objdump: error: 'arch/x86/entry/vdso/vdso64.so.dbg': No such file or directory
llvm-objcopy: error: 'arch/x86/entry/vdso/vdso64.so.dbg': No such file or directory
./include/linux/thread_info.h:228:4: error: call to '__bad_copy_from' declared with 'error' attribute: copy source size is too small
./include/linux/fortify-string.h:543:4: error: call to '__read_overflow' declared with 'error' attribute: detected read beyond size of object (1st parameter)
testing release v5.18
testing commit 4b0986a3613c92f4ec1bdc7f60ec66fea135991f gcc
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
failed building 4b0986a3613c92f4ec1bdc7f60ec66fea135991f: scripts/sign-file.c:89:14: warning: 'ERR_get_error_line' is deprecated [-Wdeprecated-declarations]
/usr/include/openssl/err.h:422:1: note: 'ERR_get_error_line' has been explicitly marked deprecated here
scripts/sign-file.c:102:9: warning: 'ERR_get_error_line' is deprecated [-Wdeprecated-declarations]
certs/extract-cert.c:46:14: warning: 'ERR_get_error_line' is deprecated [-Wdeprecated-declarations]
certs/extract-cert.c:59:9: warning: 'ERR_get_error_line' is deprecated [-Wdeprecated-declarations]
ld.lld: error: version script assignment of 'LINUX_2.6' to symbol '__vdso_sgx_enter_enclave' failed: symbol not defined
llvm-objdump: error: 'arch/x86/entry/vdso/vdso64.so.dbg': No such file or directory
llvm-objcopy: error: 'arch/x86/entry/vdso/vdso64.so.dbg': No such file or directory
testing release v5.15
testing commit 8bb7eca972ad531c9b149c0a51ab43a417385813 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 7e7348eeb38a6351d576722b709b730c7c799969c86229de57d02b13d09f2e33
run #0: crashed: KASAN: out-of-bounds Write in end_buffer_read_sync
run #1: crashed: INFO: task hung in ntfs_evict_inode
run #2: crashed: INFO: task hung in ntfs_evict_inode
run #3: OK
run #4: OK
run #5: crashed: KASAN: vmalloc-out-of-bounds Write in ntfs_evict_inode
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: out-of-bounds Write in end_buffer_read_sync, types: [KASAN-WRITE HANG]
testing release v5.12
testing commit 9f4ad9e425a1d3b6a34617b8ea226d56a119a717 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: fd7360cb541f060cb3c413d4d78fa102bbf73ecd081dcb1a0ac6c14ce2251032
all runs: OK
false negative chance: 0.000
# git bisect start 8bb7eca972ad531c9b149c0a51ab43a417385813 9f4ad9e425a1d3b6a34617b8ea226d56a119a717
Bisecting: 23811 revisions left to test after this (roughly 15 steps)
[bcb9928a155444dbd212473e60241ca0a7f641e1] net: dsa: properly check for the bridge_leave methods in dsa_switch_bridge_leave()

testing commit bcb9928a155444dbd212473e60241ca0a7f641e1 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 489e7408d61d9634b268ff698c028c557c80e8e21f77dee546d7703e0d92dba6
run #0: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #1: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #2: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #3: crashed: WARNING in update_blocked_averages
run #4: crashed: WARNING in update_blocked_averages
run #5: crashed: WARNING in update_blocked_averages
run #6: crashed: WARNING in update_blocked_averages
run #7: crashed: WARNING in update_blocked_averages
run #8: crashed: WARNING in update_blocked_averages
run #9: crashed: WARNING in update_blocked_averages
run #10: crashed: WARNING in update_blocked_averages
run #11: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #12: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #13: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #14: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #15: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #16: crashed: WARNING in update_blocked_averages
run #17: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #18: OK
run #19: OK
representative crash: BUG: sleeping function called from invalid context in lock_sock_nested, types: [ATOMIC_SLEEP WARNING]
# git bisect bad bcb9928a155444dbd212473e60241ca0a7f641e1
Bisecting: 11369 revisions left to test after this (roughly 14 steps)
[89dc6a9682919dbd64213c630a71eedaa021d7e5] mm/khugepaged.c: replace barrier() with READ_ONCE() for a selective variable

testing commit 89dc6a9682919dbd64213c630a71eedaa021d7e5 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 292f4bc22c83da9bf9aa9b68af3584a9081c0f56e62791bc69f81ba801c34455
all runs: OK
false negative chance: 0.000
# git bisect good 89dc6a9682919dbd64213c630a71eedaa021d7e5
Bisecting: 5682 revisions left to test after this (roughly 13 steps)
[9ed13a17e38e0537e24d9b507645002bf8d0201f] Merge tag 'net-5.13-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

testing commit 9ed13a17e38e0537e24d9b507645002bf8d0201f gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: e2727c8cb2457541c102c76771053095c76f7a2efa2794f2be33db7390497c54
run #0: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #1: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #2: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #3: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #4: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #5: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #6: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #7: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #8: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #9: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #10: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #11: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #12: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #13: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #14: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #15: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #16: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #17: OK
run #18: OK
run #19: OK
representative crash: BUG: sleeping function called from invalid context in lock_sock_nested, types: [ATOMIC_SLEEP]
# git bisect bad 9ed13a17e38e0537e24d9b507645002bf8d0201f
Bisecting: 2839 revisions left to test after this (roughly 12 steps)
[57151b502cbc0fa6ff9074a76883fa9d9eda322e] Merge tag 'pci-v5.13-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci

testing commit 57151b502cbc0fa6ff9074a76883fa9d9eda322e gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 297f401f7922eabbad1e7bd1d2ebe8005910c5ec6f9b2b72c482771c144eb69b
all runs: OK
false negative chance: 0.000
# git bisect good 57151b502cbc0fa6ff9074a76883fa9d9eda322e
Bisecting: 1419 revisions left to test after this (roughly 11 steps)
[b9231dfbcbc0034cf333fee33c190853daee48c0] Merge tag 'io_uring-5.13-2021-05-22' of git://git.kernel.dk/linux-block

testing commit b9231dfbcbc0034cf333fee33c190853daee48c0 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: a30c27846ec8cb7ec0cf93f7e66fbd9a25a3d2a1018f97fbf87d86d067c027fc
all runs: OK
false negative chance: 0.000
# git bisect good b9231dfbcbc0034cf333fee33c190853daee48c0
Bisecting: 709 revisions left to test after this (roughly 10 steps)
[263e88d678baa1a2e3f2d5afbdcd9fd3feb80a4d] proc: add .gitignore for proc-subset-pid selftest

testing commit 263e88d678baa1a2e3f2d5afbdcd9fd3feb80a4d gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 18dc88ff4b51fef148e25ec0e874a00bc641354fe8e2410cd7b8c0afad9fce44
all runs: OK
false negative chance: 0.000
# git bisect good 263e88d678baa1a2e3f2d5afbdcd9fd3feb80a4d
Bisecting: 352 revisions left to test after this (roughly 9 steps)
[99f925947ab0fd5c17b74460d8b32f1aa1c86e3a] Merge tag 'sched-urgent-2021-06-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

testing commit 99f925947ab0fd5c17b74460d8b32f1aa1c86e3a gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: a21e35759f2e9fa7cd477bc29134eb12ed5c2619ddb4267029bc78e1f72fe25a
run #0: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #1: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #2: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #3: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #4: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #5: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #6: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #7: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #8: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #9: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #10: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #11: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #12: OK
run #13: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: BUG: sleeping function called from invalid context in lock_sock_nested, types: [ATOMIC_SLEEP]
# git bisect bad 99f925947ab0fd5c17b74460d8b32f1aa1c86e3a
Bisecting: 168 revisions left to test after this (roughly 8 steps)
[decad3e1d1ed150588dd9d44beacf82295b9d5a5] Merge tag 'arm-soc-fixes-v5.13-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

testing commit decad3e1d1ed150588dd9d44beacf82295b9d5a5 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: efe113bdcb56ee31ff1bf9f14e0544a4c8a87b00df2c669355c1923eff21ac8c
run #0: basic kernel testing failed: WARNING: locking bug in get_page_from_freelist
run #1: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #2: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #3: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #4: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #5: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #6: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #7: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #8: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #9: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #10: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #11: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #12: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #13: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #14: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #15: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: BUG: sleeping function called from invalid context in lock_sock_nested, types: [ATOMIC_SLEEP]
# git bisect bad decad3e1d1ed150588dd9d44beacf82295b9d5a5
Bisecting: 93 revisions left to test after this (roughly 7 steps)
[dc680de28ca849dfe589dc15ac56d22505f0ef11] wireguard: allowedips: allocate nodes in kmem_cache

testing commit dc680de28ca849dfe589dc15ac56d22505f0ef11 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: adedbccfd1c04a06152cdbfb2fc425e3698bd5b6d875f38b2716574f2634c82c
run #0: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #1: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #2: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #3: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #4: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #5: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #6: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #7: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #8: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #9: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #10: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #11: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #12: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #13: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #14: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #15: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: BUG: sleeping function called from invalid context in lock_sock_nested, types: [ATOMIC_SLEEP]
# git bisect bad dc680de28ca849dfe589dc15ac56d22505f0ef11
Bisecting: 47 revisions left to test after this (roughly 6 steps)
[86b84066dc8fbb93221000e60946960cf7d54587] Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

testing commit 86b84066dc8fbb93221000e60946960cf7d54587 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 88b7bd4a8b8704d61a7ae54c4dd46e41c7661d17b0a58686d3ca3ec89c977b9e
all runs: OK
false negative chance: 0.000
# git bisect good 86b84066dc8fbb93221000e60946960cf7d54587
Bisecting: 20 revisions left to test after this (roughly 5 steps)
[5e7a2c6494813e58252caf342f5ddb166ad44d1a] Merge tag 'wireless-drivers-2021-06-03' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers

testing commit 5e7a2c6494813e58252caf342f5ddb166ad44d1a gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: de461ef8f332af0f0e79396497fb0cd1c5da70f5e311f434ede9c91aed9ca900
all runs: OK
false negative chance: 0.000
# git bisect good 5e7a2c6494813e58252caf342f5ddb166ad44d1a
Bisecting: 12 revisions left to test after this (roughly 3 steps)
[1a8024239dacf53fcf39c0f07fbf2712af22864f] virtio-net: fix for skb_over_panic inside big mode

testing commit 1a8024239dacf53fcf39c0f07fbf2712af22864f gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: cfc85f20a23c2c0320d049b09b35a2cd4c10bfb7bbeeb1e60b0d1a12f7c5624c
run #0: basic kernel testing failed: WARNING: locking bug in get_page_from_freelist
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
false negative chance: 0.000
# git bisect good 1a8024239dacf53fcf39c0f07fbf2712af22864f
Bisecting: 6 revisions left to test after this (roughly 3 steps)
[acf2492b51c9a3c4dfb947f4d3477a86d315150f] wireguard: selftests: remove old conntrack kconfig value

testing commit acf2492b51c9a3c4dfb947f4d3477a86d315150f gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: adedbccfd1c04a06152cdbfb2fc425e3698bd5b6d875f38b2716574f2634c82c
run #0: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #1: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #2: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #3: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #4: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #5: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #6: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #7: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #8: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #9: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #10: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #11: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #12: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #13: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: BUG: sleeping function called from invalid context in lock_sock_nested, types: [ATOMIC_SLEEP]
# git bisect bad acf2492b51c9a3c4dfb947f4d3477a86d315150f
Bisecting: 2 revisions left to test after this (roughly 2 steps)
[a83d958504734f78f42b1e3392d93816297e790a] Bluetooth: Fix VIRTIO_ID_BT assigned number

testing commit a83d958504734f78f42b1e3392d93816297e790a gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: a7721998ca01b1c495fbf91b02e8d10b5fe80a431be3b6b18268582c82c3d23d
run #0: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #1: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #2: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #3: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #4: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #5: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #6: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #7: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #8: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #9: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #10: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #11: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #12: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: BUG: sleeping function called from invalid context in lock_sock_nested, types: [ATOMIC_SLEEP]
# git bisect bad a83d958504734f78f42b1e3392d93816297e790a
Bisecting: 0 revisions left to test after this (roughly 1 step)
[e305509e678b3a4af2b3cfd410f409f7cdaabb52] Bluetooth: use correct lock to prevent UAF of hdev object

testing commit e305509e678b3a4af2b3cfd410f409f7cdaabb52 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: a7721998ca01b1c495fbf91b02e8d10b5fe80a431be3b6b18268582c82c3d23d
run #0: basic kernel testing failed: BUG: sleeping function called from invalid context in lock_sock_nested
run #1: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #2: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #3: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #4: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #5: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #6: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #7: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #8: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #9: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #10: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #11: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #12: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #13: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #14: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #15: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #16: OK
run #17: OK
run #18: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #19: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
representative crash: BUG: sleeping function called from invalid context in lock_sock_nested, types: [ATOMIC_SLEEP]
# git bisect bad e305509e678b3a4af2b3cfd410f409f7cdaabb52
Bisecting: 0 revisions left to test after this (roughly 0 steps)
[6a137caec23aeb9e036cdfd8a46dd8a366460e5d] Bluetooth: fix the erroneous flush_work() order

testing commit 6a137caec23aeb9e036cdfd8a46dd8a366460e5d gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 74f4ba253cebc38bbe0ecfdc76399340434252d7da6ca3941cdd12b067ade7c4
all runs: OK
false negative chance: 0.000
# git bisect good 6a137caec23aeb9e036cdfd8a46dd8a366460e5d
e305509e678b3a4af2b3cfd410f409f7cdaabb52 is the first bad commit
commit e305509e678b3a4af2b3cfd410f409f7cdaabb52
Author: Lin Ma <linma@zju.edu.cn>
Date:   Sun May 30 21:37:43 2021 +0800

    Bluetooth: use correct lock to prevent UAF of hdev object
    
    The hci_sock_dev_event() function will cleanup the hdev object for
    sockets even if this object may still be in used within the
    hci_sock_bound_ioctl() function, result in UAF vulnerability.
    
    This patch replace the BH context lock to serialize these affairs
    and prevent the race condition.
    
    Signed-off-by: Lin Ma <linma@zju.edu.cn>
    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

 net/bluetooth/hci_sock.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

accumulated error probability: 0.00
culprit signature: a7721998ca01b1c495fbf91b02e8d10b5fe80a431be3b6b18268582c82c3d23d
parent  signature: 74f4ba253cebc38bbe0ecfdc76399340434252d7da6ca3941cdd12b067ade7c4
reproducer is flaky (0.45 repro chance estimate)
revisions tested: 26, total time: 8h30m11.717577256s (build: 3h15m48.540241851s, test: 4h58m54.514671539s)
first bad commit: e305509e678b3a4af2b3cfd410f409f7cdaabb52 Bluetooth: use correct lock to prevent UAF of hdev object
recipients (to): ["linma@zju.edu.cn" "marcel@holtmann.org"]
recipients (cc): []
crash: BUG: sleeping function called from invalid context in lock_sock_nested
BUG: sleeping function called from invalid context at net/core/sock.c:3056
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 3555, name: syz-executor
INFO: lockdep is turned off.
CPU: 1 PID: 3555 Comm: syz-executor Not tainted 5.12.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0xa5/0xe6 lib/dump_stack.c:120
 ___might_sleep.cold+0x141/0x16f kernel/sched/core.c:8338
 lock_sock_nested+0x2c/0xf0 net/core/sock.c:3056
 lock_sock include/net/sock.h:1610 [inline]
 hci_sock_dev_event+0x3ed/0x5d0 net/bluetooth/hci_sock.c:765
 hci_unregister_dev+0x29b/0xfe0 net/bluetooth/hci_core.c:4013
 vhci_release+0x62/0xd0 drivers/bluetooth/hci_vhci.c:340
 __fput+0x1ff/0x870 fs/file_table.c:280
 task_work_run+0xc9/0x170 kernel/task_work.c:164
 exit_task_work include/linux/task_work.h:32 [inline]
 do_exit+0xa1e/0x23d0 kernel/exit.c:826
 do_group_exit+0xe7/0x2a0 kernel/exit.c:923
 get_signal+0x3ad/0x1c70 kernel/signal.c:2818
 arch_do_signal_or_restart+0x2b1/0x18e0 arch/x86/kernel/signal.c:789
 handle_signal_work kernel/entry/common.c:147 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
 exit_to_user_mode_prepare+0x164/0x230 kernel/entry/common.c:208
 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline]
 syscall_exit_to_user_mode+0x1a/0x60 kernel/entry/common.c:301
 do_syscall_64+0x4f/0x80 arch/x86/entry/common.c:57
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f795596b5fc
Code: Unable to access opcode bytes at RIP 0x7f795596b5d2.
RSP: 002b:00007ffc4f40ccd0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: fffffffffffffe00 RBX: 0000000000000003 RCX: 00007f795596b5fc
RDX: 0000000000000030 RSI: 00007ffc4f40cd90 RDI: 00000000000000f9
RBP: 00007ffc4f40cd3c R08: 0000000000000000 R09: 00007ffc4f40ca47
R10: 00007ffc4f40c690 R11: 0000000000000246 R12: 0000000000000001
R13: 00007f7955b5f280 R14: 0000000000010e2a R15: 00007ffc4f40cd90