ci starts bisection 2025-10-14 12:45:59.909820911 +0000 UTC m=+69713.441816030 bisecting cause commit starting from 52ba76324a9d7c39830c850999210a36ef023cde building syzkaller on b6605ba8b96835063c5eb766c38d27fac98b84d4 ensuring issue is reproducible on original commit 52ba76324a9d7c39830c850999210a36ef023cde testing commit 52ba76324a9d7c39830c850999210a36ef023cde gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 5176e155a575de6294bf5dd5c9c8d02949d8ef46c11e13b31669ce6bdc4b32c9 all runs: crashed: UBSAN: array-index-out-of-bounds in ocfs2_block_group_fill representative crash: UBSAN: array-index-out-of-bounds in ocfs2_block_group_fill, types: [MEMORY_SAFETY_UBSAN] check whether we can drop unnecessary instrumentation disabling configs for [atomic_sleep hang memleak bug_or_warning kasan locking], they are not needed testing commit 52ba76324a9d7c39830c850999210a36ef023cde gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: bc61fbdf92037d98ff43b872791fc8d991702cd46b095b5957826b64f680978b all runs: crashed: UBSAN: array-index-out-of-bounds in ocfs2_block_group_fill representative crash: UBSAN: array-index-out-of-bounds in ocfs2_block_group_fill, types: [MEMORY_SAFETY_UBSAN] the bug reproduces without the instrumentation disabling configs for [bug_or_warning kasan locking atomic_sleep hang memleak], they are not needed kconfig minimization: base=4115 full=8561 leaves diff=2152 split chunks (needed=false): <2152> split chunk #0 of len 2152 into 5 parts testing without sub-chunk 1/5 disabling configs for [kasan locking atomic_sleep hang memleak bug_or_warning], they are not needed testing commit 52ba76324a9d7c39830c850999210a36ef023cde gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: c84830cd988d8a2135af0c895c6dca82641448c3dcc5ac159973cd774dbbc4d6 all runs: crashed: UBSAN: array-index-out-of-bounds in ocfs2_block_group_fill representative crash: UBSAN: array-index-out-of-bounds in ocfs2_block_group_fill, types: [MEMORY_SAFETY_UBSAN] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [atomic_sleep hang memleak bug_or_warning kasan locking], they are not needed testing commit 52ba76324a9d7c39830c850999210a36ef023cde gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 09a6be450cdcab8ae4d46c081ee8c595518af5f24135920955113ffa49a5e81c all runs: crashed: UBSAN: array-index-out-of-bounds in ocfs2_block_group_fill representative crash: UBSAN: array-index-out-of-bounds in ocfs2_block_group_fill, types: [MEMORY_SAFETY_UBSAN] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [locking atomic_sleep hang memleak bug_or_warning kasan], they are not needed testing commit 52ba76324a9d7c39830c850999210a36ef023cde gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: eea8da34f99f075bf2a5db862ed1079a6c566d3581226bdeba17805eee46086b all runs: crashed: UBSAN: array-index-out-of-bounds in ocfs2_block_group_fill representative crash: UBSAN: array-index-out-of-bounds in ocfs2_block_group_fill, types: [MEMORY_SAFETY_UBSAN] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [bug_or_warning kasan locking atomic_sleep hang memleak], they are not needed testing commit 52ba76324a9d7c39830c850999210a36ef023cde gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 7473bb6e6443b25f870d0082d5dd75bbe5a2f027f4a271400d745af191e1abe1 all runs: OK false negative chance: 0.000 testing without sub-chunk 5/5 disabling configs for [locking atomic_sleep hang memleak bug_or_warning kasan], they are not needed testing commit 52ba76324a9d7c39830c850999210a36ef023cde gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 625abe7545517fd206898eaf393bf195eb2eccc8a9921725b64818e4b782d5c5 all runs: crashed: UBSAN: array-index-out-of-bounds in ocfs2_block_group_fill representative crash: UBSAN: array-index-out-of-bounds in ocfs2_block_group_fill, types: [MEMORY_SAFETY_UBSAN] the chunk can be dropped minimized to 431 configs; suspects: [AF_RXRPC ARCH_ENABLE_MEMORY_HOTREMOVE ATM AX25 BT BT_BREDR BT_HIDP BXT_WC_PMIC_OPREGION CFG80211 CMA DAX DIBS DLM DMABUF_HEAPS DRM DVB_CORE ENCRYPTED_KEYS EXTCON GENDWARFKSYMS GENEVE GPIOLIB HAMRADIO HAVE_CLK HID_NINTENDO HID_NVIDIA_SHIELD HID_PLAYSTATION HID_SENSOR_HUB HID_SMARTJOYPLUS HID_STEAM HID_THRUSTMASTER IIO INFINIBAND INFINIBAND_ADDR_TRANS INFINIBAND_IPOIB INFINIBAND_USER_ACCESS INFINIBAND_VIRT_DMA INPUT_TABLET INPUT_TOUCHSCREEN INTEL_SCU_IPC INTEL_SOC_PMIC_BXTWC IP_SCTP L2TP LEDS_CLASS_MULTICOLOR LIBNVDIMM MAC80211 MEDIA_COMMON_OPTIONS MEDIA_DIGITAL_TV_SUPPORT MEDIA_PLATFORM_SUPPORT MEDIA_RADIO_SUPPORT MEDIA_SDR_SUPPORT MEDIA_SUPPORT MEDIA_USB_SUPPORT MEMORY_HOTPLUG MEMORY_HOTREMOVE MFD_DLN2 MFD_INTEL_PMC_BXT MFD_MT6360 MFD_MT6370 MFD_RETU MMC MODVERSIONS MTD MTD_UBI NETFILTER_ADVANCED NETFILTER_CONNCOUNT NET_IPGRE NET_IPGRE_DEMUX NFS_V4_1 NF_CONNTRACK_SNMP NF_DUP_IPV6 NF_DUP_NETDEV NF_FLOW_TABLE NF_FLOW_TABLE_INET NF_NAT_AMANDA NF_NAT_H323 NF_NAT_OVS NF_NAT_PPTP NF_NAT_REDIRECT NF_NAT_SNMP_BASIC NF_NAT_TFTP NF_SOCKET_IPV4 NF_SOCKET_IPV6 NF_TABLES NF_TABLES_NETDEV NF_TPROXY_IPV4 NF_TPROXY_IPV6 NILFS2_FS NINTENDO_FF NLMON NLS_CODEPAGE_1250 NLS_CODEPAGE_1251 NLS_CODEPAGE_737 NLS_CODEPAGE_775 NLS_CODEPAGE_850 NLS_CODEPAGE_852 NLS_CODEPAGE_855 NLS_CODEPAGE_857 NLS_CODEPAGE_860 NLS_CODEPAGE_861 NLS_CODEPAGE_862 NLS_CODEPAGE_863 NLS_CODEPAGE_864 NLS_CODEPAGE_865 NLS_CODEPAGE_866 NLS_CODEPAGE_869 NLS_CODEPAGE_874 NLS_CODEPAGE_932 NLS_CODEPAGE_936 NLS_CODEPAGE_949 NLS_CODEPAGE_950 NLS_ISO8859_13 NLS_ISO8859_14 NLS_ISO8859_15 NLS_ISO8859_2 NLS_ISO8859_3 NLS_ISO8859_4 NLS_ISO8859_5 NLS_ISO8859_6 NLS_ISO8859_7 NLS_ISO8859_8 NLS_ISO8859_9 NLS_KOI8_R NLS_KOI8_U NLS_MAC_CELTIC NLS_MAC_CENTEURO NLS_MAC_CROATIAN NLS_MAC_CYRILLIC NLS_MAC_GAELIC NLS_MAC_GREEK NLS_MAC_ICELAND NLS_MAC_INUIT NLS_MAC_ROMAN NLS_MAC_ROMANIAN NLS_MAC_TURKISH NLS_UCS2_UTILS NOZOMI NTFS3_FS NTFS3_FS_POSIX_ACL NTFS3_LZX_XPRESS NULL_TTY NUMA_BALANCING NUMA_BALANCING_DEFAULT_ENABLED NUMA_EMU NUMA_KEEP_MEMINFO NVDIMM_DAX NVDIMM_KEYS NVDIMM_PFN NVIDIA_SHIELD_FF NVME_CORE NVME_FABRICS NVME_FC NVME_MULTIPATH NVME_RDMA NVME_TARGET NVME_TARGET_FC NVME_TARGET_FCLOOP NVME_TARGET_LOOP NVME_TARGET_RDMA NVME_TARGET_TCP NVME_TCP N_GSM N_HDLC OCFS2_DEBUG_FS OCFS2_FS OCFS2_FS_O2CB OCFS2_FS_STATS OCFS2_FS_USERSPACE_CLUSTER OF_GPIO OF_PMEM OMFS_FS OPENVSWITCH OPENVSWITCH_GENEVE OPENVSWITCH_GRE OPENVSWITCH_VXLAN OPTEE_STATIC_PROTMEM_POOL ORANGEFS_FS OSF_PARTITION OVERLAY_FS OVERLAY_FS_DEBUG OVERLAY_FS_INDEX OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW OVERLAY_FS_REDIRECT_DIR PACKET_DIAG PAGE_IDLE_FLAG PAGE_REPORTING PAHOLE_HAS_BTF_TAG PAHOLE_HAS_LANG_EXCLUDE PAHOLE_HAS_SPLIT_BTF PARPORT PARPORT_NOT_PC PARTITION_ADVANCED PCCARD PCCARD_NONSTATIC PCIEAER PCI_ENDPOINT PCI_IOV PCMCIA PCMCIA_LOAD_CIS PERCPU_STATS PERSISTENT_KEYRINGS PHYLINK PHY_CPCAP_USB PHY_QCOM_USB_HS PHY_QCOM_USB_HSIC PHY_SAMSUNG_USB2 PHY_TUSB1210 PKCS7_TEST_KEY PKCS8_PRIVATE_KEY_PARSER PLAYSTATION_FF PLFXLC PMIC_OPREGION PM_CLK PNFS_BLOCK PNFS_FILE_LAYOUT PNFS_FLEXFILE_LAYOUT POSIX_AUX_CLOCKS PPP PPPOATM PPPOE PPPOE_HASH_BITS_1 PPPOL2TP PPP_ASYNC PPP_BSDCOMP PPP_DEFLATE PPP_FILTER PPP_MPPE PPP_MULTILINK PPP_SYNC_TTY PPTP PREEMPT PREEMPT_NOTIFIERS PROC_CHILDREN PSAMPLE PSI PSTORE PSTORE_COMPRESS QCOM_QMI_HELPERS QNX4FS_FS QNX6FS_FS QRTR QRTR_TUN RADIO_ADAPTERS RADIO_SHARK RADIO_SHARK2 RADIO_TEA575X RAID6_PQ RAID_ATTRS RC_ATI_REMOTE RC_CORE RC_DEVICES RC_XBOX_DVD RDMA_RXE RDMA_SIW RDS RDS_RDMA RDS_TCP READ_ONLY_THP_FOR_FS REALTEK_AUTOPM REED_SOLOMON REED_SOLOMON_DEC8 REGMAP REGMAP_I2C REGMAP_IRQ REGMAP_MMIO REGMAP_SPI REGULATOR REGULATOR_FIXED_VOLTAGE REGULATOR_TWL4030 RESET_CONTROLLER RFKILL RFKILL_INPUT RFKILL_LEDS RMI4_2D_SENSOR RMI4_CORE RMI4_F03 RMI4_F03_SERIO RMI4_F11 RMI4_F12 RMI4_F30 RMI4_F3A ROMFS_BACKED_BY_BOTH ROMFS_FS ROMFS_ON_BLOCK ROMFS_ON_MTD ROSE RTC_DRV_HID_SENSOR_TIME RUST RXKAD SAMPLES SCHED_CORE SCREEN_INFO SCSI_FC_ATTRS SCSI_HPSA SCSI_ISCSI_ATTRS SCSI_LOGGING SCSI_NETLINK SCSI_SAS_ATA SCSI_SAS_ATTRS SCSI_SAS_LIBSAS SCSI_SCAN_ASYNC SCSI_SRP_ATTRS SCTP_DEFAULT_COOKIE_HMAC_NONE SECONDARY_TRUSTED_KEYRING SECURITY_INFINIBAND SECURITY_NETWORK_XFRM SENSORS_AQUACOMPUTER_D5NEXT SENSORS_CORSAIR_CPRO SENSORS_CORSAIR_PSU SENSORS_GIGABYTE_WATERFORCE SENSORS_NZXT_KRAKEN2 SENSORS_NZXT_SMART2 SENSORS_POWERZ SERIAL_DEV_BUS SERIAL_DEV_CTRL_TTYPORT SERIAL_MCTRL_GPIO SGI_PARTITION SIGNATURE SIGNED_PE_FILE_VERIFICATION SKB_DECRYPTED SLHC SLIP SLIP_COMPRESSED SLIP_MODE_SLIP6 SLIP_SMART SMARTJOYPLUS_FF SMBFS SMB_SERVER SMC SMC_DIAG SMSC_PHY SMS_SDIO_DRV SMS_SIANO_DEBUGFS SMS_SIANO_MDTV SMS_SIANO_RC SMS_USB_DRV SND SND_ALOOP SND_BCD2000 SND_CTL_FAST_LOOKUP SND_CTL_LED SND_DEBUG SND_DMA_SGBUF SND_DRIVERS SND_DUMMY SND_HDA SND_HDA_CODEC_ANALOG SND_HDA_CODEC_CA0110 SND_HDA_CODEC_CA0132 SND_HDA_CODEC_CIRRUS SND_HDA_CODEC_CMEDIA SND_HDA_CODEC_CONEXANT SND_HDA_CODEC_HDMI SND_HDA_CODEC_REALTEK SND_HDA_CODEC_SI3054 SND_HDA_CODEC_SIGMATEL SND_HDA_CODEC_VIA SND_HDA_COMPONENT SND_HDA_CORE SND_HDA_GENERIC SND_HDA_GENERIC_LEDS SND_HDA_HWDEP SND_HDA_I915 SND_HDA_INPUT_BEEP SND_HDA_INTEL SND_HDA_PATCH_LOADER SND_HDA_RECONFIG SND_HRTIMER SND_HWDEP SND_INTEL_DSP_CONFIG SND_INTEL_NHLT SND_INTEL_SOUNDWIRE_ACPI SND_JACK SND_JACK_INPUT_DEV SND_MIXER_OSS SND_OSSEMUL SND_PCI SND_PCM SND_PCMCIA SND_PCM_OSS SND_PCM_OSS_PLUGINS SND_PCM_TIMER SND_PCM_XRUN_DEBUG SND_PROC_FS SND_RAWMIDI SND_SEQUENCER SND_SEQUENCER_OSS SND_SEQ_DEVICE SND_SEQ_DUMMY SND_SEQ_HRTIMER_DEFAULT SND_SEQ_MIDI SND_SEQ_MIDI_EVENT SND_SEQ_VIRMIDI SND_SOC SND_SOC_I2C_AND_SPI SND_SOC_SDCA_OPTIONAL SND_SUPPORT_OLD_API SND_TIMER SND_UMP SND_UMP_LEGACY_RAWMIDI SND_USB SND_USB_6FIRE SND_USB_AUDIO SND_USB_AUDIO_MIDI_V2 SND_USB_AUDIO_USE_MEDIA_CONTROLLER SND_USB_CAIAQ SND_USB_CAIAQ_INPUT SND_USB_HIFACE SND_USB_LINE6 SND_USB_POD SND_USB_PODHD SND_USB_TONEPORT SND_USB_UA101 SND_USB_US122L SND_USB_USX2Y SND_USB_VARIAX SND_VERBOSE_PROCFS SND_VIRMIDI SND_VIRTIO SND_VMASTER SND_X86 SOCK_VALIDATE_XMIT SOLARIS_X86_PARTITION SONY_FF SOUND SOUNDWIRE SOUND_OSS_CORE SOUND_OSS_CORE_PRECLAIM SPI SPI_DLN2 SPI_DYNAMIC SPI_LJCA SPI_MASTER SQUASHFS SQUASHFS_4K_DEVBLK_SIZE SQUASHFS_COMPILE_DECOMP_MULTI SQUASHFS_DECOMP_MULTI SQUASHFS_FILE_DIRECT SQUASHFS_LZ4 SQUASHFS_LZO SQUASHFS_XATTR SQUASHFS_XZ SQUASHFS_ZLIB SQUASHFS_ZSTD SSB SSB_PCIHOST_POSSIBLE SSB_PCMCIAHOST_POSSIBLE SSB_SDIOHOST_POSSIBLE STEAM_FF STP STREAM_PARSER SUNRPC_BACKCHANNEL SUN_PARTITION SURFACE_AGGREGATOR SURFACE_AGGREGATOR_BUS SURFACE_AGGREGATOR_REGISTRY SURFACE_HID SURFACE_HID_CORE SURFACE_KBD SW_SYNC SYSFB SYSFS_SYSCALL SYSV68_PARTITION TABLET_USB_ACECAD TABLET_USB_AIPTEK TABLET_USB_HANWANG TABLET_USB_KBTAB TABLET_USB_PEGASUS TAHVO_USB TAHVO_USB_HOST_BY_DEFAULT TCG_CRB TCG_TIS TCG_TIS_CORE TCG_TPM TCP_CONG_BBR TCP_CONG_BIC TCP_CONG_CDG TCP_CONG_DCTCP TCP_CONG_HSTCP TCP_CONG_HTCP TCP_CONG_HYBLA TCP_CONG_ILLINOIS TCP_CONG_LP TCP_CONG_NV TCP_CONG_SCALABLE TCP_CONG_VEGAS TCP_CONG_VENO TCP_CONG_WESTWOOD TCP_CONG_YEAH TEE TEE_DMABUF_HEAPS TEXTSEARCH TEXTSEARCH_BM TEXTSEARCH_FSM TEXTSEARCH_KMP THP_SWAP THRUSTMASTER_FF TIPC TIPC_CRYPTO TIPC_DIAG TIPC_MEDIA_IB TIPC_MEDIA_UDP TLS TLS_TOE TMPFS_QUOTA TOOLS_SUPPORT_RELR TOUCHSCREEN_SUR40 TOUCHSCREEN_USB_3M TOUCHSCREEN_USB_COMPOSITE TOUCHSCREEN_USB_DMC_TSC10 TOUCHSCREEN_USB_E2I TOUCHSCREEN_USB_EASYTOUCH TOUCHSCREEN_USB_EGALAX TOUCHSCREEN_USB_ELO TOUCHSCREEN_USB_ETT_TC45USB TOUCHSCREEN_USB_ETURBO TOUCHSCREEN_USB_GENERAL_TOUCH TOUCHSCREEN_USB_GOTOP TOUCHSCREEN_USB_GUNZE TOUCHSCREEN_USB_IDEALTEK TOUCHSCREEN_USB_IRTOUCH TOUCHSCREEN_USB_ITM TOUCHSCREEN_USB_JASTEC TOUCHSCREEN_USB_NEXIO TOUCHSCREEN_USB_PANJIT TOUCHSCREEN_USB_ZYTRONIC TRANSPARENT_HUGEPAGE TRANSPARENT_HUGEPAGE_MADVISE TTPCI_EEPROM TTY_PRINTK TUN_VNET_CROSS_LE TWL4030_CORE TYPEC TYPEC_ANX7411 TYPEC_DP_ALTMODE TYPEC_FUSB302 TYPEC_HD3SS3220 TYPEC_MT6360 TYPEC_MUX_FSA4480 TYPEC_MUX_GPIO_SBU TYPEC_MUX_INTEL_PMC TYPEC_MUX_NB7VPQ904M TYPEC_MUX_PTN36502 TYPEC_MUX_WCD939X_USBSS TYPEC_NVIDIA_ALTMODE TYPEC_RT1711H TYPEC_RT1719 TYPEC_STUSB160X TYPEC_TCPCI TYPEC_TCPCI_MAXIM TYPEC_TCPCI_MT6370 TYPEC_TCPM TYPEC_TPS6598X TYPEC_UCSI TYPEC_WCOVE TYPEC_WUSB3801 UBIFS_ATIME_SUPPORT UBIFS_FS UBIFS_FS_ADVANCED_COMPR UBIFS_FS_LZO UBIFS_FS_SECURITY UBIFS_FS_XATTR UBIFS_FS_ZLIB UBIFS_FS_ZSTD UCSI_ACPI UCSI_CCG UCSI_STM32G0 UDF_FS UDMABUF UFS_FS UFS_FS_WRITE UHID ULTRIX_PARTITION UNICODE UNIXWARE_DISKLABEL UNIX_DIAG USB4 USB4_NET USBIP_CORE USBIP_HOST USBIP_VHCI_HCD USBIP_VUDC USBPCWATCHDOG USB_ACM USB_ADUTUX USB_AIRSPY USB_ALI_M5632 USB_DWC2 USB_GADGET USB_LJCA USB_MUSB_HDRC USB_NET_CDC_SUBSET USB_ROLE_SWITCH USB_STORAGE_REALTEK USB_ULPI_BUS USB_USBNET VIDEO_DEV VXLAN WIRELESS WLAN WLAN_VENDOR_PURELIFI ZONE_DEVICE] disabling configs for [kasan locking atomic_sleep hang memleak bug_or_warning], they are not needed picked [v6.17 v6.16 v6.15 v6.13 v6.11 v6.9 v6.7 v6.5 v6.2 v5.19 v5.16 v5.13 v5.10 v5.7 v5.4 v5.1 v4.19] out of 40 release tags testing release v6.17 testing commit e5f0a698b34ed76002dc5cff3804a61c80233a7a gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 72e7ac13f14ced3bbb57af094a25e4d672a042138dac7e76d7a42e00537f3ce3 all runs: OK false negative chance: 0.000 # git bisect start 52ba76324a9d7c39830c850999210a36ef023cde e5f0a698b34ed76002dc5cff3804a61c80233a7a Bisecting: 7063 revisions left to test after this (roughly 13 steps) [f79e772258df311c2cb21594ca0996318e720d28] Merge tag 'media/v6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media testing commit f79e772258df311c2cb21594ca0996318e720d28 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: ad73ce130cf4a15ffab7828e6a1c20357a8c9e0ba16ff052a2ed285804f2c0ce run #0: ignore: lost connection to test machine run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK false negative chance: 0.000 # git bisect good f79e772258df311c2cb21594ca0996318e720d28 Bisecting: 3501 revisions left to test after this (roughly 12 steps) [908057d185a41560a55890afa69c9676fc63e55c] Merge tag 'v6.18-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 testing commit 908057d185a41560a55890afa69c9676fc63e55c gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 83eab9fc1966c9e8dad4ac06328506124276cc58c4da21ac22b7f54b093efea7 all runs: OK false negative chance: 0.000 # git bisect good 908057d185a41560a55890afa69c9676fc63e55c Bisecting: 1731 revisions left to test after this (roughly 11 steps) [522ba450b56fff29f868b1552bdc2965f55de7ed] Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux testing commit 522ba450b56fff29f868b1552bdc2965f55de7ed gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 5905e4438a13f21abbb65a561342b878777b71a9121d72d37a81a92e29c6e2ad run #0: ignore: lost connection to test machine run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK false negative chance: 0.000 # git bisect good 522ba450b56fff29f868b1552bdc2965f55de7ed Bisecting: 869 revisions left to test after this (roughly 10 steps) [ac70d4bb24d1497665a8708d04dc2b2fd729f2fe] Merge branch 'at91-next' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux.git testing commit ac70d4bb24d1497665a8708d04dc2b2fd729f2fe gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: cee0cf9cb70fe68c850664788fcf75f4985651daa939a113bc1bc6f8f66d82c7 all runs: crashed: UBSAN: array-index-out-of-bounds in ocfs2_block_group_fill representative crash: UBSAN: array-index-out-of-bounds in ocfs2_block_group_fill, types: [MEMORY_SAFETY_UBSAN] # git bisect bad ac70d4bb24d1497665a8708d04dc2b2fd729f2fe Bisecting: 432 revisions left to test after this (roughly 9 steps) [aac31903329ba73ef24674df78252b6610cc9d60] Merge tag 'i2c-for-6.18-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux testing commit aac31903329ba73ef24674df78252b6610cc9d60 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 846aa77947545097511178ec615f51413a59e5e2aa33135fdf4466073c343fdd all runs: OK false negative chance: 0.000 # git bisect good aac31903329ba73ef24674df78252b6610cc9d60 Bisecting: 210 revisions left to test after this (roughly 8 steps) [9591fdb0611dccdeeeeacb99d89f0098737d209b] Merge tag 'x86_core_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip testing commit 9591fdb0611dccdeeeeacb99d89f0098737d209b gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: e2210aa6bd1787b722333cc88d5c126a276c82422bb1e91e6f51ff001e4a46db all runs: OK false negative chance: 0.000 # git bisect good 9591fdb0611dccdeeeeacb99d89f0098737d209b Bisecting: 103 revisions left to test after this (roughly 7 steps) [e7f7618fddfbafdb5ffb467298ee5f27ef564e59] Merge branch 'for-current' of https://git.kernel.org/pub/scm/linux/kernel/git/ath/ath.git testing commit e7f7618fddfbafdb5ffb467298ee5f27ef564e59 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 413488652f601372edb5f5063a0d1a51c0ff85a0d27e3524fc5a39749c98303f all runs: OK false negative chance: 0.000 # git bisect good e7f7618fddfbafdb5ffb467298ee5f27ef564e59 Bisecting: 55 revisions left to test after this (roughly 6 steps) [349ee8059221645207b285b50a727f20ffb58062] Merge branch 'fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc.git testing commit 349ee8059221645207b285b50a727f20ffb58062 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: a24f78e854fcaf3ddc7762842483badd9b3f8172873feff2b8a864b6f01b71d2 all runs: OK false negative chance: 0.000 # git bisect good 349ee8059221645207b285b50a727f20ffb58062 Bisecting: 21 revisions left to test after this (roughly 5 steps) [e2e1c4c0d49213eeea946832c4a6fe4469a9b1e7] Merge branch 'mm-nonmm-unstable' of https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm testing commit e2e1c4c0d49213eeea946832c4a6fe4469a9b1e7 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 3307a28110aa09b296d70e3cc292efc8656051ae1a8267233dce45a4cafb888d all runs: crashed: UBSAN: array-index-out-of-bounds in ocfs2_block_group_fill representative crash: UBSAN: array-index-out-of-bounds in ocfs2_block_group_fill, types: [MEMORY_SAFETY_UBSAN] # git bisect bad e2e1c4c0d49213eeea946832c4a6fe4469a9b1e7 Bisecting: 16 revisions left to test after this (roughly 4 steps) [a5bec166921da711415b3d62ee26ea783ab2499b] CREDITS: update Martin's information testing commit a5bec166921da711415b3d62ee26ea783ab2499b gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 8f5fbd24ccac2dff9bc9a4e82528d1c7c20e4e62a090b67e3f2b290bc082212d all runs: OK false negative chance: 0.000 # git bisect good a5bec166921da711415b3d62ee26ea783ab2499b Bisecting: 8 revisions left to test after this (roughly 3 steps) [852947be66b826c3d0ba328e19a3559fdf7ac726] riscv: kprobes: convert one final __ASSEMBLY__ to __ASSEMBLER__ testing commit 852947be66b826c3d0ba328e19a3559fdf7ac726 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 02cf4db1444be7dd4321cb0a08468851d6fde7a345b7dc6d0665908a609bb1b2 all runs: OK false negative chance: 0.000 # git bisect good 852947be66b826c3d0ba328e19a3559fdf7ac726 Bisecting: 4 revisions left to test after this (roughly 2 steps) [50bbb854548f3b261ac1b48ecfdf83344820ec15] Merge branch 'for-linux-next-fixes' of https://gitlab.freedesktop.org/drm/misc/kernel.git testing commit 50bbb854548f3b261ac1b48ecfdf83344820ec15 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: c714d15212a9486e1a2ef7404750f318ef2b1c984d04c4a4f236da59669c9ab9 all runs: OK false negative chance: 0.000 # git bisect good 50bbb854548f3b261ac1b48ecfdf83344820ec15 Bisecting: 2 revisions left to test after this (roughly 1 step) [8de04872494d12e8e4053b43994b855291680efd] treewide: drop outdated compiler version remarks in Kconfig help texts testing commit 8de04872494d12e8e4053b43994b855291680efd gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 6a7cc13cdfdd77f8e33e0b0cf367c824c45d775d0993d3aeacdb8cceeaed3829 all runs: OK false negative chance: 0.000 # git bisect good 8de04872494d12e8e4053b43994b855291680efd Bisecting: 0 revisions left to test after this (roughly 1 step) [dd3818d28262a49266f806e339b5c016ef34b9e4] ocfs2: add extra consistency check to ocfs2_dx_dir_lookup_rec() testing commit dd3818d28262a49266f806e339b5c016ef34b9e4 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 783fde8d1a284372ca9d3dc8074fea0b73eae14fea03eeabaacef146a89c73e2 all runs: crashed: UBSAN: array-index-out-of-bounds in ocfs2_block_group_fill representative crash: UBSAN: array-index-out-of-bounds in ocfs2_block_group_fill, types: [MEMORY_SAFETY_UBSAN] # git bisect bad dd3818d28262a49266f806e339b5c016ef34b9e4 Bisecting: 0 revisions left to test after this (roughly 0 steps) [aa545adbe491402cf1e664f6be0a799ed69d9946] ocfs2: annotate flexible array members with __counted_by_le() testing commit aa545adbe491402cf1e664f6be0a799ed69d9946 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 26b16e3cf2eb03d075e7f2880fc18390953462cc1f27446008e41b1bbf2ec24b all runs: crashed: UBSAN: array-index-out-of-bounds in ocfs2_block_group_fill representative crash: UBSAN: array-index-out-of-bounds in ocfs2_block_group_fill, types: [MEMORY_SAFETY_UBSAN] # git bisect bad aa545adbe491402cf1e664f6be0a799ed69d9946 aa545adbe491402cf1e664f6be0a799ed69d9946 is the first bad commit commit aa545adbe491402cf1e664f6be0a799ed69d9946 Author: Dmitry Antipov Date: Tue Oct 7 15:35:26 2025 +0300 ocfs2: annotate flexible array members with __counted_by_le() Annotate flexible array members of 'struct ocfs2_extent_list', 'struct ocfs2_chain_list', 'struct ocfs2_truncate_log', 'struct ocfs2_dx_entry_list', 'ocfs2_refcount_list' and 'struct ocfs2_xattr_header' with '__counted_by_le()' attribute to improve array bounds checking when CONFIG_UBSAN_BOUNDS is enabled. Link: https://lkml.kernel.org/r/20251007123526.213150-1-dmantipov@yandex.ru Signed-off-by: Dmitry Antipov Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton fs/ocfs2/ocfs2_fs.h | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) accumulated error probability: 0.00 culprit signature: 26b16e3cf2eb03d075e7f2880fc18390953462cc1f27446008e41b1bbf2ec24b parent signature: 6a7cc13cdfdd77f8e33e0b0cf367c824c45d775d0993d3aeacdb8cceeaed3829 revisions tested: 23, total time: 12h36m46.340495429s (build: 8h49m41.010039714s, test: 3h3m2.743656374s) first bad commit: aa545adbe491402cf1e664f6be0a799ed69d9946 ocfs2: annotate flexible array members with __counted_by_le() recipients (to): ["akpm@linux-foundation.org" "dmantipov@yandex.ru" "joseph.qi@linux.alibaba.com"] recipients (cc): [] crash: UBSAN: array-index-out-of-bounds in ocfs2_block_group_fill and is ignored by this kernel. Remove the mand option from the mount to silence this warning. ======================================================= JBD2: Ignoring recovery information on journal ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in fs/ocfs2/suballoc.c:380:22 index 0 is out of range for type 'struct ocfs2_chain_rec[] __counted_by(cl_count)' (aka 'struct ocfs2_chain_rec[]') CPU: 1 UID: 0 PID: 3725 Comm: syz.3.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Call Trace: dump_stack_lvl+0xa2/0xf0 lib/dump_stack.c:120 ubsan_epilogue+0x5/0x30 lib/ubsan.c:233 __ubsan_handle_out_of_bounds+0xa2/0xc0 lib/ubsan.c:455 ocfs2_block_group_fill+0x316/0x320 fs/ocfs2/suballoc.c:380 ocfs2_block_group_alloc_contig fs/ocfs2/suballoc.c:454 [inline] ocfs2_block_group_alloc fs/ocfs2/suballoc.c:699 [inline] ocfs2_reserve_suballoc_bits+0x63a/0x17b0 fs/ocfs2/suballoc.c:834 ocfs2_reserve_new_metadata_blocks+0x106/0x320 fs/ocfs2/suballoc.c:984 ocfs2_expand_inline_dir fs/ocfs2/dir.c:2845 [inline] ocfs2_extend_dir+0x7eb/0x1da0 fs/ocfs2/dir.c:3207 ocfs2_prepare_dir_for_insert+0x142d/0x22e0 fs/ocfs2/dir.c:4312 ocfs2_mknod+0x295/0xf50 fs/ocfs2/namei.c:297 ocfs2_mkdir+0x66/0x160 fs/ocfs2/namei.c:659 vfs_mkdir+0xc8/0x170 fs/namei.c:4453 do_mkdirat+0xaf/0x250 fs/namei.c:4486 __do_sys_mkdirat fs/namei.c:4503 [inline] __se_sys_mkdirat fs/namei.c:4501 [inline] __x64_sys_mkdirat+0x27/0x40 fs/namei.c:4501 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x8f/0x250 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f245af8d617 Code: 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f245be6ae68 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 00007f245be6aef0 RCX: 00007f245af8d617 RDX: 00000000000001ff RSI: 0000200000000680 RDI: 00000000ffffff9c RBP: 0000200000000080 R08: 0000200000000140 R09: 0000000000000000 R10: 0000200000000080 R11: 0000000000000246 R12: 0000200000000680 R13: 00007f245be6aeb0 R14: 0000000000000000 R15: 0000000000000000 ---[ end trace ]---