ci2 starts bisection 2026-10-11 13:26:05.392167259 +0000 UTC m=+158010.831288635 bisecting cause commit starting from a5ebb76233b79db01e82e061173cb73c6d2b5c6b building syzkaller on 1e72964b0111319984575e60f266d1fa0a98abb5 ensuring issue is reproducible on original commit a5ebb76233b79db01e82e061173cb73c6d2b5c6b testing commit a5ebb76233b79db01e82e061173cb73c6d2b5c6b gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 94e6f25618b898fd97677833742a6a6162d13355804944869f0ff6df32e3631d all runs: crashed: KASAN: slab-use-after-free Write in pn_bind representative crash: KASAN: slab-use-after-free Write in pn_bind, types: [KASAN-USE-AFTER-FREE-WRITE] check whether we can drop unnecessary instrumentation disabling configs for [ubsan bug_or_warning locking atomic_sleep hang memleak], they are not needed testing commit a5ebb76233b79db01e82e061173cb73c6d2b5c6b gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: c1970647baec07dfc740c52c577021a5522f058481974490d8ae09e8ac895e30 all runs: crashed: KASAN: slab-use-after-free Write in pn_bind representative crash: KASAN: slab-use-after-free Write in pn_bind, types: [KASAN-USE-AFTER-FREE-WRITE] the bug reproduces without the instrumentation disabling configs for [ubsan bug_or_warning locking atomic_sleep hang memleak], they are not needed kconfig minimization: base=4169 full=8454 leaves diff=2102 split chunks (needed=false): <2102> split chunk #0 of len 2102 into 5 parts testing without sub-chunk 1/5 disabling configs for [bug_or_warning locking atomic_sleep hang memleak ubsan], they are not needed testing commit a5ebb76233b79db01e82e061173cb73c6d2b5c6b gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: e2c57c515d8ee33000f6e3b4153af363e24eeca4619751adb09b2c3db14d8e65 run #0: crashed: KASAN: slab-use-after-free Write in pn_bind run #1: crashed: KASAN: slab-use-after-free Write in pn_bind run #2: crashed: KASAN: slab-use-after-free Write in pn_bind run #3: crashed: KASAN: slab-use-after-free Write in pn_bind run #4: crashed: KASAN: slab-use-after-free Write in pn_bind run #5: crashed: KASAN: slab-use-after-free Write in pn_bind run #6: crashed: KASAN: slab-use-after-free Write in pn_bind run #7: crashed: KASAN: slab-use-after-free Write in pn_bind run #8: crashed: KASAN: slab-use-after-free Write in pn_bind run #9: OK representative crash: KASAN: slab-use-after-free Write in pn_bind, types: [KASAN-USE-AFTER-FREE-WRITE] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [ubsan bug_or_warning locking atomic_sleep hang memleak], they are not needed testing commit a5ebb76233b79db01e82e061173cb73c6d2b5c6b gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 5c5d186a72a3975f414a086a3996086a1b3f6a3c6dabe81044cfcd702e8495db all runs: crashed: KASAN: slab-use-after-free Write in pn_bind representative crash: KASAN: slab-use-after-free Write in pn_bind, types: [KASAN-USE-AFTER-FREE-WRITE] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [locking atomic_sleep hang memleak ubsan bug_or_warning], they are not needed testing commit a5ebb76233b79db01e82e061173cb73c6d2b5c6b gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: e883c795e8cceeeb787a539a1320e0095230768b8a91d35a046f44b771fba08b all runs: crashed: KASAN: slab-use-after-free Write in pn_bind representative crash: KASAN: slab-use-after-free Write in pn_bind, types: [KASAN-USE-AFTER-FREE-WRITE] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [locking atomic_sleep hang memleak ubsan bug_or_warning], they are not needed testing commit a5ebb76233b79db01e82e061173cb73c6d2b5c6b gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: ccceb461cd0c8fb23fcf18a45201ed1878594e4e3b36b2b642676af854cbd058 all runs: crashed: KASAN: slab-use-after-free Write in pn_bind representative crash: KASAN: slab-use-after-free Write in pn_bind, types: [KASAN-USE-AFTER-FREE-WRITE] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [atomic_sleep hang memleak ubsan bug_or_warning locking], they are not needed testing commit a5ebb76233b79db01e82e061173cb73c6d2b5c6b gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: d6d29209571333e2114b9d9948c081bf7e9109f28289dbe93fe4b5472f5015cb all runs: OK false negative chance: 0.000 minimized to 418 configs; suspects: [ATM BCMA BLK_DEV_ZONED BPF_SYSCALL CARDBUS CFG80211 CFG80211_WEXT COMMON_CLK CONTIG_ALLOC DVB_CORE EXTCON GPIOLIB HAVE_ARCH_USERFAULTFD_WP HID_ZEROPLUS I2C_MUX IIO IOMMUFD KVM KVM_INTEL LIBNVDIMM MEDIA_ANALOG_TV_SUPPORT MEDIA_CAMERA_SUPPORT MEDIA_CEC_SUPPORT MEDIA_CONTROLLER MEDIA_DIGITAL_TV_SUPPORT MEDIA_RADIO_SUPPORT MEDIA_SDR_SUPPORT MEDIA_SUPPORT MEDIA_TEST_SUPPORT MEDIA_USB_SUPPORT MEMORY_HOTPLUG MEMORY_HOTREMOVE MFD_VIPERBOARD NOP_USB_XCEIV PARPORT PCCARD PCMCIA PHONET RADIO_ADAPTERS RADIO_SI470X RADIO_SI4713 RC_CORE RFKILL SND SOUND SPI SSB TAP TARGET_CORE TUN USB_AMD5536UDC USB_ATM USB_CHIPIDEA USB_CHIPIDEA_NPCM USB_CHIPIDEA_PCI USB_CHIPIDEA_UDC USB_CONFIGFS USB_CONFIGFS_ACM USB_CONFIGFS_ECM USB_CONFIGFS_ECM_SUBSET USB_CONFIGFS_EEM USB_CONFIGFS_F_FS USB_CONFIGFS_F_HID USB_CONFIGFS_F_LB_SS USB_CONFIGFS_F_MIDI USB_CONFIGFS_F_MIDI2 USB_CONFIGFS_F_PRINTER USB_CONFIGFS_F_TCM USB_CONFIGFS_F_UAC1 USB_CONFIGFS_F_UAC1_LEGACY USB_CONFIGFS_F_UAC2 USB_CONFIGFS_F_UVC USB_CONFIGFS_MASS_STORAGE USB_CONFIGFS_NCM USB_CONFIGFS_OBEX USB_CONFIGFS_PHONET USB_CONFIGFS_RNDIS USB_CONFIGFS_SERIAL USB_CONN_GPIO USB_CXACRU USB_CYPRESS_CY7C63 USB_CYTHERM USB_DSBR USB_DUMMY_HCD USB_DWC2 USB_DWC2_HOST USB_DWC2_PCI USB_DWC3 USB_DWC3_GADGET USB_DWC3_GENERIC_PLAT USB_DWC3_HAPS USB_DWC3_OF_SIMPLE USB_DWC3_PCI USB_DWC3_ULPI USB_DYNAMIC_MINORS USB_EG20T USB_EHCI_FSL USB_EHCI_HCD_PLATFORM USB_EHCI_ROOT_HUB_TT USB_EHSET_TEST_FIXTURE USB_EMI26 USB_EMI62 USB_EPSON2888 USB_EZUSB_FX2 USB_FEW_INIT_RETRIES USB_F_ACM USB_F_ECM USB_F_EEM USB_F_FS USB_F_HID USB_F_MASS_STORAGE USB_F_MIDI USB_F_MIDI2 USB_F_NCM USB_F_OBEX USB_F_PHONET USB_F_PRINTER USB_F_RNDIS USB_F_SERIAL USB_F_SS_LB USB_F_SUBSET USB_F_TCM USB_F_UAC1 USB_F_UAC1_LEGACY USB_F_UAC2 USB_F_UVC USB_GADGET USB_GADGETFS USB_GADGET_DEBUG_FILES USB_GADGET_DEBUG_FS USB_GL860 USB_GOKU USB_GR_UDC USB_GSPCA USB_GSPCA_BENQ USB_GSPCA_CONEX USB_GSPCA_CPIA1 USB_GSPCA_DTCS033 USB_GSPCA_ETOMS USB_GSPCA_FINEPIX USB_GSPCA_JEILINJ USB_GSPCA_JL2005BCD USB_GSPCA_KINECT USB_GSPCA_KONICA USB_GSPCA_MARS USB_GSPCA_MR97310A USB_GSPCA_NW80X USB_GSPCA_OV519 USB_GSPCA_OV534 USB_GSPCA_OV534_9 USB_GSPCA_PAC207 USB_GSPCA_PAC7302 USB_GSPCA_PAC7311 USB_GSPCA_SE401 USB_GSPCA_SN9C2028 USB_GSPCA_SN9C20X USB_GSPCA_SONIXB USB_GSPCA_SONIXJ USB_GSPCA_SPCA1528 USB_GSPCA_SPCA500 USB_GSPCA_SPCA501 USB_GSPCA_SPCA505 USB_GSPCA_SPCA506 USB_GSPCA_SPCA508 USB_GSPCA_SPCA561 USB_GSPCA_SQ905 USB_GSPCA_SQ905C USB_GSPCA_SQ930X USB_GSPCA_STK014 USB_GSPCA_STK1135 USB_GSPCA_STV0680 USB_GSPCA_SUNPLUS USB_GSPCA_T613 USB_GSPCA_TOPRO USB_GSPCA_TOUPTEK USB_GSPCA_TV8532 USB_GSPCA_VC032X USB_GSPCA_VICAM USB_GSPCA_XIRLINK_CIT USB_GSPCA_ZC3XX USB_HACKRF USB_HCD_BCMA USB_HCD_SSB USB_HSIC_USB3503 USB_HSIC_USB4604 USB_HSO USB_HUB_USB251XB USB_IDMOUSE USB_IOWARRIOR USB_IPHETH USB_ISIGHTFW USB_ISP116X_HCD USB_ISP1301 USB_ISP1760 USB_ISP1760_DUAL_ROLE USB_ISP1760_HCD USB_ISP1761_UDC USB_KAWETH USB_KC2190 USB_KEENE USB_LAN78XX USB_LCD USB_LD USB_LEDS_TRIGGER_USBPORT USB_LED_TRIG USB_LEGOTOWER USB_LGM_PHY USB_LIBCOMPOSITE USB_LINK_LAYER_TEST USB_M5602 USB_MA901 USB_MAX3420_UDC USB_MAX3421_HCD USB_MDC800 USB_MICROTEK USB_MR800 USB_MSI2500 USB_MUSB_DUAL_ROLE USB_MUSB_HDRC USB_NET2280 USB_NET_AQC111 USB_NET_AX88179_178A USB_NET_AX8817X USB_NET_CDCETHER USB_NET_CDC_EEM USB_NET_CDC_MBIM USB_NET_CDC_NCM USB_NET_CDC_SUBSET USB_NET_CDC_SUBSET_ENABLE USB_NET_CH9200 USB_NET_CX82310_ETH USB_NET_DM9601 USB_NET_GL620A USB_NET_HUAWEI_CDC_NCM USB_NET_INT51X1 USB_NET_KALMIA USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_QMI_WWAN USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_OXU210HP_HCD USB_PEGASUS USB_PULSE8_CEC USB_PWC USB_PWC_INPUT_EVDEV USB_PXA27X USB_R8A66597 USB_R8A66597_HCD USB_RAINSHADOW_CEC USB_RAREMONO USB_RAW_GADGET USB_RTL8150 USB_RTL8152 USB_RTL8153_ECM USB_S2255 USB_SERIAL USB_SERIAL_AIRCABLE USB_SERIAL_ARK3116 USB_SERIAL_BELKIN USB_SERIAL_CH341 USB_SERIAL_CONSOLE USB_SERIAL_CP210X USB_SERIAL_CYBERJACK USB_SERIAL_CYPRESS_M8 USB_SERIAL_DEBUG USB_SERIAL_DIGI_ACCELEPORT USB_SERIAL_EDGEPORT USB_SERIAL_EDGEPORT_TI USB_SERIAL_EMPEG USB_SERIAL_F81232 USB_SERIAL_F8153X USB_SERIAL_FTDI_SIO USB_SERIAL_GARMIN USB_SERIAL_GENERIC USB_SERIAL_IPAQ USB_SERIAL_IPW USB_SERIAL_IR USB_SERIAL_IUU USB_SERIAL_KEYSPAN USB_SERIAL_KEYSPAN_PDA USB_SERIAL_KLSI USB_SERIAL_KOBIL_SCT USB_SERIAL_MCT_U232 USB_SERIAL_METRO USB_SERIAL_MOS7715_PARPORT USB_SERIAL_MOS7720 USB_SERIAL_MOS7840 USB_SERIAL_MXUPORT USB_SERIAL_NAVMAN USB_SERIAL_OMNINET USB_SERIAL_OPTICON USB_SERIAL_OPTION USB_SERIAL_OTI6858 USB_SERIAL_PL2303 USB_SERIAL_QCAUX USB_SERIAL_QT2 USB_SERIAL_QUALCOMM USB_SERIAL_SAFE USB_SERIAL_SIERRAWIRELESS USB_SERIAL_SIMPLE USB_SERIAL_SPCP8X5 USB_SERIAL_SSU100 USB_SERIAL_SYMBOL USB_SERIAL_TI USB_SERIAL_UPD78F0730 USB_SERIAL_VISOR USB_SERIAL_WHITEHEAT USB_SERIAL_WISHBONE USB_SERIAL_WWAN USB_SERIAL_XR USB_SERIAL_XSENS_MT USB_SEVSEG USB_SI470X USB_SI4713 USB_SIERRA_NET USB_SISUSBVGA USB_SL811_CS USB_SL811_HCD USB_SL811_HCD_ISO USB_SNP_CORE USB_SPEEDTOUCH USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_ENE_UB6250 USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_STV06XX USB_TEST USB_TMC USB_TRANCEVIBRATOR USB_UAS USB_UEAGLEATM USB_ULPI_BUS USB_USBNET USB_USS720 USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_VIDEO_CLASS USB_VIDEO_CLASS_INPUT_EVDEV USB_VL600 USB_WDM USB_XHCI_DBGCAP USB_XHCI_PCI_RENESAS USB_XHCI_PLATFORM USB_XUSBATM USB_YUREX USERFAULTFD USERFAULTFD_RWP USERIO USER_RETURN_NOTIFIER UVC_COMMON U_SERIAL_CONSOLE V4L2_MEM2MEM_DEV V4L_TEST_DRIVERS VALIDATE_FS_PARSER VDPA VDPA_SIM VDPA_SIM_BLOCK VDPA_SIM_NET VETH VFIO VFIO_DEVICE_CDEV VFIO_PCI VFIO_PCI_CORE VFIO_PCI_INTX VFIO_VIRQFD VGASTATE VHOST VHOST_CROSS_ENDIAN_LEGACY VHOST_IOTLB VHOST_NET VHOST_RING VHOST_TASK VHOST_VDPA VHOST_VSOCK VIDEO VIDEOBUF2_CORE VIDEOBUF2_DMA_CONTIG VIDEOBUF2_DMA_SG VIDEOBUF2_MEMOPS VIDEOBUF2_V4L2 VIDEOBUF2_VMALLOC VIDEOMODE_HELPERS VIDEO_AU0828 VIDEO_AU0828_RC VIDEO_AU0828_V4L2 VIDEO_CS53L32A VIDEO_CX231XX VIDEO_CX231XX_ALSA VIDEO_CX231XX_DVB VIDEO_CX231XX_RC VIDEO_CX2341X VIDEO_CX25840 VIDEO_DEV VIDEO_EM28XX VIDEO_EM28XX_ALSA VIDEO_EM28XX_DVB VIDEO_EM28XX_RC VIDEO_EM28XX_V4L2 VIDEO_GO7007 VIDEO_GO7007_LOADER VIDEO_GO7007_USB VIDEO_GO7007_USB_S2250_BOARD VIDEO_HDPVR VIDEO_MSP3400 VIDEO_PVRUSB2 VIDEO_PVRUSB2_DVB VIDEO_PVRUSB2_SYSFS VIDEO_SAA711X VIDEO_STK1160 VIDEO_TUNER VIDEO_TVEEPROM VIDEO_USBTV VIDEO_V4L2_I2C VIDEO_V4L2_SUBDEV_API VIDEO_V4L2_TPG VIDEO_VICODEC VIDEO_VIM2M VIDEO_VIMC VIDEO_VIVID VIDEO_VIVID_CEC VIDEO_WM8775 VIPERBOARD_ADC VIRTIO_BALLOON VIRTIO_DMA_SHARED_BUFFER VIRTIO_MEM VIRTIO_MMIO VIRTIO_MMIO_CMDLINE_DEVICES VIRTIO_PMEM VIRTIO_VDPA VIRTIO_VSOCKETS VIRTIO_VSOCKETS_COMMON VIRT_WIFI VIRT_XFER_TO_GUEST_WORK VLAN_8021Q VLAN_8021Q_GVRP VLAN_8021Q_MVRP VMWARE_VMCI VMXNET3 VP_VDPA VSOCKETS VSOCKETS_DIAG VSOCKETS_LOOPBACK VSOCKMON VT_HW_CONSOLE_BINDING VXLAN WANT_DEV_COREDUMP WEXT_CORE WEXT_PROC WIREGUARD WIRELESS WLAN WLAN_VENDOR_ADMTEK WLAN_VENDOR_MORSEMICRO WLAN_VENDOR_NXP WLAN_VENDOR_SILABS X86_FRED X86_SGX X86_SGX_KVM X86_USER_SHADOW_STACK XDP_SOCKETS XDP_SOCKETS_DIAG XFRM_ESPINTCP XFRM_INTERFACE XFRM_IPCOMP XFRM_IPTFS XFRM_MIGRATE XFRM_OFFLOAD XFRM_STATISTICS XFRM_SUB_POLICY XFRM_USER_COMPAT XFS_BTREE_IN_MEM XFS_DRAIN_INTENTS XFS_FS XFS_LIVE_HOOKS XFS_MEMORY_BUFS XFS_ONLINE_REPAIR XFS_ONLINE_SCRUB XFS_POSIX_ACL XFS_QUOTA XFS_RT XILLYBUS_CLASS XILLYUSB XOR_BLOCKS XOR_BLOCKS_ARCH YENTA YENTA_ENE_TUNE YENTA_O2 YENTA_RICOH YENTA_TI YENTA_TOSHIBA ZEROPLUS_FF ZLIB_DEFLATE ZONEFS_FS ZRAM ZRAM_BACKEND_FORCE_LZO ZRAM_BACKEND_LZO ZRAM_DEF_COMP_LZO ZSMALLOC ZSTD_COMPRESS ZSWAP ZSWAP_COMPRESSOR_DEFAULT_842 ZSWAP_DEFAULT_ON ZSWAP_SHRINKER_DEFAULT_ON] disabling configs for [ubsan bug_or_warning locking atomic_sleep hang memleak], they are not needed picked [v7.2 v7.1 v7.0 v6.18 v6.16 v6.14 v6.12 v6.10 v6.7 v6.4 v6.1 v5.18 v5.15 v5.12 v5.9 v5.6 v5.3 v5.0 v4.19] out of 45 release tags testing release v7.2 testing commit 8d3ae59288f1e7d58d76558a6ee96d533bc5019f gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 380addae54b7fcbd1acb5d7c9b26f9bb2613553260830efeafbaabd973d9d880 all runs: crashed: KASAN: slab-use-after-free Write in pn_bind representative crash: KASAN: slab-use-after-free Write in pn_bind, types: [KASAN-USE-AFTER-FREE-WRITE] testing release v7.1 testing commit 8cd9520d35a6c38db6567e97dd93b1f11f185dc6 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 42a10b4f9f2610f49fc0e5bd1c839204792422d463c647cf6353526601d58e30 all runs: crashed: KASAN: slab-use-after-free Write in pn_bind representative crash: KASAN: slab-use-after-free Write in pn_bind, types: [KASAN-USE-AFTER-FREE-WRITE] testing release v7.0 testing commit 028ef9c96e96197026887c0f092424679298aae8 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 4f4e7196990c720f3d423639cc584ea3f66943e2b881e162f89d82157c71d6c3 all runs: OK false negative chance: 0.000 # git bisect start 8cd9520d35a6c38db6567e97dd93b1f11f185dc6 028ef9c96e96197026887c0f092424679298aae8 Bisecting: 8644 revisions left to test after this (roughly 13 steps) [515e3996a4c26e7f955c13b3b19522a2c8642af9] sched_ext: Fix deadlock between scx_root_disable() and concurrent forks testing commit 515e3996a4c26e7f955c13b3b19522a2c8642af9 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: eb66e63380a1f44dce986e431de102dd11e5e6601e2eb773998d8e078c45c687 all runs: crashed: KASAN: slab-use-after-free Write in pn_bind representative crash: KASAN: slab-use-after-free Write in pn_bind, types: [KASAN-USE-AFTER-FREE-WRITE] # git bisect bad 515e3996a4c26e7f955c13b3b19522a2c8642af9 Bisecting: 4385 revisions left to test after this (roughly 12 steps) [1f5ffc672165ff851063a5fd044b727ab2517ae3] Fix mismerge of the arm64 / timer-core interrupt handling changes testing commit 1f5ffc672165ff851063a5fd044b727ab2517ae3 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 7664c452f0c7a936a3cf5a821470663af75fc2b7187ae712318e5d18b3b7896c all runs: crashed: KASAN: slab-use-after-free Write in pn_bind representative crash: KASAN: slab-use-after-free Write in pn_bind, types: [KASAN-USE-AFTER-FREE-WRITE] # git bisect bad 1f5ffc672165ff851063a5fd044b727ab2517ae3 Bisecting: 2106 revisions left to test after this (roughly 11 steps) [ee60c510fb3468ec6fab98419218c4e7b37e2ca3] Merge tag 'nolibc-20260412-for-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/nolibc/linux-nolibc testing commit ee60c510fb3468ec6fab98419218c4e7b37e2ca3 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: be6bb68d3947233f0d4f4fd3046504f7eb011fbe905e369f2565f8553e40646f all runs: crashed: KASAN: slab-use-after-free Write in pn_bind representative crash: KASAN: slab-use-after-free Write in pn_bind, types: [KASAN-USE-AFTER-FREE-WRITE] # git bisect bad ee60c510fb3468ec6fab98419218c4e7b37e2ca3 Bisecting: 1101 revisions left to test after this (roughly 10 steps) [2e31b16101834bdc0b720967845d6a0a309cf27b] Merge tag 'acpi-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm testing commit 2e31b16101834bdc0b720967845d6a0a309cf27b gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: e8e39e2927c510e1351ef8b0fa3ad64210aef832cf052859297edb14109bab7b run #0: OK run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: crashed: KASAN: slab-use-after-free Write in pn_bind representative crash: KASAN: slab-use-after-free Write in pn_bind, types: [KASAN-USE-AFTER-FREE-WRITE] unable to determine the verdict: 9 good runs (wanted 5), for bad wanted 5 in total, got 10 # git bisect skip 2e31b16101834bdc0b720967845d6a0a309cf27b Bisecting: 1101 revisions left to test after this (roughly 10 steps) [41bf87bcac02cd788d4325415d4b2e31bf2a694d] dt-bindings: interrupt-controller: Add LS7A PCH LPC testing commit 41bf87bcac02cd788d4325415d4b2e31bf2a694d gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 8bb4b1e0127efe204b50300ea3313d17aa9a28b9a50c7a55cf8444d344a0e740 all runs: OK false negative chance: 0.000 # git bisect good 41bf87bcac02cd788d4325415d4b2e31bf2a694d Bisecting: 1081 revisions left to test after this (roughly 10 steps) [9100a28c8bb4270744942cf834efcd80f1acda7d] nvme-auth: add NVME_AUTH_MAX_DIGEST_SIZE constant testing commit 9100a28c8bb4270744942cf834efcd80f1acda7d gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: c7aaca2a11e8caa23e126b88bc99f61b73232f45053b701b44bdfde669e95ff1 all runs: OK false negative chance: 0.000 # git bisect good 9100a28c8bb4270744942cf834efcd80f1acda7d Bisecting: 992 revisions left to test after this (roughly 10 steps) [d7c8087a9cd8979d70edfe7c7feda9423feae3ab] Merge tag 'pm-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm testing commit d7c8087a9cd8979d70edfe7c7feda9423feae3ab gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: d0b7d13a045354721ecb63e0d8401e9c17ebee32f70a2a525b0e55c49ac71516 all runs: OK false negative chance: 0.000 # git bisect good d7c8087a9cd8979d70edfe7c7feda9423feae3ab Bisecting: 519 revisions left to test after this (roughly 9 steps) [c1fe867b5bf9c57ab7856486d342720e2b205eed] Merge tag 'timers-core-2026-04-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip testing commit c1fe867b5bf9c57ab7856486d342720e2b205eed gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: bd3888b92394d4f2782c9e5b65fc0dc9d8295744e88597d5af572e5f215a7f01 all runs: crashed: KASAN: slab-use-after-free Write in pn_bind representative crash: KASAN: slab-use-after-free Write in pn_bind, types: [KASAN-USE-AFTER-FREE-WRITE] # git bisect bad c1fe867b5bf9c57ab7856486d342720e2b205eed Bisecting: 180 revisions left to test after this (roughly 8 steps) [5181afcdf99527dd92a88f80fc4d0d8013e1b510] Merge tag 'docs-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux testing commit 5181afcdf99527dd92a88f80fc4d0d8013e1b510 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 0a0ed9255ed12566a0e4c9c58ed4e44ae7325caa915b3e97c7e01b83bfa55467 all runs: OK false negative chance: 0.000 # git bisect good 5181afcdf99527dd92a88f80fc4d0d8013e1b510 Bisecting: 80 revisions left to test after this (roughly 7 steps) [c0ecb2a9eeaa25832c1367ecc865ab2523b8c3d5] Merge tag 'irq-drivers-2026-04-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip testing commit c0ecb2a9eeaa25832c1367ecc865ab2523b8c3d5 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 69a4acde7da8983b5e32db8265ab39d5c2c6dcd852313a530ad5ae58e414cc6f run #0: crashed: KASAN: slab-use-after-free Write in pn_bind run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK representative crash: KASAN: slab-use-after-free Write in pn_bind, types: [KASAN-USE-AFTER-FREE-WRITE] unable to determine the verdict: 9 good runs (wanted 5), for bad wanted 5 in total, got 10 # git bisect skip c0ecb2a9eeaa25832c1367ecc865ab2523b8c3d5 Bisecting: 80 revisions left to test after this (roughly 7 steps) [1fac04a0a4737c4da3d55d7708931166a4a7136a] irqchip/irq-pic32-evic: Add __maybe_unused for board_bind_eic_interrupt in COMPILE_TEST testing commit 1fac04a0a4737c4da3d55d7708931166a4a7136a gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 279a97250c91153d8102899a47282dfc1a0477532ca602af5f80f8b331b36e10 all runs: OK false negative chance: 0.000 # git bisect good 1fac04a0a4737c4da3d55d7708931166a4a7136a Bisecting: 76 revisions left to test after this (roughly 6 steps) [09c04714cb455debc1dcc3535b6becb52c5b01e0] alarmtimer: Access timerqueue node under lock in suspend testing commit 09c04714cb455debc1dcc3535b6becb52c5b01e0 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: e85ffe2c233ad640da3ec8add4d647036951cee71fe01ba5358ffba12ef6780c all runs: crashed: KASAN: slab-use-after-free Write in pn_bind representative crash: KASAN: slab-use-after-free Write in pn_bind, types: [KASAN-USE-AFTER-FREE-WRITE] # git bisect bad 09c04714cb455debc1dcc3535b6becb52c5b01e0 Bisecting: 38 revisions left to test after this (roughly 5 steps) [15dd3a9488557d3e6ebcecacab79f4e56b69ab54] hrtimer: Push reprogramming timers into the interrupt return path testing commit 15dd3a9488557d3e6ebcecacab79f4e56b69ab54 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: a1b34806acf1e331ac22bd3dcb3fc4fd4511d1400294712268e4d5e57fe49228 run #0: infra problem: create instance operation failed: &{Code:INTERNAL_ERROR ErrorDetails:[] Location: Message:Internal error. Please try again or contact Google Support. (Code: '-4411554652280831600') ForceSendFields:[] NullFields:[]}. run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK false negative chance: 0.000 # git bisect good 15dd3a9488557d3e6ebcecacab79f4e56b69ab54 Bisecting: 19 revisions left to test after this (roughly 4 steps) [754e38d2d1aeeadddac5220f34e07cf263502a46] tracing: Use explicit array size instead of sentinel elements in symbol printing testing commit 754e38d2d1aeeadddac5220f34e07cf263502a46 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 929316355eadc2646352a0bf1a08ae1abb4bb4c47b959132120ecd691a6db783 all runs: crashed: KASAN: slab-use-after-free Write in pn_bind representative crash: KASAN: slab-use-after-free Write in pn_bind, types: [KASAN-USE-AFTER-FREE-WRITE] # git bisect bad 754e38d2d1aeeadddac5220f34e07cf263502a46 Bisecting: 9 revisions left to test after this (roughly 3 steps) [343f2f4dc5425107d509d29e26ef59c2053aeaa4] hrtimer: Try to modify timers in place testing commit 343f2f4dc5425107d509d29e26ef59c2053aeaa4 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: ab2091be9b3b05cdd5ec39a368a4270d746f955245a5df1f71bbb3bea991bee2 all runs: OK false negative chance: 0.000 # git bisect good 343f2f4dc5425107d509d29e26ef59c2053aeaa4 Bisecting: 4 revisions left to test after this (roughly 2 steps) [92f7ee408c23fcc074e4952fb6ffacdf3eb86b56] hrtimer: Less agressive interrupt 'hang' handling testing commit 92f7ee408c23fcc074e4952fb6ffacdf3eb86b56 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 51dcbd0a18ead2073c08618f4774d65d18e24daf79fab34017df0756fbd47022 all runs: crashed: KASAN: slab-use-after-free Write in pn_bind representative crash: KASAN: slab-use-after-free Write in pn_bind, types: [KASAN-USE-AFTER-FREE-WRITE] # git bisect bad 92f7ee408c23fcc074e4952fb6ffacdf3eb86b56 Bisecting: 1 revision left to test after this (roughly 1 step) [53007d526e17d29f0e5b81c07eb594a93bc4d29c] clocksource: Update clocksource::freq_khz on registration testing commit 53007d526e17d29f0e5b81c07eb594a93bc4d29c gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: d556b72773fc4a7e45792f3b0e5746a74b844c51fbc180c3681bda02437bc247 all runs: crashed: KASAN: slab-use-after-free Write in pn_bind representative crash: KASAN: slab-use-after-free Write in pn_bind, types: [KASAN-USE-AFTER-FREE-WRITE] # git bisect bad 53007d526e17d29f0e5b81c07eb594a93bc4d29c Bisecting: 1 revision left to test after this (roughly 1 step) [9213aa4784cf4e63e6d8d30ba71fd61c3d110247] sched: Default enable HRTICK when deferred rearming is enabled testing commit 9213aa4784cf4e63e6d8d30ba71fd61c3d110247 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 94f12b9ed4789cc73a7739cacd8bf87999ab25c9ccfb5c822387434a7b2f9ca8 all runs: crashed: KASAN: slab-use-after-free Write in pn_bind representative crash: KASAN: slab-use-after-free Write in pn_bind, types: [KASAN-USE-AFTER-FREE-WRITE] # git bisect bad 9213aa4784cf4e63e6d8d30ba71fd61c3d110247 9213aa4784cf4e63e6d8d30ba71fd61c3d110247 is the first bad commit commit 9213aa4784cf4e63e6d8d30ba71fd61c3d110247 Author: Peter Zijlstra Date: Tue Feb 24 17:39:08 2026 +0100 sched: Default enable HRTICK when deferred rearming is enabled The deferred rearm of the clock event device after an interrupt and and other hrtimer optimizations allow now to enable HRTICK for generic entry architectures. This decouples preemption from CONFIG_HZ, leaving only the periodic load-balancer and various accounting things relying on the tick. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163431.937531564@kernel.org kernel/sched/features.h | 5 +++++ 1 file changed, 5 insertions(+) accumulated error probability: 0.00 culprit signature: 94f12b9ed4789cc73a7739cacd8bf87999ab25c9ccfb5c822387434a7b2f9ca8 parent signature: ab2091be9b3b05cdd5ec39a368a4270d746f955245a5df1f71bbb3bea991bee2 revisions tested: 28, total time: 8h20m18.697071811s (build: 3h26m58.937124993s, test: 3h51m13.827629381s) first bad commit: 9213aa4784cf4e63e6d8d30ba71fd61c3d110247 sched: Default enable HRTICK when deferred rearming is enabled recipients (to): ["peterz@infradead.org" "tglx@kernel.org"] recipients (cc): [] crash: KASAN: slab-use-after-free Write in pn_bind ================================================================== BUG: KASAN: slab-use-after-free in gphonet_set_gadget drivers/usb/gadget/function/f_phonet.c:711 [inline] BUG: KASAN: slab-use-after-free in pn_bind+0xfe/0xa20 drivers/usb/gadget/function/f_phonet.c:501 Write of size 8 at addr ffff888122a9c6c8 by task syz-executor223/3314 CPU: 0 UID: 0 PID: 3314 Comm: syz-executor223 Not tainted syzkaller #0 PREEMPT(lazy) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Call Trace: dump_stack_lvl+0x52/0x80 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xba/0x230 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 gphonet_set_gadget drivers/usb/gadget/function/f_phonet.c:711 [inline] pn_bind+0xfe/0xa20 drivers/usb/gadget/function/f_phonet.c:501 usb_add_function+0x285/0x840 drivers/usb/gadget/composite.c:333 configfs_composite_bind+0xcc9/0x12d0 drivers/usb/gadget/configfs.c:1802 gadget_bind_driver+0x27d/0x8c0 drivers/usb/gadget/udc/core.c:1629 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x2d2/0x9d0 drivers/base/dd.c:661 __driver_probe_device+0x138/0x290 drivers/base/dd.c:803 driver_probe_device+0x4a/0x1e0 drivers/base/dd.c:833 __driver_attach+0x1e6/0x560 drivers/base/dd.c:1227 bus_for_each_dev+0x221/0x290 drivers/base/bus.c:383 bus_add_driver+0x2f1/0x580 drivers/base/bus.c:715 driver_register+0x16e/0x2b0 drivers/base/driver.c:249 usb_gadget_register_driver_owner+0xf9/0x210 drivers/usb/gadget/udc/core.c:1719 gadget_dev_desc_UDC_store+0x121/0x250 drivers/usb/gadget/configfs.c:300 flush_write_buffer fs/configfs/file.c:207 [inline] configfs_write_iter+0x2c5/0x3b0 fs/configfs/file.c:229 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x5c3/0xcf0 fs/read_write.c:688 ksys_write+0x110/0x1f0 fs/read_write.c:740 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf6/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f239ed8f39e Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08 RSP: 002b:00007ffc797b4318 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000055555cc983c0 RCX: 00007f239ed8f39e RDX: 000000000000000b RSI: 00007ffc797b43a0 RDI: 0000000000000006 RBP: 000000000000000b R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f239eddb1b0 R13: 00007f239eddb170 R14: 00007f239eddb148 R15: 00007ffc797b43a0 Allocated by task 3314: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5219 [inline] __kvmalloc_node_noprof+0x4a6/0x7d0 mm/slub.c:6711 alloc_netdev_mqs+0x7f/0x13c0 net/core/dev.c:12017 gphonet_setup_default drivers/usb/gadget/function/f_phonet.c:697 [inline] phonet_alloc_inst+0x9f/0x170 drivers/usb/gadget/function/f_phonet.c:631 try_get_usb_function_instance drivers/usb/gadget/functions.c:28 [inline] usb_get_function_instance+0xe2/0x2a0 drivers/usb/gadget/functions.c:44 function_make+0x10f/0x320 drivers/usb/gadget/configfs.c:626 configfs_mkdir+0x4ae/0x8b0 fs/configfs/dir.c:1363 vfs_mkdir+0x345/0x520 fs/namei.c:5233 filename_mkdirat+0x232/0x450 fs/namei.c:5266 __do_sys_mkdir fs/namei.c:5293 [inline] __se_sys_mkdir fs/namei.c:5290 [inline] __x64_sys_mkdir+0x71/0x140 fs/namei.c:5290 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf6/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 3334: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2687 [inline] slab_free mm/slub.c:6124 [inline] kfree+0x1a9/0x500 mm/slub.c:6442 gphonet_register_netdev drivers/usb/gadget/function/f_phonet.c:720 [inline] pn_bind+0x11b/0xa20 drivers/usb/gadget/function/f_phonet.c:502 usb_add_function+0x285/0x840 drivers/usb/gadget/composite.c:333 configfs_composite_bind+0xcc9/0x12d0 drivers/usb/gadget/configfs.c:1802 gadget_bind_driver+0x27d/0x8c0 drivers/usb/gadget/udc/core.c:1629 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x2d2/0x9d0 drivers/base/dd.c:661 __driver_probe_device+0x138/0x290 drivers/base/dd.c:803 driver_probe_device+0x4a/0x1e0 drivers/base/dd.c:833 __driver_attach+0x1e6/0x560 drivers/base/dd.c:1227 bus_for_each_dev+0x221/0x290 drivers/base/bus.c:383 bus_add_driver+0x2f1/0x580 drivers/base/bus.c:715 driver_register+0x16e/0x2b0 drivers/base/driver.c:249 usb_gadget_register_driver_owner+0xf9/0x210 drivers/usb/gadget/udc/core.c:1719 gadget_dev_desc_UDC_store+0x121/0x250 drivers/usb/gadget/configfs.c:300 flush_write_buffer fs/configfs/file.c:207 [inline] configfs_write_iter+0x2c5/0x3b0 fs/configfs/file.c:229 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x5c3/0xcf0 fs/read_write.c:688 ksys_write+0x110/0x1f0 fs/read_write.c:740 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf6/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888122a9c000 which belongs to the cache kmalloc-cg-4k of size 4096 The buggy address is located 1736 bytes inside of freed 4096-byte region [ffff888122a9c000, ffff888122a9d000) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888122a98000 pfn:0x122a98 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x200000000000240(workingset|head|node=0|zone=2) page_type: f5(slab) raw: 0200000000000240 ffff88810005d500 ffffea0004a26e10 ffffea00048c6610 raw: ffff888122a98000 0000000000040001 00000000f5000000 0000000000000000 head: 0200000000000240 ffff88810005d500 ffffea0004a26e10 ffffea00048c6610 head: ffff888122a98000 0000000000040001 00000000f5000000 0000000000000000 head: 0200000000000003 ffffea00048aa601 00000000ffffffff 00000000ffffffff head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 2504, tgid 2504 (v4l_id), ts 17294961078, free_ts 17263473816 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x157/0x180 mm/page_alloc.c:1889 prep_new_page mm/page_alloc.c:1897 [inline] get_page_from_freelist+0x2b89/0x2c20 mm/page_alloc.c:3962 __alloc_frozen_pages_noprof+0x278/0x4a0 mm/page_alloc.c:5250 alloc_slab_page mm/slub.c:3255 [inline] allocate_slab+0x7b/0x590 mm/slub.c:3444 new_slab mm/slub.c:3502 [inline] refill_objects+0x354/0x3b0 mm/slub.c:7134 refill_sheaf mm/slub.c:2804 [inline] __pcs_replace_empty_main+0x250/0x450 mm/slub.c:4578 alloc_from_pcs mm/slub.c:4681 [inline] slab_alloc_node mm/slub.c:4815 [inline] __do_kmalloc_node mm/slub.c:5218 [inline] __kvmalloc_node_noprof+0x5c1/0x7d0 mm/slub.c:6711 seq_buf_alloc fs/seq_file.c:39 [inline] seq_read_iter+0x1a2/0xb30 fs/seq_file.c:211 proc_reg_read_iter+0x117/0x200 fs/proc/inode.c:299 new_sync_read fs/read_write.c:493 [inline] vfs_read+0x47d/0x9e0 fs/read_write.c:574 ksys_read+0x110/0x1f0 fs/read_write.c:717 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf6/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 2505 tgid 2505 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1433 [inline] __free_frozen_pages+0xada/0xc50 mm/page_alloc.c:2978 __slab_free+0x26c/0x2b0 mm/slub.c:5532 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x98/0x100 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4501 [inline] slab_alloc_node mm/slub.c:4830 [inline] kmem_cache_alloc_noprof+0x254/0x590 mm/slub.c:4837 ptlock_alloc+0x1b/0x60 mm/memory.c:7456 ptlock_init include/linux/mm.h:3494 [inline] pagetable_pte_ctor include/linux/mm.h:3548 [inline] __pte_alloc_one_noprof include/asm-generic/pgalloc.h:79 [inline] pte_alloc_one+0x68/0x2b0 arch/x86/mm/pgtable.c:18 do_fault_around mm/memory.c:5750 [inline] do_read_fault mm/memory.c:5789 [inline] do_fault mm/memory.c:5932 [inline] do_pte_missing+0x2b5/0x1fb0 mm/memory.c:4477 handle_pte_fault mm/memory.c:6316 [inline] __handle_mm_fault mm/memory.c:6454 [inline] handle_mm_fault+0x86a/0xd10 mm/memory.c:6623 do_user_addr_fault+0x3f9/0xc90 arch/x86/mm/fault.c:1334 handle_page_fault arch/x86/mm/fault.c:1474 [inline] exc_page_fault+0x6a/0xb0 arch/x86/mm/fault.c:1527 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618 Memory state around the buggy address: ffff888122a9c580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888122a9c600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888122a9c680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888122a9c700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888122a9c780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================