ci starts bisection 2024-11-11 01:22:01.73164347 +0000 UTC m=+181705.295282481 bisecting cause commit starting from 7758b206117dab9894f0bcb8333f8e4731c5065a building syzkaller on df3dc63b8ba0b52ca67025f5b55cd4356b3eda75 ensuring issue is reproducible on original commit 7758b206117dab9894f0bcb8333f8e4731c5065a testing commit 7758b206117dab9894f0bcb8333f8e4731c5065a gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: eb2231c26296b77b66357defd7cc9a5de1a240d52e9f265f8d00183d7396df43 all runs: crashed: WARNING in get_pat_info representative crash: WARNING in get_pat_info, types: [WARNING] check whether we can drop unnecessary instrumentation disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN KASAN LOCKDEP], they are not needed testing commit 7758b206117dab9894f0bcb8333f8e4731c5065a gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: e6a618c7b3b7bf913543368362da03b47f20eedc63ff64cb8072276d27e4d1f9 all runs: crashed: WARNING in get_pat_info representative crash: WARNING in get_pat_info, types: [WARNING] the bug reproduces without the instrumentation disabling configs for [KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed kconfig minimization: base=4037 full=8185 leaves diff=2110 split chunks (needed=false): <2110> split chunk #0 of len 2110 into 5 parts testing without sub-chunk 1/5 disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN KASAN LOCKDEP], they are not needed testing commit 7758b206117dab9894f0bcb8333f8e4731c5065a gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: d726c193f16f6c4b46fbb3ca59834091b1ba5025866799526b8f7724bdf69a3d all runs: crashed: WARNING in get_pat_info representative crash: WARNING in get_pat_info, types: [WARNING] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [HANG LEAK UBSAN KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 7758b206117dab9894f0bcb8333f8e4731c5065a gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: cf1bae6d6ee88cb1976ec72b4a92f8ea1c800ec5fe44548939d4e454538ed027 all runs: crashed: WARNING in get_pat_info representative crash: WARNING in get_pat_info, types: [WARNING] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [UBSAN KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing commit 7758b206117dab9894f0bcb8333f8e4731c5065a gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: b3483dcc0a0a244169fa12672ce25956c822cbadd94cbef5907d96b475f9e564 all runs: crashed: WARNING in get_pat_info representative crash: WARNING in get_pat_info, types: [WARNING] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [LEAK UBSAN KASAN LOCKDEP ATOMIC_SLEEP HANG], they are not needed testing commit 7758b206117dab9894f0bcb8333f8e4731c5065a gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 303ccf40c8b5f17c8ccb63ffdc741bd6ecf130cb73ad65c449bd4908eb312192 all runs: crashed: WARNING in get_pat_info representative crash: WARNING in get_pat_info, types: [WARNING] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [LEAK UBSAN KASAN LOCKDEP ATOMIC_SLEEP HANG], they are not needed testing commit 7758b206117dab9894f0bcb8333f8e4731c5065a gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 8827774179502fcbafb14b372986f6e5f8449d3509b5fcbb69fe0af2bb9786fa all runs: OK false negative chance: 0.000 minimized to 422 configs; suspects: [ARCH_ENABLE_MEMORY_HOTREMOVE ATM BCMA BLK_DEV_ZONED BPF_SYSCALL CARDBUS CFG80211 CFG80211_WEXT CMA COMMON_CLK CONTIG_ALLOC DVB_CORE EXTCON FB GPIOLIB HID_ZEROPLUS I2C_MUX IIO IOMMUFD IRQ_REMAP KVM KVM_INTEL LIBNVDIMM MEDIA_ANALOG_TV_SUPPORT MEDIA_CAMERA_SUPPORT MEDIA_CEC_SUPPORT MEDIA_CONTROLLER MEDIA_DIGITAL_TV_SUPPORT MEDIA_RADIO_SUPPORT MEDIA_SDR_SUPPORT MEDIA_SUPPORT MEDIA_TEST_SUPPORT MEDIA_USB_SUPPORT MEMORY_HOTPLUG MEMORY_HOTREMOVE MFD_VIPERBOARD NOP_USB_XCEIV PARPORT PCCARD PCMCIA PHONET RADIO_ADAPTERS RADIO_SI470X RADIO_SI4713 RC_CORE RFKILL SND SOUND SPI SSB TAP TARGET_CORE TUN USB_AMD5536UDC USB_ATM USB_CDNSP_HOST USB_CDNSP_PCI USB_CDNS_HOST USB_CDNS_SUPPORT USB_CHAOSKEY USB_CHIPIDEA USB_CHIPIDEA_GENERIC USB_CHIPIDEA_HOST USB_CHIPIDEA_MSM USB_CHIPIDEA_NPCM USB_CHIPIDEA_PCI USB_CHIPIDEA_UDC USB_CONFIGFS USB_CONFIGFS_ACM USB_CONFIGFS_ECM USB_CONFIGFS_ECM_SUBSET USB_CONFIGFS_EEM USB_CONFIGFS_F_FS USB_CONFIGFS_F_HID USB_CONFIGFS_F_LB_SS USB_CONFIGFS_F_MIDI USB_CONFIGFS_F_MIDI2 USB_CONFIGFS_F_PRINTER USB_CONFIGFS_F_TCM USB_CONFIGFS_F_UAC1 USB_CONFIGFS_F_UAC1_LEGACY USB_CONFIGFS_F_UAC2 USB_CONFIGFS_F_UVC USB_CONFIGFS_MASS_STORAGE USB_CONFIGFS_NCM USB_CONFIGFS_OBEX USB_CONFIGFS_PHONET USB_CONFIGFS_RNDIS USB_CONFIGFS_SERIAL USB_CONN_GPIO USB_CXACRU USB_CYPRESS_CY7C63 USB_CYTHERM USB_DSBR USB_DUMMY_HCD USB_DWC2 USB_DWC2_HOST USB_DWC2_PCI USB_DWC3 USB_DWC3_GADGET USB_DWC3_HAPS USB_DWC3_OF_SIMPLE USB_DWC3_PCI USB_DWC3_ULPI USB_DYNAMIC_MINORS USB_EG20T USB_EHCI_FSL USB_EHCI_HCD_PLATFORM USB_EHCI_ROOT_HUB_TT USB_EHSET_TEST_FIXTURE USB_EMI26 USB_EMI62 USB_EPSON2888 USB_EZUSB_FX2 USB_FEW_INIT_RETRIES USB_F_ACM USB_F_ECM USB_F_EEM USB_F_FS USB_F_HID USB_F_MASS_STORAGE USB_F_MIDI USB_F_MIDI2 USB_F_NCM USB_F_OBEX USB_F_PHONET USB_F_PRINTER USB_F_RNDIS USB_F_SERIAL USB_F_SS_LB USB_F_SUBSET USB_F_TCM USB_F_UAC1 USB_F_UAC1_LEGACY USB_F_UAC2 USB_F_UVC USB_GADGET USB_GADGETFS USB_GADGET_DEBUG_FILES USB_GADGET_DEBUG_FS USB_GL860 USB_GOKU USB_GR_UDC USB_GSPCA USB_GSPCA_BENQ USB_GSPCA_CONEX USB_GSPCA_CPIA1 USB_GSPCA_DTCS033 USB_GSPCA_ETOMS USB_GSPCA_FINEPIX USB_GSPCA_JEILINJ USB_GSPCA_JL2005BCD USB_GSPCA_KINECT USB_GSPCA_KONICA USB_GSPCA_MARS USB_GSPCA_MR97310A USB_GSPCA_NW80X USB_GSPCA_OV519 USB_GSPCA_OV534 USB_GSPCA_OV534_9 USB_GSPCA_PAC207 USB_GSPCA_PAC7302 USB_GSPCA_PAC7311 USB_GSPCA_SE401 USB_GSPCA_SN9C2028 USB_GSPCA_SN9C20X USB_GSPCA_SONIXB USB_GSPCA_SONIXJ USB_GSPCA_SPCA1528 USB_GSPCA_SPCA500 USB_GSPCA_SPCA501 USB_GSPCA_SPCA505 USB_GSPCA_SPCA506 USB_GSPCA_SPCA508 USB_GSPCA_SPCA561 USB_GSPCA_SQ905 USB_GSPCA_SQ905C USB_GSPCA_SQ930X USB_GSPCA_STK014 USB_GSPCA_STK1135 USB_GSPCA_STV0680 USB_GSPCA_SUNPLUS USB_GSPCA_T613 USB_GSPCA_TOPRO USB_GSPCA_TOUPTEK USB_GSPCA_TV8532 USB_GSPCA_VC032X USB_GSPCA_VICAM USB_GSPCA_XIRLINK_CIT USB_GSPCA_ZC3XX USB_HACKRF USB_HCD_BCMA USB_HCD_SSB USB_HSIC_USB3503 USB_HSIC_USB4604 USB_HSO USB_HUB_USB251XB USB_IDMOUSE USB_IOWARRIOR USB_IPHETH USB_ISIGHTFW USB_ISP116X_HCD USB_ISP1301 USB_ISP1760 USB_ISP1760_DUAL_ROLE USB_ISP1760_HCD USB_ISP1761_UDC USB_KAWETH USB_KC2190 USB_KEENE USB_LAN78XX USB_LCD USB_LD USB_LEDS_TRIGGER_USBPORT USB_LED_TRIG USB_LEGOTOWER USB_LGM_PHY USB_LIBCOMPOSITE USB_LINK_LAYER_TEST USB_M5602 USB_MA901 USB_MAX3420_UDC USB_MAX3421_HCD USB_MDC800 USB_MICROTEK USB_MR800 USB_MSI2500 USB_MUSB_DUAL_ROLE USB_MUSB_HDRC USB_MV_U3D USB_MV_UDC USB_NET2272 USB_NET2272_DMA USB_NET2280 USB_NET_AQC111 USB_NET_AX88179_178A USB_NET_AX8817X USB_NET_CDCETHER USB_NET_CDC_EEM USB_NET_CDC_MBIM USB_NET_CDC_NCM USB_NET_CDC_SUBSET USB_NET_CDC_SUBSET_ENABLE USB_NET_CH9200 USB_NET_CX82310_ETH USB_NET_DM9601 USB_NET_GL620A USB_NET_HUAWEI_CDC_NCM USB_NET_INT51X1 USB_NET_KALMIA USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_QMI_WWAN USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_OXU210HP_HCD USB_PEGASUS USB_PULSE8_CEC USB_PWC USB_PWC_INPUT_EVDEV USB_PXA27X USB_R8A66597 USB_R8A66597_HCD USB_RAINSHADOW_CEC USB_RAREMONO USB_RAW_GADGET USB_RTL8150 USB_RTL8152 USB_RTL8153_ECM USB_S2255 USB_SERIAL USB_SERIAL_AIRCABLE USB_SERIAL_ARK3116 USB_SERIAL_BELKIN USB_SERIAL_CH341 USB_SERIAL_CONSOLE USB_SERIAL_CP210X USB_SERIAL_CYBERJACK USB_SERIAL_CYPRESS_M8 USB_SERIAL_DEBUG USB_SERIAL_DIGI_ACCELEPORT USB_SERIAL_EDGEPORT USB_SERIAL_EDGEPORT_TI USB_SERIAL_EMPEG USB_SERIAL_F81232 USB_SERIAL_F8153X USB_SERIAL_FTDI_SIO USB_SERIAL_GARMIN USB_SERIAL_GENERIC USB_SERIAL_IPAQ USB_SERIAL_IPW USB_SERIAL_IR USB_SERIAL_IUU USB_SERIAL_KEYSPAN USB_SERIAL_KEYSPAN_PDA USB_SERIAL_KLSI USB_SERIAL_KOBIL_SCT USB_SERIAL_MCT_U232 USB_SERIAL_METRO USB_SERIAL_MOS7715_PARPORT USB_SERIAL_MOS7720 USB_SERIAL_MOS7840 USB_SERIAL_MXUPORT USB_SERIAL_NAVMAN USB_SERIAL_OMNINET USB_SERIAL_OPTICON USB_SERIAL_OPTION USB_SERIAL_OTI6858 USB_SERIAL_PL2303 USB_SERIAL_QCAUX USB_SERIAL_QT2 USB_SERIAL_QUALCOMM USB_SERIAL_SAFE USB_SERIAL_SIERRAWIRELESS USB_SERIAL_SIMPLE USB_SERIAL_SPCP8X5 USB_SERIAL_SSU100 USB_SERIAL_SYMBOL USB_SERIAL_TI USB_SERIAL_UPD78F0730 USB_SERIAL_VISOR USB_SERIAL_WHITEHEAT USB_SERIAL_WISHBONE USB_SERIAL_WWAN USB_SERIAL_XR USB_SERIAL_XSENS_MT USB_SEVSEG USB_SI470X USB_SI4713 USB_SIERRA_NET USB_SISUSBVGA USB_SL811_CS USB_SL811_HCD USB_SL811_HCD_ISO USB_SNP_CORE USB_SPEEDTOUCH USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_ENE_UB6250 USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_STV06XX USB_TEST USB_TMC USB_TRANCEVIBRATOR USB_UAS USB_UEAGLEATM USB_ULPI_BUS USB_USBNET USB_USS720 USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_VIDEO_CLASS USB_VIDEO_CLASS_INPUT_EVDEV USB_VL600 USB_WDM USB_XHCI_DBGCAP USB_XHCI_PCI_RENESAS USB_XHCI_PLATFORM USB_XUSBATM USB_YUREX USERFAULTFD USERIO USERMODE_DRIVER USER_RETURN_NOTIFIER UVC_COMMON U_SERIAL_CONSOLE V4L2_MEM2MEM_DEV V4L_TEST_DRIVERS VALIDATE_FS_PARSER VDPA VDPA_SIM VDPA_SIM_BLOCK VDPA_SIM_NET VETH VFIO VFIO_DEVICE_CDEV VFIO_PCI VFIO_PCI_CORE VFIO_PCI_INTX VFIO_PCI_MMAP VFIO_VIRQFD VGASTATE VHOST VHOST_CROSS_ENDIAN_LEGACY VHOST_IOTLB VHOST_NET VHOST_RING VHOST_TASK VHOST_VDPA VHOST_VSOCK VIDEO VIDEOBUF2_CORE VIDEOBUF2_DMA_CONTIG VIDEOBUF2_DMA_SG VIDEOBUF2_MEMOPS VIDEOBUF2_V4L2 VIDEOBUF2_VMALLOC VIDEOMODE_HELPERS VIDEO_AU0828 VIDEO_AU0828_RC VIDEO_AU0828_V4L2 VIDEO_CS53L32A VIDEO_CX231XX VIDEO_CX231XX_ALSA VIDEO_CX231XX_DVB VIDEO_CX231XX_RC VIDEO_CX2341X VIDEO_CX25840 VIDEO_DEV VIDEO_EM28XX VIDEO_EM28XX_ALSA VIDEO_EM28XX_DVB VIDEO_EM28XX_RC VIDEO_EM28XX_V4L2 VIDEO_GO7007 VIDEO_GO7007_LOADER VIDEO_GO7007_USB VIDEO_GO7007_USB_S2250_BOARD VIDEO_HDPVR VIDEO_MSP3400 VIDEO_PVRUSB2 VIDEO_PVRUSB2_DVB VIDEO_PVRUSB2_SYSFS VIDEO_SAA711X VIDEO_STK1160 VIDEO_TUNER VIDEO_TVEEPROM VIDEO_USBTV VIDEO_V4L2_I2C VIDEO_V4L2_SUBDEV_API VIDEO_V4L2_TPG VIDEO_VICODEC VIDEO_VIM2M VIDEO_VIMC VIDEO_VIVID VIDEO_VIVID_CEC VIDEO_WM8775 VIPERBOARD_ADC VIRTIO_BALLOON VIRTIO_DMA_SHARED_BUFFER VIRTIO_MEM VIRTIO_MMIO VIRTIO_MMIO_CMDLINE_DEVICES VIRTIO_PMEM VIRTIO_VDPA VIRTIO_VSOCKETS VIRTIO_VSOCKETS_COMMON VIRT_WIFI VLAN_8021Q VLAN_8021Q_GVRP VLAN_8021Q_MVRP VMAP_PFN VMWARE_VMCI VMXNET3 VP_VDPA VSOCKETS VSOCKETS_DIAG VSOCKETS_LOOPBACK VSOCKMON VT_HW_CONSOLE_BINDING VXFS_FS WANT_DEV_COREDUMP WEXT_CORE WEXT_PRIV WEXT_PROC WIREGUARD WIRELESS WIRELESS_EXT WLAN WLAN_VENDOR_ADMTEK WLAN_VENDOR_SILABS X86_SGX X86_SGX_KVM X86_USER_SHADOW_STACK X86_X2APIC X86_X32_ABI XDP_SOCKETS XDP_SOCKETS_DIAG XFRM_ESPINTCP XFRM_INTERFACE XFRM_IPCOMP XFRM_MIGRATE XFRM_OFFLOAD XFRM_STATISTICS XFRM_SUB_POLICY XFRM_USER_COMPAT XFS_FS XFS_POSIX_ACL XFS_QUOTA XFS_RT XILLYBUS_CLASS XILLYUSB XOR_BLOCKS YENTA YENTA_ENE_TUNE YENTA_O2 YENTA_RICOH YENTA_TI YENTA_TOSHIBA Z3FOLD Z3FOLD_DEPRECATED ZEROPLUS_FF ZLIB_DEFLATE ZONEFS_FS ZPOOL ZRAM ZRAM_BACKEND_FORCE_LZO ZRAM_BACKEND_LZO ZRAM_DEF_COMP_LZO ZSMALLOC ZSTD_COMPRESS ZSWAP ZSWAP_COMPRESSOR_DEFAULT_842 ZSWAP_DEFAULT_ON ZSWAP_SHRINKER_DEFAULT_ON ZSWAP_ZPOOL_DEFAULT_Z3FOLD_DEPRECATED] disabling configs for [LEAK UBSAN KASAN LOCKDEP ATOMIC_SLEEP HANG], they are not needed picked [v6.11 v6.10 v6.9 v6.7 v6.5 v6.3 v6.1 v5.19 v5.16 v5.13 v5.10 v5.7 v5.4 v5.1 v4.19] out of 34 release tags testing release v6.11 testing commit 98f7e32f20d28ec452afb208f9cffc08448a2652 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: aa679ce3542407835aaf0f393bcf59d49d3abc79dc9f9d66481ab4e3ec920506 all runs: crashed: WARNING in get_pat_info representative crash: WARNING in get_pat_info, types: [WARNING] testing release v6.10 testing commit 0c3836482481200ead7b416ca80c68a29cfdaabd gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 2c5e0809e1b0166957979aec4b663e0ece0bafb0ac8178343989ae8d9596fbc5 all runs: OK false negative chance: 0.000 # git bisect start 98f7e32f20d28ec452afb208f9cffc08448a2652 0c3836482481200ead7b416ca80c68a29cfdaabd Bisecting: 7076 revisions left to test after this (roughly 13 steps) [b3ce7a30847a54a7f96a35e609303d8afecd460b] Merge tag 'drm-next-2024-07-18' of https://gitlab.freedesktop.org/drm/kernel testing commit b3ce7a30847a54a7f96a35e609303d8afecd460b gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 985642ca523b4ea926b90ddc06d6a47351260c57a2d82564312344edfbd2fa4f all runs: OK false negative chance: 0.000 # git bisect good b3ce7a30847a54a7f96a35e609303d8afecd460b Bisecting: 3385 revisions left to test after this (roughly 12 steps) [fbc90c042cd1dc7258ebfebe6d226017e5b5ac8c] Merge tag 'mm-stable-2024-07-21-14-50' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm testing commit fbc90c042cd1dc7258ebfebe6d226017e5b5ac8c gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: f4a4353d996d118b0dc389ce9a016a39190a9aa316da1e2fa378404e5b9867da all runs: OK false negative chance: 0.000 # git bisect good fbc90c042cd1dc7258ebfebe6d226017e5b5ac8c Bisecting: 1693 revisions left to test after this (roughly 11 steps) [fa63c6434b6f6aaf9d8d599dc899bc0a074cc0ad] net: dsa: vsc73xx: check busy flag in MDIO operations testing commit fa63c6434b6f6aaf9d8d599dc899bc0a074cc0ad gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: a8f9159570f0111db1aec87c2d2ae59ae292beefc6cda181e00ecdf38a0ac29c all runs: OK false negative chance: 0.000 # git bisect good fa63c6434b6f6aaf9d8d599dc899bc0a074cc0ad Bisecting: 843 revisions left to test after this (roughly 10 steps) [72bea05cb1ad486b1a850f584cc93b651579ad2f] Merge tag 'bcachefs-2024-08-24' of git://evilpiepirate.org/bcachefs testing commit 72bea05cb1ad486b1a850f584cc93b651579ad2f gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: f703e13083620f78c65cf524bfcd56ed2eee047ea9cec3ccb5e672eb7fbca90d all runs: OK false negative chance: 0.000 # git bisect good 72bea05cb1ad486b1a850f584cc93b651579ad2f Bisecting: 421 revisions left to test after this (roughly 9 steps) [6c5b3e30e5854f121d2e2cbb2d5ff7350ef7fdfb] Merge tag 'rust-fixes-6.11-2' of https://github.com/Rust-for-Linux/linux testing commit 6c5b3e30e5854f121d2e2cbb2d5ff7350ef7fdfb gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: b79ef86e2a4a66aef4a76fce9174fdeba1d8573dab872063ab987b31c930e258 all runs: OK false negative chance: 0.000 # git bisect good 6c5b3e30e5854f121d2e2cbb2d5ff7350ef7fdfb Bisecting: 209 revisions left to test after this (roughly 8 steps) [487ee43bac846446fb3e832436bdedd7acb4fe46] Merge tag 'pci-v6.11-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci testing commit 487ee43bac846446fb3e832436bdedd7acb4fe46 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: ef276a49d1b02d4cbb10478d2f794ece24bbbd901fc1f0f890353dbd6fb05aa0 all runs: OK false negative chance: 0.000 # git bisect good 487ee43bac846446fb3e832436bdedd7acb4fe46 Bisecting: 107 revisions left to test after this (roughly 7 steps) [42c5b519498820e95d96311b1200eb4b854fc2bd] Merge tag 'platform-drivers-x86-v6.11-7' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 testing commit 42c5b519498820e95d96311b1200eb4b854fc2bd gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 7d9c716323b507da4725133cc4f79aefc10cfea96071a483616963342e7e62b0 all runs: crashed: WARNING in get_pat_info representative crash: WARNING in get_pat_info, types: [WARNING] # git bisect bad 42c5b519498820e95d96311b1200eb4b854fc2bd Bisecting: 49 revisions left to test after this (roughly 6 steps) [e20398877b6216023ac311053baf2f50965cbf27] Merge tag 'perf_urgent_for_v6.11_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip testing commit e20398877b6216023ac311053baf2f50965cbf27 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 436b7b8e40987f8ee085c5613fea45d7ec9b1ace3d934175e8859c8a143f6220 all runs: OK false negative chance: 0.000 # git bisect good e20398877b6216023ac311053baf2f50965cbf27 Bisecting: 23 revisions left to test after this (roughly 5 steps) [8d8d276ba2fb5f9ac4984f5c10ae60858090babc] Merge tag 'trace-v6.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace testing commit 8d8d276ba2fb5f9ac4984f5c10ae60858090babc gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 7b23ecb0138065b7590e732c454766ac3c45a1fc7b7fe27ac8886cbb8a73f3f3 all runs: OK false negative chance: 0.000 # git bisect good 8d8d276ba2fb5f9ac4984f5c10ae60858090babc Bisecting: 11 revisions left to test after this (roughly 4 steps) [0e7af99aef5f58b4bae00e45fd1c2626a987f7bb] Merge tag 'riscv-soc-fixes-for-v6.11-final' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into arm/fixes testing commit 0e7af99aef5f58b4bae00e45fd1c2626a987f7bb gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 744afe6f066e15dd4218cc0b806cf0788c572df16af76ba81cdcf135a69838a9 all runs: OK false negative chance: 0.000 # git bisect good 0e7af99aef5f58b4bae00e45fd1c2626a987f7bb Bisecting: 5 revisions left to test after this (roughly 3 steps) [3857c7b0411a4e726fb943d41f38676c5ea992ee] Merge tag 'for-6.11/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm testing commit 3857c7b0411a4e726fb943d41f38676c5ea992ee gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: e069a7a696230d9c29fb92d13096f4d21dface444c6706a3380c7e8000e99c9b all runs: OK false negative chance: 0.000 # git bisect good 3857c7b0411a4e726fb943d41f38676c5ea992ee Bisecting: 2 revisions left to test after this (roughly 2 steps) [d6de45e3c6f3713d3825d3e2860c11d24e0f941f] platform/x86: asus-wmi: Disable OOBE experience on Zenbook S 16 testing commit d6de45e3c6f3713d3825d3e2860c11d24e0f941f gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: ae0e863528d2b488102389eef7ed0596b8050a24266fc6c5adcd017ca104534d all runs: OK false negative chance: 0.000 # git bisect good d6de45e3c6f3713d3825d3e2860c11d24e0f941f Bisecting: 0 revisions left to test after this (roughly 1 step) [79a61cc3fc0466ad2b7b89618a6157785f0293b3] mm: avoid leaving partial pfn mappings around in error case testing commit 79a61cc3fc0466ad2b7b89618a6157785f0293b3 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: d1d177998fec7847ea4aa71c821710e5c473dacfdd5b5de06f4b0b9c7ac814b7 all runs: crashed: WARNING in get_pat_info representative crash: WARNING in get_pat_info, types: [WARNING] # git bisect bad 79a61cc3fc0466ad2b7b89618a6157785f0293b3 Bisecting: 0 revisions left to test after this (roughly 0 steps) [77f587896757708780a7e8792efe62939f25a5ab] Merge tag 'arm-fixes-6.11-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc testing commit 77f587896757708780a7e8792efe62939f25a5ab gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 74e5e85c5a55ea641281519b0645a59e77ebdd9038f99ce34c44b7475c8c19ed all runs: OK false negative chance: 0.000 # git bisect good 77f587896757708780a7e8792efe62939f25a5ab 79a61cc3fc0466ad2b7b89618a6157785f0293b3 is the first bad commit commit 79a61cc3fc0466ad2b7b89618a6157785f0293b3 Author: Linus Torvalds Date: Wed Sep 11 17:11:23 2024 -0700 mm: avoid leaving partial pfn mappings around in error case As Jann points out, PFN mappings are special, because unlike normal memory mappings, there is no lifetime information associated with the mapping - it is just a raw mapping of PFNs with no reference counting of a 'struct page'. That's all very much intentional, but it does mean that it's easy to mess up the cleanup in case of errors. Yes, a failed mmap() will always eventually clean up any partial mappings, but without any explicit lifetime in the page table mapping itself, it's very easy to do the error handling in the wrong order. In particular, it's easy to mistakenly free the physical backing store before the page tables are actually cleaned up and (temporarily) have stale dangling PTE entries. To make this situation less error-prone, just make sure that any partial pfn mapping is torn down early, before any other error handling. Reported-and-tested-by: Jann Horn Cc: Andrew Morton Cc: Jason Gunthorpe Cc: Simona Vetter Signed-off-by: Linus Torvalds mm/memory.c | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-) accumulated error probability: 0.00 culprit signature: d1d177998fec7847ea4aa71c821710e5c473dacfdd5b5de06f4b0b9c7ac814b7 parent signature: 74e5e85c5a55ea641281519b0645a59e77ebdd9038f99ce34c44b7475c8c19ed revisions tested: 23, total time: 5h17m48.353626859s (build: 2h19m12.984400636s, test: 2h40m52.452528478s) first bad commit: 79a61cc3fc0466ad2b7b89618a6157785f0293b3 mm: avoid leaving partial pfn mappings around in error case recipients (to): ["akpm@linux-foundation.org" "jannh@google.com" "linux-mm@kvack.org" "torvalds@linux-foundation.org"] recipients (cc): ["linux-kernel@vger.kernel.org"] crash: WARNING in get_pat_info RDX: 0000000000000000 RSI: 0000000000003000 RDI: 0000000020ff6000 RBP: 00007fed1f84f090 R08: 0000000000000003 R09: 0000000000000000 R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000002 R13: 0000000000000000 R14: 00007fed1ff85f80 R15: 00007ffe7247d278 ------------[ cut here ]------------ WARNING: CPU: 0 PID: 3834 at arch/x86/mm/pat/memtype.c:1002 get_pat_info+0x116/0x160 arch/x86/mm/pat/memtype.c:1002 Modules linked in: CPU: 0 UID: 0 PID: 3834 Comm: syz.2.17 Not tainted 6.11.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 RIP: 0010:get_pat_info+0x116/0x160 arch/x86/mm/pat/memtype.c:1002 Code: 4d 85 e4 74 50 8b 43 20 83 e0 28 83 f8 20 75 19 b8 ea ff ff ff 4d 85 ff 75 18 48 8b 43 78 48 c1 e0 0c 49 89 06 31 c0 eb 09 90 <0f> 0b 90 b8 ea ff ff ff 65 48 8b 0c 25 28 00 00 00 48 3b 4c 24 18 RSP: 0018:ffffc9000120b958 EFLAGS: 00010283 RAX: 0000000000000000 RBX: ffff8881148c9bd0 RCX: 00000000e8088bf9 RDX: 9a2211b3fe95e043 RSI: ffffffff82ef4a02 RDI: ffff8881156bb700 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffc9000120ba58 R13: 0000000000000000 R14: ffffc9000120b9b0 R15: 0000000000000000 FS: 00007fed1f84f6c0(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2cc5ffff CR3: 0000000118c90000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: untrack_pfn+0x10c/0x150 arch/x86/mm/pat/memtype.c:1104 unmap_single_vma+0x7e/0xe0 mm/memory.c:1831 zap_page_range_single+0x1de/0x250 mm/memory.c:1932 remap_pfn_range_notrack+0x56a/0x5c0 mm/memory.c:2705 remap_pfn_range+0x6a/0xc0 mm/memory.c:2730 usbdev_mmap+0x1e1/0x2b0 drivers/usb/core/devio.c:276 call_mmap include/linux/fs.h:2130 [inline] mmap_region+0x596/0xae0 mm/mmap.c:2957 do_mmap+0x426/0x5d0 mm/mmap.c:1468 vm_mmap_pgoff+0xdd/0x1c0 mm/util.c:588 ksys_mmap_pgoff+0x182/0x200 mm/mmap.c:1514 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xe0/0x220 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fed1fdce719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fed1f84f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 RAX: ffffffffffffffda RBX: 00007fed1ff85f80 RCX: 00007fed1fdce719 RDX: 0000000000000000 RSI: 0000000000003000 RDI: 0000000020ff6000 RBP: 00007fed1f84f090 R08: 0000000000000003 R09: 0000000000000000 R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000002 R13: 0000000000000000 R14: 00007fed1ff85f80 R15: 00007ffe7247d278