ci2 starts bisection 2024-10-24 05:48:59.174806605 +0000 UTC m=+112113.159259286
bisecting fixing commit since db06c48ab67eb5db1ac64a0210d77742e335537a
building syzkaller on b88348e926b1f214763f45a5457bd91aafd36fab
ensuring issue is reproducible on original commit db06c48ab67eb5db1ac64a0210d77742e335537a

testing commit db06c48ab67eb5db1ac64a0210d77742e335537a gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 7f7edbfa371a2f0f2fadc5876d519a20009a5270496313e58e76cdfad532b937
all runs: crashed: UBSAN: shift-out-of-bounds in parse_audio_unit
representative crash: UBSAN: shift-out-of-bounds in parse_audio_unit, types: [UBSAN]
check whether we can drop unnecessary instrumentation
disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK BUG KASAN], they are not needed
testing commit db06c48ab67eb5db1ac64a0210d77742e335537a gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: d9ab466b9988441568f4036f305544177a1c2237b0251a38f9058270559b2728
all runs: crashed: UBSAN: shift-out-of-bounds in parse_audio_unit
representative crash: UBSAN: shift-out-of-bounds in parse_audio_unit, types: [UBSAN]
the bug reproduces without the instrumentation
disabling configs for [ATOMIC_SLEEP HANG LEAK BUG KASAN LOCKDEP], they are not needed
kconfig minimization: base=4920 full=6158 leaves diff=242
split chunks (needed=false): <242>
split chunk #0 of len 242 into 5 parts
testing without sub-chunk 1/5
disabling configs for [LEAK BUG KASAN LOCKDEP ATOMIC_SLEEP HANG], they are not needed
testing commit db06c48ab67eb5db1ac64a0210d77742e335537a gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 9f32272100c1043608dec106bf0495833a771f2cb3c08d91c019f8ce939d30ae
all runs: crashed: UBSAN: shift-out-of-bounds in parse_audio_unit
representative crash: UBSAN: shift-out-of-bounds in parse_audio_unit, types: [UBSAN]
the chunk can be dropped
testing without sub-chunk 2/5
disabling configs for [LEAK BUG KASAN LOCKDEP ATOMIC_SLEEP HANG], they are not needed
testing commit db06c48ab67eb5db1ac64a0210d77742e335537a gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: ddb29fbccf2218c9cccd87fbcab1abcb1785f4893c1d4ea67e3720a53e4cdd63
all runs: crashed: UBSAN: shift-out-of-bounds in parse_audio_unit
representative crash: UBSAN: shift-out-of-bounds in parse_audio_unit, types: [UBSAN]
the chunk can be dropped
testing without sub-chunk 3/5
disabling configs for [BUG KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed
testing commit db06c48ab67eb5db1ac64a0210d77742e335537a gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: e458c6f9f24f586913455e9da71c8d0906bb8aa99bd0f0cfdc98ace63a39dadd
all runs: OK
false negative chance: 0.000
testing without sub-chunk 4/5
disabling configs for [BUG KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed
testing commit db06c48ab67eb5db1ac64a0210d77742e335537a gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 601480a46574f244a80a448746223752a6823f942fd607281b6ce96eb2a299bf
all runs: crashed: UBSAN: shift-out-of-bounds in parse_audio_unit
representative crash: UBSAN: shift-out-of-bounds in parse_audio_unit, types: [UBSAN]
the chunk can be dropped
testing without sub-chunk 5/5
disabling configs for [ATOMIC_SLEEP HANG LEAK BUG KASAN LOCKDEP], they are not needed
testing commit db06c48ab67eb5db1ac64a0210d77742e335537a gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
failed building db06c48ab67eb5db1ac64a0210d77742e335537a: net/socket.c:1191: undefined reference to `wext_handle_ioctl'
net/socket.c:3385: undefined reference to `compat_wext_handle_ioctl'
net/core/net-procfs.c:343: undefined reference to `wext_proc_exit'
net/core/net-procfs.c:327: undefined reference to `wext_proc_init'
minimized to 95 configs; suspects: [HID_SMARTJOYPLUS HID_THRUSTMASTER HID_ZEROPLUS INPUT_TABLET RESET_CONTROLLER RFKILL RFKILL_LEDS RMI4_2D_SENSOR RMI4_CORE RMI4_F03 RMI4_F03_SERIO RMI4_F11 RMI4_F12 RMI4_F30 SMARTJOYPLUS_FF SMSC_PHY SND SND_COMPRESS_OFFLOAD SND_CTL_FAST_LOOKUP SND_DMAENGINE_PCM SND_DMA_SGBUF SND_DYNAMIC_MINORS SND_HRTIMER SND_HWDEP SND_INTEL_DSP_CONFIG SND_INTEL_SOUNDWIRE_ACPI SND_PCI SND_PCM SND_PCM_TIMER SND_PROC_FS SND_RAWMIDI SND_SOC SND_SOC_ACPI SND_SOC_ACPI_INTEL_MATCH SND_SOC_COMPRESS SND_SOC_GENERIC_DMAENGINE_PCM SND_SOC_I2C_AND_SPI SND_SOC_INTEL_MACH SND_SOC_INTEL_SST_TOPLEVEL SND_SOC_TOPOLOGY SND_SPI SND_SST_ATOM_HIFI2_PLATFORM SND_SST_ATOM_HIFI2_PLATFORM_ACPI SND_TIMER SND_USB SND_USB_AUDIO SND_USB_AUDIO_USE_MEDIA_CONTROLLER SND_X86 SOUND TABLET_USB_ACECAD TABLET_USB_AIPTEK TABLET_USB_HANWANG TABLET_USB_KBTAB THRUSTMASTER_FF TYPEC_FUSB302 USB_ARMLINUX USB_BELKIN USB_CONFIGFS USB_CONFIGFS_ACM USB_CONFIGFS_ECM USB_CONFIGFS_ECM_SUBSET USB_CONFIGFS_EEM USB_NET_CDC_SUBSET USB_NET_GL620A USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL USB_SERIAL_FTDI_SIO USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_ZYDAS X86_X32 ZEROPLUS_FF]
disabling configs for [HANG LEAK BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed
testing current HEAD 5e4635681cf1a50f26f88af7a946375ec6908d58
testing commit 5e4635681cf1a50f26f88af7a946375ec6908d58 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: aa9d908bb8b44acbf4547ade791fa30c2671e59385110289196352d77e475f09
all runs: crashed: UBSAN: shift-out-of-bounds in parse_audio_unit
representative crash: UBSAN: shift-out-of-bounds in parse_audio_unit, types: [UBSAN]
crash still not fixed/happens on the oldest tested release
revisions tested: 7, total time: 1h24m46.85329887s (build: 30m0.100400984s, test: 52m15.7254185s)
crash still not fixed or there were kernel test errors
commit msg: Revert "perf/aux: Fix AUX buffer serialization"
crash: UBSAN: shift-out-of-bounds in parse_audio_unit
usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3
usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3
usb 1-1: SerialNumber: syz
usb 1-1: 0:2 : does not exist
================================================================================
UBSAN: shift-out-of-bounds in sound/usb/mixer.c:2035:20
shift exponent 41 is too large for 32-bit type 'int'
CPU: 0 PID: 38 Comm: kworker/0:1 Not tainted 5.15.167-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: usb_hub_wq hub_event
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x38/0x49 lib/dump_stack.c:106
 dump_stack+0x10/0x12 lib/dump_stack.c:113
 ubsan_epilogue+0x9/0x32 lib/ubsan.c:151
 __ubsan_handle_shift_out_of_bounds.cold+0x6a/0x108 lib/ubsan.c:321
 parse_audio_feature_unit sound/usb/mixer.c:2035 [inline]
 parse_audio_unit.cold+0x1df/0x258 sound/usb/mixer.c:2885
 snd_usb_mixer_controls+0x198/0x260 sound/usb/mixer.c:3230
 snd_usb_create_mixer+0xda/0x6a0 sound/usb/mixer.c:3577
 usb_audio_probe+0x2db/0xfc0 sound/usb/card.c:858
 usb_probe_interface+0xd7/0x250 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:516 [inline]
 really_probe.part.0+0x271/0x2c0 drivers/base/dd.c:595
 really_probe drivers/base/dd.c:557 [inline]
 __driver_probe_device+0x95/0x140 drivers/base/dd.c:755
 driver_probe_device+0x1e/0x90 drivers/base/dd.c:785
 __device_attach_driver+0x78/0xb0 drivers/base/dd.c:907
 bus_for_each_drv+0x80/0xd0 drivers/base/bus.c:427
 __device_attach+0xc2/0x1f0 drivers/base/dd.c:979
 device_initial_probe+0xe/0x10 drivers/base/dd.c:1028
 bus_probe_device+0x99/0xb0 drivers/base/bus.c:487
 device_add+0x41c/0x950 drivers/base/core.c:3425
 usb_set_configuration+0x4bd/0x990 drivers/usb/core/message.c:2165
 usb_generic_driver_probe+0x4e/0x70 drivers/usb/core/generic.c:238
 usb_probe_device+0x31/0xc0 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:516 [inline]
 really_probe.part.0+0x271/0x2c0 drivers/base/dd.c:595
 really_probe drivers/base/dd.c:557 [inline]
 __driver_probe_device+0x95/0x140 drivers/base/dd.c:755
 driver_probe_device+0x1e/0x90 drivers/base/dd.c:785
 __device_attach_driver+0x78/0xb0 drivers/base/dd.c:907
 bus_for_each_drv+0x80/0xd0 drivers/base/bus.c:427
 __device_attach+0xc2/0x1f0 drivers/base/dd.c:979
 device_initial_probe+0xe/0x10 drivers/base/dd.c:1028
 bus_probe_device+0x99/0xb0 drivers/base/bus.c:487
 device_add+0x41c/0x950 drivers/base/core.c:3425
 usb_new_device.cold+0x177/0x4bf drivers/usb/core/hub.c:2599
 hub_port_connect drivers/usb/core/hub.c:5513 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5653 [inline]
 port_event drivers/usb/core/hub.c:5803 [inline]
 hub_event+0x10dc/0x1690 drivers/usb/core/hub.c:5885
 process_one_work+0x19b/0x340 kernel/workqueue.c:2325
 worker_thread+0x4e/0x340 kernel/workqueue.c:2472
 kthread+0x13a/0x160 kernel/kthread.c:337
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
================================================================================
usb 1-1: USB disconnect, device number 2
usb 1-1: new high-speed USB device number 3 using dummy_hcd
usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3
usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3
usb 1-1: SerialNumber: syz
usb 1-1: 0:2 : does not exist
usb 1-1: USB disconnect, device number 3
usb 1-1: new high-speed USB device number 4 using dummy_hcd
usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3
usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3
usb 1-1: SerialNumber: syz
usb 1-1: 0:2 : does not exist
usb 1-1: USB disconnect, device number 4
usb 1-1: new high-speed USB device number 5 using dummy_hcd
usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3
usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3
usb 1-1: SerialNumber: syz
usb 1-1: 0:2 : does not exist
usb 1-1: USB disconnect, device number 5
usb 1-1: new high-speed USB device number 6 using dummy_hcd
usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3
usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3
usb 1-1: SerialNumber: syz
usb 1-1: 0:2 : does not exist
usb 1-1: USB disconnect, device number 6
usb 1-1: new high-speed USB device number 7 using dummy_hcd
usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3
usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3
usb 1-1: SerialNumber: syz
usb 1-1: 0:2 : does not exist
usb 1-1: USB disconnect, device number 7
usb 1-1: new high-speed USB device number 8 using dummy_hcd
usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3
usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3
usb 1-1: SerialNumber: syz
usb 1-1: 0:2 : does not exist
usb 1-1: USB disconnect, device number 8
usb 1-1: new high-speed USB device number 9 using dummy_hcd
usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3
usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3
usb 1-1: SerialNumber: syz
usb 1-1: 0:2 : does not exist
usb 1-1: USB disconnect, device number 9
usb 1-1: new high-speed USB device number 10 using dummy_hcd
usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3
usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3
usb 1-1: SerialNumber: syz
usb 1-1: 0:2 : does not exist
usb 1-1: USB disconnect, device number 10
usb 1-1: new high-speed USB device number 11 using dummy_hcd
usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3
usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3
usb 1-1: SerialNumber: syz