ci starts bisection 2025-10-02 08:11:25.955530397 +0000 UTC m=+72922.519194993 bisecting cause commit starting from 50c19e20ed2ef359cf155a39c8462b0a6351b9fa building syzkaller on a185913838f62e03bd7ba14364cc781630375079 ensuring issue is reproducible on original commit 50c19e20ed2ef359cf155a39c8462b0a6351b9fa testing commit 50c19e20ed2ef359cf155a39c8462b0a6351b9fa gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: c65c51897c9a24ef3ed86854e033ede0d408d96ea5a00dac66e2dfe174f53aaa all runs: crashed: WARNING in free_mnt_ns representative crash: WARNING in free_mnt_ns, types: [WARNING] check whether we can drop unnecessary instrumentation disabling configs for [locking atomic_sleep hang memleak ubsan kasan], they are not needed testing commit 50c19e20ed2ef359cf155a39c8462b0a6351b9fa gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: e6151644d9d8d9518c2e861f45b46a755b66bcf8d45f34246b3fdaff1eec7f9c all runs: crashed: WARNING in free_mnt_ns representative crash: WARNING in free_mnt_ns, types: [WARNING] the bug reproduces without the instrumentation disabling configs for [ubsan kasan locking atomic_sleep hang memleak], they are not needed kconfig minimization: base=4099 full=8492 leaves diff=2183 split chunks (needed=false): <2183> split chunk #0 of len 2183 into 5 parts testing without sub-chunk 1/5 disabling configs for [atomic_sleep hang memleak ubsan kasan locking], they are not needed testing commit 50c19e20ed2ef359cf155a39c8462b0a6351b9fa gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 9a9405ddfada3d8a4f98c04e66a0911bb375898a814b0f9ab5bd3754dbd13185 all runs: crashed: WARNING in free_mnt_ns representative crash: WARNING in free_mnt_ns, types: [WARNING] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [kasan locking atomic_sleep hang memleak ubsan], they are not needed testing commit 50c19e20ed2ef359cf155a39c8462b0a6351b9fa gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: eeca402c8eefe1a19f168be2fb9640dc1a1c9f8e2556f302b2795c5d31f47bb6 all runs: crashed: WARNING in free_mnt_ns representative crash: WARNING in free_mnt_ns, types: [WARNING] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [hang memleak ubsan kasan locking atomic_sleep], they are not needed testing commit 50c19e20ed2ef359cf155a39c8462b0a6351b9fa gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 527dd3ba185f2688169408b61a4aa2ca0ea914a7cb76ce9159b637e5761502a1 all runs: crashed: WARNING in free_mnt_ns representative crash: WARNING in free_mnt_ns, types: [WARNING] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [hang memleak ubsan kasan locking atomic_sleep], they are not needed testing commit 50c19e20ed2ef359cf155a39c8462b0a6351b9fa gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: b268a688214ad029c2d3b6bae7f26f561335b3406a02e80e38af04b41a34b199 all runs: crashed: WARNING in free_mnt_ns representative crash: WARNING in free_mnt_ns, types: [WARNING] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [ubsan kasan locking atomic_sleep hang memleak], they are not needed testing commit 50c19e20ed2ef359cf155a39c8462b0a6351b9fa gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: b6bbfe51ffbacff530b805586cd09f7319fd28818aae71b5772003dacdea9944 all runs: crashed: WARNING in free_mnt_ns representative crash: WARNING in free_mnt_ns, types: [WARNING] the chunk can be dropped disabling configs for [memleak ubsan kasan locking atomic_sleep hang], they are not needed picked [v6.17 v6.16 v6.15 v6.13 v6.11 v6.9 v6.7 v6.5 v6.2 v5.19 v5.16 v5.13 v5.10 v5.7 v5.4 v5.1 v4.19] out of 40 release tags testing release v6.17 testing commit e5f0a698b34ed76002dc5cff3804a61c80233a7a gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 23969af6d951af5dbb70d5af076b6a75050e2bb1716f5661c666cfacec89a31d all runs: OK false negative chance: 0.000 # git bisect start 50c19e20ed2ef359cf155a39c8462b0a6351b9fa e5f0a698b34ed76002dc5cff3804a61c80233a7a Bisecting: 831 revisions left to test after this (roughly 10 steps) [f3827213abae9291b7525b05e6fd29b1f0536ce6] Merge tag 'for-6.18-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux testing commit f3827213abae9291b7525b05e6fd29b1f0536ce6 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 2d403e4703022759f6cd77a0253709e2ba2e8be9f9b7ce433e069fc8c6d0260b all runs: crashed: WARNING in free_mnt_ns representative crash: WARNING in free_mnt_ns, types: [WARNING] # git bisect bad f3827213abae9291b7525b05e6fd29b1f0536ce6 Bisecting: 455 revisions left to test after this (roughly 9 steps) [5928397f5739fb94559350575826d94fa8c35929] Merge tag 'erofs-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs testing commit 5928397f5739fb94559350575826d94fa8c35929 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 023d94e33e471538bde888a4049beab9411eeea4cb0a907677826bdd83960c0d all runs: crashed: WARNING in free_mnt_ns representative crash: WARNING in free_mnt_ns, types: [WARNING] # git bisect bad 5928397f5739fb94559350575826d94fa8c35929 Bisecting: 232 revisions left to test after this (roughly 8 steps) [a40eb50a9566318a138b3e222fc4fe04e3932cda] Merge tag 'gfs2-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 testing commit a40eb50a9566318a138b3e222fc4fe04e3932cda gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 4fe9b0c79b93a3f50ecbc1b850ab6f69879551c7f03adc0dd3199b24b45b06e3 all runs: crashed: WARNING in free_mnt_ns representative crash: WARNING in free_mnt_ns, types: [WARNING] # git bisect bad a40eb50a9566318a138b3e222fc4fe04e3932cda Bisecting: 108 revisions left to test after this (roughly 7 steps) [5484a4ea7a1f208b886b58dd55cc55f418930f8a] Merge tag 'vfs-6.18-rc1.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs testing commit 5484a4ea7a1f208b886b58dd55cc55f418930f8a gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: dfedb2d8dc4cecd3378bef34258757f7b973e80a1fddf6efcdc08cea6ea4e0bf all runs: OK false negative chance: 0.000 # git bisect good 5484a4ea7a1f208b886b58dd55cc55f418930f8a Bisecting: 54 revisions left to test after this (roughly 6 steps) [83914de1c1d39dca4a3196a03bcd64d0a861d551] net-sysfs: use check_net() testing commit 83914de1c1d39dca4a3196a03bcd64d0a861d551 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: b85b52f6cf61f080475ab53f66656c44989b799558e264da50632de0013775e1 all runs: crashed: WARNING in free_mnt_ns representative crash: WARNING in free_mnt_ns, types: [WARNING] # git bisect bad 83914de1c1d39dca4a3196a03bcd64d0a861d551 Bisecting: 26 revisions left to test after this (roughly 5 steps) [58f976d41fd915acd2403a2b8e0eef8e9c478357] uts: support ns lookup testing commit 58f976d41fd915acd2403a2b8e0eef8e9c478357 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 1b984e38198f29fa906fa033815dc0bf57febb41584bf985732873530fe22f2b all runs: OK false negative chance: 0.000 # git bisect good 58f976d41fd915acd2403a2b8e0eef8e9c478357 Bisecting: 13 revisions left to test after this (roughly 4 steps) [5fc6bef178f1b644f1439e520c8f83bfc83a1252] cgroup: split namespace into separate header testing commit 5fc6bef178f1b644f1439e520c8f83bfc83a1252 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 failed building 5fc6bef178f1b644f1439e520c8f83bfc83a1252: kernel/nscommon.c:10:9: error: call to undeclared function 'proc_alloc_inum'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] # git bisect skip 5fc6bef178f1b644f1439e520c8f83bfc83a1252 Bisecting: 13 revisions left to test after this (roughly 4 steps) [5612ff3ec588be09f11a9424db6d1186bcdeb3fa] nscommon: simplify initialization testing commit 5612ff3ec588be09f11a9424db6d1186bcdeb3fa gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 76583f4ee2f1c683885baa5e2b923af7f2d38f6d264ef00ad20baa4999d59996 all runs: OK false negative chance: 0.000 # git bisect good 5612ff3ec588be09f11a9424db6d1186bcdeb3fa Bisecting: 4 revisions left to test after this (roughly 2 steps) [06099e374f3ab818f0501671b21493ba2e1b94b9] cgroup: port to ns_ref_*() helpers testing commit 06099e374f3ab818f0501671b21493ba2e1b94b9 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 66d3c19954010920eabb5fd02311eb3fa6db5f5f29d59eb7ca0e12ec3c8ddcd0 all runs: crashed: WARNING in free_mnt_ns representative crash: WARNING in free_mnt_ns, types: [WARNING] # git bisect bad 06099e374f3ab818f0501671b21493ba2e1b94b9 Bisecting: 1 revision left to test after this (roughly 1 step) [224ef741ce87aa6474b82e0eb76e0e8e1bafe544] ns: add reference count helpers testing commit 224ef741ce87aa6474b82e0eb76e0e8e1bafe544 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: ecd3dc64645ca38c0ddc93aeebb8e0427b0270e3ff323562c33d0d2276cc24f7 all runs: crashed: WARNING in free_mnt_ns representative crash: WARNING in free_mnt_ns, types: [WARNING] # git bisect bad 224ef741ce87aa6474b82e0eb76e0e8e1bafe544 Bisecting: 0 revisions left to test after this (roughly 1 step) [bb57289f0ce1bab7c9ea2106a29088088dc95229] Merge patch series "ns: rework common initialization" testing commit bb57289f0ce1bab7c9ea2106a29088088dc95229 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: c26ceb34e48914304fac837eebc655d017a2840ade9265436dcefa3f6dfe7072 all runs: crashed: WARNING in free_mnt_ns representative crash: WARNING in free_mnt_ns, types: [WARNING] # git bisect bad bb57289f0ce1bab7c9ea2106a29088088dc95229 Bisecting: 0 revisions left to test after this (roughly 0 steps) [be5f21d3985f00827e09b798f7a07ebd6dd7f54a] ns: add ns_common_free() testing commit be5f21d3985f00827e09b798f7a07ebd6dd7f54a gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: d88e47cb72d9215de928b98a1d9f91a62717e29f0289826e9546525a961b2039 all runs: crashed: WARNING in free_mnt_ns representative crash: WARNING in free_mnt_ns, types: [WARNING] # git bisect bad be5f21d3985f00827e09b798f7a07ebd6dd7f54a be5f21d3985f00827e09b798f7a07ebd6dd7f54a is the first bad commit commit be5f21d3985f00827e09b798f7a07ebd6dd7f54a Author: Christian Brauner Date: Wed Sep 17 12:28:08 2025 +0200 ns: add ns_common_free() And drop ns_free_inum(). Anything common that can be wasted centrally should be wasted in the new common helper. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner fs/namespace.c | 4 ++-- include/linux/ns_common.h | 3 +++ include/linux/proc_ns.h | 2 -- ipc/namespace.c | 4 ++-- kernel/cgroup/namespace.c | 2 +- kernel/nscommon.c | 5 +++++ kernel/pid_namespace.c | 4 ++-- kernel/time/namespace.c | 2 +- kernel/user_namespace.c | 4 ++-- kernel/utsname.c | 2 +- net/core/net_namespace.c | 4 ++-- 11 files changed, 21 insertions(+), 15 deletions(-) accumulated error probability: 0.00 culprit signature: d88e47cb72d9215de928b98a1d9f91a62717e29f0289826e9546525a961b2039 parent signature: 76583f4ee2f1c683885baa5e2b923af7f2d38f6d264ef00ad20baa4999d59996 revisions tested: 19, total time: 5h23m17.036878066s (build: 3h1m48.991145562s, test: 1h31m15.239150263s) first bad commit: be5f21d3985f00827e09b798f7a07ebd6dd7f54a ns: add ns_common_free() recipients (to): ["anna-maria@linutronix.de" "brauner@kernel.org" "davem@davemloft.net" "edumazet@google.com" "frederic@kernel.org" "jack@suse.cz" "kuba@kernel.org" "netdev@vger.kernel.org" "pabeni@redhat.com" "tglx@linutronix.de"] recipients (cc): ["akpm@linux-foundation.org" "brauner@kernel.org" "cgroups@vger.kernel.org" "cminyard@mvista.com" "cyphar@cyphar.com" "djwong@kernel.org" "hannes@cmpxchg.org" "horms@kernel.org" "jack@suse.cz" "jlayton@kernel.org" "joel.granados@kernel.org" "kuniyu@google.com" "linux-fsdevel@vger.kernel.org" "linux-kernel@vger.kernel.org" "mawupeng1@huawei.com" "mkoutny@suse.com" "sd@queasysnail.net" "tj@kernel.org" "viro@zeniv.linux.org.uk" "wei.liu@kernel.org"] crash: WARNING in free_mnt_ns RBP: 00007fa0b832f090 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007fa0b8716038 R14: 00007fa0b8715fa0 R15: 00007fffb1069758 ------------[ cut here ]------------ ida_free called for id=424 which is not allocated. WARNING: CPU: 1 PID: 2867 at lib/idr.c:592 ida_free+0x107/0x150 lib/idr.c:592 Modules linked in: CPU: 1 UID: 0 PID: 2867 Comm: syz.3.17 Not tainted syzkaller #0 PREEMPT(none) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:ida_free+0x107/0x150 lib/idr.c:592 Code: 21 d0 74 2c 48 8d 34 45 01 00 00 00 eb 24 48 8b 3c 24 48 89 de e8 29 f7 03 00 90 48 c7 c7 4b 22 4e 82 89 ee e8 1a 65 26 ff 90 <0f> 0b 90 90 eb 16 31 f6 48 89 e7 e8 a9 44 02 00 48 8b 3c 24 48 89 RSP: 0018:ffffc90002073c78 EFLAGS: 00010246 RAX: 89283fd7100bd200 RBX: 0000000000000286 RCX: 0000000000000000 RDX: 0000000000000002 RSI: 00000000ffffdfff RDI: 00000000ffffffff RBP: 00000000000001a8 R08: 0000000000001fff R09: ffffffff8289aab0 R10: 0000000000005ffd R11: 00000000ffffdfff R12: 0000000000000000 R13: ffff8881013b5a98 R14: 00000000000001a8 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8882b4ada000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa0b8448750 CR3: 0000000002848000 CR4: 00000000003506f0 Call Trace: free_mnt_ns+0x15/0x60 fs/namespace.c:4085 namespace_unlock+0x1de/0x280 fs/namespace.c:1692 free_nsproxy+0x11/0x130 kernel/nsproxy.c:188 do_exit+0x22d/0x970 kernel/exit.c:960 do_group_exit+0x88/0xa0 kernel/exit.c:1102 get_signal+0x658/0x6b0 kernel/signal.c:3034 arch_do_signal_or_restart+0x8a/0x2a0 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x70/0xd0 kernel/entry/common.c:40 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x201/0x2f0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa0b84beec9 Code: Unable to access opcode bytes at 0x7fa0b84bee9f. RSP: 002b:00007fa0b832f0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007fa0b8715fa8 RCX: 00007fa0b84beec9 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fa0b8715fa8 RBP: 00007fa0b8715fa0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fa0b8716038 R14: 00007fffb1069670 R15: 00007fffb1069758