ci starts bisection 2025-11-08 08:21:08.898182727 +0000 UTC m=+146123.199445687 bisecting fixing commit since 07fdad3a93756b872da7b53647715c48d0f4a2d0 building syzkaller on 7e2882b32698b70f3149aee00c41e3d2d941dca3 ensuring issue is reproducible on original commit 07fdad3a93756b872da7b53647715c48d0f4a2d0 testing commit 07fdad3a93756b872da7b53647715c48d0f4a2d0 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: b9fd33cc53c0019cfbf3466dc0383208079134088a7513ff5fb71771513c8332 run #0: crashed: WARNING in copy_mnt_ns run #1: crashed: WARNING in copy_mnt_ns run #2: crashed: WARNING in copy_mnt_ns run #3: crashed: WARNING in copy_mnt_ns run #4: crashed: WARNING in copy_mnt_ns run #5: crashed: WARNING in copy_mnt_ns run #6: crashed: WARNING in copy_mnt_ns run #7: crashed: WARNING in copy_mnt_ns run #8: crashed: WARNING in free_mnt_ns run #9: crashed: WARNING in copy_mnt_ns run #10: crashed: WARNING in copy_mnt_ns run #11: crashed: WARNING in copy_mnt_ns run #12: crashed: WARNING in copy_mnt_ns run #13: crashed: WARNING in copy_mnt_ns run #14: crashed: WARNING in copy_mnt_ns run #15: crashed: WARNING in free_ipc run #16: crashed: WARNING in copy_mnt_ns run #17: crashed: WARNING in copy_mnt_ns run #18: crashed: WARNING in destroy_pid_namespace_work run #19: crashed: WARNING in destroy_pid_namespace_work representative crash: WARNING in copy_mnt_ns, types: [WARNING] check whether we can drop unnecessary instrumentation disabling configs for [hang memleak ubsan kasan locking atomic_sleep], they are not needed testing commit 07fdad3a93756b872da7b53647715c48d0f4a2d0 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 64f88a5c9bff95c724b48470ee006f87202d5ce0314637a2d999f9330f9ff12f all runs: crashed: WARNING in copy_mnt_ns representative crash: WARNING in copy_mnt_ns, types: [WARNING] the bug reproduces without the instrumentation disabling configs for [atomic_sleep hang memleak ubsan kasan locking], they are not needed kconfig minimization: base=4116 full=8555 leaves diff=2161 split chunks (needed=false): <2161> split chunk #0 of len 2161 into 5 parts testing without sub-chunk 1/5 disabling configs for [kasan locking atomic_sleep hang memleak ubsan], they are not needed testing commit 07fdad3a93756b872da7b53647715c48d0f4a2d0 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 88e676b6daad8d8ee9ea3feae78fae7d2b66e84e416e38c3d536c6fa06eb0430 all runs: crashed: WARNING in copy_mnt_ns representative crash: WARNING in copy_mnt_ns, types: [WARNING] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [memleak ubsan kasan locking atomic_sleep hang], they are not needed testing commit 07fdad3a93756b872da7b53647715c48d0f4a2d0 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 0f8a4797480278cb5ccbd42c184403088a668a3aa93365a2554c4b818ecb0b44 run #0: crashed: WARNING in copy_mnt_ns run #1: crashed: WARNING in copy_mnt_ns run #2: crashed: WARNING in copy_mnt_ns run #3: crashed: WARNING in copy_mnt_ns run #4: crashed: WARNING in copy_mnt_ns run #5: crashed: WARNING in copy_mnt_ns run #6: crashed: WARNING in copy_mnt_ns run #7: crashed: WARNING in copy_mnt_ns run #8: crashed: WARNING in free_mnt_ns run #9: crashed: WARNING in free_mnt_ns representative crash: WARNING in copy_mnt_ns, types: [WARNING] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [kasan locking atomic_sleep hang memleak ubsan], they are not needed testing commit 07fdad3a93756b872da7b53647715c48d0f4a2d0 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: ea910f67b9460ca5f9b76538f39fc0d8f9f1af4ec57e9f645b2d54caaff80095 run #0: crashed: WARNING in copy_mnt_ns run #1: crashed: WARNING in copy_mnt_ns run #2: crashed: WARNING in copy_mnt_ns run #3: crashed: WARNING in copy_mnt_ns run #4: crashed: WARNING in copy_mnt_ns run #5: crashed: WARNING in copy_mnt_ns run #6: crashed: WARNING in copy_mnt_ns run #7: crashed: WARNING in copy_mnt_ns run #8: crashed: WARNING in free_mnt_ns run #9: crashed: WARNING in free_mnt_ns representative crash: WARNING in copy_mnt_ns, types: [WARNING] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [atomic_sleep hang memleak ubsan kasan locking], they are not needed testing commit 07fdad3a93756b872da7b53647715c48d0f4a2d0 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 605e3974053ead682f9f6ceb1122d06a939793ba0259e1192ebbe504c8cf858d run #0: crashed: WARNING in copy_mnt_ns run #1: crashed: WARNING in copy_mnt_ns run #2: crashed: WARNING in copy_mnt_ns run #3: crashed: WARNING in copy_mnt_ns run #4: crashed: WARNING in copy_mnt_ns run #5: crashed: WARNING in copy_mnt_ns run #6: crashed: WARNING in copy_mnt_ns run #7: crashed: WARNING in free_mnt_ns run #8: crashed: WARNING in free_mnt_ns run #9: crashed: WARNING in free_mnt_ns representative crash: WARNING in copy_mnt_ns, types: [WARNING] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [locking atomic_sleep hang memleak ubsan kasan], they are not needed testing commit 07fdad3a93756b872da7b53647715c48d0f4a2d0 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 1acd0b6e5a88e0aec990e41d2365df5de7f62509f84016b08d8ecc931821720f all runs: crashed: WARNING in copy_mnt_ns representative crash: WARNING in copy_mnt_ns, types: [WARNING] the chunk can be dropped disabling configs for [kasan locking atomic_sleep hang memleak ubsan], they are not needed testing current HEAD a0c3aefb08cd81864b17c23c25b388dba90b9dad testing commit a0c3aefb08cd81864b17c23c25b388dba90b9dad gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: e7f86a416eb12bca18755cfc198481ddc8fce82ef42daa1bfcd12913475237c4 all runs: OK false negative chance: 0.000 # git bisect start a0c3aefb08cd81864b17c23c25b388dba90b9dad 07fdad3a93756b872da7b53647715c48d0f4a2d0 Bisecting: 3039 revisions left to test after this (roughly 12 steps) [fc282d1731ec4686c1a84f8aca50c0c421e593b5] Merge tag 'uml-for-linux-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux determine whether the revision contains the guilty commit revision 07fdad3a93756b872da7b53647715c48d0f4a2d0 crashed and is reachable testing commit fc282d1731ec4686c1a84f8aca50c0c421e593b5 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 207cd5b18fec15cb8693c2bb24c2756b76119a6a43ec3f5dbaac2b356397a6f2 all runs: OK false negative chance: 0.000 # git bisect bad fc282d1731ec4686c1a84f8aca50c0c421e593b5 Bisecting: 1423 revisions left to test after this (roughly 11 steps) [f3826aa9962b4572d01083c84ac0f8345f121168] Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm determine whether the revision contains the guilty commit revision 07fdad3a93756b872da7b53647715c48d0f4a2d0 crashed and is reachable testing commit f3826aa9962b4572d01083c84ac0f8345f121168 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: b7790e38ee2df195b4a667f81346f98a9ede9461b83d0666a69b0ef2e52bef5f all runs: OK false negative chance: 0.000 # git bisect bad f3826aa9962b4572d01083c84ac0f8345f121168 Bisecting: 789 revisions left to test after this (roughly 10 steps) [070a542f08acb7e8cf197287f5c44658c715d2d1] Merge tag 'nfs-for-6.18-1' of git://git.linux-nfs.org/projects/anna/linux-nfs determine whether the revision contains the guilty commit revision 07fdad3a93756b872da7b53647715c48d0f4a2d0 crashed and is reachable testing commit 070a542f08acb7e8cf197287f5c44658c715d2d1 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 1db69faf25ea57f0c07bf461ecfbf22a74d85f07f3f026108e0d859dbc7cb492 run #0: ignore: lost connection to test machine run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK false negative chance: 0.000 # git bisect bad 070a542f08acb7e8cf197287f5c44658c715d2d1 Bisecting: 386 revisions left to test after this (roughly 9 steps) [8804d970fab45726b3c7cd7f240b31122aa94219] Merge tag 'mm-stable-2025-10-01-19-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm determine whether the revision contains the guilty commit revision 07fdad3a93756b872da7b53647715c48d0f4a2d0 crashed and is reachable testing commit 8804d970fab45726b3c7cd7f240b31122aa94219 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 145be36d47bc259da23a12f788a9ebe872cf345c43de98b9c7e817367fe3e501 all runs: crashed: WARNING in copy_mnt_ns representative crash: WARNING in copy_mnt_ns, types: [WARNING] # git bisect good 8804d970fab45726b3c7cd7f240b31122aa94219 Bisecting: 200 revisions left to test after this (roughly 8 steps) [cf06d791f840be97f726ecaaea872a876ff62436] Merge tag 'ovl-update-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs determine whether the revision contains the guilty commit revision 07fdad3a93756b872da7b53647715c48d0f4a2d0 crashed and is reachable testing commit cf06d791f840be97f726ecaaea872a876ff62436 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: f246585f96589b51da09a68e7096ca31697c20bc01dc3b279ba8bd37cfb5ef6f all runs: OK false negative chance: 0.000 # git bisect bad cf06d791f840be97f726ecaaea872a876ff62436 Bisecting: 109 revisions left to test after this (roughly 7 steps) [e406d57be7bd2a4e73ea512c1ae36a40a44e499e] Merge tag 'mm-nonmm-stable-2025-10-02-15-29' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm determine whether the revision contains the guilty commit revision 8804d970fab45726b3c7cd7f240b31122aa94219 crashed and is reachable testing commit e406d57be7bd2a4e73ea512c1ae36a40a44e499e gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: c064b0eda34f70d42eb248d56087e366348c2267081cb3642b672d6592891f19 all runs: crashed: WARNING in copy_mnt_ns representative crash: WARNING in copy_mnt_ns, types: [WARNING] # git bisect good e406d57be7bd2a4e73ea512c1ae36a40a44e499e Bisecting: 54 revisions left to test after this (roughly 6 steps) [71cf10ce4562ed7b18f3bd44a4e2dfafd0e84c50] open_detached_copy(): don't bother with mount_lock_hash() determine whether the revision contains the guilty commit checking the merge base b320789d6883cc00ac78ce83bccbfe7ed58afcf0 no existing result, test the revision testing commit b320789d6883cc00ac78ce83bccbfe7ed58afcf0 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 815d3913ddbf4376b12dab33e5631c70f6c40cbd7e78ccbf9113b6692a9a1abf all runs: OK false negative chance: 0.000 the bug was not introduced yet; pretend that kernel crashed # git bisect good 71cf10ce4562ed7b18f3bd44a4e2dfafd0e84c50 Bisecting: 24 revisions left to test after this (roughly 5 steps) [829745b75a1af25bfb0c7dc36640548c98c57169] Merge tag 'pull-finish_no_open' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs determine whether the revision contains the guilty commit revision 8804d970fab45726b3c7cd7f240b31122aa94219 crashed and is reachable testing commit 829745b75a1af25bfb0c7dc36640548c98c57169 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 21ffc1636a3428bc93231ada29655aface133c9b9af1a73690282ac87d3de47f all runs: OK false negative chance: 0.000 # git bisect bad 829745b75a1af25bfb0c7dc36640548c98c57169 Bisecting: 15 revisions left to test after this (roughly 4 steps) [51e9889ab120c21de8a3ae447672e69aa4266103] Merge tag 'pull-fs_context' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs determine whether the revision contains the guilty commit revision 8804d970fab45726b3c7cd7f240b31122aa94219 crashed and is reachable testing commit 51e9889ab120c21de8a3ae447672e69aa4266103 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: d1c9757a49caff557703ccb13b9ff6fdba5bcaf50586c6d38bd09ede09d7a405 all runs: OK false negative chance: 0.000 # git bisect bad 51e9889ab120c21de8a3ae447672e69aa4266103 Bisecting: 6 revisions left to test after this (roughly 3 steps) [09a1b33c080f6ac700fadc67c8471e67bf75fda4] preparations to taking MNT_WRITE_HOLD out of ->mnt_flags determine whether the revision contains the guilty commit checking the merge base 38f4885088fc5ad41b8b0a2a2cfc73d01e709e5c no existing result, test the revision testing commit 38f4885088fc5ad41b8b0a2a2cfc73d01e709e5c gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 15d88f4e1c47ac553acabbe3f63686f35bc02fd60b5f9e7e909226a810284b85 all runs: OK false negative chance: 0.000 the bug was not introduced yet; pretend that kernel crashed # git bisect good 09a1b33c080f6ac700fadc67c8471e67bf75fda4 Bisecting: 3 revisions left to test after this (roughly 2 steps) [a79765248649de77771c24f7be08ff4c96f16f7a] constify {__,}mnt_is_readonly() determine whether the revision contains the guilty commit checking the merge base 38f4885088fc5ad41b8b0a2a2cfc73d01e709e5c the bug was not introduced yet; pretend that kernel crashed # git bisect good a79765248649de77771c24f7be08ff4c96f16f7a Bisecting: 1 revision left to test after this (roughly 1 step) [57e62089f8e9d0baaba40103b167003ed7170db5] do_nfs4_mount(): switch to vfs_parse_fs_string() determine whether the revision contains the guilty commit checking the merge base 8f5ae30d69d7543eee0d70083daf4de8fe15d585 no existing result, test the revision testing commit 8f5ae30d69d7543eee0d70083daf4de8fe15d585 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 17095eee78768df210400369af692d4e74e48ba9892940f6206c92ebf53e1a62 all runs: OK false negative chance: 0.000 the bug was not introduced yet; pretend that kernel crashed # git bisect good 57e62089f8e9d0baaba40103b167003ed7170db5 Bisecting: 0 revisions left to test after this (roughly 0 steps) [e64aeecbbb0962601bd2ac502a2f9c0d9be97502] Merge tag 'pull-mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs determine whether the revision contains the guilty commit revision 8804d970fab45726b3c7cd7f240b31122aa94219 crashed and is reachable testing commit e64aeecbbb0962601bd2ac502a2f9c0d9be97502 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: f2add55675f6b5ab311be7a2fe4adafe1e25f37e9fd2a50d54cc6a0ca14c331c all runs: OK false negative chance: 0.000 # git bisect bad e64aeecbbb0962601bd2ac502a2f9c0d9be97502 e64aeecbbb0962601bd2ac502a2f9c0d9be97502 is the first bad commit commit e64aeecbbb0962601bd2ac502a2f9c0d9be97502 Merge: e406d57be7bd a79765248649 Author: Linus Torvalds Date: Fri Oct 3 10:19:44 2025 -0700 Merge tag 'pull-mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs mount updates from Al Viro: "Several piles this cycle, this mount-related one being the largest and trickiest: - saner handling of guards in fs/namespace.c, getting rid of needlessly strong locking in some of the users - lock_mount() calling conventions change - have it set the environment for attaching to given location, storing the results in caller-supplied object, without altering the passed struct path. Make unlock_mount() called as __cleanup for those objects. It's not exactly guard(), but similar to it - MNT_WRITE_HOLD done right. mnt_hold_writers() does *not* mess with ->mnt_flags anymore, so insertion of a new mount into ->s_mounts of underlying superblock does not, in itself, expose ->mnt_flags of that mount to concurrent modifications - getting rid of pathological cases when umount() spends quadratic time removing the victims from propagation graph - part of that had been dealt with last cycle, this should finish it - a bunch of stuff constified - assorted cleanups * tag 'pull-mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (64 commits) constify {__,}mnt_is_readonly() WRITE_HOLD machinery: no need for to bump mount_lock seqcount struct mount: relocate MNT_WRITE_HOLD bit preparations to taking MNT_WRITE_HOLD out of ->mnt_flags setup_mnt(): primitive for connecting a mount to filesystem simplify the callers of mnt_unhold_writers() copy_mnt_ns(): use guards copy_mnt_ns(): use the regular mechanism for freeing empty mnt_ns on failure open_detached_copy(): separate creation of namespace into helper open_detached_copy(): don't bother with mount_lock_hash() path_has_submounts(): use guard(mount_locked_reader) fs/namespace.c: sanitize descriptions for {__,}lookup_mnt() ecryptfs: get rid of pointless mount references in ecryptfs dentries umount_tree(): take all victims out of propagation graph at once do_mount(): use __free(path_put) do_move_mount_old(): use __free(path_put) constify can_move_mount_beneath() arguments path_umount(): constify struct path argument may_copy_tree(), __do_loopback(): constify struct path argument path_mount(): constify struct path argument ... fs/dcache.c | 4 +- fs/ecryptfs/dentry.c | 14 +- fs/ecryptfs/ecryptfs_kernel.h | 27 +- fs/ecryptfs/file.c | 15 +- fs/ecryptfs/inode.c | 19 +- fs/ecryptfs/main.c | 24 +- fs/internal.h | 4 +- fs/mount.h | 39 +- fs/namespace.c | 996 +++++++++++++++++++----------------------- fs/pnode.c | 75 +++- fs/pnode.h | 1 + fs/super.c | 3 +- include/linux/fs.h | 4 +- include/linux/mount.h | 9 +- kernel/audit_tree.c | 12 +- 15 files changed, 602 insertions(+), 644 deletions(-) accumulated error probability: 0.00 revisions tested: 20, total time: 7h55m1.441829361s (build: 3h37m48.198605083s, test: 3h35m9.518314474s) first good commit: e64aeecbbb0962601bd2ac502a2f9c0d9be97502 Merge tag 'pull-mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs recipients (to): ["linux-kernel@vger.kernel.org" "torvalds@linux-foundation.org"] recipients (cc): ["brauner@kernel.org" "jack@suse.cz" "linux-fsdevel@vger.kernel.org" "viro@zeniv.linux.org.uk"]