ci2 starts bisection 2026-11-05 23:44:04.142121565 +0000 UTC m=+13840.407009888 bisecting fixing commit since 79807e970724c1f90cee1316361d61b80db4eef6 building syzkaller on 853b104bb454141a5b0fc0e4218ec78e9f34ffb1 ensuring issue is reproducible on original commit 79807e970724c1f90cee1316361d61b80db4eef6 testing commit 79807e970724c1f90cee1316361d61b80db4eef6 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: d100f45801069ae8929b22a778c67d3816aba6564a86e9a3a30250f29469aa67 all runs: crashed: WARNING in poll_select_finish representative crash: WARNING in poll_select_finish, types: [WARNING] check whether we can drop unnecessary instrumentation disabling configs for [kasan locking atomic_sleep hang memleak ubsan], they are not needed testing commit 79807e970724c1f90cee1316361d61b80db4eef6 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 3e78cc375d5efb48fbbdb43cc23be8545ab22f7e6288b625be5e9f0bedaa6032 all runs: crashed: WARNING in poll_select_finish representative crash: WARNING in poll_select_finish, types: [WARNING] the bug reproduces without the instrumentation disabling configs for [atomic_sleep hang memleak ubsan kasan locking], they are not needed kconfig minimization: base=7508 full=9789 leaves diff=2007 split chunks (needed=false): <2007> split chunk #0 of len 2007 into 5 parts testing without sub-chunk 1/5 disabling configs for [hang memleak ubsan kasan locking atomic_sleep], they are not needed testing commit 79807e970724c1f90cee1316361d61b80db4eef6 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: d905387a5f9893aba6f6d0d1e0ef0b8e6a65beedb82a3d07a065675d206a49df all runs: crashed: WARNING in poll_select_finish representative crash: WARNING in poll_select_finish, types: [WARNING] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [ubsan kasan locking atomic_sleep hang memleak], they are not needed testing commit 79807e970724c1f90cee1316361d61b80db4eef6 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 23e7bef4c828ab3ec034e69a88eb5fa23a68f1bb22323aa955f52264c642b67f all runs: crashed: WARNING in poll_select_finish representative crash: WARNING in poll_select_finish, types: [WARNING] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [hang memleak ubsan kasan locking atomic_sleep], they are not needed testing commit 79807e970724c1f90cee1316361d61b80db4eef6 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: ac9ec8eee28d1e1f87b83a595f256f69ca6e5737e016c5671c15c78890686a8e all runs: crashed: WARNING in poll_select_finish representative crash: WARNING in poll_select_finish, types: [WARNING] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [hang memleak ubsan kasan locking atomic_sleep], they are not needed testing commit 79807e970724c1f90cee1316361d61b80db4eef6 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 0d9c23982e08329f51b0694e985903aeba7172182d1ad0c708d7480b0ebec1e7 all runs: OK false negative chance: 0.000 testing without sub-chunk 5/5 disabling configs for [locking atomic_sleep hang memleak ubsan kasan], they are not needed testing commit 79807e970724c1f90cee1316361d61b80db4eef6 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 58505dc61e75852fe0de5159319a3156e4bbd335758c361df13f25a23db67ce0 all runs: crashed: WARNING in poll_select_finish representative crash: WARNING in poll_select_finish, types: [WARNING] the chunk can be dropped minimized to 402 configs; suspects: [AF_RXRPC ATM AX25 CFG80211 DLM DRM DRM_ROCKCHIP GENEVE HAMRADIO HID_PANTHERLORD HID_PLAYSTATION HID_SENSOR_HUB HID_SMARTJOYPLUS HID_SONY HID_THRUSTMASTER INFINIBAND INFINIBAND_ADDR_TRANS INFINIBAND_IPOIB INFINIBAND_USER_ACCESS INFINIBAND_VIRT_DMA INPUT_TABLET INPUT_TOUCHSCREEN IP_SCTP L2TP MAC80211 MEDIA_COMMON_OPTIONS MEDIA_RADIO_SUPPORT MFD_DLN2 MFD_RETU NETFILTER_CONNCOUNT NET_IPGRE NET_IPGRE_DEMUX OCFS2_FS OCFS2_FS_USERSPACE_CLUSTER OMFS_FS OPENVSWITCH OPENVSWITCH_GENEVE OPENVSWITCH_GRE OPENVSWITCH_VXLAN ORANGEFS_FS OSF_PARTITION OVERLAY_FS_INDEX OVERLAY_FS_REDIRECT_DIR PACKET_DIAG PADATA PAGE_IDLE_FLAG PANTHERLORD_FF PARPORT PARPORT_NOT_PC PARTITION_ADVANCED PATA_AMD PATA_OLDPIIX PATA_SCH PCCARD PCMCIA PERCPU_STATS PERSISTENT_KEYRINGS PHY_CPCAP_USB PHY_QCOM_USB_HSIC PHY_TUSB1210 PKCS7_TEST_KEY PKCS8_PRIVATE_KEY_PARSER PLAYSTATION_FF PLFXLC PMIC_OPREGION PM_DEBUG PM_SLEEP_DEBUG PPP PPPOATM PPPOE PPPOL2TP PPP_ASYNC PPP_BSDCOMP PPP_DEFLATE PPP_FILTER PPP_MPPE PPP_MULTILINK PPP_SYNC_TTY PPTP PRISM2_USB PROC_CHILDREN PROC_KCORE PROC_MEM_ALWAYS_FORCE PSI PSTORE_842_COMPRESS PSTORE_LZ4HC_COMPRESS PSTORE_LZ4_COMPRESS PSTORE_LZO_COMPRESS PSTORE_ZSTD_COMPRESS QFMT_V2 QNX4FS_FS QNX6FS_FS QUOTA_NETLINK_INTERFACE QUOTA_TREE RADIO_ADAPTERS RADIO_SHARK RADIO_SHARK2 RADIO_TEA575X RC_ATI_REMOTE RC_XBOX_DVD RDMA_RXE RDMA_SIW RDS RDS_RDMA RDS_TCP READ_ONLY_THP_FOR_FS REALTEK_AUTOPM REED_SOLOMON REED_SOLOMON_DEC8 REGMAP_SOUNDWIRE REGULATOR_TWL4030 REISERFS_FS REISERFS_FS_POSIX_ACL REISERFS_FS_SECURITY REISERFS_FS_XATTR REISERFS_PROC_INFO RELAY RFKILL RFKILL_INPUT RFKILL_LEDS RMI4_2D_SENSOR RMI4_CORE RMI4_F03 RMI4_F03_SERIO RMI4_F11 RMI4_F12 RMI4_F30 ROCKCHIP_ANALOGIX_DP ROCKCHIP_CDN_DP ROCKCHIP_DW_HDMI ROCKCHIP_DW_MIPI_DSI ROCKCHIP_INNO_HDMI ROCKCHIP_LVDS ROCKCHIP_VOP ROMFS_BACKED_BY_BOTH ROMFS_FS ROMFS_ON_BLOCK ROMFS_ON_MTD ROSE RTC_DRV_HID_SENSOR_TIME RXKAD SCHEDSTATS SCSI_CONSTANTS SCSI_FC_ATTRS SCSI_HPSA SCSI_ISCSI_ATTRS SCSI_LOGGING SCSI_NETLINK SCSI_SCAN_ASYNC SCSI_SPI_ATTRS SCSI_SRP_ATTRS SCTP_COOKIE_HMAC_MD5 SCTP_COOKIE_HMAC_SHA1 SCTP_DEFAULT_COOKIE_HMAC_MD5 SECONDARY_TRUSTED_KEYRING SECURITY_INFINIBAND SECURITY_NETWORK_XFRM SENSORS_AQUACOMPUTER_D5NEXT SENSORS_CORSAIR_CPRO SENSORS_CORSAIR_PSU SENSORS_NZXT_KRAKEN2 SENSORS_NZXT_SMART2 SERIAL_8250_DETECT_IRQ SERIAL_8250_MANY_PORTS SERIAL_8250_RSA SERIO_SERPORT SGI_PARTITION SIGNATURE SIGNED_PE_FILE_VERIFICATION SLHC SLIP SLIP_COMPRESSED SLIP_MODE_SLIP6 SLIP_SMART SMARTJOYPLUS_FF SMBFS SMB_SERVER SMC SMC_DIAG SMS_SDIO_DRV SMS_SIANO_DEBUGFS SMS_SIANO_MDTV SMS_SIANO_RC SMS_USB_DRV SND SND_ALOOP SND_AUDIO_GRAPH_CARD SND_AUDIO_GRAPH_CARD2 SND_BCD2000 SND_BCM2835_SOC_I2S SND_COMPRESS_OFFLOAD SND_CTL_FAST_LOOKUP SND_CTL_LED SND_DEBUG SND_DMAENGINE_PCM SND_DRIVERS SND_DUMMY SND_DYNAMIC_MINORS SND_HDA SND_HDA_ALIGNED_MMIO SND_HDA_CODEC_ANALOG SND_HDA_CODEC_CA0110 SND_HDA_CODEC_CA0132 SND_HDA_CODEC_CIRRUS SND_HDA_CODEC_CMEDIA SND_HDA_CODEC_CONEXANT SND_HDA_CODEC_HDMI SND_HDA_CODEC_REALTEK SND_HDA_CODEC_SI3054 SND_HDA_CODEC_SIGMATEL SND_HDA_CODEC_VIA SND_HDA_COMPONENT SND_HDA_CORE SND_HDA_GENERIC SND_HDA_GENERIC_LEDS SND_HDA_HWDEP SND_HDA_INPUT_BEEP SND_HDA_INTEL SND_HDA_PATCH_LOADER SND_HDA_RECONFIG SND_HDA_TEGRA SND_HRTIMER SND_HWDEP SND_IMX_SOC SND_INTEL_DSP_CONFIG SND_INTEL_NHLT SND_INTEL_SOUNDWIRE_ACPI SND_JACK SND_JACK_INPUT_DEV SND_MESON_AIU SND_MESON_AXG_FIFO SND_MESON_AXG_FRDDR SND_MESON_AXG_PDM SND_MESON_AXG_SOUND_CARD SND_MESON_AXG_SPDIFIN SND_MESON_AXG_SPDIFOUT SND_MESON_AXG_TDMIN SND_MESON_AXG_TDMOUT SND_MESON_AXG_TDM_FORMATTER SND_MESON_AXG_TDM_INTERFACE SND_MESON_AXG_TODDR SND_MESON_CARD_UTILS SND_MESON_CODEC_GLUE SND_MESON_G12A_TOACODEC SND_MESON_G12A_TOHDMITX SND_MESON_GX_SOUND_CARD SND_MIXER_OSS SND_OSSEMUL SND_PCI SND_PCM SND_PCM_ELD SND_PCM_IEC958 SND_PCM_OSS SND_PCM_OSS_PLUGINS SND_PCM_TIMER SND_PCM_XRUN_DEBUG SND_PROC_FS SND_RAWMIDI SND_SEQUENCER SND_SEQUENCER_OSS SND_SEQ_DEVICE SND_SEQ_DUMMY SND_SEQ_MIDI SND_SEQ_MIDI_EVENT SND_SEQ_VIRMIDI SND_SIMPLE_CARD SND_SIMPLE_CARD_UTILS SND_SOC SND_SOC_ADAU7002 SND_SOC_AK4613 SND_SOC_APPLE_MCA SND_SOC_APQ8016_SBC SND_SOC_COMPRESS SND_SOC_DA7219 SND_SOC_DMIC SND_SOC_ES7134 SND_SOC_ES7241 SND_SOC_FSL_ASOC_CARD SND_SOC_FSL_ASRC SND_SOC_FSL_AUDMIX SND_SOC_FSL_EASRC SND_SOC_FSL_ESAI SND_SOC_FSL_MICFIL SND_SOC_FSL_SAI SND_SOC_FSL_SPDIF SND_SOC_FSL_SSI SND_SOC_FSL_UTILS SND_SOC_GENERIC_DMAENGINE_PCM SND_SOC_GTM601 SND_SOC_HDMI_CODEC SND_SOC_I2C_AND_SPI SND_SOC_IMX_AUDMIX SND_SOC_IMX_AUDMUX SND_SOC_IMX_PCM_DMA SND_SOC_IMX_SGTL5000 SND_SOC_IMX_SPDIF SND_SOC_LPASS_APQ8016 SND_SOC_LPASS_CDC_DMA SND_SOC_LPASS_CPU SND_SOC_LPASS_HDMI SND_SOC_LPASS_MACRO_COMMON SND_SOC_LPASS_PLATFORM SND_SOC_LPASS_RX_MACRO SND_SOC_LPASS_SC7180 SND_SOC_LPASS_SC7280 SND_SOC_LPASS_TX_MACRO SND_SOC_LPASS_VA_MACRO SND_SOC_LPASS_WSA_MACRO SND_SOC_MAX98357A SND_SOC_MAX98927 SND_SOC_MESON_T9015 SND_SOC_MSM8916_WCD_ANALOG SND_SOC_MSM8916_WCD_DIGITAL SND_SOC_MSM8996 SND_SOC_NAU8822 SND_SOC_PCM3168A SND_SOC_PCM3168A_I2C SND_SOC_QCOM SND_SOC_QCOM_COMMON SND_SOC_QCOM_SDW SND_SOC_QDSP6 SND_SOC_QDSP6_ADM SND_SOC_QDSP6_AFE SND_SOC_QDSP6_AFE_CLOCKS SND_SOC_QDSP6_AFE_DAI SND_SOC_QDSP6_APM SND_SOC_QDSP6_APM_DAI SND_SOC_QDSP6_APM_LPASS_DAI SND_SOC_QDSP6_ASM SND_SOC_QDSP6_ASM_DAI SND_SOC_QDSP6_COMMON SND_SOC_QDSP6_CORE SND_SOC_QDSP6_PRM SND_SOC_QDSP6_PRM_LPASS_CLOCKS SND_SOC_QDSP6_ROUTING SND_SOC_RCAR SND_SOC_RK3399_GRU_SOUND SND_SOC_RL6231 SND_SOC_ROCKCHIP SND_SOC_ROCKCHIP_I2S SND_SOC_ROCKCHIP_RT5645 SND_SOC_ROCKCHIP_SPDIF SND_SOC_RT5514 SND_SOC_RT5514_SPI SND_SOC_RT5645 SND_SOC_RT5659 SND_SOC_RT5663 SND_SOC_RT5682 SND_SOC_RT5682S SND_SOC_RT5682_I2C SND_SOC_RZ SND_SOC_SAMSUNG SND_SOC_SC7180 SND_SOC_SC7280 SND_SOC_SDM845 SND_SOC_SGTL5000 SND_SOC_SIMPLE_AMPLIFIER SND_SOC_SIMPLE_MUX SND_SOC_SM8250 SND_SOC_SPDIF SND_SOC_TAS571X SND_SOC_TEGRA SND_SOC_TEGRA186_ASRC SND_SOC_TEGRA186_DSPK SND_SOC_TEGRA210_ADMAIF SND_SOC_TEGRA210_ADX SND_SOC_TEGRA210_AHUB SND_SOC_TEGRA210_AMX SND_SOC_TEGRA210_DMIC SND_SOC_TEGRA210_I2S SND_SOC_TEGRA210_MIXER SND_SOC_TEGRA210_MVC SND_SOC_TEGRA210_OPE SND_SOC_TEGRA210_SFC SND_SOC_TEGRA_AUDIO_GRAPH_CARD SND_SOC_TLV320AIC31XX SND_SOC_TLV320AIC32X4 SND_SOC_TLV320AIC32X4_I2C SND_SOC_TOPOLOGY SND_SOC_WCD9335 SND_SOC_WCD934X SND_SOC_WCD938X SND_SOC_WCD938X_SDW SND_SOC_WCD_MBHC SND_SOC_WM8524 SND_SOC_WM8904 SND_SOC_WM8960 SND_SOC_WM8962 SND_SOC_WM8978 SND_SOC_WM8994 SND_SOC_WM_HUBS SND_SOC_WSA881X SND_SPI SND_SUN4I_I2S SND_SUN4I_SPDIF SND_SUN50I_CODEC_ANALOG SND_SUN8I_ADDA_PR_REGMAP SND_SUN8I_CODEC SND_SUN8I_CODEC_ANALOG SND_SUPPORT_OLD_API SND_TIMER SND_USB SND_USB_6FIRE SND_USB_AUDIO SND_USB_AUDIO_USE_MEDIA_CONTROLLER SND_USB_CAIAQ SND_USB_CAIAQ_INPUT SND_USB_HIFACE SND_USB_LINE6 SND_USB_POD SND_USB_PODHD SND_USB_TONEPORT SND_USB_UA101 SND_USB_VARIAX SND_VERBOSE_PROCFS SND_VIRMIDI SND_VIRTIO SND_VMASTER SOCK_VALIDATE_XMIT SOLARIS_X86_PARTITION SONY_FF SOUND SOUNDWIRE_QCOM SOUND_OSS_CORE SOUND_OSS_CORE_PRECLAIM SPI_DLN2 SQUASHFS_4K_DEVBLK_SIZE SQUASHFS_FILE_DIRECT SQUASHFS_LZ4 SQUASHFS_LZO SQUASHFS_XATTR SQUASHFS_XZ SQUASHFS_ZSTD SSB SSB_PCIHOST_POSSIBLE SSB_PCMCIAHOST_POSSIBLE SSB_SDIOHOST_POSSIBLE STREAM_PARSER SUN_PARTITION SW_SYNC SYN_COOKIES SYSV68_PARTITION SYSV_FS TABLET_USB_ACECAD TABLET_USB_AIPTEK TABLET_USB_HANWANG TABLET_USB_KBTAB TABLET_USB_PEGASUS TAHVO_USB TAHVO_USB_HOST_BY_DEFAULT TCG_CRB TCG_TIS_I2C_INFINEON TCG_TPM TCP_CONG_ADVANCED TCP_CONG_BBR TCP_CONG_BIC TCP_CONG_CDG TCP_CONG_DCTCP TCP_CONG_HSTCP TCP_CONG_HTCP TCP_CONG_HYBLA TCP_CONG_ILLINOIS TCP_CONG_LP TCP_CONG_NV TCP_CONG_SCALABLE TCP_CONG_VEGAS TCP_CONG_VENO TCP_CONG_WESTWOOD TCP_CONG_YEAH TCP_MD5SIG TEXTSEARCH TEXTSEARCH_BM TEXTSEARCH_FSM TEXTSEARCH_KMP THERMAL_NETLINK THRUSTMASTER_FF TIPC TIPC_CRYPTO TIPC_DIAG TIPC_MEDIA_IB TIPC_MEDIA_UDP TLS TLS_TOE TOOLS_SUPPORT_RELR TOUCHSCREEN_ATMEL_MXT TWL4030_CORE USB_STORAGE_REALTEK VXLAN WIRELESS WLAN WLAN_VENDOR_PURELIFI XFRM] disabling configs for [hang memleak ubsan kasan locking atomic_sleep], they are not needed determining the merge base between 79807e970724c1f90cee1316361d61b80db4eef6 and d68ce4e71248e1ff5af9654b407541d9260b3ba5 830b3c68c1fb1e9176028d02ef86f3cf76aa2476/Linux 6.1 is a merge base, check if it has the bug testing commit 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: abe9fbe4e2006f79d75a54af8cdaf70143df4a364d85e796767b73a1dbc2cc17 all runs: crashed: kernel BUG in __page_table_check_zero representative crash: kernel BUG in __page_table_check_zero, types: [BUG] testing current HEAD d68ce4e71248e1ff5af9654b407541d9260b3ba5 testing commit d68ce4e71248e1ff5af9654b407541d9260b3ba5 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: ff386d84d6805cc5f6364843e128d37d373860e6beabbec697703a47f9429231 run #0: ignore: lost connection to test machine run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK false negative chance: 0.000 # git bisect start d68ce4e71248e1ff5af9654b407541d9260b3ba5 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 Bisecting: 183511 revisions left to test after this (roughly 18 steps) [f15167014a15324f1439ea5ca375468e23c77633] Merge tag 'powerpc-6.13-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux determine whether the revision contains the guilty commit revision 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 crashed and is reachable testing commit f15167014a15324f1439ea5ca375468e23c77633 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: e3ac29f6a2ddef301fdd8658df4108d91e83cd88cdee028d988ddd81ba192701 all runs: crashed: WARNING in poll_select_finish representative crash: WARNING in poll_select_finish, types: [WARNING] # git bisect good f15167014a15324f1439ea5ca375468e23c77633 Bisecting: 91792 revisions left to test after this (roughly 17 steps) [c098b1aa2fa60fad42df8a1a6250099329e33311] Merge tag 'amd-drm-next-6.20-2026-01-16' of https://gitlab.freedesktop.org/agd5f/linux into drm-next determine whether the revision contains the guilty commit revision 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 crashed and is reachable testing commit c098b1aa2fa60fad42df8a1a6250099329e33311 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 1a458b540f27ad70f47479f171e1bb4bbb977efbc7eec4c5908cf5bcb440effe all runs: OK false negative chance: 0.000 # git bisect bad c098b1aa2fa60fad42df8a1a6250099329e33311 Bisecting: 45860 revisions left to test after this (roughly 16 steps) [45215c589e7f22641e2fc6f518bcbead71d90f9c] Merge tag 'drm-misc-next-2025-06-12' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next determine whether the revision contains the guilty commit revision 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 crashed and is reachable testing commit 45215c589e7f22641e2fc6f518bcbead71d90f9c gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: f9c49b0df837df97ba7fa281bd7a7ac0e4f9213b38aa1b892280e2f446423b36 all runs: crashed: WARNING in poll_select_finish representative crash: WARNING in poll_select_finish, types: [WARNING] # git bisect good 45215c589e7f22641e2fc6f518bcbead71d90f9c Bisecting: 23058 revisions left to test after this (roughly 15 steps) [f79e772258df311c2cb21594ca0996318e720d28] Merge tag 'media/v6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media determine whether the revision contains the guilty commit revision 45215c589e7f22641e2fc6f518bcbead71d90f9c crashed and is reachable testing commit f79e772258df311c2cb21594ca0996318e720d28 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 097d8e28b19eb80d4f96aa93818ba9e4079b8e6e46b2a48b4060a04a019658fb all runs: crashed: WARNING in poll_select_finish representative crash: WARNING in poll_select_finish, types: [WARNING] # git bisect good f79e772258df311c2cb21594ca0996318e720d28 Bisecting: 10969 revisions left to test after this (roughly 14 steps) [8f7aa3d3c7323f4ca2768a9e74ebbe359c4f8f88] Merge tag 'net-next-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next determine whether the revision contains the guilty commit revision f15167014a15324f1439ea5ca375468e23c77633 crashed and is reachable testing commit 8f7aa3d3c7323f4ca2768a9e74ebbe359c4f8f88 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 911fd66ba4a8291528a765f58ac4fbfec973989c05cd4c777a895209a4463432 all runs: crashed: WARNING in poll_select_finish representative crash: WARNING in poll_select_finish, types: [WARNING] # git bisect good 8f7aa3d3c7323f4ca2768a9e74ebbe359c4f8f88 Bisecting: 5576 revisions left to test after this (roughly 13 steps) [399ead3a6d76cbdd29a716660db5c84a314dab70] Merge tag 'uml-for-linux-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux determine whether the revision contains the guilty commit revision 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 crashed and is reachable testing commit 399ead3a6d76cbdd29a716660db5c84a314dab70 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 4ba9bc76c04dd3f9868a6bbc2932e7d4204c0b9cdc3022a6728beab070c40d93 all runs: crashed: WARNING in poll_select_finish representative crash: WARNING in poll_select_finish, types: [WARNING] # git bisect good 399ead3a6d76cbdd29a716660db5c84a314dab70 Bisecting: 2718 revisions left to test after this (roughly 12 steps) [9e906a9dead17d81d6c2687f65e159231d0e3286] Merge tag 'perf-tools-for-v6.19-2025-12-06' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools determine whether the revision contains the guilty commit revision 45215c589e7f22641e2fc6f518bcbead71d90f9c crashed and is reachable testing commit 9e906a9dead17d81d6c2687f65e159231d0e3286 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 262647e6b0d26e81f3490d75674d221576b9b707b32ff6bc838fc7f3299422bc all runs: OK false negative chance: 0.000 # git bisect bad 9e906a9dead17d81d6c2687f65e159231d0e3286 Bisecting: 1357 revisions left to test after this (roughly 11 steps) [7eb7f5723df50a7d5564aa609e4c147f669a5cb4] Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi determine whether the revision contains the guilty commit revision 45215c589e7f22641e2fc6f518bcbead71d90f9c crashed and is reachable testing commit 7eb7f5723df50a7d5564aa609e4c147f669a5cb4 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: ba418220d27100112d6c30944618e14ce420158653a361a5edbe0dea525effb4 all runs: crashed: WARNING in poll_select_finish representative crash: WARNING in poll_select_finish, types: [WARNING] # git bisect good 7eb7f5723df50a7d5564aa609e4c147f669a5cb4 Bisecting: 817 revisions left to test after this (roughly 9 steps) [701d7d782d98242a64cdeed90750f88ff733bc39] Merge tag 'spdx-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx determine whether the revision contains the guilty commit revision 8f7aa3d3c7323f4ca2768a9e74ebbe359c4f8f88 crashed and is reachable testing commit 701d7d782d98242a64cdeed90750f88ff733bc39 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: a8b1c19af218e3352dc62d11af43a1c335185972099d47083fb8cef774ee3016 all runs: OK false negative chance: 0.000 # git bisect bad 701d7d782d98242a64cdeed90750f88ff733bc39 Bisecting: 267 revisions left to test after this (roughly 8 steps) [fbff94967958e46f7404b2dfbcf3b19e96aaaae2] Merge tag 'linux-watchdog-6.19-rc1' of git://www.linux-watchdog.org/linux-watchdog determine whether the revision contains the guilty commit revision 399ead3a6d76cbdd29a716660db5c84a314dab70 crashed and is reachable testing commit fbff94967958e46f7404b2dfbcf3b19e96aaaae2 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 62574ee18342a56c63aeecbedbd6f7b3732930e4baacbb1b9433b709e2a9bad9 all runs: crashed: WARNING in poll_select_finish representative crash: WARNING in poll_select_finish, types: [WARNING] # git bisect good fbff94967958e46f7404b2dfbcf3b19e96aaaae2 Bisecting: 133 revisions left to test after this (roughly 7 steps) [af06a40474793ad9677d1771c0624ae8191f0892] init: replace simple_strtoul with kstrtoul to improve lpj_setup determine whether the revision contains the guilty commit revision 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 crashed and is reachable testing commit af06a40474793ad9677d1771c0624ae8191f0892 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 77536d91e76df1c12d2daca26b252de98a6957617250bec1cac63a6d033ce509 all runs: OK false negative chance: 0.000 # git bisect bad af06a40474793ad9677d1771c0624ae8191f0892 Bisecting: 66 revisions left to test after this (roughly 6 steps) [a9af76a78760717361cccc884dc649e30db61c8b] watchdog: add sys_info sysctls to dump sys info on system lockup determine whether the revision contains the guilty commit revision 45215c589e7f22641e2fc6f518bcbead71d90f9c crashed and is reachable testing commit a9af76a78760717361cccc884dc649e30db61c8b gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 1a93aa697e2c83fc9b0ec0a1ddf712a16a572704652dbd66e8b0534b607e3844 all runs: OK false negative chance: 0.000 # git bisect bad a9af76a78760717361cccc884dc649e30db61c8b Bisecting: 33 revisions left to test after this (roughly 5 steps) [ded7d97442f0f5af25e942949ac304e025b85165] mailmap: add entry for Hao Ge determine whether the revision contains the guilty commit revision f79e772258df311c2cb21594ca0996318e720d28 crashed and is reachable testing commit ded7d97442f0f5af25e942949ac304e025b85165 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: ffea4c56acc80b31b4882e72f0c335d7a88c3ff0a740a80d90dd6f5b0670a25f all runs: crashed: WARNING in poll_select_finish representative crash: WARNING in poll_select_finish, types: [WARNING] # git bisect good ded7d97442f0f5af25e942949ac304e025b85165 Bisecting: 16 revisions left to test after this (roughly 4 steps) [6480241f31f543333ed0c7a209962412461f6e41] lib: add mul_u64_add_u64_div_u64() and mul_u64_u64_div_u64_roundup() determine whether the revision contains the guilty commit revision f79e772258df311c2cb21594ca0996318e720d28 crashed and is reachable testing commit 6480241f31f543333ed0c7a209962412461f6e41 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 22fb04c296043cf4acf7042349b0859bcf7f78a303e94814fa4cde010f084341 all runs: OK false negative chance: 0.000 # git bisect bad 6480241f31f543333ed0c7a209962412461f6e41 Bisecting: 8 revisions left to test after this (roughly 3 steps) [e1c70505ee8158c1108340d9cd67182ade93af4a] ocfs2: add extra consistency checks for chain allocator dinodes determine whether the revision contains the guilty commit revision 45215c589e7f22641e2fc6f518bcbead71d90f9c crashed and is reachable testing commit e1c70505ee8158c1108340d9cd67182ade93af4a gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: d30e8ecf4783d9f64582a5fe8f55ffff69dcdd81b504dccd4187e98934b26f32 all runs: crashed: WARNING in poll_select_finish representative crash: WARNING in poll_select_finish, types: [WARNING] # git bisect good e1c70505ee8158c1108340d9cd67182ade93af4a Bisecting: 4 revisions left to test after this (roughly 2 steps) [bd97c976419126ee3e9acd4957f6f16a90316643] util_macros.h: fix kernel-doc for u64_to_user_ptr() determine whether the revision contains the guilty commit revision 45215c589e7f22641e2fc6f518bcbead71d90f9c crashed and is reachable testing commit bd97c976419126ee3e9acd4957f6f16a90316643 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 7a371ae52294c448d18b82b651ae6f085246f3333f1eb051a9568bba0dc877fe all runs: OK false negative chance: 0.000 # git bisect bad bd97c976419126ee3e9acd4957f6f16a90316643 Bisecting: 1 revision left to test after this (roughly 1 step) [7f37d88f5cb32fff454f12cd99444686482ca23b] lib/Kconfig.debug: cleanup CONFIG_DEBUG_SECTION_MISMATCH help text determine whether the revision contains the guilty commit revision f15167014a15324f1439ea5ca375468e23c77633 crashed and is reachable testing commit 7f37d88f5cb32fff454f12cd99444686482ca23b gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 12bc579fdcaa916dd644d3afc93c1f1e0c713fd44fd0b837782e453d53e0d9b7 all runs: OK false negative chance: 0.000 # git bisect bad 7f37d88f5cb32fff454f12cd99444686482ca23b Bisecting: 0 revisions left to test after this (roughly 0 steps) [93ce0ff117b0c468961d7c296a03ad57e1e8da9f] ocfs2: validate cl_bpc in allocator inodes to prevent divide-by-zero determine whether the revision contains the guilty commit revision 45215c589e7f22641e2fc6f518bcbead71d90f9c crashed and is reachable testing commit 93ce0ff117b0c468961d7c296a03ad57e1e8da9f gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 33b04dc9166fe54a4ea9b28af8b794b52b401bc75844210b94695675473e9907 all runs: OK false negative chance: 0.000 # git bisect bad 93ce0ff117b0c468961d7c296a03ad57e1e8da9f 93ce0ff117b0c468961d7c296a03ad57e1e8da9f is the first bad commit commit 93ce0ff117b0c468961d7c296a03ad57e1e8da9f Author: Deepanshu Kartikey Date: Thu Oct 30 18:30:03 2025 +0300 ocfs2: validate cl_bpc in allocator inodes to prevent divide-by-zero The chain allocator field cl_bpc (blocks per cluster) is read from disk and used in division operations without validation. A corrupted filesystem image with cl_bpc=0 causes a divide-by-zero crash in the kernel: divide error: 0000 [#1] PREEMPT SMP KASAN RIP: 0010:ocfs2_bg_discontig_add_extent fs/ocfs2/suballoc.c:335 [inline] RIP: 0010:ocfs2_block_group_fill+0x5bd/0xa70 fs/ocfs2/suballoc.c:386 Call Trace: ocfs2_block_group_alloc+0x7e9/0x1330 fs/ocfs2/suballoc.c:703 ocfs2_reserve_suballoc_bits+0x20a6/0x4640 fs/ocfs2/suballoc.c:834 ocfs2_reserve_new_inode+0x4f4/0xcc0 fs/ocfs2/suballoc.c:1074 ocfs2_mknod+0x83c/0x2050 fs/ocfs2/namei.c:306 This patch adds validation in ocfs2_validate_inode_block() to ensure cl_bpc matches the expected value calculated from the superblock's cluster size and block size for chain allocator inodes (identified by OCFS2_CHAIN_FL). Moving the validation to inode validation time (rather than allocation time) has several benefits: - Validates once when the inode is read, rather than on every allocation - Protects all code paths that use cl_bpc (allocation, resize, etc.) - Follows the existing pattern of inode validation in OCFS2 - Centralizes validation logic The validation catches both: - Zero values that cause divide-by-zero crashes - Non-zero but incorrect values indicating filesystem corruption or mismatched filesystem geometry With this fix, mounting a corrupted filesystem produces: OCFS2: ERROR (device loop0): ocfs2_validate_inode_block: Inode 74 has corrupted cl_bpc: ondisk=0 expected=16 instead of a kernel crash. [dmantipov@yandex.ru: combine into the series and tweak the message to fit the commonly used style] Link: https://lkml.kernel.org/r/20251030153003.1934585-2-dmantipov@yandex.ru Link: https://lore.kernel.org/ocfs2-devel/20251026132625.12348-1-kartikey406@gmail.com/T/#u [v1] Link: https://lore.kernel.org/all/20251027124131.10002-1-kartikey406@gmail.com/T/ [v2] Signed-off-by: Deepanshu Kartikey Signed-off-by: Dmitry Antipov Reported-by: syzbot+fd8af97c7227fe605d95@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=fd8af97c7227fe605d95 Tested-by: syzbot+fd8af97c7227fe605d95@syzkaller.appspotmail.com Suggested-by: Joseph Qi Reviewed-by: Joseph Qi Cc: Heming Zhao Cc: Joel Becker Cc: Jun Piao Cc: Junxiao Bi Cc: Mark Fasheh Signed-off-by: Andrew Morton fs/ocfs2/inode.c | 10 ++++++++++ 1 file changed, 10 insertions(+) accumulated error probability: 0.00 culprit signature: 33b04dc9166fe54a4ea9b28af8b794b52b401bc75844210b94695675473e9907 parent signature: d30e8ecf4783d9f64582a5fe8f55ffff69dcdd81b504dccd4187e98934b26f32 revisions tested: 27, total time: 7h50m13.036151369s (build: 2h58m48.606877485s, test: 3h59m22.95199772s) first good commit: 93ce0ff117b0c468961d7c296a03ad57e1e8da9f ocfs2: validate cl_bpc in allocator inodes to prevent divide-by-zero recipients (to): ["akpm@linux-foundation.org" "dmantipov@yandex.ru" "joseph.qi@linux.alibaba.com" "kartikey406@gmail.com" "syzbot+fd8af97c7227fe605d95@syzkaller.appspotmail.com"] recipients (cc): []