ci2 starts bisection 2026-08-23 01:01:00.533532737 +0000 UTC m=+437961.200208360 bisecting fixing commit since 7e6e670547210424443261b2d54d2acfff85a37c building syzkaller on b13552fed1cdc2826f57a5741df12ca67130314a ensuring issue is reproducible on original commit 7e6e670547210424443261b2d54d2acfff85a37c testing commit 7e6e670547210424443261b2d54d2acfff85a37c gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 620b202b5a29b72e1d99cc4f0630c33500a168cbb991f57f520d8c7cb7bc1fdd run #0: crashed: WARNING in its_irq_domain_free run #1: crashed: WARNING in its_irq_domain_free run #2: crashed: WARNING in its_irq_domain_free run #3: crashed: WARNING in its_irq_domain_free run #4: crashed: WARNING in its_irq_domain_free run #5: crashed: WARNING in its_irq_domain_free run #6: crashed: WARNING in its_irq_domain_free run #7: crashed: WARNING in its_irq_domain_free run #8: crashed: WARNING in its_irq_domain_free run #9: crashed: WARNING in its_irq_domain_free run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK representative crash: WARNING in its_irq_domain_free, types: [WARNING] check whether we can drop unnecessary instrumentation disabling configs for [hang memleak ubsan kasan locking atomic_sleep], they are not needed testing commit 7e6e670547210424443261b2d54d2acfff85a37c gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: f8a0da09df0e638b061e4742080f5cf31978aeb5ab976e0e4395fe530828abf6 all runs: crashed: WARNING in its_irq_domain_free representative crash: WARNING in its_irq_domain_free, types: [WARNING] the bug reproduces without the instrumentation disabling configs for [kasan locking atomic_sleep hang memleak ubsan], they are not needed kconfig minimization: base=7505 full=9788 leaves diff=2010 split chunks (needed=false): <2010> split chunk #0 of len 2010 into 5 parts testing without sub-chunk 1/5 disabling configs for [hang memleak ubsan kasan locking atomic_sleep], they are not needed testing commit 7e6e670547210424443261b2d54d2acfff85a37c gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 25b0a66277dc79409baa0d7b59257ccf4c5fab632b687a3a304245307ab54b0e all runs: crashed: WARNING in its_irq_domain_free representative crash: WARNING in its_irq_domain_free, types: [WARNING] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [kasan locking atomic_sleep hang memleak ubsan], they are not needed testing commit 7e6e670547210424443261b2d54d2acfff85a37c gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: d57b274d6101ec3db514a2d6b2ef171826f3c7d444328f4781aeb18131e6fac4 all runs: crashed: WARNING in its_irq_domain_free representative crash: WARNING in its_irq_domain_free, types: [WARNING] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [locking atomic_sleep hang memleak ubsan kasan], they are not needed testing commit 7e6e670547210424443261b2d54d2acfff85a37c gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: e4dc13382978ac24e7f166ce8e00853064dcba540777db0f92738a817b341620 all runs: crashed: WARNING in its_irq_domain_free representative crash: WARNING in its_irq_domain_free, types: [WARNING] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [ubsan kasan locking atomic_sleep hang memleak], they are not needed testing commit 7e6e670547210424443261b2d54d2acfff85a37c gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 7a6a8e91e1db81346ee382a8f009f2a968e4f1b1b6b718caf8ef512c3887ce1e all runs: crashed: WARNING in its_irq_domain_free representative crash: WARNING in its_irq_domain_free, types: [WARNING] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [hang memleak ubsan kasan locking atomic_sleep], they are not needed testing commit 7e6e670547210424443261b2d54d2acfff85a37c gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: a363fb76923c18e72aca7cb4881a2e9da6692da25f910a45eb852e023824548e all runs: crashed: WARNING in its_irq_domain_free representative crash: WARNING in its_irq_domain_free, types: [WARNING] the chunk can be dropped disabling configs for [hang memleak ubsan kasan locking atomic_sleep], they are not needed determining the merge base between 7e6e670547210424443261b2d54d2acfff85a37c and 2709dd5ae32f0828f386327c76bba9f39f63a1c6 830b3c68c1fb1e9176028d02ef86f3cf76aa2476/Linux 6.1 is a merge base, check if it has the bug testing commit 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: aa350d5c3a305e29facb0ea246d60016cdf6fdce38919d2b992ac6c4f40a9b1d all runs: crashed: WARNING in its_irq_domain_free representative crash: WARNING in its_irq_domain_free, types: [WARNING] testing current HEAD 2709dd5ae32f0828f386327c76bba9f39f63a1c6 testing commit 2709dd5ae32f0828f386327c76bba9f39f63a1c6 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: a19c671c38fa33fded8b80979ea5eafdfa8578f9d55e1c5ab9c90ab241ddbe0c all runs: OK false negative chance: 0.000 # git bisect start 2709dd5ae32f0828f386327c76bba9f39f63a1c6 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 Bisecting: 168991 revisions left to test after this (roughly 17 steps) [5e5466433d266046790c0af40a15af0a6be139a1] Merge tag 'char-misc-6.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc determine whether the revision contains the guilty commit revision 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 crashed and is reachable testing commit 5e5466433d266046790c0af40a15af0a6be139a1 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: f794f273fa8766cba854e30857329283371c3b58a373381e9f293f14c7d36a0c all runs: crashed: WARNING in its_irq_domain_free representative crash: WARNING in its_irq_domain_free, types: [WARNING] # git bisect good 5e5466433d266046790c0af40a15af0a6be139a1 Bisecting: 84341 revisions left to test after this (roughly 16 steps) [8804d970fab45726b3c7cd7f240b31122aa94219] Merge tag 'mm-stable-2025-10-01-19-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm determine whether the revision contains the guilty commit revision 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 crashed and is reachable testing commit 8804d970fab45726b3c7cd7f240b31122aa94219 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 626f4250ee6216893d0d3813245874795650db93afe48a6661e217ad8cf1f047 all runs: OK false negative chance: 0.000 # git bisect bad 8804d970fab45726b3c7cd7f240b31122aa94219 Bisecting: 42336 revisions left to test after this (roughly 15 steps) [a1b5bd45d4ee58af4f56e49497b8c3db96d8f8a3] Merge tag 'usb-6.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb determine whether the revision contains the guilty commit revision 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 crashed and is reachable testing commit a1b5bd45d4ee58af4f56e49497b8c3db96d8f8a3 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 4c0c576a2dcf986635b8f356621fcb44b4c6bd2c615a371d9bff316d5f325efd all runs: crashed: WARNING in its_irq_domain_free representative crash: WARNING in its_irq_domain_free, types: [WARNING] # git bisect good a1b5bd45d4ee58af4f56e49497b8c3db96d8f8a3 Bisecting: 21234 revisions left to test after this (roughly 14 steps) [45fa9f97e65231a9fd4f9429489cb74c10ccd0fd] lib/sbitmap: make sbitmap_get_shallow() internal determine whether the revision contains the guilty commit revision a1b5bd45d4ee58af4f56e49497b8c3db96d8f8a3 crashed and is reachable testing commit 45fa9f97e65231a9fd4f9429489cb74c10ccd0fd gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: dc214daef7e225e8fe2cf04924960052c1b0fa527a0242d5e81b170c0bf72bdd all runs: OK false negative chance: 0.000 # git bisect bad 45fa9f97e65231a9fd4f9429489cb74c10ccd0fd Bisecting: 10432 revisions left to test after this (roughly 13 steps) [1b98f357dadd6ea613a435fbaef1a5dd7b35fd21] Merge tag 'net-next-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next determine whether the revision contains the guilty commit revision 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 crashed and is reachable testing commit 1b98f357dadd6ea613a435fbaef1a5dd7b35fd21 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: a46ecaac25e1c86f781f2fddb6781e00dff652cc0c84ebe0b67ecb4a719f63db all runs: OK false negative chance: 0.000 # git bisect bad 1b98f357dadd6ea613a435fbaef1a5dd7b35fd21 Bisecting: 5341 revisions left to test after this (roughly 12 steps) [95bf3760eb9ceeb93febdc280695347b1e0a89c1] Merge tag 'lkmm.2025.05.25a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu determine whether the revision contains the guilty commit revision a1b5bd45d4ee58af4f56e49497b8c3db96d8f8a3 crashed and is reachable testing commit 95bf3760eb9ceeb93febdc280695347b1e0a89c1 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: da2a358da53eb8e9f027b595b6b100e9033d63b2d00976806fdbe041fa7e16bc all runs: OK false negative chance: 0.000 # git bisect bad 95bf3760eb9ceeb93febdc280695347b1e0a89c1 Bisecting: 2664 revisions left to test after this (roughly 11 steps) [c4e33a8431cc1a4c87c9cdee427c60f40079eea5] btrfs: use clear_extent_bits() instead of clear_extent_bit() where possible determine whether the revision contains the guilty commit revision 5e5466433d266046790c0af40a15af0a6be139a1 crashed and is reachable testing commit c4e33a8431cc1a4c87c9cdee427c60f40079eea5 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 1f3c1bc4335ae846e0186c135d5af9454d1e9afbd9e7dd7a63b5abf03dd13b96 all runs: crashed: WARNING in its_irq_domain_free representative crash: WARNING in its_irq_domain_free, types: [WARNING] # git bisect good c4e33a8431cc1a4c87c9cdee427c60f40079eea5 Bisecting: 1354 revisions left to test after this (roughly 10 steps) [15d90a5e5524532b7456a24f4626cf28c1629c4c] Merge tag 'crc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux determine whether the revision contains the guilty commit revision a1b5bd45d4ee58af4f56e49497b8c3db96d8f8a3 crashed and is reachable testing commit 15d90a5e5524532b7456a24f4626cf28c1629c4c gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: fbeafcf55fbeb862c718a9850f31fe748bd0a12ccfc52c7c5c9c39f61e391523 all runs: crashed: WARNING in its_irq_domain_free representative crash: WARNING in its_irq_domain_free, types: [WARNING] # git bisect good 15d90a5e5524532b7456a24f4626cf28c1629c4c Bisecting: 671 revisions left to test after this (roughly 9 steps) [ddddf9d64f7361323da663637adb4a02466bfc99] Merge tag 'perf-core-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip determine whether the revision contains the guilty commit revision 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 crashed and is reachable testing commit ddddf9d64f7361323da663637adb4a02466bfc99 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 28e005a6c3642698643cea5f363788eb52694d6fbf6fb95e14e0500bd61ecf69 all runs: crashed: WARNING in its_irq_domain_free representative crash: WARNING in its_irq_domain_free, types: [WARNING] # git bisect good ddddf9d64f7361323da663637adb4a02466bfc99 Bisecting: 335 revisions left to test after this (roughly 8 steps) [c4070e1996e05dd2eb5e08ee68d0d00553ae08f7] Merge commit 'its-for-linus-20250509-merge' into x86/core, to resolve conflicts determine whether the revision contains the guilty commit revision a1b5bd45d4ee58af4f56e49497b8c3db96d8f8a3 crashed and is reachable testing commit c4070e1996e05dd2eb5e08ee68d0d00553ae08f7 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: cf76042e216411fb3d2247709f3eb44df135b438bb5b0ba0e4629d37d0c44090 all runs: crashed: WARNING in its_irq_domain_free representative crash: WARNING in its_irq_domain_free, types: [WARNING] # git bisect good c4070e1996e05dd2eb5e08ee68d0d00553ae08f7 Bisecting: 158 revisions left to test after this (roughly 7 steps) [2bd1bea5fa6aa79bc563a57919730eb809651b28] Merge tag 'irq-cleanups-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip determine whether the revision contains the guilty commit revision 5e5466433d266046790c0af40a15af0a6be139a1 crashed and is reachable testing commit 2bd1bea5fa6aa79bc563a57919730eb809651b28 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 831375f2bf8afd745e01a14f0ab020a239b9b894080f2fcffe4f1022579cd4de all runs: crashed: WARNING in its_irq_domain_free representative crash: WARNING in its_irq_domain_free, types: [WARNING] # git bisect good 2bd1bea5fa6aa79bc563a57919730eb809651b28 Bisecting: 80 revisions left to test after this (roughly 6 steps) [6376c0770656f3bdf7f411faf068371b6932aeca] Merge tag 'timers-clocksource-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip determine whether the revision contains the guilty commit revision 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 crashed and is reachable testing commit 6376c0770656f3bdf7f411faf068371b6932aeca gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: afb63f541f6998f4f70f6c67ae7a370e2ac5900701e49cd382d277de8332b749 all runs: OK false negative chance: 0.000 # git bisect bad 6376c0770656f3bdf7f411faf068371b6932aeca Bisecting: 41 revisions left to test after this (roughly 5 steps) [44ed0f35df343d00b8d38006854f96e333104a66] Merge tag 'irq-msi-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip determine whether the revision contains the guilty commit revision 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 crashed and is reachable testing commit 44ed0f35df343d00b8d38006854f96e333104a66 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 33c5cc8e153690c442570b17090ddda265e99f9758fd2c5797c8d4ccac7d566f all runs: OK false negative chance: 0.000 # git bisect bad 44ed0f35df343d00b8d38006854f96e333104a66 Bisecting: 15 revisions left to test after this (roughly 4 steps) [a1d8a8309367565dc658ae31dcc256beb9f0423b] Merge branch 'irq/platform-msi' into irq/msi determine whether the revision contains the guilty commit revision 5e5466433d266046790c0af40a15af0a6be139a1 crashed and is reachable testing commit a1d8a8309367565dc658ae31dcc256beb9f0423b gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: b8d570ca22ba92de77a9c8904073ef4d1176c3a2e816e775ceafece2a6be5a26 all runs: crashed: WARNING in its_irq_domain_free representative crash: WARNING in its_irq_domain_free, types: [WARNING] # git bisect good a1d8a8309367565dc658ae31dcc256beb9f0423b Bisecting: 7 revisions left to test after this (roughly 3 steps) [e4d001b54f78769ba1a1404c2801ae95e19fd893] genirq/msi: Add helper for creating MSI-parent irq domains determine whether the revision contains the guilty commit revision a1b5bd45d4ee58af4f56e49497b8c3db96d8f8a3 crashed and is reachable testing commit e4d001b54f78769ba1a1404c2801ae95e19fd893 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: ab73569bc9502063064aca09ea2581daee9e7bea60dc333c67152f2d60823f9d all runs: OK false negative chance: 0.000 # git bisect bad e4d001b54f78769ba1a1404c2801ae95e19fd893 Bisecting: 3 revisions left to test after this (roughly 2 steps) [03c298760ed97c5981402d64c4eed9bc4f2f0a4e] genirq/msi: Engage the .msi_teardown() callback on domain removal determine whether the revision contains the guilty commit revision 5e5466433d266046790c0af40a15af0a6be139a1 crashed and is reachable testing commit 03c298760ed97c5981402d64c4eed9bc4f2f0a4e gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: acd3f07802f38cb8f1195a2b8a326937c16f9bad4fd59d7e3f0b2fccd4f86638 all runs: OK false negative chance: 0.000 # git bisect bad 03c298760ed97c5981402d64c4eed9bc4f2f0a4e Bisecting: 1 revision left to test after this (roughly 1 step) [713335b6ee29f0045737a1ddfc685bc6040d4baf] irqchip/gic-v3-its: Implement .msi_teardown() callback determine whether the revision contains the guilty commit revision a1b5bd45d4ee58af4f56e49497b8c3db96d8f8a3 crashed and is reachable testing commit 713335b6ee29f0045737a1ddfc685bc6040d4baf gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: dceb94fe7e88fd6be34d1c813b4497a8a3cbc523020b3a1fcdba0623e91debcf all runs: OK false negative chance: 0.000 # git bisect bad 713335b6ee29f0045737a1ddfc685bc6040d4baf Bisecting: 0 revisions left to test after this (roughly 0 steps) [28026cf2dd84d961a62123b1fa941dc3c2c4a132] genirq/msi: Add .msi_teardown() callback as the reverse of .msi_prepare() determine whether the revision contains the guilty commit revision a1b5bd45d4ee58af4f56e49497b8c3db96d8f8a3 crashed and is reachable testing commit 28026cf2dd84d961a62123b1fa941dc3c2c4a132 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 3d8af14a6cf4a601846c6cd41a31050d1705d49bd55423cbdf29ce543fcd735c all runs: crashed: WARNING in its_irq_domain_free representative crash: WARNING in its_irq_domain_free, types: [WARNING] # git bisect good 28026cf2dd84d961a62123b1fa941dc3c2c4a132 713335b6ee29f0045737a1ddfc685bc6040d4baf is the first bad commit commit 713335b6ee29f0045737a1ddfc685bc6040d4baf Author: Marc Zyngier Date: Tue May 13 17:31:41 2025 +0100 irqchip/gic-v3-its: Implement .msi_teardown() callback The ITS driver currently nukes the structure representing an endpoint device translating via an ITS on freeing the last LPI allocated for it. That's an unfortunate state of affair, as it is pretty common for a driver to allocate a single MSI, do something clever, teardown this MSI, and reallocate a whole bunch of them. The NVME driver does exactly that, amongst others. What happens in that case is that the core code is accidentaly issuing another .msi_prepare() call, even if it shouldn't. This luckily cancels the above behaviour and hides the problem. In order to fix the core code, start by implementing the new .msi_teardown() callback. Nothing calls it yet, so a side effect is that the its_dev structure will not be freed and that the DID will stay mapped. Not a big deal, and this will be solved in following patches. Signed-off-by: Marc Zyngier Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250513163144.2215824-3-maz@kernel.org drivers/irqchip/irq-gic-v3-its-msi-parent.c | 10 +++++++ drivers/irqchip/irq-gic-v3-its.c | 46 ++++++++++++++++------------- kernel/irq/msi.c | 3 +- 3 files changed, 36 insertions(+), 23 deletions(-) accumulated error probability: 0.00 culprit signature: dceb94fe7e88fd6be34d1c813b4497a8a3cbc523020b3a1fcdba0623e91debcf parent signature: 3d8af14a6cf4a601846c6cd41a31050d1705d49bd55423cbdf29ce543fcd735c revisions tested: 27, total time: 7h10m53.793577585s (build: 2h16m13.531213664s, test: 4h1m31.776376739s) first good commit: 713335b6ee29f0045737a1ddfc685bc6040d4baf irqchip/gic-v3-its: Implement .msi_teardown() callback recipients (to): ["maz@kernel.org" "tglx@linutronix.de"] recipients (cc): []