ci starts bisection 2025-05-13 06:30:05.837838888 +0000 UTC m=+51599.377653063 bisecting cause commit starting from cd802e7e5f1e77ae68cd98653fb70a97189eb937 building syzkaller on 77908e5f2ae80bee6d434bca762a25a0a5fc6a83 ensuring issue is reproducible on original commit cd802e7e5f1e77ae68cd98653fb70a97189eb937 testing commit cd802e7e5f1e77ae68cd98653fb70a97189eb937 gcc compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2 kernel signature: 94ab2e25158941138fb5e50fefe17b4b392021c61a99d9aa4d9aa4befbc9fd85 run #0: crashed: BUG: corrupted list in em28xx_close_extension run #1: crashed: KASAN: use-after-free Read in em28xx_close_extension run #2: crashed: KASAN: slab-use-after-free Read in em28xx_init_extension run #3: crashed: KASAN: use-after-free Read in em28xx_close_extension run #4: crashed: KASAN: use-after-free Read in em28xx_init_extension run #5: crashed: KASAN: use-after-free Read in em28xx_init_extension run #6: crashed: KASAN: use-after-free Read in em28xx_init_extension run #7: crashed: BUG: corrupted list in em28xx_init_extension run #8: crashed: KASAN: use-after-free Read in em28xx_init_extension run #9: crashed: KASAN: slab-out-of-bounds Read in em28xx_init_extension run #10: crashed: KASAN: slab-out-of-bounds Read in em28xx_close_extension run #11: crashed: BUG: corrupted list in em28xx_init_extension run #12: crashed: BUG: corrupted list in em28xx_close_extension run #13: crashed: KASAN: use-after-free Read in em28xx_init_extension run #14: crashed: BUG: corrupted list in em28xx_close_extension run #15: crashed: BUG: corrupted list in em28xx_close_extension run #16: crashed: KASAN: use-after-free Read in em28xx_init_extension run #17: crashed: KASAN: use-after-free Read in em28xx_close_extension run #18: crashed: BUG: corrupted list in em28xx_init_extension run #19: crashed: BUG: corrupted list in em28xx_init_extension representative crash: KASAN: use-after-free Read in em28xx_close_extension, types: [KASAN BUG] check whether we can drop unnecessary instrumentation disabling configs for [HANG LEAK UBSAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit cd802e7e5f1e77ae68cd98653fb70a97189eb937 gcc compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2 kernel signature: 6aba1c142a3d79468a44394d3891e68eb09681ab4f869d304191cc5c919e5d1b run #0: crashed: BUG: corrupted list in em28xx_close_extension run #1: crashed: BUG: corrupted list in em28xx_close_extension run #2: crashed: KASAN: slab-out-of-bounds Read in em28xx_init_extension run #3: crashed: BUG: corrupted list in em28xx_init_extension run #4: crashed: KASAN: slab-out-of-bounds Read in em28xx_init_extension run #5: crashed: BUG: corrupted list in em28xx_init_extension run #6: crashed: BUG: corrupted list in em28xx_close_extension run #7: crashed: BUG: corrupted list in em28xx_close_extension run #8: crashed: KASAN: slab-out-of-bounds Read in em28xx_init_extension run #9: crashed: BUG: corrupted list in em28xx_close_extension representative crash: BUG: corrupted list in em28xx_close_extension, types: [BUG KASAN] the bug reproduces without the instrumentation disabling configs for [HANG LEAK UBSAN LOCKDEP ATOMIC_SLEEP], they are not needed kconfig minimization: base=4087 full=8329 leaves diff=2129 split chunks (needed=false): <2129> split chunk #0 of len 2129 into 5 parts testing without sub-chunk 1/5 disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed testing commit cd802e7e5f1e77ae68cd98653fb70a97189eb937 gcc compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2 kernel signature: 43f4ed6e3ba8190457020a0a90e63e661d8dff88f7a20bf09f1b04440642d363 run #0: crashed: BUG: corrupted list in em28xx_close_extension run #1: crashed: BUG: corrupted list in em28xx_close_extension run #2: crashed: KASAN: slab-use-after-free Read in em28xx_close_extension run #3: crashed: BUG: corrupted list in em28xx_init_extension run #4: crashed: KASAN: slab-out-of-bounds Read in em28xx_close_extension run #5: crashed: BUG: corrupted list in em28xx_init_extension run #6: crashed: BUG: corrupted list in em28xx_close_extension run #7: crashed: BUG: corrupted list in em28xx_init_extension run #8: crashed: BUG: corrupted list in em28xx_close_extension run #9: crashed: BUG: corrupted list in em28xx_close_extension representative crash: BUG: corrupted list in em28xx_close_extension, types: [BUG] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [UBSAN LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing commit cd802e7e5f1e77ae68cd98653fb70a97189eb937 gcc compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2 failed building cd802e7e5f1e77ae68cd98653fb70a97189eb937: ld.lld: error: undefined symbol: devm_drm_of_get_bridge testing without sub-chunk 3/5 disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed testing commit cd802e7e5f1e77ae68cd98653fb70a97189eb937 gcc compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2 kernel signature: 60f82e157ffe58fb9ffd9b1373a761d8827d03db48be74918ff672da285e1d42 run #0: crashed: BUG: corrupted list in em28xx_close_extension run #1: crashed: BUG: corrupted list in em28xx_close_extension run #2: crashed: BUG: corrupted list in em28xx_close_extension run #3: crashed: BUG: corrupted list in em28xx_close_extension run #4: crashed: KASAN: use-after-free Read in em28xx_close_extension run #5: crashed: KASAN: use-after-free Read in em28xx_close_extension run #6: crashed: BUG: corrupted list in em28xx_close_extension run #7: crashed: BUG: corrupted list in em28xx_close_extension run #8: crashed: BUG: corrupted list in em28xx_close_extension run #9: crashed: BUG: corrupted list in em28xx_close_extension representative crash: BUG: corrupted list in em28xx_close_extension, types: [BUG] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [UBSAN LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing commit cd802e7e5f1e77ae68cd98653fb70a97189eb937 gcc compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2 kernel signature: f815558f7ba9643291f981432b5960cd466a0208dd3e1027cd13543bd8afc9ae run #0: crashed: BUG: corrupted list in em28xx_close_extension run #1: crashed: BUG: corrupted list in em28xx_close_extension run #2: crashed: KASAN: use-after-free Read in em28xx_close_extension run #3: crashed: BUG: corrupted list in em28xx_close_extension run #4: crashed: KASAN: use-after-free Read in em28xx_close_extension run #5: crashed: KASAN: use-after-free Read in em28xx_close_extension run #6: crashed: KASAN: use-after-free Read in em28xx_close_extension run #7: crashed: KASAN: use-after-free Read in em28xx_close_extension run #8: crashed: BUG: corrupted list in em28xx_close_extension run #9: crashed: BUG: corrupted list in em28xx_close_extension representative crash: BUG: corrupted list in em28xx_close_extension, types: [BUG KASAN] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN LOCKDEP], they are not needed testing commit cd802e7e5f1e77ae68cd98653fb70a97189eb937 gcc compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2 kernel signature: 7a383ef21e889d36a91e3b77d44310ca82991f9a3a7873e1530b7ae7a7145bc2 all runs: OK false negative chance: 0.000 minimized to 851 configs; suspects: [6LOWPAN ARCH_ENABLE_MEMORY_HOTREMOVE ASUS_WMI ATM BCMA BLK_DEV_ZONED BPF_SYSCALL CARDBUS CFG80211 CFG80211_WEXT CHARGER_BQ24190 CMA COMMON_CLK CONTIG_ALLOC DAX DLM DRM DRM_BRIDGE DRM_CLIENT_SELECTION DRM_CLIENT_SETUP DRM_DEBUG_MM DRM_DISPLAY_DP_AUX_BUS DRM_DISPLAY_DP_HELPER DRM_DISPLAY_DSC_HELPER DRM_DISPLAY_HDCP_HELPER DRM_DISPLAY_HDMI_HELPER DRM_DISPLAY_HELPER DRM_GEM_SHMEM_HELPER DRM_GM12U320 DRM_GUD DRM_I915 DRM_I915_CAPTURE_ERROR DRM_I915_COMPRESS_ERROR DRM_I915_USERPTR DRM_KMS_HELPER DRM_MIPI_DSI DRM_PANEL DRM_PANEL_BRIDGE DRM_PANEL_EDP DRM_PANEL_ORIENTATION_QUIRKS DRM_SIMPLEDRM DRM_TTM DRM_TTM_HELPER DRM_UDL DRM_VGEM DRM_VIRTIO_GPU DRM_VIRTIO_GPU_KMS DRM_VKMS DRM_VMWGFX DUMMY DVB_AF9013 DVB_AF9033 DVB_AS102 DVB_AS102_FE DVB_B2C2_FLEXCOP DVB_B2C2_FLEXCOP_USB DVB_CORE DVB_DIB3000MB DVB_DIB3000MC DVB_EC100 DVB_GP8PSK_FE DVB_RTL2830 DVB_RTL2832 DVB_RTL2832_SDR DVB_TEST_DRIVERS DVB_TTUSB_BUDGET DVB_TTUSB_DEC DVB_USB DVB_USB_A800 DVB_USB_AF9005 DVB_USB_AF9005_REMOTE DVB_USB_AF9015 DVB_USB_AF9035 DVB_USB_ANYSEE DVB_USB_AU6610 DVB_USB_AZ6007 DVB_USB_AZ6027 DVB_USB_CE6230 DVB_USB_CINERGY_T2 DVB_USB_CXUSB DVB_USB_CXUSB_ANALOG DVB_USB_DIB0700 DVB_USB_DIB3000MC DVB_USB_DIBUSB_MB DVB_USB_DIBUSB_MC DVB_USB_DIGITV DVB_USB_DTT200U DVB_USB_DTV5100 DVB_USB_DVBSKY DVB_USB_DW2102 DVB_USB_EC168 DVB_USB_GL861 DVB_USB_GP8PSK DVB_USB_LME2510 DVB_USB_M920X DVB_USB_MXL111SF DVB_USB_NOVA_T_USB2 DVB_USB_OPERA1 DVB_USB_PCTV452E DVB_USB_RTL28XXU DVB_USB_TECHNISAT_USB2 DVB_USB_TTUSB2 DVB_USB_UMT_010 DVB_USB_V2 DVB_USB_VP702X DVB_USB_VP7045 DVB_USB_ZD1301 DVB_VIDTV DVB_ZL10353 ECRYPT_FS ECRYPT_FS_MESSAGING EDAC EFS_FS ENCRYPTED_KEYS EQUALIZER EROFS_FS EROFS_FS_POSIX_ACL EROFS_FS_SECURITY EROFS_FS_XATTR EROFS_FS_ZIP EVM EVM_ADD_XATTRS EVM_ATTR_FSUUID EXFAT_FS EXPORTFS_BLOCK_OPS EXT3_FS EXT3_FS_POSIX_ACL EXT3_FS_SECURITY EXTCON EXTCON_INTEL_CHT_WC EXTCON_PTN5150 EXTCON_USBC_TUSB320 F2FS_CHECK_FS F2FS_FAULT_INJECTION F2FS_FS F2FS_FS_COMPRESSION F2FS_FS_LZ4 F2FS_FS_LZ4HC F2FS_FS_LZO F2FS_FS_LZORLE F2FS_FS_POSIX_ACL F2FS_FS_SECURITY F2FS_FS_XATTR F2FS_FS_ZSTD F2FS_STAT_FS FANOTIFY FANOTIFY_ACCESS_PERMISSIONS FB FB_CFB_COPYAREA FB_CFB_FILLRECT FB_CFB_IMAGEBLIT FB_CORE FB_DEFERRED_IO FB_DEVICE FB_IOMEM_FOPS FB_IOMEM_HELPERS FB_NOTIFY FB_SYSMEM_FOPS FB_SYSMEM_HELPERS FB_SYSMEM_HELPERS_DEFERRED FB_SYS_COPYAREA FB_SYS_FILLRECT FB_SYS_IMAGEBLIT FB_TILEBLITTING FB_VESA FB_VGA16 FB_VIRTUAL FDDI FIREWIRE FIREWIRE_NET FIREWIRE_OHCI FIREWIRE_SBP2 FONT_8x16 FONT_8x8 FONT_SUPPORT FRAMEBUFFER_CONSOLE FRAMEBUFFER_CONSOLE_DETECT_PRIMARY FRAMEBUFFER_CONSOLE_ROTATION FS_DAX FS_DAX_PMD FS_ENCRYPTION FS_ENCRYPTION_ALGS FS_STACK FS_VERITY FS_VERITY_BUILTIN_SIGNATURES FTL FUSE_DAX FUSE_FS FW_LOADER_COMPRESS FW_LOADER_PAGED_BUF FW_LOADER_SYSFS FW_LOADER_USER_HELPER FW_LOADER_USER_HELPER_FALLBACK GACT_PROB GARP GENDWARFKSYMS GENERIC_PHY GET_FREE_REGION GFS2_FS GFS2_FS_LOCKING_DLM GNSS GNSS_USB GOOGLE_COREBOOT_TABLE GOOGLE_FIRMWARE GOOGLE_MEMCONSOLE GOOGLE_MEMCONSOLE_COREBOOT GOOGLE_VPD GPIOLIB GPIOLIB_IRQCHIP GPIO_ACPI GPIO_DLN2 GPIO_LJCA GPIO_VIPERBOARD GREENASIA_FF GREYBUS GREYBUS_BRIDGED_PHY GREYBUS_ES2 GREYBUS_HID GREYBUS_USB GTP GUEST_PERF_EVENTS GVE HAS_LTO_CLANG HAVE_ARCH_NODE_DEV_GROUP HAVE_ARCH_USERFAULTFD_MINOR HAVE_ARCH_USERFAULTFD_WP HAVE_BOOTMEM_INFO_NODE HAVE_CLK_PREPARE HAVE_KVM_CPU_RELAX_INTERCEPT HAVE_KVM_DIRTY_RING HAVE_KVM_DIRTY_RING_ACQ_REL HAVE_KVM_DIRTY_RING_TSO HAVE_KVM_IRQCHIP HAVE_KVM_IRQ_BYPASS HAVE_KVM_IRQ_ROUTING HAVE_KVM_MSI HAVE_KVM_NO_POLL HAVE_KVM_PFNCACHE HAVE_KVM_PM_NOTIFIER HAVE_KVM_READONLY_MEM HAVE_SCHED_AVG_IRQ HDLC HDLC_CISCO HDLC_FR HDLC_PPP HDLC_RAW HDLC_RAW_ETH HDLC_X25 HDMI HFSPLUS_FS HFS_FS HID_ACCUTOUCH HID_ACRUX HID_ACRUX_FF HID_ALPS HID_APPLEIR HID_ASUS HID_AUREAL HID_BATTERY_STRENGTH HID_BETOP_FF HID_BIGBEN_FF HID_CMEDIA HID_CORSAIR HID_COUGAR HID_CP2112 HID_CREATIVE_SB0540 HID_ELAN HID_ELECOM HID_ELO HID_EMS_FF HID_EVISION HID_FT260 HID_GEMBIRD HID_GFRM HID_GLORIOUS HID_GOOGLE_STADIA_FF HID_GREENASIA HID_GT683R HID_HOLTEK HID_ICADE HID_JABRA HID_KEYTOUCH HID_KYE HID_LCPOWER HID_LED HID_LENOVO HID_LETSKETCH HID_LOGITECH HID_LOGITECH_DJ HID_LOGITECH_HIDPP HID_MACALLY HID_MAGICMOUSE HID_MALTRON HID_MAYFLASH HID_MCP2200 HID_MCP2221 HID_MEGAWORLD_FF HID_MULTITOUCH HID_NTI HID_ORTEK HID_PENMOUNT HID_PICOLCD HID_PICOLCD_BACKLIGHT HID_PICOLCD_CIR HID_PICOLCD_FB HID_PICOLCD_LCD HID_PICOLCD_LEDS HID_PLANTRONICS HID_PRIMAX HID_PRODIKEYS HID_PXRC HID_RAZER HID_RETRODE HID_RMI HID_ROCCAT HID_SAITEK HID_SEMITEK HID_SENSOR_ACCEL_3D HID_SENSOR_ALS HID_SENSOR_CUSTOM_INTEL_HINGE HID_SENSOR_CUSTOM_SENSOR HID_SENSOR_DEVICE_ROTATION HID_SENSOR_GYRO_3D HID_SENSOR_HUB HID_SENSOR_HUMIDITY HID_SENSOR_IIO_COMMON HID_SENSOR_IIO_TRIGGER HID_SENSOR_INCLINOMETER_3D HID_SENSOR_MAGNETOMETER_3D HID_SENSOR_PRESS HID_SENSOR_PROX HID_SENSOR_TEMP HID_SIGMAMICRO HID_SPEEDLINK HID_STEELSERIES HID_THINGM HID_TIVO HID_TOPRE HID_TWINHAN HID_U2FZERO HID_UCLOGIC HID_UDRAW_PS3 HID_VIEWSONIC HID_VIVALDI HID_VIVALDI_COMMON HID_VRC2 HID_WACOM HID_WALTOP HID_WIIMOTE HID_XIAOMI HID_XINMO HID_ZEROPLUS HID_ZYDACRON HMM_MIRROR HOLTEK_FF HOTPLUG_PCI_PCIE HPET_MMAP HPET_MMAP_DEFAULT HPFS_FS I2C_ALGOBIT I2C_CHARDEV I2C_CP2615 I2C_DESIGNWARE_CORE I2C_DESIGNWARE_PLATFORM I2C_DIOLAN_U2C I2C_DLN2 I2C_HID_ACPI I2C_HID_CORE I2C_HID_OF I2C_LJCA I2C_MUX I2C_MUX_REG I2C_ROBOTFUZZ_OSIF I2C_SI4713 I2C_SLAVE I2C_SLAVE_EEPROM I2C_TINY_USB I2C_VIPERBOARD IEEE802154 IEEE802154_6LOWPAN IEEE802154_ATUSB IEEE802154_DRIVERS IEEE802154_HWSIM IEEE802154_NL802154_EXPERIMENTAL IEEE802154_SOCKET IFB IIO IIO_BUFFER IIO_KFIFO_BUF IIO_TRIGGER IIO_TRIGGERED_BUFFER IKCONFIG IKCONFIG_PROC IMA IMA_APPRAISE IMA_APPRAISE_MODSIG IMA_DEFAULT_HASH_SHA256 IMA_LSM_RULES IMA_MEASURE_ASYMMETRIC_KEYS IMA_NG_TEMPLATE IMA_QUEUE_EARLY_BOOT_KEYS IMA_READ_POLICY IMA_WRITE_POLICY INET6_ESPINTCP INET6_ESP_OFFLOAD INET6_IPCOMP INET6_TUNNEL INET6_XFRM_TUNNEL INET_AH INET_DIAG INET_DIAG_DESTROY INET_ESP INET_ESPINTCP INET_ESP_OFFLOAD INET_IPCOMP INET_MPTCP_DIAG INET_RAW_DIAG INET_SCTP_DIAG INET_TCP_DIAG INET_UDP_DIAG INET_XFRM_TUNNEL INFINIBAND INFINIBAND_ADDR_TRANS INFINIBAND_ADDR_TRANS_CONFIGFS INFINIBAND_IPOIB INFINIBAND_IPOIB_CM INFINIBAND_IPOIB_DEBUG INFINIBAND_ISER INFINIBAND_ON_DEMAND_PAGING INFINIBAND_RTRS INFINIBAND_SRP INFINIBAND_USER_ACCESS INFINIBAND_USER_MAD INFINIBAND_USER_MEM INPUT_ATI_REMOTE2 INPUT_CM109 INPUT_IMS_PCU INPUT_JOYDEV INPUT_KEYSPAN_REMOTE INPUT_LEDS INPUT_MOUSEDEV INPUT_MOUSEDEV_PSAUX INPUT_POWERMATE INPUT_UINPUT INPUT_YEALINK INTEGRITY INTEGRITY_ASYMMETRIC_KEYS INTEGRITY_AUDIT INTEGRITY_SIGNATURE INTEGRITY_TRUSTED_KEYRING INTEL_CHTWC_INT33FE INTEL_IDMA64 INTEL_IOATDMA INTEL_IOMMU_DEFAULT_ON INTEL_IOMMU_SVM INTEL_ISHTP_ECLITE INTEL_ISH_FIRMWARE_DOWNLOADER INTEL_ISH_HID INTEL_SOC_PMIC_CHTWC INTERVAL_TREE_SPAN_ITER IOMMUFD IOMMUFD_DRIVER IOMMUFD_DRIVER_CORE IOMMUFD_TEST IO_URING_ZCRX IP6_NF_MATCH_AH IP6_NF_MATCH_EUI64 IP6_NF_MATCH_FRAG IP6_NF_MATCH_HL IP6_NF_MATCH_MH IP6_NF_MATCH_OPTS IP6_NF_MATCH_RPFILTER IP6_NF_MATCH_RT IP6_NF_MATCH_SRH IP6_NF_NAT IP6_NF_RAW IP6_NF_SECURITY IP6_NF_TARGET_HL IP6_NF_TARGET_MASQUERADE IP6_NF_TARGET_NPT IP6_NF_TARGET_SYNPROXY IPV6_FOU IPV6_FOU_TUNNEL IPV6_GRE IPV6_ILA IPV6_MIP6 IPV6_MROUTE IPV6_MROUTE_MULTIPLE_TABLES IPV6_MULTIPLE_TABLES IPV6_OPTIMISTIC_DAD IPV6_PIMSM_V2 IPV6_ROUTER_PREF IPV6_ROUTE_INFO IPV6_RPL_LWTUNNEL IPV6_SEG6_BPF IPV6_SEG6_HMAC IPV6_SEG6_LWTUNNEL IPV6_SIT_6RD IPV6_SUBTREES IPV6_TUNNEL IPV6_VTI IPVLAN IPVLAN_L3S IPVTAP IP_FIB_TRIE_STATS IP_MROUTE_MULTIPLE_TABLES IP_NF_ARPFILTER IP_NF_ARPTABLES IP_NF_ARP_MANGLE IP_NF_MATCH_AH IP_NF_MATCH_ECN IP_NF_MATCH_RPFILTER IP_NF_MATCH_TTL IP_NF_RAW IP_NF_SECURITY IP_NF_TARGET_ECN IP_NF_TARGET_NETMAP IP_NF_TARGET_REDIRECT IP_NF_TARGET_SYNPROXY IP_NF_TARGET_TTL IP_ROUTE_CLASSID IP_SCTP IP_SET IP_SET_BITMAP_IP IP_SET_BITMAP_IPMAC IP_SET_BITMAP_PORT IP_SET_HASH_IP IP_SET_HASH_IPMAC IP_SET_HASH_IPMARK IP_SET_HASH_IPPORT IP_SET_HASH_IPPORTIP IP_SET_HASH_IPPORTNET IP_SET_HASH_MAC IP_SET_HASH_NET IP_SET_HASH_NETIFACE IRQ_REMAP IRQ_TIME_ACCOUNTING KVM KVM_INTEL LAPB LCD_CLASS_DEVICE LEDS_CLASS_MULTICOLOR LIBNVDIMM MAC802154 MEDIA_ANALOG_TV_SUPPORT MEDIA_CAMERA_SUPPORT MEDIA_CEC_SUPPORT MEDIA_CONTROLLER MEDIA_DIGITAL_TV_SUPPORT MEDIA_RADIO_SUPPORT MEDIA_SDR_SUPPORT MEDIA_SUPPORT MEDIA_TEST_SUPPORT MEDIA_USB_SUPPORT MEMORY_HOTPLUG MEMORY_HOTREMOVE MFD_DLN2 MFD_VIPERBOARD MODVERSIONS MPTCP MTD NETFILTER_ADVANCED NET_ACT_GACT NET_ACT_MIRRED NET_IPGRE_DEMUX NFT_COMPAT NFT_COMPAT_ARP NFT_FWD_NETDEV NF_TABLES NF_TABLES_ARP NF_TABLES_NETDEV NOP_USB_XCEIV PAGE_POOL PARPORT PCCARD PCMCIA PHONET RADIO_ADAPTERS RADIO_SI470X RADIO_SI4713 RAS RC_CORE REGULATOR RFKILL SND SOUND SPI SSB STAGING TAP TARGET_CORE TRANSPARENT_HUGEPAGE TUN TYPEC TYPEC_MUX_PI3USB30532 USB_AMD5536UDC USB_ATM USB_BELKIN USB_C67X00_HCD USB_CATC USB_CDC_PHONET USB_CDNS2_UDC USB_CDNS3 USB_CDNS3_GADGET USB_CDNS3_HOST USB_CDNS3_PCI_WRAP USB_CDNSP_GADGET USB_CDNSP_HOST USB_CDNSP_PCI USB_CDNS_HOST USB_CDNS_SUPPORT USB_CHAOSKEY USB_CHIPIDEA USB_CHIPIDEA_GENERIC USB_CHIPIDEA_HOST USB_CHIPIDEA_MSM USB_CHIPIDEA_NPCM USB_CHIPIDEA_PCI USB_CHIPIDEA_UDC USB_CONFIGFS USB_CONFIGFS_ACM USB_CONFIGFS_ECM USB_CONFIGFS_ECM_SUBSET USB_CONFIGFS_EEM USB_CONFIGFS_F_FS USB_CONFIGFS_F_HID USB_CONFIGFS_F_LB_SS USB_CONFIGFS_F_MIDI USB_CONFIGFS_F_MIDI2 USB_CONFIGFS_F_PRINTER USB_CONFIGFS_F_TCM USB_CONFIGFS_F_UAC1 USB_CONFIGFS_F_UAC1_LEGACY USB_CONFIGFS_F_UAC2 USB_CONFIGFS_F_UVC USB_CONFIGFS_MASS_STORAGE USB_CONFIGFS_NCM USB_CONFIGFS_OBEX USB_CONFIGFS_PHONET USB_CONFIGFS_RNDIS USB_CONFIGFS_SERIAL USB_CONN_GPIO USB_CXACRU USB_CYPRESS_CY7C63 USB_CYTHERM USB_DSBR USB_DUMMY_HCD USB_DWC2 USB_DWC2_HOST USB_DWC2_PCI USB_DWC3 USB_DWC3_GADGET USB_DWC3_HAPS USB_DWC3_OF_SIMPLE USB_DWC3_PCI USB_DWC3_ULPI USB_DYNAMIC_MINORS USB_EG20T USB_EHCI_FSL USB_EHCI_HCD_PLATFORM USB_EHCI_ROOT_HUB_TT USB_EHSET_TEST_FIXTURE USB_EMI26 USB_EMI62 USB_EPSON2888 USB_EZUSB_FX2 USB_FEW_INIT_RETRIES USB_F_ACM USB_F_ECM USB_F_EEM USB_F_FS USB_F_HID USB_F_MASS_STORAGE USB_F_MIDI USB_F_MIDI2 USB_F_NCM USB_F_OBEX USB_F_PHONET USB_F_PRINTER USB_F_RNDIS USB_F_SERIAL USB_F_SS_LB USB_F_SUBSET USB_F_TCM USB_F_UAC1 USB_F_UAC1_LEGACY USB_F_UAC2 USB_F_UVC USB_GADGET USB_GADGETFS USB_GADGET_DEBUG_FILES USB_GADGET_DEBUG_FS USB_GL860 USB_GOKU USB_GR_UDC USB_GSPCA USB_GSPCA_BENQ USB_GSPCA_CONEX USB_GSPCA_CPIA1 USB_GSPCA_DTCS033 USB_GSPCA_ETOMS USB_GSPCA_FINEPIX USB_GSPCA_JEILINJ USB_GSPCA_JL2005BCD USB_GSPCA_KINECT USB_GSPCA_KONICA USB_GSPCA_MARS USB_GSPCA_MR97310A USB_GSPCA_NW80X USB_GSPCA_OV519 USB_GSPCA_OV534 USB_GSPCA_OV534_9 USB_GSPCA_PAC207 USB_GSPCA_PAC7302 USB_GSPCA_PAC7311 USB_GSPCA_SE401 USB_GSPCA_SN9C2028 USB_GSPCA_SN9C20X USB_GSPCA_SONIXB USB_GSPCA_SONIXJ USB_GSPCA_SPCA1528 USB_GSPCA_SPCA500 USB_GSPCA_SPCA501 USB_GSPCA_SPCA505 USB_GSPCA_SPCA506 USB_GSPCA_SPCA508 USB_GSPCA_SPCA561 USB_GSPCA_SQ905 USB_GSPCA_SQ905C USB_GSPCA_SQ930X USB_GSPCA_STK014 USB_GSPCA_STK1135 USB_GSPCA_STV0680 USB_GSPCA_SUNPLUS USB_GSPCA_T613 USB_GSPCA_TOPRO USB_GSPCA_TOUPTEK USB_GSPCA_TV8532 USB_GSPCA_VC032X USB_GSPCA_VICAM USB_GSPCA_XIRLINK_CIT USB_GSPCA_ZC3XX USB_HACKRF USB_HCD_BCMA USB_HCD_SSB USB_HSIC_USB3503 USB_HSIC_USB4604 USB_HSO USB_HUB_USB251XB USB_IDMOUSE USB_IOWARRIOR USB_IPHETH USB_ISIGHTFW USB_ISP116X_HCD USB_ISP1301 USB_ISP1760 USB_ISP1760_DUAL_ROLE USB_ISP1760_HCD USB_ISP1761_UDC USB_KAWETH USB_KC2190 USB_KEENE USB_LAN78XX USB_LCD USB_LD USB_LEDS_TRIGGER_USBPORT USB_LED_TRIG USB_LEGOTOWER USB_LGM_PHY USB_LIBCOMPOSITE USB_LINK_LAYER_TEST USB_LJCA USB_M5602 USB_MA901 USB_MAX3420_UDC USB_MAX3421_HCD USB_MDC800 USB_MICROTEK USB_MR800 USB_MSI2500 USB_MUSB_DUAL_ROLE USB_MUSB_HDRC USB_NET2280 USB_NET_AQC111 USB_NET_AX88179_178A USB_NET_AX8817X USB_NET_CDCETHER USB_NET_CDC_EEM USB_NET_CDC_MBIM USB_NET_CDC_NCM USB_NET_CDC_SUBSET USB_NET_CDC_SUBSET_ENABLE USB_NET_CH9200 USB_NET_CX82310_ETH USB_NET_DM9601 USB_NET_GL620A USB_NET_HUAWEI_CDC_NCM USB_NET_INT51X1 USB_NET_KALMIA USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_QMI_WWAN USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_OXU210HP_HCD USB_PEGASUS USB_PULSE8_CEC USB_PWC USB_PWC_INPUT_EVDEV USB_PXA27X USB_R8A66597 USB_R8A66597_HCD USB_RAINSHADOW_CEC USB_RAREMONO USB_RAW_GADGET USB_ROLES_INTEL_XHCI USB_ROLE_SWITCH USB_RTL8150 USB_RTL8152 USB_RTL8153_ECM USB_S2255 USB_SERIAL USB_SERIAL_AIRCABLE USB_SERIAL_ARK3116 USB_SERIAL_BELKIN USB_SERIAL_CH341 USB_SERIAL_CONSOLE USB_SERIAL_CP210X USB_SERIAL_CYBERJACK USB_SERIAL_CYPRESS_M8 USB_SERIAL_DEBUG USB_SERIAL_DIGI_ACCELEPORT USB_SERIAL_EDGEPORT USB_SERIAL_EDGEPORT_TI USB_SERIAL_EMPEG USB_SERIAL_F81232 USB_SERIAL_F8153X USB_SERIAL_FTDI_SIO USB_SERIAL_GARMIN USB_SERIAL_GENERIC USB_SERIAL_IPAQ USB_SERIAL_IPW USB_SERIAL_IR USB_SERIAL_IUU USB_SERIAL_KEYSPAN USB_SERIAL_KEYSPAN_PDA USB_SERIAL_KLSI USB_SERIAL_KOBIL_SCT USB_SERIAL_MCT_U232 USB_SERIAL_METRO USB_SERIAL_MOS7715_PARPORT USB_SERIAL_MOS7720 USB_SERIAL_MOS7840 USB_SERIAL_MXUPORT USB_SERIAL_NAVMAN USB_SERIAL_OMNINET USB_SERIAL_OPTICON USB_SERIAL_OPTION USB_SERIAL_OTI6858 USB_SERIAL_PL2303 USB_SERIAL_QCAUX USB_SERIAL_QT2 USB_SERIAL_QUALCOMM USB_SERIAL_SAFE USB_SERIAL_SIERRAWIRELESS USB_SERIAL_SIMPLE USB_SERIAL_SPCP8X5 USB_SERIAL_SSU100 USB_SERIAL_SYMBOL USB_SERIAL_TI USB_SERIAL_UPD78F0730 USB_SERIAL_VISOR USB_SERIAL_WHITEHEAT USB_SERIAL_WISHBONE USB_SERIAL_WWAN USB_SERIAL_XR USB_SERIAL_XSENS_MT USB_SEVSEG USB_SI470X USB_SI4713 USB_SIERRA_NET USB_SISUSBVGA USB_SL811_CS USB_SL811_HCD USB_SL811_HCD_ISO USB_SNP_CORE USB_SPEEDTOUCH USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_ENE_UB6250 USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_STV06XX USB_TEST USB_TMC USB_TRANCEVIBRATOR USB_UAS USB_UEAGLEATM USB_ULPI_BUS USB_USBNET USB_USS720 USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_VIDEO_CLASS USB_VIDEO_CLASS_INPUT_EVDEV USB_VL600 USB_WDM USB_XHCI_DBGCAP USB_XHCI_PCI_RENESAS USB_XHCI_PLATFORM USB_XUSBATM USB_YUREX USERFAULTFD USERIO USERMODE_DRIVER USER_RETURN_NOTIFIER UVC_COMMON U_SERIAL_CONSOLE V4L2_MEM2MEM_DEV V4L_TEST_DRIVERS VALIDATE_FS_PARSER VDPA VDPA_SIM VDPA_SIM_BLOCK VDPA_SIM_NET VETH VFIO VFIO_DEVICE_CDEV VFIO_PCI VFIO_PCI_CORE VFIO_PCI_INTX VFIO_VIRQFD VGASTATE VHOST VHOST_CROSS_ENDIAN_LEGACY VHOST_IOTLB VHOST_NET VHOST_RING VHOST_TASK VHOST_VDPA VHOST_VSOCK VIDEO VIDEOBUF2_CORE VIDEOBUF2_DMA_CONTIG VIDEOBUF2_DMA_SG VIDEOBUF2_MEMOPS VIDEOBUF2_V4L2 VIDEOBUF2_VMALLOC VIDEOMODE_HELPERS VIDEO_AU0828 VIDEO_AU0828_RC VIDEO_AU0828_V4L2 VIDEO_CS53L32A VIDEO_CX231XX VIDEO_CX231XX_ALSA VIDEO_CX231XX_DVB VIDEO_CX231XX_RC VIDEO_CX2341X VIDEO_CX25840 VIDEO_DEV VIDEO_EM28XX VIDEO_EM28XX_ALSA VIDEO_EM28XX_DVB VIDEO_EM28XX_RC VIDEO_EM28XX_V4L2 VIDEO_GO7007 VIDEO_GO7007_LOADER VIDEO_GO7007_USB VIDEO_GO7007_USB_S2250_BOARD VIDEO_HDPVR VIDEO_MSP3400 VIDEO_PVRUSB2 VIDEO_PVRUSB2_DVB VIDEO_PVRUSB2_SYSFS VIDEO_SAA711X VIDEO_STK1160 VIDEO_TUNER VIDEO_TVEEPROM VIDEO_USBTV VIDEO_V4L2_I2C VIDEO_V4L2_SUBDEV_API VIDEO_V4L2_TPG VIDEO_VICODEC VIDEO_VIM2M VIDEO_VIMC VIDEO_VIVID VIDEO_VIVID_CEC VIDEO_WM8775 VIPERBOARD_ADC VIRTIO_BALLOON VIRTIO_DMA_SHARED_BUFFER VIRTIO_FS VIRTIO_MEM VIRTIO_MMIO VIRTIO_MMIO_CMDLINE_DEVICES VIRTIO_PMEM VIRTIO_VDPA VIRTIO_VSOCKETS VIRTIO_VSOCKETS_COMMON VIRT_WIFI VLAN_8021Q VLAN_8021Q_GVRP VLAN_8021Q_MVRP VMAP_PFN VMWARE_VMCI VMXNET3 VP_VDPA VSOCKETS VSOCKETS_DIAG VSOCKETS_LOOPBACK VSOCKMON VT_HW_CONSOLE_BINDING VXFS_FS WAN WANT_DEV_COREDUMP WEXT_CORE WEXT_PROC WIREGUARD WIRELESS WLAN WLAN_VENDOR_ADMTEK WLAN_VENDOR_SILABS X86_SGX X86_SGX_KVM X86_USER_SHADOW_STACK XDP_SOCKETS XDP_SOCKETS_DIAG XFRM_ESPINTCP XFRM_INTERFACE XFRM_IPCOMP XFRM_MIGRATE XFRM_OFFLOAD XFRM_STATISTICS XFRM_SUB_POLICY XFRM_USER_COMPAT XFS_FS XFS_POSIX_ACL XFS_QUOTA XFS_RT XILLYBUS_CLASS XILLYUSB XOR_BLOCKS YENTA YENTA_ENE_TUNE YENTA_O2 YENTA_RICOH YENTA_TI YENTA_TOSHIBA ZEROPLUS_FF ZLIB_DEFLATE ZONEFS_FS ZONE_DEVICE ZPOOL ZRAM ZRAM_BACKEND_FORCE_LZO ZRAM_BACKEND_LZO ZRAM_DEF_COMP_LZO ZSMALLOC ZSTD_COMPRESS ZSWAP ZSWAP_COMPRESSOR_DEFAULT_842 ZSWAP_DEFAULT_ON ZSWAP_SHRINKER_DEFAULT_ON ZSWAP_ZPOOL_DEFAULT_ZSMALLOC] disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed picked [v6.14 v6.13 v6.12 v6.10 v6.8 v6.6 v6.4 v6.2 v5.19 v5.16 v5.13 v5.10 v5.7 v5.4 v5.1 v4.19] out of 37 release tags testing release v6.14 testing commit 38fec10eb60d687e30c8c6b5420d86e8149f7557 gcc compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2 kernel signature: 80b40129d941ffb033f38314dd885cc00b10a42213422304e577b090e0bc0e70 run #0: crashed: BUG: corrupted list in em28xx_close_extension run #1: crashed: KASAN: use-after-free Read in em28xx_close_extension run #2: crashed: BUG: corrupted list in em28xx_close_extension run #3: crashed: BUG: corrupted list in em28xx_close_extension run #4: crashed: KASAN: use-after-free Read in em28xx_close_extension run #5: crashed: KASAN: use-after-free Read in em28xx_close_extension run #6: crashed: BUG: corrupted list in em28xx_close_extension run #7: crashed: KASAN: use-after-free Read in em28xx_close_extension run #8: crashed: BUG: corrupted list in em28xx_close_extension run #9: crashed: KASAN: out-of-bounds Read in em28xx_close_extension representative crash: BUG: corrupted list in em28xx_close_extension, types: [BUG KASAN] testing release v6.13 testing commit ffd294d346d185b70e28b1a28abe367bbfe53c04 gcc compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2 kernel signature: 7910ddeb6028384910a9843fac6a4b2d85a54a618e0fbbb50b69d34ad6c94d6b run #0: crashed: BUG: corrupted list in em28xx_close_extension run #1: crashed: BUG: corrupted list in em28xx_close_extension run #2: crashed: BUG: corrupted list in em28xx_close_extension run #3: crashed: KASAN: use-after-free Read in em28xx_close_extension run #4: crashed: KASAN: use-after-free Read in em28xx_close_extension run #5: crashed: BUG: corrupted list in em28xx_close_extension run #6: crashed: KASAN: slab-use-after-free Read in em28xx_close_extension run #7: crashed: BUG: corrupted list in em28xx_close_extension run #8: crashed: BUG: corrupted list in em28xx_close_extension run #9: crashed: KASAN: use-after-free Read in em28xx_close_extension representative crash: BUG: corrupted list in em28xx_close_extension, types: [BUG KASAN] testing release v6.12 testing commit adc218676eef25575469234709c2d87185ca223a gcc compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2 kernel signature: 125ddf7a33e380dfddf1d89e17af58164206c1444d6d5c5d344ad0b728576234 run #0: crashed: KASAN: use-after-free Read in em28xx_close_extension run #1: crashed: KASAN: use-after-free Read in em28xx_close_extension run #2: crashed: BUG: corrupted list in em28xx_init_extension run #3: crashed: BUG: corrupted list in em28xx_close_extension run #4: crashed: BUG: corrupted list in em28xx_close_extension run #5: crashed: BUG: corrupted list in em28xx_close_extension run #6: crashed: KASAN: use-after-free Read in em28xx_close_extension run #7: crashed: BUG: corrupted list in em28xx_close_extension run #8: crashed: KASAN: use-after-free Read in em28xx_close_extension run #9: crashed: KASAN: use-after-free Read in em28xx_close_extension representative crash: KASAN: use-after-free Read in em28xx_close_extension, types: [KASAN BUG] testing release v6.10 testing commit 0c3836482481200ead7b416ca80c68a29cfdaabd gcc compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2 kernel signature: 96874b229105e06a414f430049398ce0eda240519e279c27c947f5270ce066d5 run #0: crashed: BUG: corrupted list in em28xx_close_extension run #1: crashed: BUG: corrupted list in em28xx_init_extension run #2: crashed: BUG: corrupted list in em28xx_close_extension run #3: crashed: BUG: corrupted list in em28xx_close_extension run #4: crashed: BUG: corrupted list in em28xx_close_extension run #5: crashed: BUG: corrupted list in em28xx_close_extension run #6: crashed: BUG: corrupted list in em28xx_close_extension run #7: crashed: BUG: corrupted list in em28xx_close_extension run #8: crashed: BUG: corrupted list in em28xx_close_extension run #9: crashed: KASAN: use-after-free Read in em28xx_close_extension representative crash: BUG: corrupted list in em28xx_close_extension, types: [BUG] testing release v6.8 testing commit e8f897f4afef0031fe618a8e94127a0934896aba gcc compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2 kernel signature: 3e969a2fbf1dd7c6d1afb2b4f58f82c5f284c9fb6b6459db00eb7899c24ff7cb all runs: OK false negative chance: 0.000 # git bisect start 0c3836482481200ead7b416ca80c68a29cfdaabd e8f897f4afef0031fe618a8e94127a0934896aba Bisecting: 15131 revisions left to test after this (roughly 14 steps) [63407d3081a6b406d94bd7d96ff2ca38fa7df236] Merge tag 'phy-fixes-6.9' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy testing commit 63407d3081a6b406d94bd7d96ff2ca38fa7df236 gcc compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2 kernel signature: 541ad4ca0e13a6273be766b5c26b095896634572a2516ebb9100f90affdfbfb1 all runs: OK false negative chance: 0.000 # git bisect good 63407d3081a6b406d94bd7d96ff2ca38fa7df236 Bisecting: 7853 revisions left to test after this (roughly 13 steps) [d34672777da3ea919e8adb0670ab91ddadf7dea0] Merge tag 'fbdev-for-6.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev testing commit d34672777da3ea919e8adb0670ab91ddadf7dea0 gcc compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2 kernel signature: 4df2a90d66378b652bb7e44af2426def4416abc27509c0a3fac1490887b0606c all runs: OK false negative chance: 0.000 # git bisect good d34672777da3ea919e8adb0670ab91ddadf7dea0 Bisecting: 3911 revisions left to test after this (roughly 12 steps) [b9dd56e813af002f45f6a494414d4a05dfdaa30e] Merge tag 'soundwire-6.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire testing commit b9dd56e813af002f45f6a494414d4a05dfdaa30e gcc compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2 kernel signature: faecaefefd700164f5d662df420a4a78c54fd39ee386bdae869d9b04ada9a29a all runs: OK false negative chance: 0.000 # git bisect good b9dd56e813af002f45f6a494414d4a05dfdaa30e Bisecting: 1956 revisions left to test after this (roughly 11 steps) [3a0f38eb285c8c2eead4b3230c7ac2983707599d] af_unix: Annotate data-race of sk->sk_state in unix_inq_len(). testing commit 3a0f38eb285c8c2eead4b3230c7ac2983707599d gcc compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2 kernel signature: 161c0bdd8f6012c2aecd270a969683151b81a4f406b58671bd417c1ccd70f828 all runs: OK false negative chance: 0.000 # git bisect good 3a0f38eb285c8c2eead4b3230c7ac2983707599d Bisecting: 978 revisions left to test after this (roughly 10 steps) [35bb670d65fc0f80c62383ab4f2544cec85ac57a] Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi testing commit 35bb670d65fc0f80c62383ab4f2544cec85ac57a gcc compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2 kernel signature: f33021200e5c724c25117c5a707ddb05c4ac5e10e19d2920dc5272cb97b83c34 all runs: OK false negative chance: 0.000 # git bisect good 35bb670d65fc0f80c62383ab4f2544cec85ac57a Bisecting: 489 revisions left to test after this (roughly 9 steps) [389637d4fb5fee40e8a0f2bfd31583f6768ef792] mei: vsc: Fix spelling error testing commit 389637d4fb5fee40e8a0f2bfd31583f6768ef792 gcc compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2 kernel signature: 8afc9c3ddcdc4bfacb5730f6fe1f5eeb6a41d6d71be37fc140361ced81463050 all runs: OK false negative chance: 0.000 # git bisect good 389637d4fb5fee40e8a0f2bfd31583f6768ef792 Bisecting: 244 revisions left to test after this (roughly 8 steps) [bcec2919676d8c4ed82f374b2b39e74cf3a4fbf8] Merge tag 'qcom-arm64-fixes-for-6.10' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes testing commit bcec2919676d8c4ed82f374b2b39e74cf3a4fbf8 gcc compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2 kernel signature: a555ae1caf47dccf92f6ab2275b3a9a740c2aac7af7790e9ec1c7207fe920f91 all runs: OK false negative chance: 0.000 # git bisect good bcec2919676d8c4ed82f374b2b39e74cf3a4fbf8 Bisecting: 113 revisions left to test after this (roughly 7 steps) [51df8e0cbaefd432f7029dde94e6c7e4e5b19465] Merge tag 'net-6.10-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net testing commit 51df8e0cbaefd432f7029dde94e6c7e4e5b19465 gcc compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2 kernel signature: 8e5ba136e2724511c866a0cfe39755887b9a6b07be6a294c922aa2c32c9e097c all runs: OK false negative chance: 0.000 # git bisect good 51df8e0cbaefd432f7029dde94e6c7e4e5b19465 Bisecting: 57 revisions left to test after this (roughly 6 steps) [f469cf967b095ec2d001a712e8cdbf3b1f06912b] Merge tag 'char-misc-6.10-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc testing commit f469cf967b095ec2d001a712e8cdbf3b1f06912b gcc compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2 kernel signature: 1ea26751b2bdd63fa49ca59897acf7f3498474e1c873ea568ec13eb9fcf0e1be run #0: crashed: BUG: corrupted list in em28xx_close_extension run #1: crashed: BUG: corrupted list in em28xx_close_extension run #2: crashed: KASAN: use-after-free Read in em28xx_close_extension run #3: crashed: BUG: corrupted list in em28xx_close_extension run #4: crashed: BUG: corrupted list in em28xx_close_extension run #5: crashed: BUG: corrupted list in em28xx_close_extension run #6: crashed: BUG: corrupted list in em28xx_close_extension run #7: crashed: KASAN: use-after-free Read in em28xx_close_extension run #8: crashed: BUG: corrupted list in em28xx_close_extension run #9: crashed: BUG: corrupted list in em28xx_close_extension representative crash: BUG: corrupted list in em28xx_close_extension, types: [BUG] # git bisect bad f469cf967b095ec2d001a712e8cdbf3b1f06912b Bisecting: 24 revisions left to test after this (roughly 5 steps) [9b48104b2cde4d392ebf52fda17c3eb5282cddaa] Merge tag 'sound-6.10' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound testing commit 9b48104b2cde4d392ebf52fda17c3eb5282cddaa gcc compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2 kernel signature: fe2d9b16d6eec0ee6797351544852722e64108c0dc5167998fcf3d9a8888e774 all runs: OK false negative chance: 0.000 # git bisect good 9b48104b2cde4d392ebf52fda17c3eb5282cddaa Bisecting: 14 revisions left to test after this (roughly 4 steps) [6d3c721e686ea6c59e18289b400cc95c76e927e0] usb: gadget: configfs: Prevent OOB read/write in usb_string_copy() testing commit 6d3c721e686ea6c59e18289b400cc95c76e927e0 gcc compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2 kernel signature: 353d0c08b415892bfdadeef72030fd1e5016e644ef9632fc5b2e22eba39252ea run #0: crashed: BUG: corrupted list in em28xx_close_extension run #1: crashed: BUG: corrupted list in em28xx_close_extension run #2: crashed: KASAN: use-after-free Read in em28xx_close_extension run #3: crashed: BUG: corrupted list in em28xx_close_extension run #4: crashed: BUG: corrupted list in em28xx_close_extension run #5: crashed: BUG: corrupted list in em28xx_close_extension run #6: crashed: KASAN: use-after-free Read in em28xx_close_extension run #7: crashed: BUG: corrupted list in em28xx_close_extension run #8: crashed: BUG: corrupted list in em28xx_close_extension run #9: crashed: BUG: corrupted list in em28xx_close_extension representative crash: BUG: corrupted list in em28xx_close_extension, types: [BUG] # git bisect bad 6d3c721e686ea6c59e18289b400cc95c76e927e0 Bisecting: 4 revisions left to test after this (roughly 2 steps) [79989bd4ab86404743953fa382af0a22900050cf] xhci: always resume roothubs if xHC was reset during resume testing commit 79989bd4ab86404743953fa382af0a22900050cf gcc compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2 kernel signature: 6ff31bc328421b2b8e9d3de0d9bb51c18e65e5920bdf627d3368e1bdf2e65f1c all runs: OK false negative chance: 0.000 # git bisect good 79989bd4ab86404743953fa382af0a22900050cf Bisecting: 2 revisions left to test after this (roughly 1 step) [3859e85de30815a20bce7db712ce3d94d40a682d] USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k testing commit 3859e85de30815a20bce7db712ce3d94d40a682d gcc compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2 kernel signature: 12b995fd0d469acdc1d2eba2f91643fe01c452f63fc2b11448147c49af418bb6 run #0: crashed: BUG: corrupted list in em28xx_close_extension run #1: crashed: KASAN: slab-use-after-free Read in em28xx_close_extension run #2: crashed: KASAN: use-after-free Read in em28xx_close_extension run #3: crashed: KASAN: use-after-free Read in em28xx_close_extension run #4: crashed: KASAN: use-after-free Read in em28xx_close_extension run #5: crashed: KASAN: use-after-free Read in em28xx_close_extension run #6: crashed: KASAN: use-after-free Read in em28xx_close_extension run #7: crashed: BUG: corrupted list in em28xx_close_extension run #8: crashed: KASAN: slab-use-after-free Read in em28xx_close_extension run #9: crashed: KASAN: use-after-free Read in em28xx_close_extension representative crash: KASAN: slab-use-after-free Read in em28xx_close_extension, types: [KASAN] # git bisect bad 3859e85de30815a20bce7db712ce3d94d40a682d Bisecting: 0 revisions left to test after this (roughly 0 steps) [a368ecde8a5055b627749b09c6218ef793043e47] USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor testing commit a368ecde8a5055b627749b09c6218ef793043e47 gcc compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2 kernel signature: a651730e37fa52a1ef055bbc7cc9f6c16d7cbde12ddbfa16757533a4d22787f4 run #0: crashed: KASAN: slab-use-after-free Read in em28xx_close_extension run #1: crashed: BUG: corrupted list in em28xx_close_extension run #2: crashed: BUG: corrupted list in em28xx_close_extension run #3: crashed: KASAN: use-after-free Read in em28xx_close_extension run #4: crashed: KASAN: use-after-free Read in em28xx_close_extension run #5: crashed: BUG: corrupted list in em28xx_close_extension run #6: crashed: BUG: corrupted list in em28xx_close_extension run #7: crashed: BUG: corrupted list in em28xx_close_extension run #8: crashed: BUG: corrupted list in em28xx_close_extension run #9: crashed: KASAN: use-after-free Read in em28xx_close_extension representative crash: BUG: corrupted list in em28xx_close_extension, types: [BUG KASAN] # git bisect bad a368ecde8a5055b627749b09c6218ef793043e47 a368ecde8a5055b627749b09c6218ef793043e47 is the first bad commit commit a368ecde8a5055b627749b09c6218ef793043e47 Author: Alan Stern Date: Thu Jun 27 15:56:18 2024 -0400 USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor Syzbot has identified a bug in usbcore (see the Closes: tag below) caused by our assumption that the reserved bits in an endpoint descriptor's bEndpointAddress field will always be 0. As a result of the bug, the endpoint_is_duplicate() routine in config.c (and possibly other routines as well) may believe that two descriptors are for distinct endpoints, even though they have the same direction and endpoint number. This can lead to confusion, including the bug identified by syzbot (two descriptors with matching endpoint numbers and directions, where one was interrupt and the other was bulk). To fix the bug, we will clear the reserved bits in bEndpointAddress when we parse the descriptor. (Note that both the USB-2.0 and USB-3.1 specs say these bits are "Reserved, reset to zero".) This requires us to make a copy of the descriptor earlier in usb_parse_endpoint() and use the copy instead of the original when checking for duplicates. Signed-off-by: Alan Stern Reported-and-tested-by: syzbot+8693a0bb9c10b554272a@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-usb/0000000000003d868e061bc0f554@google.com/ Fixes: 0a8fd1346254 ("USB: fix problems with duplicate endpoint addresses") CC: Oliver Neukum CC: stable@vger.kernel.org Link: https://lore.kernel.org/r/205a5edc-7fef-4159-b64a-80374b6b101a@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman drivers/usb/core/config.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) accumulated error probability: 0.00 culprit signature: a651730e37fa52a1ef055bbc7cc9f6c16d7cbde12ddbfa16757533a4d22787f4 parent signature: 6ff31bc328421b2b8e9d3de0d9bb51c18e65e5920bdf627d3368e1bdf2e65f1c revisions tested: 25, total time: 8h31m10.145034149s (build: 5h26m53.552600442s, test: 2h39m2.23889907s) first bad commit: a368ecde8a5055b627749b09c6218ef793043e47 USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor recipients (to): ["gregkh@linuxfoundation.org" "stern@rowland.harvard.edu" "syzbot+8693a0bb9c10b554272a@syzkaller.appspotmail.com"] recipients (cc): [] crash: BUG: corrupted list in em28xx_close_extension usb 7-1: USB disconnect, device number 2 em28xx 7-1:0.0: Disconnecting em28xx #6 em28xx 7-1:0.0: Disconnecting em28xx list_del corruption. prev->next should be ffff88815e310250, but was ffffffff841d97ea. (prev=ffff88815e2ac250) ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:64! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 1 PID: 3443 Comm: kworker/1:3 Not tainted 6.10.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Workqueue: usb_hub_wq hub_event RIP: 0010:__list_del_entry_valid_or_report+0x124/0x140 lib/list_debug.c:62 Code: 90 03 90 0f 0b 48 c7 c7 60 13 ab 86 48 89 de e8 32 70 90 03 90 0f 0b 48 c7 c7 c0 13 ab 86 48 89 de 4c 89 f9 e8 1d 70 90 03 90 <0f> 0b 48 c7 c7 40 14 ab 86 48 89 de 4c 89 f1 e8 08 70 90 03 90 0f RSP: 0018:ffffc90001137510 EFLAGS: 00010246 RAX: 000000000000006d RBX: ffff88815e310250 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 00000000ffffffff RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0ff3778 R12: dffffc0000000000 R13: ffffffff84d7d3e0 R14: ffff88815e264250 R15: ffff88815e2ac250 FS: 0000000000000000(0000) GS:ffff8881f6300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6f9f371da0 CR3: 0000000007f1a000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __list_del_entry_valid include/linux/list.h:124 [inline] __list_del_entry include/linux/list.h:215 [inline] list_del include/linux/list.h:229 [inline] em28xx_close_extension+0xf6/0x1d0 drivers/media/usb/em28xx/em28xx-core.c:1136 em28xx_usb_disconnect+0x153/0x260 drivers/media/usb/em28xx/em28xx-cards.c:4145 usb_unbind_interface+0x1c7/0x7f0 drivers/usb/core/driver.c:461 device_remove drivers/base/dd.c:568 [inline] __device_release_driver drivers/base/dd.c:1270 [inline] device_release_driver_internal+0x457/0x710 drivers/base/dd.c:1293 bus_remove_device+0x2d0/0x380 drivers/base/bus.c:574 device_del+0x432/0x760 drivers/base/core.c:3868 usb_disable_device+0x2da/0x630 drivers/usb/core/message.c:1418 usb_disconnect+0x2c2/0x820 drivers/usb/core/hub.c:2304 hub_port_connect drivers/usb/core/hub.c:5361 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x15f1/0x3a30 drivers/usb/core/hub.c:5903 process_one_work kernel/workqueue.c:3248 [inline] process_scheduled_works+0x9b6/0x1380 kernel/workqueue.c:3329 worker_thread+0x750/0xb20 kernel/workqueue.c:3409 kthread+0x256/0x2e0 kernel/kthread.c:389 ret_from_fork+0x32/0x70 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__list_del_entry_valid_or_report+0x124/0x140 lib/list_debug.c:62 Code: 90 03 90 0f 0b 48 c7 c7 60 13 ab 86 48 89 de e8 32 70 90 03 90 0f 0b 48 c7 c7 c0 13 ab 86 48 89 de 4c 89 f9 e8 1d 70 90 03 90 <0f> 0b 48 c7 c7 40 14 ab 86 48 89 de 4c 89 f1 e8 08 70 90 03 90 0f RSP: 0018:ffffc90001137510 EFLAGS: 00010246 RAX: 000000000000006d RBX: ffff88815e310250 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 00000000ffffffff RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0ff3778 R12: dffffc0000000000 R13: ffffffff84d7d3e0 R14: ffff88815e264250 R15: ffff88815e2ac250 FS: 0000000000000000(0000) GS:ffff8881f6300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6f9f371da0 CR3: 0000000007f1a000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400