ci starts bisection 2023-08-11 22:05:47.281810748 +0000 UTC m=+26925.921332047
bisecting cause commit starting from 89d77f71f493a3663b10fa812d17f472935d24be
building syzkaller on 62df2017e3b1edd786a4c737bd4ccba2b4581d88
ensuring issue is reproducible on original commit 89d77f71f493a3663b10fa812d17f472935d24be

testing commit 89d77f71f493a3663b10fa812d17f472935d24be gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: c83c1c7bd0b81f3220c3bfb2e43239fdf7d1c0662dc87c310313ac734b7b7694
all runs: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
representative crash: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups, types: [KASAN]
check whether we can drop unnecessary instrumentation
disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed
testing commit 89d77f71f493a3663b10fa812d17f472935d24be gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 1fe9aefc552de2b0ff4bcf3699ef780f98c3cb714f79072bf2011a24a943f8a3
run #0: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #1: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #2: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #3: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #4: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #5: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #6: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #7: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #8: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #9: OK
representative crash: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups, types: [KASAN]
the bug reproduces without the instrumentation
disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN BUG LOCKDEP], they are not needed
kconfig minimization: base=3883 full=7593 leaves diff=2000
split chunks (needed=false): <2000>
split chunk #0 of len 2000 into 5 parts
testing without sub-chunk 1/5
disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN BUG LOCKDEP], they are not needed
testing commit 89d77f71f493a3663b10fa812d17f472935d24be gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: cc586d9ab085a4d5ae3d9abfaf1ba6435f614c16e932760cdd4277bb60c100cc
run #0: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #1: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #2: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #3: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #4: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #5: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #6: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #7: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #8: OK
run #9: OK
representative crash: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups, types: [KASAN]
the chunk can be dropped
testing without sub-chunk 2/5
disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed
testing commit 89d77f71f493a3663b10fa812d17f472935d24be gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: ce1b9c0fc086f220b7e252e5250352363799986776807b69148fc72e810acd51
all runs: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
representative crash: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups, types: [KASAN]
the chunk can be dropped
testing without sub-chunk 3/5
disabling configs for [BUG LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed
testing commit 89d77f71f493a3663b10fa812d17f472935d24be gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 821d1c9b9ae41580f4e9049c077e0022748138d716627ff8632500fa28d947b1
run #0: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #1: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #2: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #3: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #4: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #5: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #6: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #7: OK
run #8: OK
run #9: OK
representative crash: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups, types: [KASAN]
the chunk can be dropped
testing without sub-chunk 4/5
disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed
testing commit 89d77f71f493a3663b10fa812d17f472935d24be gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: eb6a64e4c6ba91801d9e34d5a76758e0dc33272df2ab0c9d77eb96b7cf8dfdef
run #0: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #1: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #2: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #3: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #4: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
representative crash: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups, types: [KASAN]
the chunk can be dropped
testing without sub-chunk 5/5
disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN BUG LOCKDEP], they are not needed
testing commit 89d77f71f493a3663b10fa812d17f472935d24be gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: ace79adb2f72cce46b7651020f953e1eca908f3a93d3835bbc1771423677bbec
all runs: OK
false negative chance: 0.000
minimized to 400 configs; suspects: [ARCH_ENABLE_MEMORY_HOTREMOVE ATM BCMA BLK_DEV_ZONED BPF_SYSCALL CARDBUS CFG80211 CFG80211_WEXT CMA COMMON_CLK CONTIG_ALLOC CRYPTO_842 CRYPTO_LZ4 CRYPTO_LZ4HC CRYPTO_LZO CRYPTO_ZSTD DVB_CORE EXTCON FB GPIOLIB HID_ZEROPLUS I2C_MUX IIO IOMMUFD IRQ_REMAP KVM KVM_INTEL LIBNVDIMM MEDIA_ANALOG_TV_SUPPORT MEDIA_CAMERA_SUPPORT MEDIA_CEC_SUPPORT MEDIA_CONTROLLER MEDIA_DIGITAL_TV_SUPPORT MEDIA_RADIO_SUPPORT MEDIA_SDR_SUPPORT MEDIA_SUPPORT MEDIA_TEST_SUPPORT MEDIA_USB_SUPPORT MEMORY_HOTPLUG MEMORY_HOTREMOVE MFD_VIPERBOARD PARPORT PCCARD PCMCIA PHONET RADIO_ADAPTERS RADIO_SI470X RADIO_SI4713 RC_CORE RFKILL SND SOUND SPI SSB TAP TARGET_CORE TUN USB_AMD5536UDC USB_ATM USB_CONFIGFS USB_CONFIGFS_F_LB_SS USB_CONFIGFS_F_MIDI USB_CONFIGFS_F_PRINTER USB_CONFIGFS_F_TCM USB_CONFIGFS_F_UAC1 USB_CONFIGFS_F_UAC1_LEGACY USB_CONFIGFS_F_UAC2 USB_CONFIGFS_F_UVC USB_CONFIGFS_MASS_STORAGE USB_CONFIGFS_NCM USB_CONFIGFS_OBEX USB_CONFIGFS_PHONET USB_CONFIGFS_RNDIS USB_CONFIGFS_SERIAL USB_CXACRU USB_CYPRESS_CY7C63 USB_CYTHERM USB_DSBR USB_DUMMY_HCD USB_DWC2 USB_DWC2_HOST USB_DWC2_PCI USB_DWC3 USB_DWC3_GADGET USB_DWC3_OF_SIMPLE USB_DWC3_PCI USB_DWC3_ULPI USB_DYNAMIC_MINORS USB_EG20T USB_EHCI_HCD_PLATFORM USB_EHCI_ROOT_HUB_TT USB_EHSET_TEST_FIXTURE USB_EMI26 USB_EMI62 USB_EPSON2888 USB_EZUSB_FX2 USB_FEW_INIT_RETRIES USB_F_ACM USB_F_ECM USB_F_EEM USB_F_FS USB_F_HID USB_F_MASS_STORAGE USB_F_MIDI USB_F_NCM USB_F_OBEX USB_F_PHONET USB_F_PRINTER USB_F_RNDIS USB_F_SERIAL USB_F_SS_LB USB_F_SUBSET USB_F_TCM USB_F_UAC1 USB_F_UAC1_LEGACY USB_F_UAC2 USB_F_UVC USB_GADGET USB_GADGETFS USB_GADGET_DEBUG_FILES USB_GADGET_DEBUG_FS USB_GL860 USB_GOKU USB_GPIO_VBUS USB_GR_UDC USB_GSPCA USB_GSPCA_BENQ USB_GSPCA_CONEX USB_GSPCA_CPIA1 USB_GSPCA_DTCS033 USB_GSPCA_ETOMS USB_GSPCA_FINEPIX USB_GSPCA_JEILINJ USB_GSPCA_JL2005BCD USB_GSPCA_KINECT USB_GSPCA_KONICA USB_GSPCA_MARS USB_GSPCA_MR97310A USB_GSPCA_NW80X USB_GSPCA_OV519 USB_GSPCA_OV534 USB_GSPCA_OV534_9 USB_GSPCA_PAC207 USB_GSPCA_PAC7302 USB_GSPCA_PAC7311 USB_GSPCA_SE401 USB_GSPCA_SN9C2028 USB_GSPCA_SN9C20X USB_GSPCA_SONIXB USB_GSPCA_SONIXJ USB_GSPCA_SPCA1528 USB_GSPCA_SPCA500 USB_GSPCA_SPCA501 USB_GSPCA_SPCA505 USB_GSPCA_SPCA506 USB_GSPCA_SPCA508 USB_GSPCA_SPCA561 USB_GSPCA_SQ905 USB_GSPCA_SQ905C USB_GSPCA_SQ930X USB_GSPCA_STK014 USB_GSPCA_STK1135 USB_GSPCA_STV0680 USB_GSPCA_SUNPLUS USB_GSPCA_T613 USB_GSPCA_TOPRO USB_GSPCA_TOUPTEK USB_GSPCA_TV8532 USB_GSPCA_VC032X USB_GSPCA_VICAM USB_GSPCA_XIRLINK_CIT USB_GSPCA_ZC3XX USB_HACKRF USB_HCD_BCMA USB_HCD_SSB USB_HSIC_USB3503 USB_HSIC_USB4604 USB_HSO USB_HUB_USB251XB USB_IDMOUSE USB_IOWARRIOR USB_IPHETH USB_ISIGHTFW USB_ISP116X_HCD USB_ISP1301 USB_ISP1760 USB_ISP1760_DUAL_ROLE USB_ISP1760_HCD USB_ISP1761_UDC USB_KAWETH USB_KC2190 USB_KEENE USB_LAN78XX USB_LCD USB_LD USB_LEDS_TRIGGER_USBPORT USB_LED_TRIG USB_LEGOTOWER USB_LIBCOMPOSITE USB_LINK_LAYER_TEST USB_M5602 USB_MA901 USB_MAX3421_HCD USB_MDC800 USB_MICROTEK USB_MR800 USB_MSI2500 USB_MUSB_DUAL_ROLE USB_MUSB_HDRC USB_MV_U3D USB_MV_UDC USB_NET2272 USB_NET2272_DMA USB_NET2280 USB_NET_AX88179_178A USB_NET_AX8817X USB_NET_CDCETHER USB_NET_CDC_EEM USB_NET_CDC_MBIM USB_NET_CDC_NCM USB_NET_CDC_SUBSET USB_NET_CDC_SUBSET_ENABLE USB_NET_CH9200 USB_NET_CX82310_ETH USB_NET_DM9601 USB_NET_GL620A USB_NET_HUAWEI_CDC_NCM USB_NET_INT51X1 USB_NET_KALMIA USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_QMI_WWAN USB_NET_RNDIS_HOST USB_NET_RNDIS_WLAN USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_OXU210HP_HCD USB_PEGASUS USB_PULSE8_CEC USB_PWC USB_PWC_INPUT_EVDEV USB_PXA27X USB_R8A66597 USB_R8A66597_HCD USB_RAINSHADOW_CEC USB_RAREMONO USB_RAW_GADGET USB_RTL8150 USB_RTL8152 USB_RTL8153_ECM USB_S2255 USB_SERIAL USB_SERIAL_AIRCABLE USB_SERIAL_ARK3116 USB_SERIAL_BELKIN USB_SERIAL_CH341 USB_SERIAL_CONSOLE USB_SERIAL_CP210X USB_SERIAL_CYBERJACK USB_SERIAL_CYPRESS_M8 USB_SERIAL_DEBUG USB_SERIAL_DIGI_ACCELEPORT USB_SERIAL_EDGEPORT USB_SERIAL_EDGEPORT_TI USB_SERIAL_EMPEG USB_SERIAL_F81232 USB_SERIAL_F8153X USB_SERIAL_FTDI_SIO USB_SERIAL_GARMIN USB_SERIAL_GENERIC USB_SERIAL_IPAQ USB_SERIAL_IPW USB_SERIAL_IR USB_SERIAL_IUU USB_SERIAL_KEYSPAN USB_SERIAL_KEYSPAN_PDA USB_SERIAL_KLSI USB_SERIAL_KOBIL_SCT USB_SERIAL_MCT_U232 USB_SERIAL_METRO USB_SERIAL_MOS7715_PARPORT USB_SERIAL_MOS7720 USB_SERIAL_MOS7840 USB_SERIAL_MXUPORT USB_SERIAL_NAVMAN USB_SERIAL_OMNINET USB_SERIAL_OPTICON USB_SERIAL_OPTION USB_SERIAL_OTI6858 USB_SERIAL_PL2303 USB_SERIAL_QCAUX USB_SERIAL_QT2 USB_SERIAL_QUALCOMM USB_SERIAL_SAFE USB_SERIAL_SIERRAWIRELESS USB_SERIAL_SIMPLE USB_SERIAL_SPCP8X5 USB_SERIAL_SSU100 USB_SERIAL_SYMBOL USB_SERIAL_TI USB_SERIAL_UPD78F0730 USB_SERIAL_VISOR USB_SERIAL_WHITEHEAT USB_SERIAL_WISHBONE USB_SERIAL_WWAN USB_SERIAL_XR USB_SERIAL_XSENS_MT USB_SEVSEG USB_SI470X USB_SI4713 USB_SIERRA_NET USB_SISUSBVGA USB_SL811_CS USB_SL811_HCD USB_SL811_HCD_ISO USB_SNP_CORE USB_SPEEDTOUCH USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_ENE_UB6250 USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_STV06XX USB_TEST USB_TMC USB_TRANCEVIBRATOR USB_UAS USB_UEAGLEATM USB_ULPI_BUS USB_USBNET USB_USS720 USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_VIDEO_CLASS USB_VIDEO_CLASS_INPUT_EVDEV USB_VL600 USB_WDM USB_XHCI_DBGCAP USB_XHCI_PLATFORM USB_XUSBATM USB_YUREX USERFAULTFD USERIO USERMODE_DRIVER USER_RETURN_NOTIFIER UVC_COMMON U_SERIAL_CONSOLE V4L2_MEM2MEM_DEV V4L_TEST_DRIVERS VALIDATE_FS_PARSER VDPA VDPA_SIM VDPA_SIM_BLOCK VDPA_SIM_NET VDPA_USER VETH VFIO VFIO_PCI VFIO_PCI_CORE VFIO_PCI_INTX VFIO_PCI_MMAP VFIO_VIRQFD VGASTATE VHOST VHOST_CROSS_ENDIAN_LEGACY VHOST_IOTLB VHOST_NET VHOST_RING VHOST_TASK VHOST_VDPA VHOST_VSOCK VIDEOBUF2_CORE VIDEOBUF2_DMA_CONTIG VIDEOBUF2_DMA_SG VIDEOBUF2_MEMOPS VIDEOBUF2_V4L2 VIDEOBUF2_VMALLOC VIDEOMODE_HELPERS VIDEO_AU0828 VIDEO_AU0828_RC VIDEO_AU0828_V4L2 VIDEO_CMDLINE VIDEO_CS53L32A VIDEO_CX231XX VIDEO_CX231XX_ALSA VIDEO_CX231XX_DVB VIDEO_CX231XX_RC VIDEO_CX2341X VIDEO_CX25840 VIDEO_DEV VIDEO_EM28XX VIDEO_EM28XX_ALSA VIDEO_EM28XX_DVB VIDEO_EM28XX_RC VIDEO_EM28XX_V4L2 VIDEO_GO7007 VIDEO_GO7007_LOADER VIDEO_GO7007_USB VIDEO_GO7007_USB_S2250_BOARD VIDEO_HDPVR VIDEO_MSP3400 VIDEO_NOMODESET VIDEO_PVRUSB2 VIDEO_PVRUSB2_DVB VIDEO_PVRUSB2_SYSFS VIDEO_SAA711X VIDEO_STK1160 VIDEO_STK1160_COMMON VIDEO_TUNER VIDEO_TVEEPROM VIDEO_USBTV VIDEO_V4L2_I2C VIDEO_V4L2_SUBDEV_API VIDEO_V4L2_TPG VIDEO_VICODEC VIDEO_VIM2M VIDEO_VIMC VIDEO_VIVID VIDEO_VIVID_CEC VIDEO_WM8775 VIPERBOARD_ADC VIRTIO_BALLOON VIRTIO_DMA_SHARED_BUFFER VIRTIO_MEM VIRTIO_MMIO VIRTIO_MMIO_CMDLINE_DEVICES VIRTIO_PMEM VIRTIO_VDPA VIRTIO_VSOCKETS VIRTIO_VSOCKETS_COMMON VIRT_WIFI VLAN_8021Q VLAN_8021Q_GVRP VLAN_8021Q_MVRP VMAP_PFN VMWARE_VMCI VMXNET3 VP_VDPA VSOCKETS VSOCKETS_DIAG VSOCKETS_LOOPBACK VSOCKMON VT_HW_CONSOLE_BINDING VXFS_FS WANT_DEV_COREDUMP WEXT_CORE WEXT_PRIV WEXT_PROC WIREGUARD WIRELESS WIRELESS_EXT WLAN WLAN_VENDOR_ADMTEK WLAN_VENDOR_PURELIFI WLAN_VENDOR_SILABS X86_FEATURE_NAMES X86_SGX X86_SGX_KVM X86_X2APIC X86_X32_ABI XARRAY_MULTI XDP_SOCKETS XDP_SOCKETS_DIAG XFRM_ESPINTCP XFRM_INTERFACE XFRM_IPCOMP XFRM_MIGRATE XFRM_OFFLOAD XFRM_STATISTICS XFRM_SUB_POLICY XFRM_USER_COMPAT XFS_FS XFS_POSIX_ACL XFS_QUOTA XFS_RT XFS_SUPPORT_V4 XOR_BLOCKS YENTA YENTA_ENE_TUNE YENTA_O2 YENTA_RICOH YENTA_TI YENTA_TOSHIBA ZBUD ZEROPLUS_FF ZLIB_DEFLATE ZONEFS_FS ZPOOL ZRAM ZRAM_DEF_COMP_LZORLE ZSMALLOC ZSTD_COMPRESS ZSWAP ZSWAP_COMPRESSOR_DEFAULT_LZO ZSWAP_ZPOOL_DEFAULT_ZBUD]
disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN BUG LOCKDEP], they are not needed
testing release v6.3
testing commit 457391b0380335d5e9a5babdec90ac53928b23b4 gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: e9565b3bd48a9a96a9fe819015b1b9e228ad080f2fd332190a4704f813eac398
run #0: crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
representative crash: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups, types: [KASAN]
testing release v6.2
testing commit c9c3395d5e3dcc6daee66c6908354d47bf98cb0c gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: af518d6336ae4e2deda761b94dd010b3b64a0277002ee883be5aaae214e7f358
run #0: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #1: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #2: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #3: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: use-after-free Write in usb_anchor_suspend_wakeups, types: [KASAN]
testing release v6.1
testing commit 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: e294cd69660add76791e943d881896f9c14439d70184c82d7c40c63715dd1254
run #0: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #1: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #2: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: use-after-free Write in usb_anchor_suspend_wakeups, types: [KASAN]
testing release v6.0
testing commit 4fe89d07dcc2804c8b562f6c7896a45643d34b2f gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: a1ad3b0315f0dce01ba4643e7cfbac25f23ce2a40d208db208c9ae89bea719b2
run #0: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #1: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #2: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #3: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #4: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: use-after-free Write in usb_anchor_suspend_wakeups, types: [KASAN]
testing release v5.19
testing commit 3d7cb6b04c3f3115719235cc6866b10326de34cd gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 7820e88520693714b36c495c28994d093f74bd6f1d7e7274ab3614a5f35d0a2d
run #0: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #1: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: use-after-free Write in usb_anchor_suspend_wakeups, types: [KASAN]
testing release v5.18
testing commit 4b0986a3613c92f4ec1bdc7f60ec66fea135991f gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: a901492c9ac1191bbfedcaea622ab91c132a95a34499e80fcd1b783a39355d54
run #0: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #1: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #2: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #3: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #4: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #5: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #6: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #7: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: use-after-free Write in usb_anchor_suspend_wakeups, types: [KASAN]
testing release v5.17
testing commit f443e374ae131c168a065ea1748feac6b2e76613 gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 2ca86192ce25e885b5551c8be0aa3b325d8e8954ca0321e94762ef8afe683e9d
run #0: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #1: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #2: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #3: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #4: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #5: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: use-after-free Write in usb_anchor_suspend_wakeups, types: [KASAN]
testing release v5.16
testing commit df0cc57e057f18e44dac8e6c18aba47ab53202f9 gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 68169e9c8967d00c9b043922c6dbe7a544decfc6c9adbe540ec26e3c0f139aae
run #0: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #1: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #2: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: use-after-free Write in usb_anchor_suspend_wakeups, types: [KASAN]
testing release v5.15
testing commit 8bb7eca972ad531c9b149c0a51ab43a417385813 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 57ea7d770b7fe5fb4849c1bae11740f5217021d7493c8f5101dba33fe164f0ef
run #0: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #1: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #2: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #3: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #4: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #5: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #6: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #7: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #8: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #9: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #10: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: use-after-free Write in usb_anchor_suspend_wakeups, types: [KASAN]
testing release v5.14
testing commit 7d2a07b769330c34b4deabeed939325c77a7ec2f gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 70a94241f07b93095c7eb13ee27db5f474d83c05cfbe16d0e52c62c4fb22a56c
run #0: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #1: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #2: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #3: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #4: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #5: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #6: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #7: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #8: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: use-after-free Write in usb_anchor_suspend_wakeups, types: [KASAN]
testing release v5.13
testing commit 62fb9874f5da54fdb243003b386128037319b219 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: df23fbc79d768751d92603a3b5f671d0d293fad3041fa38cecf9c11445db26fc
run #0: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #1: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #2: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #3: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #4: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #5: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #6: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #7: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: use-after-free Write in usb_anchor_suspend_wakeups, types: [KASAN]
testing release v5.12
testing commit 9f4ad9e425a1d3b6a34617b8ea226d56a119a717 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 555a0550e38ce9154e06008d1a2a7e268e2c7b7c9e43c281582469aff0ec73ed
run #0: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #1: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #2: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #3: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #4: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #5: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: use-after-free Write in usb_anchor_suspend_wakeups, types: [KASAN]
testing release v5.11
testing commit f40ddce88593482919761f74910f42f4b84c004b gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: fa272486f47e2fa53c3cb1ca457a13678df5c652b3cefd6bde99d5b3824cdd3a
run #0: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #1: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #2: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #3: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #4: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #5: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #6: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: use-after-free Write in usb_anchor_suspend_wakeups, types: [KASAN]
testing release v5.10
testing commit 2c85ebc57b3e1817b6ce1a6b703928e113a90442 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 1e6cbc58ae470d39d18c832f3526dbe74b845ab5ea9b7156179dc5a2fef62161
run #0: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #1: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #2: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #3: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #4: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #5: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #6: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #7: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #8: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #9: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #10: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #11: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: use-after-free Write in usb_anchor_suspend_wakeups, types: [KASAN]
testing release v5.9
testing commit bbf5c979011a099af5dc76498918ed7df445635b gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: bf9024e8d7241a6590cd3698e323a9ab849a64ddb9a85c7a55a2cb3ebafda2de
run #0: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #1: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #2: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #3: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #4: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #5: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #6: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #7: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #8: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #9: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #10: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #11: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: use-after-free Write in usb_anchor_suspend_wakeups, types: [KASAN]
testing release v5.8
testing commit bcf876870b95592b52519ed4aafcf9d95999bc9c gcc
compiler: gcc (GCC) 8.4.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 24839e22afe0071717c5ec67ee7340b2944d486ebcccef5dcbe18aaf215ccda5
all runs: OK
false negative chance: 0.000
# git bisect start bbf5c979011a099af5dc76498918ed7df445635b bcf876870b95592b52519ed4aafcf9d95999bc9c
Bisecting: 7841 revisions left to test after this (roughly 13 steps)
[47ec5303d73ea344e84f46660fff693c57641386] Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

testing commit 47ec5303d73ea344e84f46660fff693c57641386 gcc
compiler: gcc (GCC) 8.4.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 5c1f89f515e7d625649c399393e55dd91748efa52124fce3044dc9dd9528a68f
run #0: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #1: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #2: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #3: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: use-after-free Write in usb_anchor_suspend_wakeups, types: [KASAN]
# git bisect bad 47ec5303d73ea344e84f46660fff693c57641386
Bisecting: 4088 revisions left to test after this (roughly 12 steps)
[8f7be6291529011a58856bf178f52ed5751c68ac] Merge tag 'mmc-v5.9' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc

testing commit 8f7be6291529011a58856bf178f52ed5751c68ac gcc
compiler: gcc (GCC) 8.4.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 81c6af33c7b7c71382eaaa9e6a94eb4be0944f4715b9c39c140598171f8a51bc
run #0: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #1: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #2: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #3: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: use-after-free Write in usb_anchor_suspend_wakeups, types: [KASAN]
# git bisect bad 8f7be6291529011a58856bf178f52ed5751c68ac
Bisecting: 2031 revisions left to test after this (roughly 11 steps)
[822ef14e9dc73079c646d33aa77e2ac42361b39e] Merge tag 'arm-drivers-5.9' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

testing commit 822ef14e9dc73079c646d33aa77e2ac42361b39e gcc
compiler: gcc (GCC) 8.4.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 4447bca4966f0d28e0d31be3c9d03c57e9864ab7e56b14799972f2c750bd272f
all runs: OK
false negative chance: 0.002
# git bisect good 822ef14e9dc73079c646d33aa77e2ac42361b39e
Bisecting: 982 revisions left to test after this (roughly 10 steps)
[e0fc99e21e6e299673f1640105ac0c1d829c2d93] Merge tag 'for-5.9/drivers-20200803' of git://git.kernel.dk/linux-block

testing commit e0fc99e21e6e299673f1640105ac0c1d829c2d93 gcc
compiler: gcc (GCC) 8.4.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 928b6cef75b1baf9ed8139bf24698eb0ffe08c42133baefc6595221700dac612
run #0: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #1: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #2: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #3: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #4: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: use-after-free Write in usb_anchor_suspend_wakeups, types: [KASAN]
# git bisect bad e0fc99e21e6e299673f1640105ac0c1d829c2d93
Bisecting: 521 revisions left to test after this (roughly 9 steps)
[4f30a60aa78410496e5ffe632a371c00f0d83a8d] Merge tag 'close-range-v5.9' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux

testing commit 4f30a60aa78410496e5ffe632a371c00f0d83a8d gcc
compiler: gcc (GCC) 8.4.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 92d6e692c9603320fc6429518fafcf3efcadebe5a7df1412ea1810bffb336ceb
run #0: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #1: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: use-after-free Write in usb_anchor_suspend_wakeups, types: [KASAN]
# git bisect bad 4f30a60aa78410496e5ffe632a371c00f0d83a8d
Bisecting: 260 revisions left to test after this (roughly 8 steps)
[b171373902b06d1b5a775de74178bf1527fee6cc] Merge tag 'spi-v5.9' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

testing commit b171373902b06d1b5a775de74178bf1527fee6cc gcc
compiler: gcc (GCC) 8.4.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 57471249f62e920d6f06b9c40ff3049170f8bf725ed86e6a46e764862471e4a3
all runs: OK
false negative chance: 0.018
# git bisect good b171373902b06d1b5a775de74178bf1527fee6cc
Bisecting: 128 revisions left to test after this (roughly 7 steps)
[427714f258a3783b15e33d6daa34d57824f28bab] Merge tag 'tasklets-v5.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

testing commit 427714f258a3783b15e33d6daa34d57824f28bab gcc
compiler: gcc (GCC) 8.4.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: cfbddfa4b72808d7216a951ef541499d6ea972a3d84137e14bb7d11e1bf392d8
all runs: OK
false negative chance: 0.018
# git bisect good 427714f258a3783b15e33d6daa34d57824f28bab
Bisecting: 62 revisions left to test after this (roughly 6 steps)
[fd76a74d940ae3d6b8b2395cd12914630c7e1739] Merge tag 'audit-pr-20200803' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit

testing commit fd76a74d940ae3d6b8b2395cd12914630c7e1739 gcc
compiler: gcc (GCC) 8.4.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 01c87a3b6cec6fc2b1b97d98787d69ee4905a2eee6976a12eea79aec0dfb9e63
all runs: OK
false negative chance: 0.018
# git bisect good fd76a74d940ae3d6b8b2395cd12914630c7e1739
Bisecting: 31 revisions left to test after this (roughly 5 steps)
[0a72761b27fe3b10e3f336bf2f2aa22635504cdd] Merge tag 'threads-v5.9' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux

testing commit 0a72761b27fe3b10e3f336bf2f2aa22635504cdd gcc
compiler: gcc (GCC) 8.4.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: e5f2369613a35540d98ed02b94ec7b1e21ea6d449033f7897e27f3537fe61171
all runs: OK
false negative chance: 0.018
# git bisect good 0a72761b27fe3b10e3f336bf2f2aa22635504cdd
Bisecting: 15 revisions left to test after this (roughly 4 steps)
[140c8180eb7c7cbda399f64474788b86db72db32] arch: remove HAVE_COPY_THREAD_TLS

testing commit 140c8180eb7c7cbda399f64474788b86db72db32 gcc
compiler: gcc (GCC) 8.4.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: fc98a2a46462421055dc48bd695908463e3f7fb4f0e6a4673f0743c3ee48cbbc
all runs: OK
false negative chance: 0.018
# git bisect good 140c8180eb7c7cbda399f64474788b86db72db32
Bisecting: 8 revisions left to test after this (roughly 3 steps)
[1d27a0be16d6c95fd71deef34e94b40cb4411cc9] selftests: add clone3() CAP_CHECKPOINT_RESTORE test

testing commit 1d27a0be16d6c95fd71deef34e94b40cb4411cc9 gcc
compiler: gcc (GCC) 8.4.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: e361d0a2c9080741efbeb70a4565dad600cf2dcef5147a05a64fe036cc4bcb57
all runs: OK
false negative chance: 0.018
# git bisect good 1d27a0be16d6c95fd71deef34e94b40cb4411cc9
Bisecting: 4 revisions left to test after this (roughly 2 steps)
[60997c3d45d9a67daf01c56d805ae4fec37e0bd8] close_range: add CLOSE_RANGE_UNSHARE

testing commit 60997c3d45d9a67daf01c56d805ae4fec37e0bd8 gcc
compiler: gcc (GCC) 8.4.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 9f34f4fa7348eb88458e53bdfd8007fe23bac5b4f23d8d5933e9d48981d6d32a
run #0: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #1: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #2: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #3: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: use-after-free Write in usb_anchor_suspend_wakeups, types: [KASAN]
# git bisect bad 60997c3d45d9a67daf01c56d805ae4fec37e0bd8
Bisecting: 1 revision left to test after this (roughly 1 step)
[9b4feb630e8e9801603f3cab3a36369e3c1cf88d] arch: wire-up close_range()

testing commit 9b4feb630e8e9801603f3cab3a36369e3c1cf88d gcc
compiler: gcc (GCC) 8.4.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: e6f0ace4d42eb8061c3fe0560b0f97fa3f341a4dd9271c5fec186d023fdd34bb
run #0: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #1: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #2: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #3: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #4: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #5: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #6: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #7: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: use-after-free Write in usb_anchor_suspend_wakeups, types: [KASAN]
# git bisect bad 9b4feb630e8e9801603f3cab3a36369e3c1cf88d
Bisecting: 0 revisions left to test after this (roughly 0 steps)
[278a5fbaed89dacd04e9d052f4594ffd0e0585de] open: add close_range()

testing commit 278a5fbaed89dacd04e9d052f4594ffd0e0585de gcc
compiler: gcc (GCC) 8.4.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: e957267ecdb7f2c385a73f2e01247b441aabde680942065eee0fd61ab633172a
all runs: OK
false negative chance: 0.018
# git bisect good 278a5fbaed89dacd04e9d052f4594ffd0e0585de
9b4feb630e8e9801603f3cab3a36369e3c1cf88d is the first bad commit
commit 9b4feb630e8e9801603f3cab3a36369e3c1cf88d
Author: Christian Brauner <christian.brauner@ubuntu.com>
Date:   Fri May 24 11:31:44 2019 +0200

    arch: wire-up close_range()
    
    This wires up the close_range() syscall into all arches at once.
    
    Suggested-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
    Reviewed-by: Oleg Nesterov <oleg@redhat.com>
    Acked-by: Arnd Bergmann <arnd@arndb.de>
    Acked-by: Michael Ellerman <mpe@ellerman.id.au> (powerpc)
    Cc: Jann Horn <jannh@google.com>
    Cc: David Howells <dhowells@redhat.com>
    Cc: Dmitry V. Levin <ldv@altlinux.org>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Al Viro <viro@zeniv.linux.org.uk>
    Cc: Florian Weimer <fweimer@redhat.com>
    Cc: linux-api@vger.kernel.org
    Cc: linux-alpha@vger.kernel.org
    Cc: linux-arm-kernel@lists.infradead.org
    Cc: linux-ia64@vger.kernel.org
    Cc: linux-m68k@lists.linux-m68k.org
    Cc: linux-mips@vger.kernel.org
    Cc: linux-parisc@vger.kernel.org
    Cc: linuxppc-dev@lists.ozlabs.org
    Cc: linux-s390@vger.kernel.org
    Cc: linux-sh@vger.kernel.org
    Cc: sparclinux@vger.kernel.org
    Cc: linux-xtensa@linux-xtensa.org
    Cc: linux-arch@vger.kernel.org
    Cc: x86@kernel.org

 arch/alpha/kernel/syscalls/syscall.tbl      | 1 +
 arch/arm/tools/syscall.tbl                  | 1 +
 arch/arm64/include/asm/unistd32.h           | 2 ++
 arch/ia64/kernel/syscalls/syscall.tbl       | 1 +
 arch/m68k/kernel/syscalls/syscall.tbl       | 1 +
 arch/microblaze/kernel/syscalls/syscall.tbl | 1 +
 arch/mips/kernel/syscalls/syscall_n32.tbl   | 1 +
 arch/mips/kernel/syscalls/syscall_n64.tbl   | 1 +
 arch/mips/kernel/syscalls/syscall_o32.tbl   | 1 +
 arch/parisc/kernel/syscalls/syscall.tbl     | 1 +
 arch/powerpc/kernel/syscalls/syscall.tbl    | 1 +
 arch/s390/kernel/syscalls/syscall.tbl       | 1 +
 arch/sh/kernel/syscalls/syscall.tbl         | 1 +
 arch/sparc/kernel/syscalls/syscall.tbl      | 1 +
 arch/x86/entry/syscalls/syscall_32.tbl      | 1 +
 arch/x86/entry/syscalls/syscall_64.tbl      | 1 +
 arch/xtensa/kernel/syscalls/syscall.tbl     | 1 +
 include/uapi/asm-generic/unistd.h           | 2 ++
 18 files changed, 20 insertions(+)

accumulated error probability: 0.12
culprit signature: e6f0ace4d42eb8061c3fe0560b0f97fa3f341a4dd9271c5fec186d023fdd34bb
parent  signature: e957267ecdb7f2c385a73f2e01247b441aabde680942065eee0fd61ab633172a
reproducer is flaky (0.18 repro chance estimate)
revisions tested: 37, total time: 11h44m45.882029862s (build: 3h39m57.001777907s, test: 7h47m4.57812591s)
first bad commit: 9b4feb630e8e9801603f3cab3a36369e3c1cf88d arch: wire-up close_range()
recipients (to): ["arnd@arndb.de" "christian.brauner@ubuntu.com" "mpe@ellerman.id.au" "oleg@redhat.com"]
recipients (cc): []
crash: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
==================================================================
BUG: KASAN: use-after-free in instrument_atomic_write include/linux/instrumented.h:71 [inline]
BUG: KASAN: use-after-free in atomic_inc include/asm-generic/atomic-instrumented.h:240 [inline]
BUG: KASAN: use-after-free in usb_anchor_suspend_wakeups drivers/usb/core/urb.c:891 [inline]
BUG: KASAN: use-after-free in usb_anchor_suspend_wakeups+0x1a/0x30 drivers/usb/core/urb.c:888
Write of size 4 at addr ffff8881e3923110 by task swapper/0/0

CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.8.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x7c/0xb0 lib/dump_stack.c:118
 print_address_description.constprop.8.cold.10+0x9/0x455 mm/kasan/report.c:383
 __kasan_report mm/kasan/report.c:513 [inline]
 kasan_report.cold.11+0x1f/0x37 mm/kasan/report.c:530
 check_memory_region_inline mm/kasan/generic.c:186 [inline]
 check_memory_region+0x1c1/0x1e0 mm/kasan/generic.c:192
 instrument_atomic_write include/linux/instrumented.h:71 [inline]
 atomic_inc include/asm-generic/atomic-instrumented.h:240 [inline]
 usb_anchor_suspend_wakeups drivers/usb/core/urb.c:891 [inline]
 usb_anchor_suspend_wakeups+0x1a/0x30 drivers/usb/core/urb.c:888
 __usb_hcd_giveback_urb+0x14e/0x3e0 drivers/usb/core/hcd.c:1642
 dummy_timer+0xfe6/0x2c1c drivers/usb/gadget/udc/dummy_hcd.c:1967
 call_timer_fn+0x165/0x400 kernel/time/timer.c:1404
 expire_timers kernel/time/timer.c:1449 [inline]
 __run_timers kernel/time/timer.c:1773 [inline]
 __run_timers kernel/time/timer.c:1740 [inline]
 run_timer_softirq+0x555/0xf90 kernel/time/timer.c:1786
 __do_softirq+0x19b/0x625 kernel/softirq.c:292
 asm_call_on_stack+0xf/0x20 arch/x86/entry/entry_64.S:711
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:22 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:48 [inline]
 do_softirq_own_stack+0x34/0x40 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:387 [inline]
 __irq_exit_rcu kernel/softirq.c:417 [inline]
 irq_exit_rcu+0x110/0x130 kernel/softirq.c:429
 sysvec_apic_timer_interrupt+0x52/0xb0 arch/x86/kernel/apic/apic.c:1091
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:596
RIP: 0010:native_irq_disable arch/x86/include/asm/irqflags.h:49 [inline]
RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:89 [inline]
RIP: 0010:acpi_safe_halt drivers/acpi/processor_idle.c:112 [inline]
RIP: 0010:acpi_safe_halt+0x43/0x50 drivers/acpi/processor_idle.c:108
Code: da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 75 18 48 8b 03 a8 08 75 0f e9 07 00 00 00 0f 00 2d 2f 43 84 00 fb f4 <fa> 5b c3 48 89 df e8 12 c4 7b fd eb de 48 b8 00 00 00 00 00 fc ff
RSP: 0018:ffffffff85207c78 EFLAGS: 00000246
RAX: 0000000000004000 RBX: ffffffff8522fd40 RCX: ffffffff84017567
RDX: 1ffffffff0a45fa8 RSI: 0000000000000008 RDI: ffffffff8522fd40
RBP: ffff8881f0ffa064 R08: fffffbfff0a45fa9 R09: fffffbfff0a45fa9
R10: ffffffff8522fd47 R11: fffffbfff0a45fa8 R12: 1ffffffff0a40f95
R13: ffff8881f0ffa270 R14: 0000000000000001 R15: 0000000000000001
 acpi_idle_enter+0x3b5/0xb50 drivers/acpi/processor_idle.c:651
 cpuidle_enter_state+0xac/0x9e0 drivers/cpuidle/cpuidle.c:234
 cpuidle_enter+0x45/0xa0 drivers/cpuidle/cpuidle.c:345
 cpuidle_idle_call kernel/sched/idle.c:207 [inline]
 do_idle+0x31f/0x390 kernel/sched/idle.c:269
 cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:365
 start_kernel+0x517/0x558 init/main.c:1043
 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243

Allocated by task 4153:
 save_stack+0x19/0x40 mm/kasan/common.c:48
 set_track mm/kasan/common.c:56 [inline]
 __kasan_kmalloc mm/kasan/common.c:494 [inline]
 __kasan_kmalloc.constprop.16+0xc1/0xd0 mm/kasan/common.c:467
 kmalloc include/linux/slab.h:555 [inline]
 kzalloc include/linux/slab.h:669 [inline]
 usbtmc_open+0x9c/0x930 drivers/usb/class/usbtmc.c:175
 usb_open+0x1b3/0x240 drivers/usb/core/file.c:48
 chrdev_open+0x1d8/0x4e0 fs/char_dev.c:414
 do_dentry_open+0x439/0xf70 fs/open.c:828
 do_open fs/namei.c:3243 [inline]
 path_openat+0x1712/0x21b0 fs/namei.c:3360
 do_filp_open+0x171/0x240 fs/namei.c:3387
 do_sys_openat2+0x2db/0x500 fs/open.c:1179
 do_sys_open+0x85/0xd0 fs/open.c:1195
 do_syscall_64+0x41/0x80 arch/x86/entry/common.c:359
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Freed by task 4153:
 save_stack+0x19/0x40 mm/kasan/common.c:48
 set_track mm/kasan/common.c:56 [inline]
 kasan_set_free_info mm/kasan/common.c:316 [inline]
 __kasan_slab_free+0x124/0x170 mm/kasan/common.c:455
 slab_free_hook mm/slub.c:1474 [inline]
 slab_free_freelist_hook mm/slub.c:1507 [inline]
 slab_free mm/slub.c:3072 [inline]
 kfree+0xd3/0x2e0 mm/slub.c:4063
 usbtmc_release+0x22f/0x300 drivers/usb/class/usbtmc.c:261
 __fput+0x206/0x6a0 fs/file_table.c:281
 task_work_run+0xba/0x140 kernel/task_work.c:123
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_usermode_loop arch/x86/entry/common.c:216 [inline]
 __prepare_exit_to_usermode+0x14a/0x150 arch/x86/entry/common.c:246
 do_syscall_64+0x4d/0x80 arch/x86/entry/common.c:368
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

The buggy address belongs to the object at ffff8881e3923000
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 272 bytes inside of
 1024-byte region [ffff8881e3923000, ffff8881e3923400)
The buggy address belongs to the page:
page:ffffea00078e4800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 head:ffffea00078e4800 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x200000000010200(slab|head)
raw: 0200000000010200 ffffea0007895400 0000000400000003 ffff8881f6002280
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL)
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook mm/page_alloc.c:2218 [inline]
 prep_new_page+0x21e/0x320 mm/page_alloc.c:2224
 get_page_from_freelist+0x111d/0x4f00 mm/page_alloc.c:3794
 __alloc_pages_nodemask+0x278/0x710 mm/page_alloc.c:4844
 alloc_pages include/linux/gfp.h:545 [inline]
 alloc_slab_page+0x2cf/0x4e0 mm/slub.c:1545
 allocate_slab mm/slub.c:1690 [inline]
 new_slab+0x81/0x3d0 mm/slub.c:1756
 new_slab_objects mm/slub.c:2513 [inline]
 ___slab_alloc+0x58b/0x860 mm/slub.c:2674
 __slab_alloc+0x9/0x10 mm/slub.c:2714
 slab_alloc_node mm/slub.c:2788 [inline]
 __kmalloc_node_track_caller+0xc5/0x340 mm/slub.c:4472
 __kmalloc_reserve.isra.57+0x29/0xa0 net/core/skbuff.c:142
 __alloc_skb+0xbd/0x510 net/core/skbuff.c:210
 alloc_skb include/linux/skbuff.h:1083 [inline]
 nlmsg_new include/net/netlink.h:940 [inline]
 inet6_rt_notify+0xd2/0x260 net/ipv6/route.c:6009
 fib6_del_route net/ipv6/ip6_fib.c:1987 [inline]
 fib6_del+0x798/0xf20 net/ipv6/ip6_fib.c:2017
 fib6_clean_node+0x29d/0x420 net/ipv6/ip6_fib.c:2179
 fib6_walk_continue+0x217/0x3e0 net/ipv6/ip6_fib.c:2101
 fib6_walk+0x8b/0xd0 net/ipv6/ip6_fib.c:2149
 fib6_clean_tree+0x9d/0xd0 net/ipv6/ip6_fib.c:2229
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1213 [inline]
 __free_pages_ok+0x617/0xcb0 mm/page_alloc.c:1470
 unfreeze_partials.isra.75+0x267/0x2d0 mm/slub.c:2294
 put_cpu_partial+0x87/0xd0 mm/slub.c:2330
 qlink_free mm/kasan/quarantine.c:148 [inline]
 qlist_free_all+0x47/0xb0 mm/kasan/quarantine.c:167
 quarantine_reduce+0x136/0x170 mm/kasan/quarantine.c:260
 __kasan_kmalloc.constprop.16+0x98/0xd0 mm/kasan/common.c:475
 slab_post_alloc_hook mm/slab.h:586 [inline]
 slab_alloc_node mm/slub.c:2824 [inline]
 slab_alloc mm/slub.c:2832 [inline]
 kmem_cache_alloc+0xc9/0x230 mm/slub.c:2837
 getname_flags fs/namei.c:138 [inline]
 getname_flags+0xb5/0x510 fs/namei.c:128
 getname fs/namei.c:209 [inline]
 do_renameat2+0x142/0x940 fs/namei.c:4368
 __do_sys_rename fs/namei.c:4496 [inline]
 __se_sys_rename fs/namei.c:4494 [inline]
 __x64_sys_rename+0x55/0x80 fs/namei.c:4494
 do_syscall_64+0x41/0x80 arch/x86/entry/common.c:359
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Memory state around the buggy address:
 ffff8881e3923000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881e3923080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8881e3923100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                         ^
 ffff8881e3923180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881e3923200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
   7:	fc ff df
   a:	48 c1 ea 03          	shr    $0x3,%rdx
   e:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
  12:	75 18                	jne    0x2c
  14:	48 8b 03             	mov    (%rbx),%rax
  17:	a8 08                	test   $0x8,%al
  19:	75 0f                	jne    0x2a
  1b:	e9 07 00 00 00       	jmp    0x27
  20:	0f 00 2d 2f 43 84 00 	verw   0x84432f(%rip)        # 0x844356
  27:	fb                   	sti
  28:	f4                   	hlt
* 29:	fa                   	cli <-- trapping instruction
  2a:	5b                   	pop    %rbx
  2b:	c3                   	ret
  2c:	48 89 df             	mov    %rbx,%rdi
  2f:	e8 12 c4 7b fd       	call   0xfd7bc446
  34:	eb de                	jmp    0x14
  36:	48                   	rex.W
  37:	b8 00 00 00 00       	mov    $0x0,%eax
  3c:	00 fc                	add    %bh,%ah
  3e:	ff                   	.byte 0xff