bisecting cause commit starting from 5287773dba0d5228c9714827b7ba9153b863e2b3 building syzkaller on e2d91b1d0dd8c8b4760986ec8114469246022bb8 testing commit 5287773dba0d5228c9714827b7ba9153b863e2b3 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 68d61dbfb49541c95827be63ca0fb26df6121bdb460eb981437de9d160334d3f run #0: crashed: BUG: stack guard page was hit in corrupted run #1: crashed: BUG: stack guard page was hit in corrupted run #2: crashed: BUG: stack guard page was hit in corrupted run #3: crashed: BUG: stack guard page was hit in corrupted run #4: crashed: BUG: stack guard page was hit in corrupted run #5: crashed: BUG: stack guard page was hit in corrupted run #6: crashed: BUG: stack guard page was hit in sys_lchown run #7: crashed: BUG: stack guard page was hit in corrupted run #8: crashed: BUG: stack guard page was hit in corrupted run #9: crashed: BUG: stack guard page was hit in corrupted run #10: crashed: BUG: stack guard page was hit in corrupted run #11: crashed: BUG: stack guard page was hit in sys_lchown run #12: crashed: BUG: stack guard page was hit in corrupted run #13: crashed: BUG: stack guard page was hit in corrupted run #14: crashed: BUG: stack guard page was hit in corrupted run #15: crashed: BUG: stack guard page was hit in corrupted run #16: crashed: BUG: stack guard page was hit in corrupted run #17: crashed: BUG: stack guard page was hit in corrupted run #18: crashed: BUG: stack guard page was hit in corrupted run #19: crashed: BUG: stack guard page was hit in corrupted testing release v5.10.106 testing commit 327f1e7d813c77eceadafbdc498f5eb680fd9fb2 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 021a100fec15c048dee9c0c1b89a0db3ff5703e16f0066f540c9a0b5b188f4a8 all runs: OK # git bisect start 5287773dba0d5228c9714827b7ba9153b863e2b3 327f1e7d813c77eceadafbdc498f5eb680fd9fb2 Bisecting: 2820 revisions left to test after this (roughly 12 steps) [9346eaec14ab233535b3025ebcd6c78e96aa65e4] FROMGIT: kasan: add a test for kmem_cache_alloc/free_bulk testing commit 9346eaec14ab233535b3025ebcd6c78e96aa65e4 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 9e89151e0776fdcd828d132139cefff63a87149d1ed2f4360922b58639e5c494 all runs: basic kernel testing failed: KASAN: use-after-free Read in task_active_pid_ns # git bisect skip 9346eaec14ab233535b3025ebcd6c78e96aa65e4 Bisecting: 2818 revisions left to test after this (roughly 12 steps) [13aefe4bf83adbb2e00d7c716541ad51dcb1200d] BACKPORT: kasan: remove redundant config option testing commit 13aefe4bf83adbb2e00d7c716541ad51dcb1200d compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: a9fcad46787dfedbefb443f500a0f709a390086ead164ceecd322732eb9d131e all runs: basic kernel testing failed: KASAN: use-after-free Read in task_active_pid_ns # git bisect skip 13aefe4bf83adbb2e00d7c716541ad51dcb1200d Bisecting: 2818 revisions left to test after this (roughly 12 steps) [5cf9a844f6f9ca929b6a513345db4ac521da68f9] ANDROID: dts: hi3660-hikey960: Add usb mux hub for hikey960 testing commit 5cf9a844f6f9ca929b6a513345db4ac521da68f9 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 00371f819d9aca5781513930d6de6466666643f0d015849a52589f9394cbda70 all runs: basic kernel testing failed: KASAN: use-after-free Read in task_active_pid_ns # git bisect skip 5cf9a844f6f9ca929b6a513345db4ac521da68f9 Bisecting: 2818 revisions left to test after this (roughly 12 steps) [852e4c4f82715aee7829b3958ae44172e69c1662] ANDROID: Revert "drm/virtio: Call the right shmem helpers" testing commit 852e4c4f82715aee7829b3958ae44172e69c1662 compiler: gcc (GCC) 8.4.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: d252ec605ef2f80ddd2dc95932639fb1318f15475b45eaff102bce40de80095c all runs: basic kernel testing failed: KASAN: use-after-free Read in task_active_pid_ns # git bisect skip 852e4c4f82715aee7829b3958ae44172e69c1662 Bisecting: 2818 revisions left to test after this (roughly 12 steps) [5ea1ff037ee9a0dfacd8a5424cf146cddc9bc596] FROMGIT: arm64: cpufeatures: Allow disabling of Pointer Auth from the command-line testing commit 5ea1ff037ee9a0dfacd8a5424cf146cddc9bc596 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 mm/memory.c:4800:10: error: assignment of member 'vma' in read-only object mm/memory.c:4942:12: error: assignment of member 'pgoff' in read-only object mm/memory.c:4943:15: error: assignment of member 'gfp_mask' in read-only object # git bisect skip 5ea1ff037ee9a0dfacd8a5424cf146cddc9bc596 Bisecting: 2818 revisions left to test after this (roughly 12 steps) [900900ef8988b195e8c1d7c8296ae3c7dce5e3c5] ANDROID: Incremental fs: Remove attributes from file testing commit 900900ef8988b195e8c1d7c8296ae3c7dce5e3c5 compiler: gcc (GCC) 8.4.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: e6bcf9d2630f042c5ad9caee9397f940c558328239b88eadc080df24a857def6 all runs: basic kernel testing failed: KASAN: use-after-free Read in task_active_pid_ns # git bisect skip 900900ef8988b195e8c1d7c8296ae3c7dce5e3c5 Bisecting: 2818 revisions left to test after this (roughly 12 steps) [5fe4f2978dca799e7dc41c6273e1a992f8f1f984] UPSTREAM: soc: meson: enable building drivers as modules testing commit 5fe4f2978dca799e7dc41c6273e1a992f8f1f984 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 mm/memory.c:4800:10: error: assignment of member 'vma' in read-only object mm/memory.c:4942:12: error: assignment of member 'pgoff' in read-only object mm/memory.c:4943:15: error: assignment of member 'gfp_mask' in read-only object # git bisect skip 5fe4f2978dca799e7dc41c6273e1a992f8f1f984 Bisecting: 2818 revisions left to test after this (roughly 12 steps) [3a11b451ab1975b305aa704bc2b31ff217a729bf] Revert "ANDROID: include: uapi: drm: add additional QCOM modifiers" testing commit 3a11b451ab1975b305aa704bc2b31ff217a729bf compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 8e249f512e190423f43fc272386e25c0dac4606b70221a1c46f5832d70d3b168 all runs: basic kernel testing failed: KASAN: use-after-free Read in task_active_pid_ns # git bisect skip 3a11b451ab1975b305aa704bc2b31ff217a729bf Bisecting: 2818 revisions left to test after this (roughly 12 steps) [b3aad324675d1d4c02cdd096e57e212825869799] ANDROID: gki_defconfig: enable CONFIG_KASAN_HW_TAGS testing commit b3aad324675d1d4c02cdd096e57e212825869799 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 966fa7c2e93690457f210d1cd563734586342dd21d304d3780afeb4c7cc8cbff all runs: basic kernel testing failed: KASAN: use-after-free Read in task_active_pid_ns # git bisect skip b3aad324675d1d4c02cdd096e57e212825869799 Bisecting: 2818 revisions left to test after this (roughly 12 steps) [67668f721bbc07989519795db4ad0b8bfe62da59] ANDROID: mm: page_pinner: use put_user_page at dump_user_range testing commit 67668f721bbc07989519795db4ad0b8bfe62da59 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: f32a82ccaf1f4ddfa4e6c10bb8dac06c8175a2ff503617c937e80d29bc36d101 all runs: basic kernel testing failed: KASAN: use-after-free Read in task_active_pid_ns # git bisect skip 67668f721bbc07989519795db4ad0b8bfe62da59 Bisecting: 2818 revisions left to test after this (roughly 12 steps) [25b284fcf26eb1b7cf9ec1d0ebe46cb5dbb40477] Revert "FROMLIST: dt-bindings: reserved-memory: Make DMA-BUF CMA heap DT-configurable" testing commit 25b284fcf26eb1b7cf9ec1d0ebe46cb5dbb40477 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 674dfa89ef7fb0d7eb5cb47d4595937fa1cadf00aab591226b000d2dcf708e3e all runs: basic kernel testing failed: KASAN: use-after-free Read in task_active_pid_ns # git bisect skip 25b284fcf26eb1b7cf9ec1d0ebe46cb5dbb40477 Bisecting: 2818 revisions left to test after this (roughly 12 steps) [7a2a316228bcd80821a15fed6cd70c80a5daa182] ANDROID: sched: gki: add padding to some structs to support WALT testing commit 7a2a316228bcd80821a15fed6cd70c80a5daa182 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 2b2d328b6042c29565383f457b2911b438507434228ce834e26552b0a679097a all runs: basic kernel testing failed: KASAN: use-after-free Read in task_active_pid_ns # git bisect skip 7a2a316228bcd80821a15fed6cd70c80a5daa182 Bisecting: 2818 revisions left to test after this (roughly 12 steps) [bdf2f9bb6a9450ad797ffe1eb547ce25dc4dbb36] FROMGIT: kasan: don't run tests when KASAN is not enabled testing commit bdf2f9bb6a9450ad797ffe1eb547ce25dc4dbb36 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: eb149dbb4bee318e6cf5827e25682774fc036f4cfa4930b572f40b5a1657ecb3 all runs: basic kernel testing failed: KASAN: use-after-free Read in task_active_pid_ns # git bisect skip bdf2f9bb6a9450ad797ffe1eb547ce25dc4dbb36 Bisecting: 2818 revisions left to test after this (roughly 12 steps) [34eebce472a6088386eb10f0d645cadd888e604c] Merge 3d5e28bff7ad ("Merge branch 'stable/for-linus-5.10-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/swiotlb") into android-mainline testing commit 34eebce472a6088386eb10f0d645cadd888e604c compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: efab8dadb9f3b52c6dadf99479c9f6ad32a6154355dcceb9520ec06dae8086d9 all runs: basic kernel testing failed: KASAN: use-after-free Read in task_active_pid_ns # git bisect skip 34eebce472a6088386eb10f0d645cadd888e604c Bisecting: 2818 revisions left to test after this (roughly 12 steps) [c6672561bc64854cdb87f2518f62b5c0c7bdf7d4] UPSTREAM: net: add and use skb_unclone_keeptruesize() helper testing commit c6672561bc64854cdb87f2518f62b5c0c7bdf7d4 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 0bab7ef284f1695844ab959cb265ad7d6ee4d7dea93bb36a614bd7acd10326b6 all runs: OK # git bisect good c6672561bc64854cdb87f2518f62b5c0c7bdf7d4 Bisecting: 32 revisions left to test after this (roughly 5 steps) [add227a8d80c6e523ad3b43aac4b586b510bd1eb] Merge branch 'android12-5.10' into `android12-5.10-lts` testing commit add227a8d80c6e523ad3b43aac4b586b510bd1eb compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: a7c9fe09dbed63d125c58a8139e3cf6f6dff3339828b837b2c7170e758c808f7 all runs: OK # git bisect good add227a8d80c6e523ad3b43aac4b586b510bd1eb Bisecting: 15 revisions left to test after this (roughly 4 steps) [74562af5949e9555bf7b32d72d8ee72d85e2acbf] UPSTREAM: ARM: Spectre-BHB: provide empty stub for non-config testing commit 74562af5949e9555bf7b32d72d8ee72d85e2acbf compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 0246b9f2ad8991949ff6e1f306d9e3a5c439cd1a8f7dd35e6000e81d7510faca run #0: crashed: BUG: stack guard page was hit in sys_lchown run #1: crashed: BUG: stack guard page was hit in corrupted run #2: crashed: BUG: stack guard page was hit in corrupted run #3: crashed: BUG: stack guard page was hit in corrupted run #4: crashed: BUG: stack guard page was hit in corrupted run #5: crashed: BUG: stack guard page was hit in corrupted run #6: crashed: BUG: stack guard page was hit in corrupted run #7: crashed: BUG: stack guard page was hit in corrupted run #8: crashed: BUG: stack guard page was hit in corrupted run #9: crashed: BUG: stack guard page was hit in corrupted # git bisect bad 74562af5949e9555bf7b32d72d8ee72d85e2acbf Bisecting: 7 revisions left to test after this (roughly 3 steps) [56d625a4ce5428dd2b7e0f215618c5f8050cf5ed] ANDROID: fix up rndis ABI breakage testing commit 56d625a4ce5428dd2b7e0f215618c5f8050cf5ed compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 56bf667808a559a7ff3d8a83ad525f13a8f64d49a4981316cc30d31d6b7dd07f run #0: crashed: BUG: stack guard page was hit in corrupted run #1: crashed: BUG: stack guard page was hit in corrupted run #2: crashed: BUG: stack guard page was hit in corrupted run #3: crashed: BUG: stack guard page was hit in corrupted run #4: crashed: BUG: stack guard page was hit in corrupted run #5: crashed: BUG: stack guard page was hit in sys_lchown run #6: crashed: BUG: stack guard page was hit in corrupted run #7: crashed: BUG: stack guard page was hit in corrupted run #8: crashed: BUG: stack guard page was hit in corrupted run #9: crashed: BUG: stack guard page was hit in sys_lchown # git bisect bad 56d625a4ce5428dd2b7e0f215618c5f8050cf5ed Bisecting: 4 revisions left to test after this (roughly 2 steps) [b9b8fd203dba3f17f85a0f7ea3b6bf490e6e53f5] UPSTREAM: lib/iov_iter: initialize "flags" in new pipe_buffer testing commit b9b8fd203dba3f17f85a0f7ea3b6bf490e6e53f5 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 39ee0978b6f595cb59ed926dcff147271075172001bdffb89983a06aa254061a run #0: crashed: BUG: stack guard page was hit in corrupted run #1: crashed: BUG: stack guard page was hit in corrupted run #2: crashed: BUG: stack guard page was hit in corrupted run #3: crashed: BUG: stack guard page was hit in corrupted run #4: crashed: BUG: stack guard page was hit in corrupted run #5: crashed: BUG: stack guard page was hit in sys_lchown run #6: crashed: BUG: stack guard page was hit in corrupted run #7: crashed: BUG: stack guard page was hit in corrupted run #8: crashed: BUG: stack guard page was hit in corrupted run #9: crashed: BUG: stack guard page was hit in sys_lchown # git bisect bad b9b8fd203dba3f17f85a0f7ea3b6bf490e6e53f5 Bisecting: 1 revision left to test after this (roughly 1 step) [07630c80731a93d066b6365b53a033841baebd54] Revert "ANDROID: incremental-fs: fix mount_fs issue" testing commit 07630c80731a93d066b6365b53a033841baebd54 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 3af6ee77b6448106be3da3f5860524a61234d284c61c5aa60f0bd9f5c14d7c30 run #0: crashed: BUG: stack guard page was hit in corrupted run #1: crashed: BUG: stack guard page was hit in corrupted run #2: crashed: BUG: stack guard page was hit in sys_lchown run #3: crashed: BUG: stack guard page was hit in corrupted run #4: crashed: BUG: stack guard page was hit in corrupted run #5: crashed: BUG: stack guard page was hit in corrupted run #6: crashed: BUG: stack guard page was hit in corrupted run #7: crashed: BUG: stack guard page was hit in corrupted run #8: crashed: BUG: stack guard page was hit in sys_lchown run #9: crashed: BUG: stack guard page was hit in corrupted # git bisect bad 07630c80731a93d066b6365b53a033841baebd54 Bisecting: 0 revisions left to test after this (roughly 0 steps) [e4d293dc33b5fa97b7965447fe6c3f6796af01c9] Revert "ANDROID: vendor_hooks: Add hooks for binder proc transaction" testing commit e4d293dc33b5fa97b7965447fe6c3f6796af01c9 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: cf348fe618040f0025621cf660c5c0059ebf6206cb8743ad0c6ffcb1d4a75832 all runs: OK # git bisect good e4d293dc33b5fa97b7965447fe6c3f6796af01c9 07630c80731a93d066b6365b53a033841baebd54 is the first bad commit commit 07630c80731a93d066b6365b53a033841baebd54 Author: Paul Lawrence Date: Fri Feb 4 15:20:46 2022 +0000 Revert "ANDROID: incremental-fs: fix mount_fs issue" This reverts commit 93717b608dd30f9d41b15a72e809238807c68026. Test: Can now install the same apk twice, and repeated installs are stable Bug: 217661925 Signed-off-by: Paul Lawrence Change-Id: I86871c364c17a0d1107b3891a574b72edcf04ea2 (cherry picked from commit d107cd06f26b4d45b1079c7eb857815905198076) Signed-off-by: Steve Muckle fs/incfs/vfs.c | 58 +++++++++++++++------------------------------------------- fs/incfs/vfs.h | 1 + 2 files changed, 16 insertions(+), 43 deletions(-) culprit signature: 3af6ee77b6448106be3da3f5860524a61234d284c61c5aa60f0bd9f5c14d7c30 parent signature: cf348fe618040f0025621cf660c5c0059ebf6206cb8743ad0c6ffcb1d4a75832 revisions tested: 21, total time: 3h4m35.750168795s (build: 2h10m26.964521996s, test: 50m13.989924228s) first bad commit: 07630c80731a93d066b6365b53a033841baebd54 Revert "ANDROID: incremental-fs: fix mount_fs issue" recipients (to): ["linux-kernel@vger.kernel.org" "paullawrence@google.com" "smuckle@google.com"] recipients (cc): [] crash: BUG: stack guard page was hit in corrupted BUG: stack guard page was hit at ffffc9000085ffa8 (stack is ffffc90000860000..ffffc90000867fff) kernel stack overflow (double-fault): 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 406 Comm: syz-executor235 Not tainted 5.10.81-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:stack_trace_save+0x1f/0xc0 kernel/stacktrace.c:113 Code: 66 66 2e 0f 1f 84 00 00 00 00 00 48 b8 00 00 00 00 00 fc ff df 55 83 c2 01 31 c9 48 89 e5 53 48 8d 9d 78 ff ff ff 48 83 c4 80 <48> c7 85 78 ff ff ff b3 8a b5 41 48 c1 eb 03 48 c7 45 80 e6 6f 29 RSP: 0018:ffffc9000085ffb8 EFLAGS: 00010287 RAX: dffffc0000000000 RBX: ffffc9000085ffb8 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000040 RDI: ffffc90000860050 RBP: ffffc90000860040 R08: ffff888120007660 R09: ffffed1024000ecc R10: fffff5200010c095 R11: 0000000000000079 R12: 0000000000000cc0 R13: ffff88810017d080 R14: 0000000000000cc0 R15: 0000000000000001 FS: 0000555555b71300(0000) GS:ffff8881f7200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000085ffa8 CR3: 000000011f425000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: Modules linked in: ---[ end trace 4cf84a829174a972 ]--- RIP: 0010:stack_trace_save+0x1f/0xc0 kernel/stacktrace.c:113 Code: 66 66 2e 0f 1f 84 00 00 00 00 00 48 b8 00 00 00 00 00 fc ff df 55 83 c2 01 31 c9 48 89 e5 53 48 8d 9d 78 ff ff ff 48 83 c4 80 <48> c7 85 78 ff ff ff b3 8a b5 41 48 c1 eb 03 48 c7 45 80 e6 6f 29 RSP: 0018:ffffc9000085ffb8 EFLAGS: 00010287 RAX: dffffc0000000000 RBX: ffffc9000085ffb8 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000040 RDI: ffffc90000860050 RBP: ffffc90000860040 R08: ffff888120007660 R09: ffffed1024000ecc R10: fffff5200010c095 R11: 0000000000000079 R12: 0000000000000cc0 R13: ffff88810017d080 R14: 0000000000000cc0 R15: 0000000000000001 FS: 0000555555b71300(0000) GS:ffff8881f7200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000085ffa8 CR3: 000000011f425000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 66 66 2e 0f 1f 84 00 data16 nopw %cs:0x0(%rax,%rax,1) 7: 00 00 00 00 b: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 12: fc ff df 15: 55 push %rbp 16: 83 c2 01 add $0x1,%edx 19: 31 c9 xor %ecx,%ecx 1b: 48 89 e5 mov %rsp,%rbp 1e: 53 push %rbx 1f: 48 8d 9d 78 ff ff ff lea -0x88(%rbp),%rbx 26: 48 83 c4 80 add $0xffffffffffffff80,%rsp * 2a: 48 c7 85 78 ff ff ff movq $0x41b58ab3,-0x88(%rbp) <-- trapping instruction 31: b3 8a b5 41 35: 48 c1 eb 03 shr $0x3,%rbx 39: 48 rex.W 3a: c7 .byte 0xc7 3b: 45 80 e6 6f rex.RB and $0x6f,%r14b 3f: 29 .byte 0x29