ci2 starts bisection 2026-09-08 09:22:18.809408297 +0000 UTC m=+78577.447022571 bisecting fixing commit since e4f7d8be268ecf717f94ee2e242afa79ddeacaed building syzkaller on 5d63f80b763910b40ae04a96c13dc75d621bea67 ensuring issue is reproducible on original commit e4f7d8be268ecf717f94ee2e242afa79ddeacaed testing commit e4f7d8be268ecf717f94ee2e242afa79ddeacaed gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 91196fb8e2409ef726a949034e55131983713f7424c725a5ff7131edfa0dfe40 run #0: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #1: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #2: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #3: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #4: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #5: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #6: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #7: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #8: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #9: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #10: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #11: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #12: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #13: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #14: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #15: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #16: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #17: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #18: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #19: crashed: WARNING in nvmet_fc_alloc_ls_iodlist representative crash: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist, types: [KASAN-INVALID-FREE WARNING] check whether we can drop unnecessary instrumentation disabling configs for [ubsan locking atomic_sleep hang memleak], they are not needed testing commit e4f7d8be268ecf717f94ee2e242afa79ddeacaed gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: d9348d66c4d5ad1105437e5adc64ecbd889c9e2445238fcb505a5c89608c1de6 run #0: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #1: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #2: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #3: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #4: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #5: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #6: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #7: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #8: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #9: OK representative crash: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist, types: [KASAN-INVALID-FREE] the bug reproduces without the instrumentation disabling configs for [ubsan locking atomic_sleep hang memleak], they are not needed kconfig minimization: base=7505 full=9788 leaves diff=2010 split chunks (needed=false): <2010> split chunk #0 of len 2010 into 5 parts testing without sub-chunk 1/5 disabling configs for [locking atomic_sleep hang memleak ubsan], they are not needed testing commit e4f7d8be268ecf717f94ee2e242afa79ddeacaed gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 14eec133dd4d779d3a5fadd198adfb4e6679465d6e842c2d4b0cf410a01c9e66 run #0: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #1: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #2: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #3: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #4: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #5: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #6: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #7: OK run #8: OK run #9: OK representative crash: WARNING in nvmet_fc_alloc_ls_iodlist, types: [WARNING KASAN-INVALID-FREE] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [locking atomic_sleep hang memleak ubsan], they are not needed testing commit e4f7d8be268ecf717f94ee2e242afa79ddeacaed gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: be289f4e150edc49cc91bc640432fa5b84bc77de09616067e502c796617526a3 run #0: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #1: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #2: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #3: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #4: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #5: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #6: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #7: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #8: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #9: crashed: WARNING in nvmet_fc_alloc_ls_iodlist representative crash: WARNING in nvmet_fc_alloc_ls_iodlist, types: [WARNING KASAN-INVALID-FREE] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [locking atomic_sleep hang memleak ubsan], they are not needed testing commit e4f7d8be268ecf717f94ee2e242afa79ddeacaed gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: f5c31989d22255f64e05c3474d1c8edacf3fff40014691ef210eae04787e20c8 all runs: OK false negative chance: 0.000 testing without sub-chunk 4/5 disabling configs for [ubsan locking atomic_sleep hang memleak], they are not needed testing commit e4f7d8be268ecf717f94ee2e242afa79ddeacaed gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 0ee1cea19f170d9d6590cb8330392203941f44a93bc3288c795a0a9b1834a908 run #0: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #1: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #2: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #3: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #4: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #5: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #6: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #7: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #8: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #9: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist representative crash: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist, types: [KASAN-INVALID-FREE WARNING] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [memleak ubsan locking atomic_sleep hang], they are not needed testing commit e4f7d8be268ecf717f94ee2e242afa79ddeacaed gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: f0e1b2ab06a7d52fb2016b91ca35d95464b19642b1cca9a9cf448a0667494322 run #0: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #1: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #2: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #3: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #4: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #5: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #6: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #7: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #8: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #9: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist representative crash: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist, types: [KASAN-INVALID-FREE WARNING] the chunk can be dropped minimized to 402 configs; suspects: [AX25 CFG80211 DRM DRM_NOUVEAU FSCACHE HAMRADIO HID_NINTENDO HSR INFINIBAND INFINIBAND_ADDR_TRANS INFINIBAND_USER_ACCESS INPUT_JOYSTICK INPUT_MOUSE IP6_NF_RAW IPV6_MULTIPLE_TABLES IP_ADVANCED_ROUTER IP_MULTIPLE_TABLES IP_NF_RAW IP_SET ISDN ISO9660_FS JFFS2_FS JFFS2_LZO JFFS2_RTIME JFFS2_RUBIN JFFS2_SUMMARY JFFS2_ZLIB JFS_DEBUG JFS_FS JFS_POSIX_ACL JFS_SECURITY JOLIET JOYSTICK_IFORCE JOYSTICK_IFORCE_USB JOYSTICK_PXRC JOYSTICK_XPAD JOYSTICK_XPAD_FF JOYSTICK_XPAD_LEDS KARMA_PARTITION KCOV KCOV_ENABLE_COMPARISONS KCOV_INSTRUMENT_ALL KEYS_REQUEST_CACHE KEY_DH_OPERATIONS KEY_NOTIFICATIONS L2TP L2TP_ETH L2TP_IP L2TP_V3 LAPB LAPBETHER LDM_PARTITION LEDS_TRIGGER_AUDIO LLC2 LOGIG940_FF LOGIRUMBLEPAD2_FF LOGITECH_FF LOGIWHEELS_FF LOGO_LINUX_MONO LOGO_LINUX_VGA16 LPC_ICH LWTUNNEL LWTUNNEL_BPF LZ4HC_COMPRESS LZ4_COMPRESS MAC80211 MAC80211_DEBUGFS MAC80211_HAS_RC MAC80211_HWSIM MAC80211_MESH MAC80211_RC_DEFAULT_MINSTREL MAC80211_RC_MINSTREL MACSEC MAC_PARTITION MDIO_MVUSB MD_LINEAR MD_MULTIPATH MD_RAID0 MD_RAID1 MD_RAID10 MD_RAID456 MEDIA_CONTROLLER_DVB MEDIA_RADIO_SUPPORT MEDIA_TUNER_MSI001 MEMORY_HOTPLUG_DEFAULT_ONLINE MEMSTICK MEMSTICK_REALTEK_USB MHI_WWAN_CTRL MINIX_FS MINIX_SUBPARTITION MISC_RTSX MISC_RTSX_USB MISDN MISDN_DSP MISDN_HFCUSB MISDN_L1OIP MKISS MLX4_INFINIBAND MMC_REALTEK_USB MMC_USHC MMC_VUB300 MODULE_FORCE_UNLOAD MODULE_SRCVERSION_ALL MODVERSIONS MOST MOST_USB_HDM MOUSE_APPLETOUCH MOUSE_BCM5974 MOUSE_PS2 MOUSE_PS2_ALPS MOUSE_PS2_BYD MOUSE_PS2_CYPRESS MOUSE_PS2_FOCALTECH MOUSE_PS2_LOGIPS2PP MOUSE_PS2_SMBUS MOUSE_PS2_SYNAPTICS MOUSE_PS2_SYNAPTICS_SMBUS MOUSE_PS2_TRACKPOINT MOUSE_SYNAPTICS_USB MPLS MPLS_IPTUNNEL MPLS_ROUTING MPTCP MPTCP_IPV6 MSDOS_FS MTD_BLOCK2MTD MTD_MTDRAM MTD_PHRAM MTD_SLRAM MUSB_PIO_ONLY NETCONSOLE NETDEVSIM NETFILTER_FAMILY_ARP NETFILTER_NETLINK NETFILTER_NETLINK_ACCT NETFILTER_NETLINK_GLUE_CT NETFILTER_NETLINK_LOG NETFILTER_NETLINK_OSF NETFILTER_NETLINK_QUEUE NETFILTER_SYNPROXY NETFILTER_XT_CONNMARK NETFILTER_XT_MATCH_BPF NETFILTER_XT_MATCH_CGROUP NETFILTER_XT_MATCH_CLUSTER NETFILTER_XT_MATCH_COMMENT NETFILTER_XT_MATCH_CONNBYTES NETFILTER_XT_MATCH_CONNLABEL NETFILTER_XT_MATCH_CONNLIMIT NETFILTER_XT_MATCH_CONNMARK NETFILTER_XT_MATCH_CPU NETFILTER_XT_MATCH_DCCP NETFILTER_XT_MATCH_DEVGROUP NETFILTER_XT_MATCH_DSCP NETFILTER_XT_MATCH_ECN NETFILTER_XT_MATCH_ESP NETFILTER_XT_MATCH_HASHLIMIT NETFILTER_XT_MATCH_HELPER NETFILTER_XT_MATCH_HL NETFILTER_XT_MATCH_IPCOMP NETFILTER_XT_MATCH_IPRANGE NETFILTER_XT_MATCH_L2TP NETFILTER_XT_MATCH_LENGTH NETFILTER_XT_MATCH_LIMIT NETFILTER_XT_MATCH_MAC NETFILTER_XT_MATCH_MARK NETFILTER_XT_MATCH_MULTIPORT NETFILTER_XT_MATCH_NFACCT NETFILTER_XT_MATCH_OSF NETFILTER_XT_MATCH_OWNER NETFILTER_XT_MATCH_PHYSDEV NETFILTER_XT_MATCH_PKTTYPE NETFILTER_XT_MATCH_POLICY NETFILTER_XT_MATCH_QUOTA NETFILTER_XT_MATCH_RATEEST NETFILTER_XT_MATCH_REALM NETFILTER_XT_MATCH_RECENT NETFILTER_XT_MATCH_SCTP NETFILTER_XT_MATCH_SOCKET NETFILTER_XT_MATCH_STATE NETFILTER_XT_MATCH_STATISTIC NETFILTER_XT_MATCH_STRING NETFILTER_XT_MATCH_TCPMSS NETFILTER_XT_MATCH_TIME NETFILTER_XT_MATCH_U32 NETFILTER_XT_SET NETFILTER_XT_TARGET_AUDIT NETFILTER_XT_TARGET_CLASSIFY NETFILTER_XT_TARGET_CONNMARK NETFILTER_XT_TARGET_CONNSECMARK NETFILTER_XT_TARGET_CT NETFILTER_XT_TARGET_DSCP NETFILTER_XT_TARGET_HL NETFILTER_XT_TARGET_HMARK NETFILTER_XT_TARGET_IDLETIMER NETFILTER_XT_TARGET_LED NETFILTER_XT_TARGET_MARK NETFILTER_XT_TARGET_NETMAP NETFILTER_XT_TARGET_NFLOG NETFILTER_XT_TARGET_NFQUEUE NETFILTER_XT_TARGET_NOTRACK NETFILTER_XT_TARGET_RATEEST NETFILTER_XT_TARGET_REDIRECT NETFILTER_XT_TARGET_SECMARK NETFILTER_XT_TARGET_TCPMSS NETFILTER_XT_TARGET_TCPOPTSTRIP NETFILTER_XT_TARGET_TEE NETFILTER_XT_TARGET_TPROXY NETFILTER_XT_TARGET_TRACE NETLABEL NETLINK_DIAG NETPOLL NETROM NETWORK_SECMARK NET_9P_RDMA NET_ACT_BPF NET_ACT_CONNMARK NET_ACT_CSUM NET_ACT_CT NET_ACT_CTINFO NET_ACT_IFE NET_ACT_IPT NET_ACT_MPLS NET_ACT_NAT NET_ACT_PEDIT NET_ACT_POLICE NET_ACT_SAMPLE NET_ACT_SIMP NET_ACT_SKBEDIT NET_ACT_SKBMOD NET_ACT_TUNNEL_KEY NET_ACT_VLAN NET_CLS_BPF NET_CLS_CGROUP NET_CLS_FLOW NET_CLS_FW NET_CLS_MATCHALL NET_CLS_ROUTE4 NET_DSA_TAG_MTK NET_DSA_TAG_QCA NET_DSA_TAG_RTL4_A NET_EMATCH NET_EMATCH_CANID NET_EMATCH_CMP NET_EMATCH_IPSET NET_EMATCH_IPT NET_EMATCH_META NET_EMATCH_NBYTE NET_EMATCH_TEXT NET_EMATCH_U32 NET_FC NET_FOU NET_FOU_IP_TUNNELS NET_IFE NET_IFE_SKBMARK NET_IFE_SKBPRIO NET_IFE_SKBTCINDEX NET_IPGRE NET_IPGRE_BROADCAST NET_IPGRE_DEMUX NET_IPIP NET_IPVTI NET_KEY NET_KEY_MIGRATE NET_L3_MASTER_DEV NET_MPLS_GSO NET_NCSI NET_NSH NET_POLL_CONTROLLER NET_REDIRECT NET_SCH_CAKE NET_SCH_CHOKE NET_SCH_CODEL NET_SCH_DRR NET_SCH_ETS NET_SCH_FQ NET_SCH_FQ_CODEL NET_SCH_FQ_PIE NET_SCH_GRED NET_SCH_HFSC NET_SCH_HHF NET_SCH_HTB NET_SCH_MULTIQ NET_SCH_NETEM NET_SCH_PIE NET_SCH_PLUG NET_SCH_PRIO NET_SCH_QFQ NET_SCH_RED NET_SCH_SFB NET_SCH_SFQ NET_SCH_SKBPRIO NET_SCH_TBF NET_SCH_TEQL NET_TC_SKB_EXT NET_TEAM NET_TEAM_MODE_ACTIVEBACKUP NET_TEAM_MODE_BROADCAST NET_TEAM_MODE_LOADBALANCE NET_TEAM_MODE_RANDOM NET_TEAM_MODE_ROUNDROBIN NET_UDP_TUNNEL NET_VRF NFC_DIGITAL NFC_FDP NFC_HCI NFC_MRVL NFC_MRVL_USB NFC_NCI_UART NFC_PN533 NFC_PN533_USB NFC_PORT100 NFC_SHDLC NFC_SIM NFC_VIRTUAL_NCI NFSD NFSD_BLOCKLAYOUT NFSD_FLEXFILELAYOUT NFSD_PNFS NFSD_SCSILAYOUT NFSD_V3_ACL NFSD_V4 NFSD_V4_2_INTER_SSC NFSD_V4_SECURITY_LABEL NFS_ACL_SUPPORT NFS_FSCACHE NFS_V3_ACL NFS_V4_2_READ_PLUS NFT_BRIDGE_META NFT_BRIDGE_REJECT NFT_COMPAT NFT_CONNLIMIT NFT_CT NFT_DUP_IPV4 NFT_DUP_IPV6 NFT_DUP_NETDEV NFT_FIB NFT_FIB_INET NFT_FIB_IPV4 NFT_FIB_IPV6 NFT_FIB_NETDEV NFT_FLOW_OFFLOAD NFT_HASH NFT_LIMIT NFT_LOG NFT_MASQ NFT_NAT NFT_NUMGEN NFT_OSF NFT_QUEUE NFT_QUOTA NFT_REDIR NFT_REJECT NFT_REJECT_INET NFT_REJECT_IPV4 NFT_REJECT_IPV6 NFT_REJECT_NETDEV NFT_SOCKET NFT_SYNPROXY NFT_TPROXY NFT_TUNNEL NFT_XFRM NF_CONNTRACK_AMANDA NF_CONNTRACK_BRIDGE NF_CONNTRACK_BROADCAST NF_CONNTRACK_H323 NF_CONNTRACK_IRC NF_CONNTRACK_LABELS NF_CONNTRACK_MARK NF_CONNTRACK_NETBIOS_NS NF_CONNTRACK_PPTP NF_CONNTRACK_SANE NF_CONNTRACK_SECMARK NF_CONNTRACK_SNMP NF_CONNTRACK_TFTP NF_CONNTRACK_TIMEOUT NF_CONNTRACK_TIMESTAMP NF_CONNTRACK_ZONES NF_CT_NETLINK NF_CT_NETLINK_HELPER NF_CT_NETLINK_TIMEOUT NF_CT_PROTO_GRE NF_DUP_IPV4 NF_DUP_IPV6 NF_DUP_NETDEV NF_FLOW_TABLE NF_FLOW_TABLE_INET NF_LOG_ARP NF_NAT_AMANDA NF_NAT_FTP NF_NAT_H323 NF_NAT_IRC NF_NAT_PPTP NF_NAT_REDIRECT NF_NAT_SIP NF_NAT_SNMP_BASIC NF_NAT_TFTP NF_SOCKET_IPV4 NF_SOCKET_IPV6 NF_TABLES NF_TABLES_ARP NF_TABLES_BRIDGE NF_TABLES_INET NF_TABLES_IPV4 NF_TABLES_IPV6 NF_TABLES_NETDEV NF_TPROXY_IPV4 NF_TPROXY_IPV6 NILFS2_FS NINTENDO_FF NLMON NLS_ASCII NLS_CODEPAGE_1250 NLS_CODEPAGE_1251 NLS_CODEPAGE_737 NLS_CODEPAGE_775 NLS_CODEPAGE_850 NLS_CODEPAGE_852 NLS_CODEPAGE_855 NLS_CODEPAGE_857 NLS_CODEPAGE_860 NLS_CODEPAGE_861 NLS_CODEPAGE_862 NLS_CODEPAGE_863 NLS_CODEPAGE_864 NLS_CODEPAGE_865 NLS_CODEPAGE_866 NLS_CODEPAGE_869 NLS_CODEPAGE_874 NLS_CODEPAGE_932 NLS_CODEPAGE_936 NLS_CODEPAGE_949 NLS_CODEPAGE_950 NLS_ISO8859_13 NLS_ISO8859_14 NLS_ISO8859_15 NLS_ISO8859_2 NLS_ISO8859_3 NLS_ISO8859_4 NLS_ISO8859_5 NLS_ISO8859_6 NLS_ISO8859_7 NLS_ISO8859_8 NLS_ISO8859_9 NLS_KOI8_R NLS_KOI8_U NLS_MAC_CELTIC NLS_MAC_CENTEURO NLS_MAC_CROATIAN NLS_MAC_CYRILLIC NLS_MAC_GAELIC NLS_MAC_GREEK NLS_MAC_ICELAND NLS_MAC_INUIT NLS_MAC_ROMAN NLS_MAC_ROMANIAN NLS_MAC_TURKISH NLS_UTF8 NOUVEAU_LEGACY_CTX_SUPPORT NOUVEAU_PLATFORM_DRIVER NOZOMI NO_HZ NTFS3_FS NTFS3_FS_POSIX_ACL NTFS3_LZX_XPRESS NTFS_FS NTFS_RW NULL_TTY NVME_FABRICS NVME_FC NVME_MULTIPATH NVME_RDMA NVME_TARGET NVME_TARGET_FC NVME_TARGET_FCLOOP NVME_TARGET_LOOP NVME_TARGET_RDMA NVME_TARGET_TCP NVME_TCP N_GSM N_HDLC OCFS2_DEBUG_FS OCFS2_FS OCFS2_FS_O2CB OCFS2_FS_STATS PARTITION_ADVANCED PSAMPLE RFKILL SERIAL_NONSTANDARD WAN WATCH_QUEUE WIRELESS WLAN WWAN X25 XFRM] disabling configs for [atomic_sleep hang memleak ubsan locking], they are not needed testing current HEAD cf82dcca96346600c7068cf3f841335f9fa08f54 testing commit cf82dcca96346600c7068cf3f841335f9fa08f54 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 81fb44e7a2daefc1f562ed8b563d8a194fbc78d2bcf151c3d71c954de7cb5e80 all runs: OK false negative chance: 0.000 # git bisect start cf82dcca96346600c7068cf3f841335f9fa08f54 e4f7d8be268ecf717f94ee2e242afa79ddeacaed Bisecting: 544 revisions left to test after this (roughly 9 steps) [83a765cbd7b4d11b0b9fa1bb9d941ae911a2159b] net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() determine whether the revision contains the guilty commit revision e4f7d8be268ecf717f94ee2e242afa79ddeacaed crashed and is reachable testing commit 83a765cbd7b4d11b0b9fa1bb9d941ae911a2159b gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 1ceec9e8efb83ef8208e3129fe5c32fadbf2b6fb26c81ce074ed34a9bf1f20fb run #0: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #1: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #2: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #3: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #4: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #5: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #6: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #7: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #8: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #9: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist representative crash: WARNING in nvmet_fc_alloc_ls_iodlist, types: [WARNING KASAN-INVALID-FREE] # git bisect good 83a765cbd7b4d11b0b9fa1bb9d941ae911a2159b Bisecting: 272 revisions left to test after this (roughly 8 steps) [8ce48d2879aafc0e7a6f8bfc3613c0ba979ec6f5] mptcp: pm: userspace: fix use-after-free in get_local_id determine whether the revision contains the guilty commit revision e4f7d8be268ecf717f94ee2e242afa79ddeacaed crashed and is reachable testing commit 8ce48d2879aafc0e7a6f8bfc3613c0ba979ec6f5 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: ed133b61a5065c5a5651a8db13759c4e8c6de32c0d1f015a3f84dcaa8083113e run #0: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #1: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #2: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #3: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #4: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #5: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #6: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #7: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #8: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #9: OK representative crash: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist, types: [KASAN-INVALID-FREE WARNING] # git bisect good 8ce48d2879aafc0e7a6f8bfc3613c0ba979ec6f5 Bisecting: 136 revisions left to test after this (roughly 7 steps) [6509e270ae1b4366a95f8d75b0dafec7b6f9e7a8] tls: fix lockless read of strp->msg_ready in ->poll determine whether the revision contains the guilty commit revision e4f7d8be268ecf717f94ee2e242afa79ddeacaed crashed and is reachable testing commit 6509e270ae1b4366a95f8d75b0dafec7b6f9e7a8 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 4bd6a614b12c7f70a1e28fbe0d2aef0482e0c61d5a236b4e359433e8c9f37a12 run #0: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #1: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #2: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #3: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #4: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #5: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #6: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #7: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #8: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #9: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist representative crash: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist, types: [KASAN-INVALID-FREE WARNING] # git bisect good 6509e270ae1b4366a95f8d75b0dafec7b6f9e7a8 Bisecting: 68 revisions left to test after this (roughly 6 steps) [3f119c37aa293af41400cccb3d89fab8dcf774b0] smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). determine whether the revision contains the guilty commit revision e4f7d8be268ecf717f94ee2e242afa79ddeacaed crashed and is reachable testing commit 3f119c37aa293af41400cccb3d89fab8dcf774b0 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: de444e9cb226637f99ab1244cb3707c7cca45f27f75f3f9bd076021b2a26eb00 all runs: OK false negative chance: 0.000 # git bisect bad 3f119c37aa293af41400cccb3d89fab8dcf774b0 Bisecting: 33 revisions left to test after this (roughly 5 steps) [2753722612d8824d3910096f93059f669009b0f0] can: isotp: fix timer drain order, wakeup handling and tx_gen ordering determine whether the revision contains the guilty commit revision 83a765cbd7b4d11b0b9fa1bb9d941ae911a2159b crashed and is reachable testing commit 2753722612d8824d3910096f93059f669009b0f0 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: c6a1c8c156c2bb3209ad039a3c9fef36cc9614dce360560d4b0378a2b0d7a109 all runs: OK false negative chance: 0.000 # git bisect bad 2753722612d8824d3910096f93059f669009b0f0 Bisecting: 16 revisions left to test after this (roughly 4 steps) [d960881b9312e781a3429aabceb223ce6b7c882f] ipv6: fix use-after-free in ip6_finish_output2() determine whether the revision contains the guilty commit revision 6509e270ae1b4366a95f8d75b0dafec7b6f9e7a8 crashed and is reachable testing commit d960881b9312e781a3429aabceb223ce6b7c882f gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: f8e2094c2f302fa69f0f67c78cac294f6a386416f0e3f1bff7594ffd11d69b0b run #0: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #1: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #2: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #3: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #4: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #5: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #6: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #7: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #8: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #9: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist representative crash: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist, types: [KASAN-INVALID-FREE WARNING] # git bisect good d960881b9312e781a3429aabceb223ce6b7c882f Bisecting: 8 revisions left to test after this (roughly 3 steps) [e19f1e37f93d78d8a18c24e82b1eb4b1752d807f] mptcp: pm: fix data race in add_addr timer callback determine whether the revision contains the guilty commit revision d960881b9312e781a3429aabceb223ce6b7c882f crashed and is reachable testing commit e19f1e37f93d78d8a18c24e82b1eb4b1752d807f gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 614170b6651ed19e72394f1272f307cdd8f192fa1624a9461aa5ad7000460dc9 all runs: OK false negative chance: 0.000 # git bisect bad e19f1e37f93d78d8a18c24e82b1eb4b1752d807f Bisecting: 3 revisions left to test after this (roughly 2 steps) [84b205297fa15f97510342221d8c9a0119711478] Input: byd - synchronize timer deletion before freeing private data determine whether the revision contains the guilty commit revision d960881b9312e781a3429aabceb223ce6b7c882f crashed and is reachable testing commit 84b205297fa15f97510342221d8c9a0119711478 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 9fe04b932d43d7cb92fe045b11cec5fd38be97bac3040ee4cc915b372518a3ad all runs: OK false negative chance: 0.000 # git bisect bad 84b205297fa15f97510342221d8c9a0119711478 Bisecting: 1 revision left to test after this (roughly 1 step) [1a8f007faefe8c226ec65896589f8d59b0a8d5a5] nvmet-fc: fix invalid free in LS IOD error path determine whether the revision contains the guilty commit revision 83a765cbd7b4d11b0b9fa1bb9d941ae911a2159b crashed and is reachable testing commit 1a8f007faefe8c226ec65896589f8d59b0a8d5a5 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: be5c6d274a7c94adda0b91e62afe1d37f6e35f7044e72e042d06251cfe334091 run #0: ignore: lost connection to test machine run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK false negative chance: 0.000 # git bisect bad 1a8f007faefe8c226ec65896589f8d59b0a8d5a5 Bisecting: 0 revisions left to test after this (roughly 0 steps) [447b668faa14710f611e714031e3739ac3ec3a4f] nvmet-auth: zero the AUTH_RECEIVE response buffer determine whether the revision contains the guilty commit revision 83a765cbd7b4d11b0b9fa1bb9d941ae911a2159b crashed and is reachable testing commit 447b668faa14710f611e714031e3739ac3ec3a4f gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 963ed80577f3cdc9611cb94c68aa0679d9595d4958b2519a4bc1f3a7b49d04d1 run #0: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #1: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #2: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #3: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #4: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #5: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #6: crashed: WARNING in nvmet_fc_alloc_ls_iodlist run #7: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #8: crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist run #9: OK representative crash: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist, types: [KASAN-INVALID-FREE WARNING] # git bisect good 447b668faa14710f611e714031e3739ac3ec3a4f 1a8f007faefe8c226ec65896589f8d59b0a8d5a5 is the first bad commit commit 1a8f007faefe8c226ec65896589f8d59b0a8d5a5 Author: Jiang HongHui Date: Wed Jul 29 19:02:06 2026 +0800 nvmet-fc: fix invalid free in LS IOD error path commit ba98d6796d12258e837ece065d2ecb59d76ce4ff upstream. nvmet_fc_alloc_ls_iodlist() advances iod while initializing the LS IOD array. If an rqstbuf allocation or response buffer DMA mapping fails, the unwind loop decrements iod past the start of the array. The final kfree(iod) therefore frees an address before the allocated object. This can be reproduced with nvme-fcloop and failslab by setting fail-nth to 6 before creating a target port. KASAN reports: BUG: KASAN: invalid-free in nvmet_fc_register_targetport Free of addr ffff88816cf8ff48 by task nvmet_fail_nth/9552 Free the original allocation base stored in tgtport->iod instead. With this fix applied, the same sysfs write with fail-nth=6 returns -ENOMEM without any KASAN report. Fixes: c53432030d86 ("nvme-fabrics: Add target support for FC transport") Cc: stable@vger.kernel.org Reviewed-by: Maurizio Lombardi Assisted-by: Codex:gpt-5 Signed-off-by: Jiang HongHui Signed-off-by: Keith Busch Signed-off-by: Greg Kroah-Hartman drivers/nvme/target/fc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) accumulated error probability: 0.00 culprit signature: be5c6d274a7c94adda0b91e62afe1d37f6e35f7044e72e042d06251cfe334091 parent signature: 963ed80577f3cdc9611cb94c68aa0679d9595d4958b2519a4bc1f3a7b49d04d1 revisions tested: 18, total time: 5h29m15.868331447s (build: 2h24m7.425000362s, test: 2h38m54.595107098s) first good commit: 1a8f007faefe8c226ec65896589f8d59b0a8d5a5 nvmet-fc: fix invalid free in LS IOD error path recipients (to): ["gregkh@linuxfoundation.org" "jiang_hh2019@163.com" "kbusch@kernel.org" "mlombard@redhat.com"] recipients (cc): []