ci starts bisection 2023-11-27 00:25:41.719184437 +0000 UTC m=+248910.834838236 bisecting fixing commit since bd6c11bc43c496cddfc6cf603b5d45365606dbd5 building syzkaller on 696ea0d2f4fdaa17db929e152edba19bf7666d84 ensuring issue is reproducible on original commit bd6c11bc43c496cddfc6cf603b5d45365606dbd5 testing commit bd6c11bc43c496cddfc6cf603b5d45365606dbd5 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 4a910676721298a50af09dcd67ff53b6e2f3355ba7e8c254fc206680dd9882cd run #0: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #1: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #2: crashed: WARNING: ODEBUG bug in put_device run #3: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #4: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #5: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #6: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #7: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #8: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #9: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #10: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #11: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #12: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #13: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #14: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #15: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #16: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #17: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #18: OK run #19: OK representative crash: KASAN: slab-use-after-free Write in __sco_sock_close, types: [KASAN] check whether we can drop unnecessary instrumentation disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed testing commit bd6c11bc43c496cddfc6cf603b5d45365606dbd5 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 1368779ba8b54e08d497f47c6a26405606fff24c932af6ae302f3c901de70fe0 all runs: crashed: KASAN: slab-use-after-free Write in __sco_sock_close representative crash: KASAN: slab-use-after-free Write in __sco_sock_close, types: [KASAN] the bug reproduces without the instrumentation disabling configs for [UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed kconfig minimization: base=3923 full=7650 leaves diff=1999 split chunks (needed=false): <1999> split chunk #0 of len 1999 into 5 parts testing without sub-chunk 1/5 disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing commit bd6c11bc43c496cddfc6cf603b5d45365606dbd5 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: fd16f53e01343b75ab869832d3ce6ce832faa49b0f5afca9e21205139ab16877 all runs: OK false negative chance: 0.000 testing without sub-chunk 2/5 disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN BUG LOCKDEP], they are not needed testing commit bd6c11bc43c496cddfc6cf603b5d45365606dbd5 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: feee0331dc2f8cfd43f9e0e7cdb4dd7dac335c92e430156f95225f431fe93152 run #0: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #1: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #2: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #3: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #4: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #5: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #6: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #7: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #8: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #9: OK representative crash: KASAN: slab-use-after-free Write in __sco_sock_close, types: [KASAN] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed testing commit bd6c11bc43c496cddfc6cf603b5d45365606dbd5 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 2a5ce52a733bad59bbc961be87dda2d22ade2235e8fd001b47423599c1d90df4 run #0: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #1: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #2: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #3: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #4: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #5: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #6: OK run #7: OK run #8: OK run #9: OK representative crash: KASAN: slab-use-after-free Write in __sco_sock_close, types: [KASAN] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing commit bd6c11bc43c496cddfc6cf603b5d45365606dbd5 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: b097244510a5bafe6c4ea4da16b8b9d54457f190e3be6bb2913420c88149ffb1 run #0: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #1: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #2: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #3: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #4: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #5: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #6: OK run #7: OK run #8: OK run #9: OK representative crash: KASAN: slab-use-after-free Write in __sco_sock_close, types: [KASAN] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing commit bd6c11bc43c496cddfc6cf603b5d45365606dbd5 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 1d917ab4c8be80c7225ada487640b02fcdd188e27042204f068af2845c96e4fb run #0: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #1: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #2: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #3: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #4: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #5: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #6: OK run #7: OK run #8: OK run #9: OK representative crash: KASAN: slab-use-after-free Write in __sco_sock_close, types: [KASAN] the chunk can be dropped minimized to 400 configs; suspects: [6LOWPAN 6LOWPAN_GHC_EXT_HDR_DEST 6LOWPAN_GHC_EXT_HDR_FRAG 6LOWPAN_GHC_EXT_HDR_HOP 6LOWPAN_GHC_EXT_HDR_ROUTE 6LOWPAN_GHC_ICMPV6 6LOWPAN_GHC_UDP 6LOWPAN_NHC 6LOWPAN_NHC_DEST 6LOWPAN_NHC_FRAGMENT 6LOWPAN_NHC_HOP 6LOWPAN_NHC_IPV6 6LOWPAN_NHC_MOBILITY 6LOWPAN_NHC_ROUTING 6LOWPAN_NHC_UDP 6PACK 842_COMPRESS 842_DECOMPRESS 9P_FSCACHE 9P_FS_POSIX_ACL 9P_FS_SECURITY ACORN_PARTITION ACORN_PARTITION_ADFS ACORN_PARTITION_CUMANA ACORN_PARTITION_EESOX ACORN_PARTITION_ICS ACORN_PARTITION_POWERTEC ACORN_PARTITION_RISCIX ACPI_NFIT ACPI_PLATFORM_PROFILE ADDRESS_MASKING ADFS_FS AFFS_FS AFS_FS AFS_FSCACHE AF_KCM AF_RXRPC AF_RXRPC_IPV6 AIX_PARTITION AMIGA_PARTITION ANDROID_BINDERFS ANDROID_BINDER_IPC ANON_VMA_NAME APERTURE_HELPERS AR5523 ARCH_ENABLE_MEMORY_HOTREMOVE ARCH_ENABLE_THP_MIGRATION ARCH_WANT_OPTIMIZE_VMEMMAP ASM_MODVERSIONS ASYNC_CORE ASYNC_MEMCPY ASYNC_PQ ASYNC_RAID6_RECOV ASYNC_TX_DMA ASYNC_XOR ATARI_PARTITION ATA_GENERIC ATA_OVER_ETH ATH10K ATH10K_CE ATH10K_PCI ATH10K_USB ATH11K ATH6KL ATH6KL_USB ATH9K ATH9K_AHB ATH9K_BTCOEX_SUPPORT ATH9K_CHANNEL_CONTEXT ATH9K_COMMON ATH9K_COMMON_DEBUG ATH9K_DEBUGFS ATH9K_DYNACK ATH9K_HTC ATH9K_HTC_DEBUGFS ATH9K_HW ATH9K_PCI ATH9K_PCOEM ATH9K_RFKILL ATH_COMMON ATM ATM_BR2684 ATM_CLIP ATM_DRIVERS ATM_LANE ATM_MPOA ATM_TCP AUXILIARY_BUS AX25 AX25_DAMA_SLAVE AX88796B_PHY BAREUDP BATMAN_ADV BATMAN_ADV_BATMAN_V BATMAN_ADV_BLA BATMAN_ADV_DAT BATMAN_ADV_MCAST BATMAN_ADV_NC BCACHE BCMA BCMA_HOST_PCI_POSSIBLE BEFS_FS BFQ_CGROUP_DEBUG BFQ_GROUP_IOSCHED BFS_FS BIG_KEYS BLK_CGROUP_PUNT_BIO BLK_CGROUP_RWSTAT BLK_DEBUG_FS_ZONED BLK_DEV_BSGLIB BLK_DEV_FD BLK_DEV_INTEGRITY BLK_DEV_INTEGRITY_T10 BLK_DEV_NBD BLK_DEV_NULL_BLK BLK_DEV_NULL_BLK_FAULT_INJECTION BLK_DEV_NVME BLK_DEV_PMEM BLK_DEV_RAM BLK_DEV_RNBD BLK_DEV_RNBD_CLIENT BLK_DEV_THROTTLING BLK_DEV_ZONED BLK_ICQ BLK_INLINE_ENCRYPTION BLK_INLINE_ENCRYPTION_FALLBACK BLK_WBT BLK_WBT_MQ BONDING BOOT_VESA_SUPPORT BPF_EVENTS BPF_JIT BPF_JIT_ALWAYS_ON BPF_JIT_DEFAULT_ON BPF_LSM BPF_PRELOAD BPF_PRELOAD_UMD BPF_STREAM_PARSER BPF_SYSCALL BPQETHER BRIDGE BRIDGE_CFM BRIDGE_EBT_802_3 BRIDGE_EBT_AMONG BRIDGE_EBT_ARP BRIDGE_EBT_ARPREPLY BRIDGE_EBT_BROUTE BRIDGE_EBT_DNAT BRIDGE_EBT_IP BRIDGE_EBT_IP6 BRIDGE_EBT_LIMIT BRIDGE_EBT_LOG BRIDGE_EBT_MARK BRIDGE_EBT_MARK_T BRIDGE_EBT_NFLOG BRIDGE_EBT_PKTTYPE BRIDGE_EBT_REDIRECT BRIDGE_EBT_SNAT BRIDGE_EBT_STP BRIDGE_EBT_T_FILTER BRIDGE_EBT_T_NAT BRIDGE_EBT_VLAN BRIDGE_IGMP_SNOOPING BRIDGE_MRP BRIDGE_NF_EBTABLES BRIDGE_VLAN_FILTERING BSD_DISKLABEL BSD_PROCESS_ACCT_V3 BT BTRFS_ASSERT BTRFS_FS BTRFS_FS_POSIX_ACL BTRFS_FS_REF_VERIFY BTT BT_6LOWPAN BT_ATH3K BT_BCM BT_BNEP BT_BNEP_MC_FILTER BT_BNEP_PROTO_FILTER BT_BREDR BT_CMTP BT_HCIBCM203X BT_HCIBFUSB BT_HCIBPA10X BT_HCIBTUSB BT_HCIBTUSB_BCM BT_HCIBTUSB_MTK BT_HCIBTUSB_POLL_SYNC BT_HCIBTUSB_RTL BT_HCIUART BT_HCIUART_3WIRE BT_HCIUART_AG6XX BT_HCIUART_BCSP BT_HCIUART_H4 BT_HCIUART_LL BT_HCIUART_MRVL BT_HCIUART_QCA BT_HCIUART_SERDEV BT_HCIVHCI BT_HIDP BT_HS BT_INTEL BT_LE BT_LEDS BT_LE_L2CAP_ECRED BT_MSFTEXT BT_MTK BT_QCA BT_RFCOMM BT_RFCOMM_TTY BT_RTL CACHEFILES CAIF CAIF_DEBUG CAIF_DRIVERS CAIF_NETDEV CAIF_TTY CAIF_USB CAIF_VIRTIO CAN CAN_8DEV_USB CAN_BCM CAN_CALC_BITTIMING CAN_DEV CAN_EMS_USB CAN_GS_USB CAN_GW CAN_IFI_CANFD CAN_ISOTP CAN_J1939 CAN_KVASER_USB CAN_MCBA_USB CAN_NETLINK CAN_PEAK_USB CAN_RAW CAN_RX_OFFLOAD CAN_SLCAN CAN_VCAN CAN_VXCAN CAPI_TRACE CARL9170 CARL9170_HWRNG CARL9170_LEDS CARL9170_WPC CEC_CORE CEPH_FS CEPH_FSCACHE CEPH_FS_POSIX_ACL CEPH_LIB CEPH_LIB_USE_DNS_RESOLVER CFG80211 CFG80211_CRDA_SUPPORT CFG80211_DEBUGFS CFG80211_DEFAULT_PS CFG80211_REQUIRE_SIGNED_REGDB CFG80211_USE_KERNEL_REGDB_KEYS CFG80211_WEXT CFS_BANDWIDTH CGROUP_BPF CHARGER_BQ24190 CHARGER_ISP1704 CHR_DEV_ST CIFS CIFS_ALLOW_INSECURE_LEGACY CIFS_DEBUG CIFS_DFS_UPCALL CIFS_FSCACHE CIFS_POSIX CIFS_SMB_DIRECT CIFS_SWN_UPCALL CIFS_UPCALL CIFS_XATTR CLS_U32_MARK CLS_U32_PERF CMA CMA_SIZE_SEL_MBYTES CMDLINE_PARTITION COMEDI COMEDI_DT9812 COMEDI_NI_USB6501 COMEDI_USBDUX COMEDI_USBDUXFAST COMEDI_USBDUXSIGMA COMEDI_USB_DRIVERS COMEDI_VMK80XX COMPAT_NETLINK_MESSAGES COUNTER CRAMFS CRAMFS_BLOCKDEV CRAMFS_MTD CRC4 CRC64 CRC64_ROCKSOFT CRC7 CRC8 CRC_ITU_T CRC_T10DIF CRYPTO_ADIANTUM CRYPTO_AEGIS128 CRYPTO_AEGIS128_AESNI_SSE2 CRYPTO_AES_NI_INTEL CRYPTO_AES_TI CRYPTO_ANSI_CPRNG CRYPTO_ANUBIS CRYPTO_ARC4 CRYPTO_ARCH_HAVE_LIB_BLAKE2S CRYPTO_ARCH_HAVE_LIB_CHACHA CRYPTO_ARCH_HAVE_LIB_CURVE25519 CRYPTO_ARCH_HAVE_LIB_POLY1305 CRYPTO_ARIA CRYPTO_ARIA_AESNI_AVX_X86_64 CRYPTO_BLAKE2B CRYPTO_BLAKE2S_X86 CRYPTO_BLOWFISH CRYPTO_BLOWFISH_COMMON CRYPTO_BLOWFISH_X86_64 CRYPTO_CAMELLIA CRYPTO_CAMELLIA_AESNI_AVX2_X86_64 CRYPTO_CAMELLIA_AESNI_AVX_X86_64 CRYPTO_CAMELLIA_X86_64 CRYPTO_CAST5 CRYPTO_CAST5_AVX_X86_64 CRYPTO_CAST6 CRYPTO_CAST6_AVX_X86_64 CRYPTO_CAST_COMMON CRYPTO_CFB CRYPTO_CHACHA20 CRYPTO_CHACHA20POLY1305 CRYPTO_CHACHA20_X86_64 CRYPTO_CRC32 CRYPTO_CRC32C_INTEL CRYPTO_CRC32_PCLMUL CRYPTO_CRC64_ROCKSOFT CRYPTO_CRCT10DIF CRYPTO_CRCT10DIF_PCLMUL CRYPTO_CRYPTD CRYPTO_CTS CRYPTO_CURVE25519 CRYPTO_CURVE25519_X86 CRYPTO_DEFLATE CRYPTO_DES CRYPTO_DES3_EDE_X86_64 CRYPTO_DEV_CCP CRYPTO_DEV_CCP_DD CRYPTO_DEV_PADLOCK CRYPTO_DEV_PADLOCK_AES CRYPTO_DEV_PADLOCK_SHA CRYPTO_DEV_QAT CRYPTO_DEV_QAT_C3XXX CRYPTO_DEV_QAT_C3XXXVF CRYPTO_DEV_QAT_C62X CRYPTO_DEV_QAT_C62XVF CRYPTO_DEV_QAT_DH895xCC CRYPTO_DEV_QAT_DH895xCCVF CRYPTO_DEV_VIRTIO CRYPTO_DH CRYPTO_DRBG_CTR CRYPTO_DRBG_HASH CRYPTO_ECC CRYPTO_ECDH CRYPTO_ECRDSA CRYPTO_ENGINE CRYPTO_ESSIV CRYPTO_FCRYPT CRYPTO_GHASH_CLMUL_NI_INTEL CRYPTO_HCTR2 CRYPTO_KDF800108_CTR CRYPTO_KEYWRAP CRYPTO_KHAZAD CRYPTO_KPP CRYPTO_LIB_ARC4 CRYPTO_LIB_CHACHA CRYPTO_LIB_CHACHA20POLY1305 CRYPTO_LIB_CHACHA_GENERIC CRYPTO_LIB_CURVE25519 CRYPTO_LIB_CURVE25519_GENERIC CRYPTO_LIB_DES CRYPTO_LIB_POLY1305 CRYPTO_LIB_POLY1305_GENERIC CRYPTO_LRW CRYPTO_MICHAEL_MIC CRYPTO_NHPOLY1305 CRYPTO_NHPOLY1305_AVX2 CRYPTO_NHPOLY1305_SSE2 CRYPTO_OFB CRYPTO_PCBC CRYPTO_PCRYPT CRYPTO_POLY1305 CRYPTO_POLY1305_X86_64 CRYPTO_POLYVAL CRYPTO_POLYVAL_CLMUL_NI CRYPTO_RMD160 CRYPTO_SEED CRYPTO_SERPENT CRYPTO_SERPENT_AVX2_X86_64 CRYPTO_SERPENT_AVX_X86_64 CRYPTO_SERPENT_SSE2_X86_64 CRYPTO_SHA1_SSSE3 CRYPTO_SHA256_SSSE3 CRYPTO_SHA512_SSSE3 CRYPTO_SIMD CRYPTO_SM2 CRYPTO_SM3 CRYPTO_SM3_AVX_X86_64 CRYPTO_SM4 CRYPTO_SM4_AESNI_AVX2_X86_64 CRYPTO_SM4_AESNI_AVX_X86_64 CRYPTO_SM4_GENERIC CRYPTO_STREEBOG CRYPTO_TEA CRYPTO_TWOFISH CRYPTO_TWOFISH_AVX_X86_64 CRYPTO_TWOFISH_COMMON CRYPTO_TWOFISH_X86_64 CRYPTO_TWOFISH_X86_64_3WAY CRYPTO_USER CRYPTO_USER_API CRYPTO_USER_API_AEAD CRYPTO_USER_API_ENABLE_OBSOLETE CRYPTO_USER_API_HASH CRYPTO_USER_API_RNG CRYPTO_USER_API_SKCIPHER CRYPTO_VMAC CRYPTO_WP512 CRYPTO_XCBC CRYPTO_XCTR CRYPTO_XTS CRYPTO_XXHASH CUSE CYPRESS_FIRMWARE DAMON DAMON_DBGFS DAMON_PADDR DAMON_RECLAIM DAMON_VADDR DAX DCA DCB DEFAULT_PFIFO_FAST DEVICE_MIGRATION DEVICE_PRIVATE DEV_COREDUMP DEV_DAX DIMLIB DLN2_ADC DMABUF_HEAPS DMABUF_HEAPS_CMA DMABUF_HEAPS_SYSTEM DMABUF_MOVE_NOTIFY DMA_CMA DMA_ENGINE_RAID DM_AUDIT DM_BIO_PRISON DM_BUFIO DM_CACHE DM_CACHE_SMQ DM_CLONE DM_CRYPT DM_FLAKEY DM_INTEGRITY DM_MULTIPATH DM_MULTIPATH_QL DM_MULTIPATH_ST DM_PERSISTENT_DATA DM_RAID DM_SNAPSHOT DM_THIN_PROVISIONING DM_UEVENT DM_VERITY DM_VERITY_FEC DM_WRITECACHE DM_ZONED DRAGONRISE_FF DRM DRM_BOCHS DRM_BUDDY DRM_CIRRUS_QEMU ENCRYPTED_KEYS EXTCON FSCACHE FUSE_FS GPIOLIB HAMRADIO HID_DRAGONRISE IIO INFINIBAND INFINIBAND_ADDR_TRANS INFINIBAND_RTRS_CLIENT IOSCHED_BFQ ISDN ISDN_CAPI LIBNVDIMM MAC80211 MAC80211_LEDS MEDIA_SUPPORT MEMORY_HOTPLUG MEMORY_HOTREMOVE MFD_DLN2 MTD NET_CLS_U32 NET_SCH_DEFAULT PARTITION_ADVANCED RFKILL SERIAL_DEV_BUS TLS TLS_DEVICE TRANSPARENT_HUGEPAGE TRUSTED_KEYS USB_GADGET USB_PHY VLAN_8021Q WANT_COMPAT_NETLINK_MESSAGES WEXT_CORE WIRELESS WIRELESS_EXT WLAN WLAN_VENDOR_ATH X86_X32_ABI ZONE_DEVICE] disabling configs for [BUG LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed testing current HEAD dba1b8a7ab6853a84bf3afdbeac1c2f2370d3444 testing commit dba1b8a7ab6853a84bf3afdbeac1c2f2370d3444 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: a96e4044b2ec7b8d8a92721b65566085c364490db41ca1f406f60ec7d5805c92 all runs: OK false negative chance: 0.000 # git bisect start dba1b8a7ab6853a84bf3afdbeac1c2f2370d3444 bd6c11bc43c496cddfc6cf603b5d45365606dbd5 Bisecting: 13719 revisions left to test after this (roughly 14 steps) [9e87705289667a6c5185c619ea32f3d39314eb1b] Merge tag 'bcachefs-2023-10-30' of https://evilpiepirate.org/git/bcachefs determine whether the revision contains the guilty commit revision bd6c11bc43c496cddfc6cf603b5d45365606dbd5 crashed and is reachable testing commit 9e87705289667a6c5185c619ea32f3d39314eb1b gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: c2aa6a04d40e4e66a5d9457188b098a5fef4e44883582a9234389b854d723b09 run #0: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #1: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #2: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #3: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #4: crashed: KFENCE: use-after-free in __sco_sock_close run #5: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #6: OK run #7: OK run #8: OK run #9: OK representative crash: KASAN: slab-use-after-free Write in __sco_sock_close, types: [KASAN] # git bisect good 9e87705289667a6c5185c619ea32f3d39314eb1b Bisecting: 6858 revisions left to test after this (roughly 13 steps) [c1ed833e0b3b7b9edc82b97b73b2a8a10ceab241] Merge branch 'smc-fixes' determine whether the revision contains the guilty commit revision bd6c11bc43c496cddfc6cf603b5d45365606dbd5 crashed and is reachable testing commit c1ed833e0b3b7b9edc82b97b73b2a8a10ceab241 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 82f38befbd738bea231a878f60f72e4b5f582b1c7f86334c9a6f2ee15e79bd1c all runs: OK false negative chance: 0.000 # git bisect bad c1ed833e0b3b7b9edc82b97b73b2a8a10ceab241 Bisecting: 3446 revisions left to test after this (roughly 12 steps) [fe4ae2fab00b4751265580c5865fdf23b62d80b3] Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux determine whether the revision contains the guilty commit revision bd6c11bc43c496cddfc6cf603b5d45365606dbd5 crashed and is reachable testing commit fe4ae2fab00b4751265580c5865fdf23b62d80b3 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: d3b0cfe159326b04eec011c83ee093f9a786acd73e1d727e0c3bab8bdb23536a all runs: OK false negative chance: 0.000 # git bisect bad fe4ae2fab00b4751265580c5865fdf23b62d80b3 Bisecting: 1730 revisions left to test after this (roughly 11 steps) [cc33a80b816406f900a53c7f98a50f6eacdd2e31] MAINTAINERS: Maintainer change for ptp_vmw driver determine whether the revision contains the guilty commit revision bd6c11bc43c496cddfc6cf603b5d45365606dbd5 crashed and is reachable testing commit cc33a80b816406f900a53c7f98a50f6eacdd2e31 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 20823b9e9ac43d0d367211bbc65f7de8aa651dbe62f481632843fc9279100c92 all runs: OK false negative chance: 0.000 # git bisect bad cc33a80b816406f900a53c7f98a50f6eacdd2e31 Bisecting: 745 revisions left to test after this (roughly 10 steps) [a1fb841f9d189d257814562dacb3d65667f2a9c3] Merge tag 'wireless-next-2023-10-06' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next determine whether the revision contains the guilty commit revision bd6c11bc43c496cddfc6cf603b5d45365606dbd5 crashed and is reachable testing commit a1fb841f9d189d257814562dacb3d65667f2a9c3 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: f306de2902177f90a9279e17a983e7b8da9e1ed6c10632e199ce8588d9ad366c run #0: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #1: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #2: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #3: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #4: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #5: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #6: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #7: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #8: OK run #9: OK representative crash: KASAN: slab-use-after-free Write in __sco_sock_close, types: [KASAN] # git bisect good a1fb841f9d189d257814562dacb3d65667f2a9c3 Bisecting: 327 revisions left to test after this (roughly 9 steps) [56a7bb12c78ffa1b02e154b1d779ed2a1555fa3c] Merge tag 'wireless-next-2023-10-16' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next determine whether the revision contains the guilty commit revision a1fb841f9d189d257814562dacb3d65667f2a9c3 crashed and is reachable testing commit 56a7bb12c78ffa1b02e154b1d779ed2a1555fa3c gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 8cd20a0078c7667d5cc4abf3ff3db1eae947182b47d06a895f3fbf6b688bd2b9 run #0: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #1: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #2: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #3: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #4: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #5: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #6: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #7: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #8: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #9: OK representative crash: KASAN: slab-use-after-free Write in __sco_sock_close, types: [KASAN] # git bisect good 56a7bb12c78ffa1b02e154b1d779ed2a1555fa3c Bisecting: 163 revisions left to test after this (roughly 7 steps) [92fc97ae9cfd1e8c13d973ac92d224a185056840] net: atm: Remove redundant check. determine whether the revision contains the guilty commit revision a1fb841f9d189d257814562dacb3d65667f2a9c3 crashed and is reachable testing commit 92fc97ae9cfd1e8c13d973ac92d224a185056840 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: d8caff462dc2609cc085aae8e6711f42920017e40dd654a47cad3b6d1de4c559 run #0: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #1: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #2: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #3: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #4: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #5: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #6: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #7: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #8: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #9: OK representative crash: KASAN: slab-use-after-free Write in __sco_sock_close, types: [KASAN] # git bisect good 92fc97ae9cfd1e8c13d973ac92d224a185056840 Bisecting: 81 revisions left to test after this (roughly 6 steps) [bd07063dd11f6fda903802a5868960be3690d327] net: don't use input buffer of __dev_alloc_name() as a scratch space determine whether the revision contains the guilty commit revision bd6c11bc43c496cddfc6cf603b5d45365606dbd5 crashed and is reachable testing commit bd07063dd11f6fda903802a5868960be3690d327 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 9ba8843f74e92ca8a10b493e6cf3e83f5c43f66edd4d129634fdf7e6cd0dd467 all runs: OK false negative chance: 0.000 # git bisect bad bd07063dd11f6fda903802a5868960be3690d327 Bisecting: 40 revisions left to test after this (roughly 5 steps) [4ed924fc122f759e383df7eccd89a2e57d9c4c5d] Bluetooth: btmtksdio: enable bluetooth wakeup in system suspend determine whether the revision contains the guilty commit revision 92fc97ae9cfd1e8c13d973ac92d224a185056840 crashed and is reachable testing commit 4ed924fc122f759e383df7eccd89a2e57d9c4c5d gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 82fd908aae388a9babc69fe474cc76dc1fbe467875633b8f79c411b45556f1de all runs: OK false negative chance: 0.000 # git bisect bad 4ed924fc122f759e383df7eccd89a2e57d9c4c5d Bisecting: 20 revisions left to test after this (roughly 4 steps) [bdf24b4bdfa59b124f9d0ff837f8d35a908da3b8] Merge branch 'tcp-ts-usec-resolution' determine whether the revision contains the guilty commit revision 56a7bb12c78ffa1b02e154b1d779ed2a1555fa3c crashed and is reachable testing commit bdf24b4bdfa59b124f9d0ff837f8d35a908da3b8 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 530d4aff892fe6c813dd6b204d02f51730091d8a1f6e6de19934452007df6415 run #0: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #1: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #2: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #3: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #4: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #5: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #6: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #7: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #8: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #9: OK representative crash: KASAN: slab-use-after-free Write in __sco_sock_close, types: [KASAN] # git bisect good bdf24b4bdfa59b124f9d0ff837f8d35a908da3b8 Bisecting: 10 revisions left to test after this (roughly 3 steps) [a7f8dedb4be2cc930a29af24427b885405ecd15d] Bluetooth: qca: add support for QCA2066 determine whether the revision contains the guilty commit revision 92fc97ae9cfd1e8c13d973ac92d224a185056840 crashed and is reachable testing commit a7f8dedb4be2cc930a29af24427b885405ecd15d gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 3bd7f55930647115f275e82caaab07f71bcbc48f29f8d26602ed413467b77eea run #0: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #1: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #2: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #3: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #4: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #5: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #6: OK run #7: OK run #8: OK run #9: OK representative crash: KASAN: slab-use-after-free Write in __sco_sock_close, types: [KASAN] # git bisect good a7f8dedb4be2cc930a29af24427b885405ecd15d Bisecting: 5 revisions left to test after this (roughly 3 steps) [fcb89f120376c054005e6d7a82bb89f95b3b04ef] Bluetooth: ISO: Fix bcast listener cleanup determine whether the revision contains the guilty commit revision a1fb841f9d189d257814562dacb3d65667f2a9c3 crashed and is reachable testing commit fcb89f120376c054005e6d7a82bb89f95b3b04ef gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 29847aba49c37e89f539d2519e515da24614857093329d5916367b109d75b593 run #0: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #1: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #2: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #3: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #4: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #5: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #6: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #7: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #8: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #9: OK representative crash: KASAN: slab-use-after-free Write in __sco_sock_close, types: [KASAN] # git bisect good fcb89f120376c054005e6d7a82bb89f95b3b04ef Bisecting: 2 revisions left to test after this (roughly 2 steps) [f4da3ee15de9944482382181329bb6d7335ca003] Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID determine whether the revision contains the guilty commit revision bdf24b4bdfa59b124f9d0ff837f8d35a908da3b8 crashed and is reachable testing commit f4da3ee15de9944482382181329bb6d7335ca003 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 7922d6704bb01205545581399e50891121c4fa3a19572e1ce5bcd0fb103283ae all runs: OK false negative chance: 0.000 # git bisect bad f4da3ee15de9944482382181329bb6d7335ca003 Bisecting: 0 revisions left to test after this (roughly 1 step) [181a42edddf51d5d9697ecdf365d72ebeab5afb0] Bluetooth: Make handle of hci_conn be unique determine whether the revision contains the guilty commit revision fcb89f120376c054005e6d7a82bb89f95b3b04ef crashed and is reachable testing commit 181a42edddf51d5d9697ecdf365d72ebeab5afb0 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: e664f6a957b0d5b8655c133bbad0ab2a3878f64fafe8f07edf5eb5bb997dd4b3 all runs: OK false negative chance: 0.000 # git bisect bad 181a42edddf51d5d9697ecdf365d72ebeab5afb0 Bisecting: 0 revisions left to test after this (roughly 0 steps) [624820f7c8826dd010e8b1963303c145f99816e9] Bluetooth: btusb: Add date->evt_skb is NULL check determine whether the revision contains the guilty commit revision 92fc97ae9cfd1e8c13d973ac92d224a185056840 crashed and is reachable testing commit 624820f7c8826dd010e8b1963303c145f99816e9 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 98f88aba64f23b0692a511e5d3cd3077215cf6beea49ecd006e2a6bf62736cbd run #0: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #1: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #2: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #3: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #4: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #5: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #6: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #7: crashed: KASAN: slab-use-after-free Write in __sco_sock_close run #8: OK run #9: OK representative crash: KASAN: slab-use-after-free Write in __sco_sock_close, types: [KASAN] # git bisect good 624820f7c8826dd010e8b1963303c145f99816e9 181a42edddf51d5d9697ecdf365d72ebeab5afb0 is the first bad commit commit 181a42edddf51d5d9697ecdf365d72ebeab5afb0 Author: Ziyang Xuan Date: Wed Oct 11 17:57:31 2023 +0800 Bluetooth: Make handle of hci_conn be unique The handle of new hci_conn is always HCI_CONN_HANDLE_MAX + 1 if the handle of the first hci_conn entry in hci_dev->conn_hash->list is not HCI_CONN_HANDLE_MAX + 1. Use ida to manage the allocation of hci_conn->handle to make it be unique. Fixes: 9f78191cc9f1 ("Bluetooth: hci_conn: Always allocate unique handles") Signed-off-by: Ziyang Xuan Signed-off-by: Luiz Augusto von Dentz include/net/bluetooth/hci_core.h | 6 ++++- net/bluetooth/amp.c | 3 +-- net/bluetooth/hci_conn.c | 57 ++++++++++++++++++++++------------------ net/bluetooth/hci_core.c | 3 +++ net/bluetooth/hci_event.c | 38 +++++++++++---------------- 5 files changed, 56 insertions(+), 51 deletions(-) accumulated error probability: 0.00 culprit signature: e664f6a957b0d5b8655c133bbad0ab2a3878f64fafe8f07edf5eb5bb997dd4b3 parent signature: 98f88aba64f23b0692a511e5d3cd3077215cf6beea49ecd006e2a6bf62736cbd revisions tested: 23, total time: 6h46m41.915220538s (build: 2h47m38.158059653s, test: 3h39m44.114309031s) first good commit: 181a42edddf51d5d9697ecdf365d72ebeab5afb0 Bluetooth: Make handle of hci_conn be unique recipients (to): ["davem@davemloft.net" "edumazet@google.com" "johan.hedberg@gmail.com" "kuba@kernel.org" "linux-bluetooth@vger.kernel.org" "luiz.dentz@gmail.com" "luiz.von.dentz@intel.com" "marcel@holtmann.org" "netdev@vger.kernel.org" "pabeni@redhat.com" "william.xuanziyang@huawei.com"] recipients (cc): ["linux-kernel@vger.kernel.org"]