ci2 starts bisection 2025-04-12 14:13:35.187922683 +0000 UTC m=+65381.611408171
bisecting fixing commit since 4e1bc8d8e8ae84440fa6a9b1b78164a39c5ed0e1
building syzkaller on f323435486123f331122c97cd8bd4183c89d4f05
ensuring issue is reproducible on original commit 4e1bc8d8e8ae84440fa6a9b1b78164a39c5ed0e1

testing commit 4e1bc8d8e8ae84440fa6a9b1b78164a39c5ed0e1 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: bd1c67ad4d933b74ec2d66c2e6e2007a218f161f799dac33e6f2b9d884b137bc
run #0: crashed: BUG: soft lockup in tipc_release
run #1: crashed: BUG: soft lockup in sock_setsockopt
run #2: crashed: BUG: soft lockup in sock_setsockopt
run #3: crashed: BUG: soft lockup in sys_sendmsg
run #4: crashed: BUG: soft lockup in sys_sendmsg
run #5: crashed: BUG: soft lockup in sock_setsockopt
run #6: crashed: BUG: soft lockup in sock_setsockopt
run #7: crashed: BUG: soft lockup in tipc_release
run #8: crashed: BUG: soft lockup in sys_sendmsg
run #9: crashed: BUG: soft lockup in tipc_release
run #10: crashed: BUG: soft lockup in sock_setsockopt
run #11: crashed: BUG: soft lockup in sock_setsockopt
run #12: crashed: BUG: soft lockup in sock_setsockopt
run #13: crashed: BUG: soft lockup in sock_setsockopt
run #14: crashed: BUG: soft lockup in sys_sendmsg
run #15: crashed: BUG: soft lockup in sock_setsockopt
run #16: crashed: BUG: soft lockup in sys_sendmsg
run #17: crashed: BUG: soft lockup in sock_setsockopt
run #18: crashed: BUG: soft lockup in sock_setsockopt
run #19: crashed: BUG: soft lockup in sock_setsockopt
representative crash: BUG: soft lockup in tipc_release, types: [HANG]
check whether we can drop unnecessary instrumentation
disabling configs for [UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP LEAK], they are not needed
testing commit 4e1bc8d8e8ae84440fa6a9b1b78164a39c5ed0e1 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: c6da6f9eae92a801c930ad4331fddf1e1eddfb6d7d6e4ab394002661b4943d35
run #0: crashed: BUG: soft lockup in sock_setsockopt
run #1: crashed: BUG: soft lockup in sock_setsockopt
run #2: crashed: BUG: soft lockup in sys_sendmsg
run #3: crashed: BUG: soft lockup in tipc_release
run #4: crashed: BUG: soft lockup in sys_sendmsg
run #5: crashed: BUG: soft lockup in sys_sendmsg
run #6: crashed: BUG: soft lockup in sys_sendmsg
run #7: crashed: BUG: soft lockup in sock_setsockopt
run #8: crashed: BUG: soft lockup in sock_setsockopt
run #9: crashed: BUG: soft lockup in sys_sendmsg
representative crash: BUG: soft lockup in sock_setsockopt, types: [HANG]
the bug reproduces without the instrumentation
disabling configs for [BUG KASAN LOCKDEP ATOMIC_SLEEP LEAK UBSAN], they are not needed
kconfig minimization: base=4789 full=6019 leaves diff=238
split chunks (needed=false): <238>
split chunk #0 of len 238 into 5 parts
testing without sub-chunk 1/5
disabling configs for [KASAN LOCKDEP ATOMIC_SLEEP LEAK UBSAN BUG], they are not needed
testing commit 4e1bc8d8e8ae84440fa6a9b1b78164a39c5ed0e1 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: c81455889a8c6fe2a98c8c4f0433e9dbb5b19f9f4618749d8e796dc9fba52304
run #0: crashed: BUG: soft lockup in sock_setsockopt
run #1: crashed: BUG: soft lockup in sock_setsockopt
run #2: crashed: BUG: soft lockup in sys_sendmsg
run #3: crashed: BUG: soft lockup in sock_setsockopt
run #4: crashed: BUG: soft lockup in sock_setsockopt
run #5: crashed: BUG: soft lockup in sock_setsockopt
run #6: crashed: BUG: soft lockup in sock_setsockopt
run #7: crashed: BUG: soft lockup in sock_setsockopt
run #8: crashed: BUG: soft lockup in sock_setsockopt
run #9: crashed: BUG: soft lockup in sock_setsockopt
representative crash: BUG: soft lockup in sock_setsockopt, types: [HANG]
the chunk can be dropped
testing without sub-chunk 2/5
disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed
testing commit 4e1bc8d8e8ae84440fa6a9b1b78164a39c5ed0e1 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 9604bd743e1fe34ee15373d34b44c394e4106450b53728594b832f3d4888623e
run #0: crashed: BUG: soft lockup in sys_sendmsg
run #1: crashed: BUG: soft lockup in sock_setsockopt
run #2: crashed: BUG: soft lockup in tipc_release
run #3: crashed: BUG: soft lockup in sys_sendmsg
run #4: crashed: BUG: soft lockup in sock_setsockopt
run #5: crashed: BUG: soft lockup in sys_sendmsg
run #6: crashed: BUG: soft lockup in tipc_release
run #7: crashed: BUG: soft lockup in sock_setsockopt
run #8: crashed: BUG: soft lockup in sys_sendmsg
run #9: crashed: BUG: soft lockup in sock_setsockopt
representative crash: BUG: soft lockup in sys_sendmsg, types: [HANG]
the chunk can be dropped
testing without sub-chunk 3/5
disabling configs for [KASAN LOCKDEP ATOMIC_SLEEP LEAK UBSAN BUG], they are not needed
testing commit 4e1bc8d8e8ae84440fa6a9b1b78164a39c5ed0e1 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: eadbde18cbd35ddf1072f8ccd787f03e2c09ed24ee5c1e9fe94cb09e30b93b9e
run #0: crashed: BUG: soft lockup in sock_setsockopt
run #1: crashed: BUG: soft lockup in sock_setsockopt
run #2: crashed: BUG: soft lockup in sock_setsockopt
run #3: crashed: BUG: soft lockup in sys_sendmsg
run #4: crashed: BUG: soft lockup in tipc_release
run #5: crashed: BUG: soft lockup in sys_sendmsg
run #6: crashed: BUG: soft lockup in sys_sendmsg
run #7: crashed: BUG: soft lockup in tipc_release
run #8: crashed: BUG: soft lockup in sock_setsockopt
run #9: crashed: BUG: soft lockup in sock_setsockopt
representative crash: BUG: soft lockup in sock_setsockopt, types: [HANG]
the chunk can be dropped
testing without sub-chunk 4/5
disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed
testing commit 4e1bc8d8e8ae84440fa6a9b1b78164a39c5ed0e1 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: b8f32999033f49c651beb3ee1331554546184df55ee8c6bb80b6f6b5f93464a7
run #0: crashed: BUG: soft lockup in tipc_release
run #1: crashed: BUG: soft lockup in sock_setsockopt
run #2: crashed: BUG: soft lockup in sys_sendmsg
run #3: crashed: BUG: soft lockup in tipc_release
run #4: crashed: BUG: soft lockup in tipc_release
run #5: crashed: BUG: soft lockup in sock_setsockopt
run #6: crashed: BUG: soft lockup in sock_setsockopt
run #7: crashed: BUG: soft lockup in sock_setsockopt
run #8: crashed: BUG: soft lockup in sys_sendmsg
run #9: crashed: BUG: soft lockup in sock_setsockopt
representative crash: BUG: soft lockup in tipc_release, types: [HANG]
the chunk can be dropped
testing without sub-chunk 5/5
disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed
testing commit 4e1bc8d8e8ae84440fa6a9b1b78164a39c5ed0e1 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
failed building 4e1bc8d8e8ae84440fa6a9b1b78164a39c5ed0e1: net/socket.c:1128: undefined reference to `wext_handle_ioctl'
net/socket.c:3397: undefined reference to `compat_wext_handle_ioctl'
net/core/net-procfs.c:346: undefined reference to `wext_proc_exit'
net/core/net-procfs.c:330: undefined reference to `wext_proc_init'
minimized to 46 configs; suspects: [HID_ZEROPLUS USB_NET_GL620A USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL USB_SERIAL_FTDI_SIO USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_ZYDAS X86_X32 ZEROPLUS_FF]
disabling configs for [LOCKDEP ATOMIC_SLEEP LEAK UBSAN BUG KASAN], they are not needed
testing current HEAD e0b88ee5f09c4906ca93c2f0358c9fd1388f6b36
testing commit e0b88ee5f09c4906ca93c2f0358c9fd1388f6b36 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: d2c6a8383aa62b6bebc681369bfe6f6a836fc39539fd7bf844820eaac48bd404
run #0: crashed: BUG: soft lockup in sys_sendmsg
run #1: crashed: BUG: soft lockup in sys_sendmsg
run #2: crashed: BUG: soft lockup in sock_setsockopt
run #3: crashed: BUG: soft lockup in tipc_release
run #4: crashed: BUG: soft lockup in tipc_release
run #5: crashed: BUG: soft lockup in sock_setsockopt
run #6: crashed: BUG: soft lockup in sock_setsockopt
run #7: crashed: BUG: soft lockup in sock_setsockopt
run #8: crashed: BUG: soft lockup in sock_setsockopt
run #9: crashed: BUG: soft lockup in sys_sendmsg
representative crash: BUG: soft lockup in sys_sendmsg, types: [HANG]
crash still not fixed/happens on the oldest tested release
revisions tested: 7, total time: 2h37m0.130535964s (build: 1h28m44.172115282s, test: 1h6m35.940784737s)
crash still not fixed or there were kernel test errors
commit msg: Merge b44253956407 ("usb: xhci: Fix NULL pointer dereference on certain command aborts") into android13-5.10-lts
crash: BUG: soft lockup in sys_sendmsg
watchdog: BUG: soft lockup - CPU#0 stuck for 123s! [syz-executor.0:692]
Modules linked in:
CPU: 0 PID: 692 Comm: syz-executor.0 Not tainted 5.10.234-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:arch_safe_halt arch/x86/include/asm/irqflags.h:104 [inline]
RIP: 0010:kvm_wait arch/x86/kernel/kvm.c:923 [inline]
RIP: 0010:kvm_wait+0x3e/0x40 arch/x86/kernel/kvm.c:903
Code: 40 38 d6 74 03 50 9d c3 f6 c4 02 75 0f 0f 1f 44 00 00 0f 00 2d c1 71 15 01 f4 eb e9 0f 1f 44 00 00 0f 00 2d b2 71 15 01 fb f4 <eb> d9 8b 05 1a 8c b7 01 83 f8 ff 74 06 85 c0 0f 95 c0 c3 55 48 89
RSP: 0018:ffffc90000cf7be8 EFLAGS: 00000242
RAX: 0000000000000246 RBX: ffff888237c4b300 RCX: 0000000000000008
RDX: 0000000000000003 RSI: 0000000000000003 RDI: ffff888101384088
RBP: ffffc90000cf7c28 R08: ffff88823fff0940 R09: 0000000000000000
R10: 0000000000000001 R11: ffff888237c4b300 R12: ffff888101384088
R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000100
FS:  00007f24787296c0(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000000 CR3: 0000000110df4000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 </IRQ>
 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:554 [inline]
 queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:51 [inline]
 queued_spin_lock include/asm-generic/qspinlock.h:85 [inline]
 do_raw_spin_lock include/linux/spinlock.h:183 [inline]
 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:136 [inline]
 _raw_spin_lock_bh+0x39/0x40 kernel/locking/spinlock.c:175
 spin_lock_bh include/linux/spinlock.h:359 [inline]
 lock_sock_nested+0x19/0x60 net/core/sock.c:3117
 lock_sock include/net/sock.h:1648 [inline]
 tipc_sendstream+0x23/0x50 net/tipc/socket.c:1540
 sock_sendmsg_nosec net/socket.c:652 [inline]
 __sock_sendmsg+0x35/0x40 net/socket.c:664
 ____sys_sendmsg+0x23e/0x260 net/socket.c:2376
 ___sys_sendmsg+0x74/0xc0 net/socket.c:2430
 __sys_sendmsg+0x5d/0xb0 net/socket.c:2459
 __do_sys_sendmsg net/socket.c:2468 [inline]
 __se_sys_sendmsg net/socket.c:2466 [inline]
 __x64_sys_sendmsg+0x1a/0x20 net/socket.c:2466
 do_syscall_64+0x32/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f2478ba7e69
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f24787290c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f2478cd5f80 RCX: 00007f2478ba7e69
RDX: 0000000000000000 RSI: 0000000020000780 RDI: 0000000000000004
RBP: 00007f2478bf447a R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f2478cd5f80 R15: 00007ffd4a7d4778
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 693 Comm: syz-executor.0 Not tainted 5.10.234-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:arch_atomic_try_cmpxchg arch/x86/include/asm/atomic.h:202 [inline]
RIP: 0010:atomic_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:707 [inline]
RIP: 0010:queued_spin_lock include/asm-generic/qspinlock.h:82 [inline]
RIP: 0010:do_raw_spin_lock include/linux/spinlock.h:183 [inline]
RIP: 0010:__raw_spin_lock_bh include/linux/spinlock_api_smp.h:136 [inline]
RIP: 0010:_raw_spin_lock_bh+0x1d/0x40 kernel/locking/spinlock.c:175
Code: ff 4c 8b 65 f8 c9 c3 66 0f 1f 44 00 00 55 48 89 e5 53 48 89 fb bf 01 02 00 00 e8 9e de 3e ff 31 c0 ba 01 00 00 00 f0 0f b1 13 <75> 06 48 8b 5d f8 c9 c3 48 83 3d 33 de eb 00 00 74 0e 89 c6 48 89
RSP: 0018:ffffc9000109f978 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffc9000109fa9c RCX: 000000000000009c
RDX: 0000000000000001 RSI: ffffc9000109f9c0 RDI: 0000000000000201
RBP: ffffc9000109f980 R08: ffffc9000109f954 R09: 0000000000000001
R10: ffff888110d83e00 R11: ffff888109339000 R12: ffffc9000109fa9c
R13: ffff88810afe2480 R14: ffff888101384000 R15: ffffc9000109fa88
FS:  00007f24787086c0(0000) GS:ffff888237d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2478708d58 CR3: 0000000110df4000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <NMI>
 </NMI>
 spin_lock_bh include/linux/spinlock.h:359 [inline]
 tipc_skb_peek_port net/tipc/msg.h:1248 [inline]
 tipc_sk_rcv+0x53/0x740 net/tipc/socket.c:2487
 tipc_node_xmit+0x7d/0x5c0 net/tipc/node.c:1674
 tipc_node_xmit_skb net/tipc/node.c:1739 [inline]
 tipc_node_distr_xmit+0xe9/0x120 net/tipc/node.c:1754
 tipc_sk_rcv+0x2a0/0x740 net/tipc/socket.c:2497
 tipc_node_xmit+0x7d/0x5c0 net/tipc/node.c:1674
 tipc_sk_push_backlog+0x8f/0x150 net/tipc/socket.c:1306
 tipc_sk_conn_proto_rcv net/tipc/socket.c:1358 [inline]
 tipc_sk_proto_rcv net/tipc/socket.c:2156 [inline]
 tipc_sk_filter_rcv+0xc81/0xe00 net/tipc/socket.c:2350
 tipc_sk_enqueue net/tipc/socket.c:2442 [inline]
 tipc_sk_rcv+0x3bc/0x740 net/tipc/socket.c:2493
 tipc_node_xmit+0x7d/0x5c0 net/tipc/node.c:1674
 tipc_node_xmit_skb net/tipc/node.c:1739 [inline]
 tipc_node_distr_xmit+0xe9/0x120 net/tipc/node.c:1754
 tipc_sk_backlog_rcv+0x5d/0x80 net/tipc/socket.c:2410
 sk_backlog_rcv include/net/sock.h:1052 [inline]
 __release_sock+0x5f/0xa0 net/core/sock.c:2583
 release_sock+0x2b/0x90 net/core/sock.c:3134
 sock_setsockopt+0xe8/0xde0 net/core/sock.c:1257
 __sys_setsockopt+0x174/0x1a0 net/socket.c:2142
 __do_sys_setsockopt net/socket.c:2157 [inline]
 __se_sys_setsockopt net/socket.c:2154 [inline]
 __x64_sys_setsockopt+0x20/0x30 net/socket.c:2154
 do_syscall_64+0x32/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f2478ba7e69
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f24787080c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 00007f2478cd6050 RCX: 00007f2478ba7e69
RDX: 0000000000000021 RSI: 0000000000000001 RDI: 0000000000000003
RBP: 00007f2478bf447a R08: 0000000000000004 R09: 0000000000000000
R10: 0000000020000540 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f2478cd6050 R15: 00007ffd4a7d4778