ci starts bisection 2026-01-07 05:49:00.832091009 +0000 UTC m=+3606530.357577131 bisecting fixing commit since 6146a0f1dfae5d37442a9ddcba012add260bceb0 building syzkaller on 2c50b6a91afe391fad4d14f7b7d7167d570089dd ensuring issue is reproducible on original commit 6146a0f1dfae5d37442a9ddcba012add260bceb0 testing commit 6146a0f1dfae5d37442a9ddcba012add260bceb0 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 614f633c3d912caf8e1790592ef00067753ed877af8bd7a1cc897857ab451681 all runs: crashed: KASAN: user-memory-access Write in __destroy_inode representative crash: KASAN: user-memory-access Write in __destroy_inode, types: [KASAN-WRITE] check whether we can drop unnecessary instrumentation disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed testing commit 6146a0f1dfae5d37442a9ddcba012add260bceb0 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: e0a18e8035c2a1fb11c4131b120ad3ef11a2ff339050735071229aba2c7ddd78 all runs: crashed: KASAN: user-memory-access Write in __destroy_inode representative crash: KASAN: user-memory-access Write in __destroy_inode, types: [KASAN-WRITE] the bug reproduces without the instrumentation disabling configs for [atomic_sleep hang memleak ubsan bug_or_warning locking], they are not needed kconfig minimization: base=4116 full=8526 leaves diff=2154 split chunks (needed=false): <2154> split chunk #0 of len 2154 into 5 parts testing without sub-chunk 1/5 disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed testing commit 6146a0f1dfae5d37442a9ddcba012add260bceb0 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: e5ada2d960221d458cb2f7bfbc4845e2796a8871048526e26273713f2d24a787 all runs: crashed: KASAN: user-memory-access Write in __destroy_inode representative crash: KASAN: user-memory-access Write in __destroy_inode, types: [KASAN-WRITE] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [bug_or_warning locking atomic_sleep hang memleak ubsan], they are not needed testing commit 6146a0f1dfae5d37442a9ddcba012add260bceb0 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 2454196841099a5b66ab9a09eb31fead406c2578e0396967b885557bc3e1d360 all runs: crashed: KASAN: user-memory-access Write in __destroy_inode representative crash: KASAN: user-memory-access Write in __destroy_inode, types: [KASAN-WRITE] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [ubsan bug_or_warning locking atomic_sleep hang memleak], they are not needed testing commit 6146a0f1dfae5d37442a9ddcba012add260bceb0 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 8435e9c25d9bc7782312b962746988fb2b09dd4fd2ce4d3bd35342a79c6f0cf3 all runs: OK false negative chance: 0.000 testing without sub-chunk 4/5 disabling configs for [ubsan bug_or_warning locking atomic_sleep hang memleak], they are not needed testing commit 6146a0f1dfae5d37442a9ddcba012add260bceb0 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: fd6ede0b90836572810a6a4bc3b5958e204c4937ad1c737ec69aabe4ba2809ee all runs: crashed: KASAN: user-memory-access Write in __destroy_inode representative crash: KASAN: user-memory-access Write in __destroy_inode, types: [KASAN-WRITE] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed testing commit 6146a0f1dfae5d37442a9ddcba012add260bceb0 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: cb8e07a792bd1ef1a3fc00afc7cc056c5594645b635b322d4a6ca9c6ebbbd4e3 all runs: crashed: KASAN: user-memory-access Write in __destroy_inode representative crash: KASAN: user-memory-access Write in __destroy_inode, types: [KASAN-WRITE] the chunk can be dropped minimized to 431 configs; suspects: [AX25 BRIDGE BRIDGE_NETFILTER CAN CFG80211 CHECKPOINT_RESTORE DVB_CORE FB_CORE HAMRADIO HID_LOGITECH HSR INFINIBAND INFINIBAND_ADDR_TRANS INFINIBAND_USER_ACCESS INPUT_JOYSTICK INPUT_MOUSE IP6_NF_IPTABLES_LEGACY IP6_NF_MANGLE IP6_NF_RAW IPV6_MULTIPLE_TABLES IP_NF_FILTER IP_NF_IPTABLES_LEGACY IP_NF_MANGLE IP_NF_NAT IP_NF_RAW IP_NF_SECURITY IP_NF_TARGET_ECN IP_NF_TARGET_MASQUERADE IP_NF_TARGET_NETMAP IP_NF_TARGET_REDIRECT IP_NF_TARGET_REJECT IP_NF_TARGET_SYNPROXY IP_NF_TARGET_TTL IP_ROUTE_CLASSID IP_SET IP_SET_BITMAP_IP IP_SET_BITMAP_IPMAC IP_SET_BITMAP_PORT IP_SET_HASH_IP IP_SET_HASH_IPMAC IP_SET_HASH_IPMARK IP_SET_HASH_IPPORT IP_SET_HASH_IPPORTIP IP_SET_HASH_IPPORTNET IP_SET_HASH_MAC IP_SET_HASH_NET IP_SET_HASH_NETIFACE IP_SET_HASH_NETNET IP_SET_HASH_NETPORT IP_SET_HASH_NETPORTNET IP_SET_LIST_SET IP_VS IP_VS_DH IP_VS_FO IP_VS_FTP IP_VS_IPV6 IP_VS_LBLC IP_VS_LBLCR IP_VS_LC IP_VS_MH IP_VS_NFCT IP_VS_NQ IP_VS_OVF IP_VS_PE_SIP IP_VS_PROTO_AH IP_VS_PROTO_AH_ESP IP_VS_PROTO_ESP IP_VS_PROTO_SCTP IP_VS_PROTO_TCP IP_VS_PROTO_UDP IP_VS_RR IP_VS_SED IP_VS_SH IP_VS_TWOS IP_VS_WLC IP_VS_WRR IRQ_BYPASS_MANAGER IRQ_POLL IR_IGORPLUGUSB IR_IGUANA IR_IMON IR_IMON_RAW IR_MCEUSB IR_REDRAT3 IR_STREAMZAP IR_TOY IR_TTUSBIR ISDN ISDN_CAPI JFFS2_CMODE_PRIORITY JFFS2_COMPRESSION_OPTIONS JFFS2_FS JFFS2_FS_POSIX_ACL JFFS2_FS_SECURITY JFFS2_FS_WRITEBUFFER JFFS2_FS_XATTR JFFS2_LZO JFFS2_RTIME JFFS2_RUBIN JFFS2_SUMMARY JFFS2_ZLIB JFS_DEBUG JFS_FS JFS_POSIX_ACL JFS_SECURITY JOYSTICK_IFORCE JOYSTICK_IFORCE_USB JOYSTICK_PXRC JOYSTICK_XPAD JOYSTICK_XPAD_FF JOYSTICK_XPAD_LEDS KARMA_PARTITION KCOV KCOV_ENABLE_COMPARISONS KCOV_INSTRUMENT_ALL KEYS_REQUEST_CACHE KEY_DH_OPERATIONS KEY_NOTIFICATIONS KSM KVM KVM_AMD KVM_ASYNC_PF KVM_COMMON KVM_COMPAT KVM_ELIDE_TLB_FLUSH_IF_YOUNG KVM_GENERIC_DIRTYLOG_READ_PROTECT KVM_GENERIC_HARDWARE_ENABLING KVM_GENERIC_MEMORY_ATTRIBUTES KVM_GENERIC_MMU_NOTIFIER KVM_GENERIC_PRE_FAULT_MEMORY KVM_GUEST_MEMFD KVM_HYPERV KVM_IOAPIC KVM_MMIO KVM_MMU_LOCKLESS_AGING KVM_PROVE_MMU KVM_SW_PROTECTED_VM KVM_VFIO KVM_X86 KVM_XEN L2TP L2TP_ETH L2TP_IP L2TP_V3 LAPB LAPBETHER LDM_PARTITION LEDS_CLASS_MULTICOLOR LEGACY_PTYS LIBNVDIMM LINEAR_RANGES LLC LLC2 LOGIG940_FF LOGIRUMBLEPAD2_FF LOGITECH_FF LOGIWHEELS_FF LOGO LOGO_LINUX_MONO LOGO_LINUX_VGA16 LPC_ICH LWTUNNEL LWTUNNEL_BPF LZ4HC_COMPRESS LZ4_COMPRESS MAC80211 MAC80211_HAS_RC MAC80211_HWSIM MAC80211_MESH MAC80211_RC_DEFAULT_MINSTREL MAC80211_RC_MINSTREL MACSEC MACVLAN MACVTAP MAC_PARTITION MAPPING_DIRTY_HELPERS MCTP MDIO_MVUSB MD_RAID0 MD_RAID1 MD_RAID10 MD_RAID456 MEDIA_ANALOG_TV_SUPPORT MEDIA_ATTACH MEDIA_CONTROLLER MEDIA_CONTROLLER_DVB MEDIA_DIGITAL_TV_SUPPORT MEDIA_RADIO_SUPPORT MEDIA_SDR_SUPPORT MEDIA_SUPPORT MEDIA_SUPPORT_FILTER MEDIA_TUNER MEDIA_TUNER_MSI001 MEMORY_BALLOON MEMORY_HOTPLUG MEMORY_ISOLATION MEMREGION MEMSTICK MEMSTICK_REALTEK_USB MEM_SOFT_DIRTY MFD_CORE MFD_SYSCON MHI_BUS MHI_WWAN_CTRL MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO MHP_MEMMAP_ON_MEMORY MICROCHIP_PHY MINIX_FS MINIX_SUBPARTITION MISC_RTSX MISC_RTSX_USB MISDN MISDN_DSP MISDN_HFCUSB MISDN_L1OIP MKISS MLX4_CORE MLX4_INFINIBAND MMC MMC_REALTEK_USB MMC_USHC MMC_VUB300 MM_ID MODULE_SRCVERSION_ALL MOST MOST_USB_HDM MOUSE_APPLETOUCH MOUSE_BCM5974 MOUSE_PS2 MOUSE_PS2_ALPS MOUSE_PS2_BYD MOUSE_PS2_CYPRESS MOUSE_PS2_FOCALTECH MOUSE_PS2_LIFEBOOK MOUSE_PS2_LOGIPS2PP MOUSE_PS2_SMBUS MOUSE_PS2_SYNAPTICS MOUSE_PS2_SYNAPTICS_SMBUS MOUSE_PS2_TRACKPOINT MOUSE_SYNAPTICS_USB MPLS MPLS_IPTUNNEL MPLS_ROUTING MPTCP MPTCP_IPV6 MRP MTD MTD_BLKDEVS MTD_BLOCK MTD_BLOCK2MTD MTD_CFI_I1 MTD_CFI_I2 MTD_MAP_BANK_WIDTH_1 MTD_MAP_BANK_WIDTH_2 MTD_MAP_BANK_WIDTH_4 MTD_MTDRAM MTD_PHRAM MTD_SLRAM MUSB_PIO_ONLY ND_BTT ND_CLAIM ND_PFN NETDEVSIM NETFILTER_ADVANCED NETFILTER_BPF_LINK NETFILTER_FAMILY_ARP NETFILTER_FAMILY_BRIDGE NETFILTER_NETLINK_ACCT NETFILTER_NETLINK_GLUE_CT NETFILTER_NETLINK_OSF NETFILTER_NETLINK_QUEUE NETFILTER_SYNPROXY NETFILTER_XTABLES_COMPAT NETFILTER_XTABLES_LEGACY NETFILTER_XT_CONNMARK NETFILTER_XT_MATCH_BPF NETFILTER_XT_MATCH_CGROUP NETFILTER_XT_MATCH_CLUSTER NETFILTER_XT_MATCH_COMMENT NETFILTER_XT_MATCH_CONNBYTES NETFILTER_XT_MATCH_CONNLABEL NETFILTER_XT_MATCH_CONNLIMIT NETFILTER_XT_MATCH_CONNMARK NETFILTER_XT_MATCH_CPU NETFILTER_XT_MATCH_DCCP NETFILTER_XT_MATCH_DEVGROUP NETFILTER_XT_MATCH_DSCP NETFILTER_XT_MATCH_ECN NETFILTER_XT_MATCH_ESP NETFILTER_XT_MATCH_HASHLIMIT NETFILTER_XT_MATCH_HELPER NETFILTER_XT_MATCH_HL NETFILTER_XT_MATCH_IPCOMP NETFILTER_XT_MATCH_IPRANGE NETFILTER_XT_MATCH_IPVS NETFILTER_XT_MATCH_L2TP NETFILTER_XT_MATCH_LENGTH NETFILTER_XT_MATCH_LIMIT NETFILTER_XT_MATCH_MAC NETFILTER_XT_MATCH_MARK NETFILTER_XT_MATCH_MULTIPORT NETFILTER_XT_MATCH_NFACCT NETFILTER_XT_MATCH_OSF NETFILTER_XT_MATCH_OWNER NETFILTER_XT_MATCH_PHYSDEV NETFILTER_XT_MATCH_PKTTYPE NETFILTER_XT_MATCH_QUOTA NETFILTER_XT_MATCH_RATEEST NETFILTER_XT_MATCH_REALM NETFILTER_XT_MATCH_RECENT NETFILTER_XT_MATCH_SCTP NETFILTER_XT_MATCH_SOCKET NETFILTER_XT_MATCH_STATISTIC NETFILTER_XT_MATCH_STRING NETFILTER_XT_MATCH_TCPMSS NETFILTER_XT_MATCH_TIME NETFILTER_XT_MATCH_U32 NETFILTER_XT_NAT NETFILTER_XT_SET NETFILTER_XT_TARGET_AUDIT NETFILTER_XT_TARGET_CHECKSUM NETFILTER_XT_TARGET_CLASSIFY NETFILTER_XT_TARGET_CONNMARK NETFILTER_XT_TARGET_CT NETFILTER_XT_TARGET_DSCP NETFILTER_XT_TARGET_HL NETFILTER_XT_TARGET_HMARK NETFILTER_XT_TARGET_IDLETIMER NETFILTER_XT_TARGET_LED NETFILTER_XT_TARGET_MARK NETFILTER_XT_TARGET_NETMAP NETFILTER_XT_TARGET_NFQUEUE NETFILTER_XT_TARGET_NOTRACK NETFILTER_XT_TARGET_RATEEST NETFILTER_XT_TARGET_REDIRECT NETFILTER_XT_TARGET_TCPOPTSTRIP NETFILTER_XT_TARGET_TEE NETFILTER_XT_TARGET_TPROXY NETFILTER_XT_TARGET_TRACE NETLABEL NETLINK_DIAG NETROM NET_9P_RDMA NET_ACT_BPF NET_ACT_CONNMARK NET_ACT_CSUM NET_ACT_CT NET_ACT_CTINFO NET_ACT_GATE NET_ACT_IFE NET_ACT_MPLS NET_ACT_NAT NET_ACT_PEDIT NET_ACT_POLICE NET_ACT_SAMPLE NET_ACT_SIMP NET_ACT_SKBEDIT NET_ACT_SKBMOD NET_ACT_TUNNEL_KEY NET_ACT_VLAN NET_CLS_BASIC NET_CLS_BPF NET_CLS_FLOW NET_CLS_FLOWER NET_CLS_FW NET_CLS_MATCHALL NET_CLS_ROUTE4 NET_CRC32C NET_DEVLINK NET_DROP_MONITOR NET_DSA NET_DSA_TAG_BRCM NET_DSA_TAG_BRCM_COMMON NET_DSA_TAG_BRCM_PREPEND NET_DSA_TAG_MTK NET_DSA_TAG_QCA NET_DSA_TAG_RTL4_A NET_EMATCH_CANID NET_EMATCH_CMP NET_EMATCH_IPSET NET_EMATCH_IPT NET_EMATCH_META NET_EMATCH_NBYTE NET_EMATCH_TEXT NET_EMATCH_U32 NET_FC NET_FOU NET_FOU_IP_TUNNELS NET_IFE NET_IFE_SKBMARK NET_IFE_SKBPRIO NET_IFE_SKBTCINDEX NET_IPGRE NET_IPGRE_BROADCAST NET_IPGRE_DEMUX NET_IPIP NET_IPVTI NET_KEY NET_KEY_MIGRATE NET_L3_MASTER_DEV NET_MPLS_GSO NET_NCSI NET_NSH NET_REDIRECT NET_SCH_CAKE NET_SCH_CBS NET_SCH_CHOKE NET_SCH_CODEL NET_SCH_DRR NET_SCH_ETF NET_SCH_ETS NET_SCH_FQ NET_SCH_FQ_CODEL NET_SCH_FQ_PIE NET_SCH_GRED NET_SCH_HFSC NET_SCH_HHF NET_SCH_HTB NET_SCH_INGRESS NET_SCH_MQPRIO NET_SCH_MQPRIO_LIB NET_SCH_MULTIQ NET_SCH_NETEM NET_SCH_PIE NET_SCH_PLUG NET_SCH_PRIO NET_SCH_QFQ NET_SCH_RED NET_SCH_SFB NET_SCH_SFQ NET_SCH_SKBPRIO NET_SCH_TAPRIO NET_SCH_TBF NET_SCH_TEQL NET_SHAPER NET_SOCK_MSG NET_SWITCHDEV NET_TC_SKB_EXT NET_TEAM NET_TEAM_MODE_ACTIVEBACKUP NET_TEAM_MODE_BROADCAST NET_TEAM_MODE_LOADBALANCE NET_TEAM_MODE_RANDOM NET_TEAM_MODE_ROUNDROBIN NET_UDP_TUNNEL NET_VRF NFC NFC_DIGITAL NFC_FDP NFC_HCI NFC_MRVL NFC_MRVL_USB NFC_NCI NFC_NCI_UART NFC_PN533 NFC_PN533_USB NFC_PORT100 NFC_SHDLC NFC_SIM NFC_VIRTUAL_NCI NFSD NFSD_BLOCKLAYOUT NFSD_FLEXFILELAYOUT NFSD_PNFS NFSD_SCSILAYOUT NFSD_V3_ACL NFSD_V4 NFSD_V4_2_INTER_SSC NFSD_V4_SECURITY_LABEL NFS_FSCACHE NFS_V4_1 NFS_V4_2 NFS_V4_2_READ_PLUS NFS_V4_2_SSC_HELPER NFS_V4_SECURITY_LABEL NFT_BRIDGE_META NFT_BRIDGE_REJECT NFT_COMPAT NFT_CONNLIMIT NFT_CT NFT_DUP_IPV4 NFT_DUP_IPV6 NFT_DUP_NETDEV NFT_EXTHDR_DCCP NFT_FIB NFT_FIB_INET NFT_FIB_IPV4 NFT_FIB_IPV6 NFT_FIB_NETDEV NFT_FLOW_OFFLOAD NFT_HASH NFT_LIMIT NFT_LOG NFT_MASQ NFT_NAT NFT_NUMGEN NFT_OSF NFT_QUEUE NFT_QUOTA NFT_REDIR NFT_REJECT NFT_REJECT_INET NFT_REJECT_IPV4 NFT_REJECT_IPV6 NFT_REJECT_NETDEV NFT_SOCKET NFT_SYNPROXY NFT_TPROXY NFT_TUNNEL NFT_XFRM NF_CONNTRACK_AMANDA NF_CONNTRACK_BRIDGE NF_CONNTRACK_BROADCAST NF_CONNTRACK_EVENTS NF_CONNTRACK_H323 NF_CONNTRACK_LABELS NF_CONNTRACK_MARK NF_CONNTRACK_NETBIOS_NS NF_CONNTRACK_OVS NF_CONNTRACK_PPTP NF_CONNTRACK_SANE NF_CONNTRACK_TFTP NF_CONNTRACK_TIMEOUT NF_CONNTRACK_TIMESTAMP NF_CONNTRACK_ZONES NF_CT_NETLINK_HELPER NF_CT_NETLINK_TIMEOUT NF_CT_PROTO_GRE NF_CT_PROTO_SCTP NF_FLOW_TABLE NF_TABLES NF_TABLES_BRIDGE NF_TABLES_INET NF_TABLES_IPV4 NF_TABLES_IPV6 NF_TABLES_NETDEV PARTITION_ADVANCED PSAMPLE RC_CORE RC_DEVICES RFKILL SPI USB_GADGET USB_MUSB_HDRC VIDEO_DEV WAN WATCH_QUEUE WIRELESS WLAN WWAN X25] disabling configs for [memleak ubsan bug_or_warning locking atomic_sleep hang], they are not needed testing current HEAD f0b9d8eb98dfee8d00419aa07543bdc2c1a44fb1 testing commit f0b9d8eb98dfee8d00419aa07543bdc2c1a44fb1 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 7bb6b1591025af2e1afec99e4537f540172c7d5eee0933aff5fbf519b8c4c01a all runs: OK false negative chance: 0.000 # git bisect start f0b9d8eb98dfee8d00419aa07543bdc2c1a44fb1 6146a0f1dfae5d37442a9ddcba012add260bceb0 Bisecting: 7331 revisions left to test after this (roughly 13 steps) [6dfafbd0299a60bfb5d5e277fdf100037c7ded07] Merge tag 'drm-next-2025-12-03' of https://gitlab.freedesktop.org/drm/kernel determine whether the revision contains the guilty commit revision 6146a0f1dfae5d37442a9ddcba012add260bceb0 crashed and is reachable testing commit 6dfafbd0299a60bfb5d5e277fdf100037c7ded07 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 16865b7eb38ebb0f4845a29fde981cd140bb25ae78b5b876f2d5ddec2dabb39f all runs: OK false negative chance: 0.000 # git bisect bad 6dfafbd0299a60bfb5d5e277fdf100037c7ded07 Bisecting: 4339 revisions left to test after this (roughly 12 steps) [015e7b0b0e8e51f7321ec2aafc1d7fc0a8a5536f] Merge tag 'bpf-next-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next determine whether the revision contains the guilty commit revision 6146a0f1dfae5d37442a9ddcba012add260bceb0 crashed and is reachable testing commit 015e7b0b0e8e51f7321ec2aafc1d7fc0a8a5536f gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 14ec7313bf6b29c4fb03da312842b59da6692887f395ca89698414f363835bc7 all runs: OK false negative chance: 0.000 # git bisect bad 015e7b0b0e8e51f7321ec2aafc1d7fc0a8a5536f Bisecting: 1728 revisions left to test after this (roughly 11 steps) [63e6995005be8ceb8a1d56a18df1a1a40c28356d] Merge tag 'objtool-core-2025-12-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip determine whether the revision contains the guilty commit revision 6146a0f1dfae5d37442a9ddcba012add260bceb0 crashed and is reachable testing commit 63e6995005be8ceb8a1d56a18df1a1a40c28356d gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: f9fab242306c0ed3a4cc1759339772e769b892d188ca76e830f5c33f7d071f8e all runs: OK false negative chance: 0.000 # git bisect bad 63e6995005be8ceb8a1d56a18df1a1a40c28356d Bisecting: 890 revisions left to test after this (roughly 10 steps) [7e29f077609413f94f70d4da4d7602a59abad991] Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi determine whether the revision contains the guilty commit revision 6146a0f1dfae5d37442a9ddcba012add260bceb0 crashed and is reachable testing commit 7e29f077609413f94f70d4da4d7602a59abad991 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: e13ee9700db7767a6a5fc1464cefffd51999c1d12d1e74580c1b938b18655154 all runs: crashed: KASAN: user-memory-access Write in __destroy_inode representative crash: KASAN: user-memory-access Write in __destroy_inode, types: [KASAN-WRITE] # git bisect good 7e29f077609413f94f70d4da4d7602a59abad991 Bisecting: 396 revisions left to test after this (roughly 9 steps) [415d34b92c1f921a9ff3c38f56319cbc5536f642] Merge tag 'namespace-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs determine whether the revision contains the guilty commit revision 7e29f077609413f94f70d4da4d7602a59abad991 crashed and is reachable testing commit 415d34b92c1f921a9ff3c38f56319cbc5536f642 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 3aba9e8dcd33b3e5207c27e1e7c5b247e245b9b7f527cfb1ac2d72fd4d076a59 all runs: crashed: KASAN: user-memory-access Write in __destroy_inode representative crash: KASAN: user-memory-access Write in __destroy_inode, types: [KASAN-WRITE] # git bisect good 415d34b92c1f921a9ff3c38f56319cbc5536f642 Bisecting: 197 revisions left to test after this (roughly 8 steps) [d0deeb803cd65c41c37ac106063c46c51d5d43ab] Merge tag 'vfs-6.19-rc1.ovl' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs determine whether the revision contains the guilty commit revision 7e29f077609413f94f70d4da4d7602a59abad991 crashed and is reachable testing commit d0deeb803cd65c41c37ac106063c46c51d5d43ab gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: ba693939021dc5a116ec1acc52e94209f6fcfe9709ad34c4606d8a1d68258404 all runs: OK false negative chance: 0.000 # git bisect bad d0deeb803cd65c41c37ac106063c46c51d5d43ab Bisecting: 98 revisions left to test after this (roughly 7 steps) [5c06bc9f060ce48aa87cabdcf3d9d6995362e501] Merge patch series "ovl: convert to cred guard" determine whether the revision contains the guilty commit checking the merge base dcb6fa37fd7bc9c3d2b066329b0d27dedf8becaa no existing result, test the revision testing commit dcb6fa37fd7bc9c3d2b066329b0d27dedf8becaa gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 62c63f8065bdc72498a542f28df74722a54da6be9cb54bf8b6b5c17fc6d514dd all runs: crashed: KASAN: user-memory-access Write in __destroy_inode representative crash: KASAN: user-memory-access Write in __destroy_inode, types: [KASAN-WRITE] testing commit 5c06bc9f060ce48aa87cabdcf3d9d6995362e501 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 5d8d3bb7d7f4c44ae0d433441832880caf13b211ff515609ed2546bec3b2e824 all runs: crashed: KASAN: user-memory-access Write in __destroy_inode representative crash: KASAN: user-memory-access Write in __destroy_inode, types: [KASAN-WRITE] # git bisect good 5c06bc9f060ce48aa87cabdcf3d9d6995362e501 Bisecting: 52 revisions left to test after this (roughly 6 steps) [afdf0fb340948a8c0f581ed1dc42828af89b80b6] Merge tag 'vfs-6.19-rc1.fs_header' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs determine whether the revision contains the guilty commit revision 7e29f077609413f94f70d4da4d7602a59abad991 crashed and is reachable testing commit afdf0fb340948a8c0f581ed1dc42828af89b80b6 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 6a6fb8f8ef1731d18ced2cfa77ebc65f3c35ac85647e7b70012e7056bf2baadc all runs: OK false negative chance: 0.000 # git bisect bad afdf0fb340948a8c0f581ed1dc42828af89b80b6 Bisecting: 22 revisions left to test after this (roughly 5 steps) [a45ff1c7c9e9447ffca83a9d219c50e9eb8bdaeb] Merge patch series "coredump: cleanups & pidfd extension" determine whether the revision contains the guilty commit checking the merge base 3a8660878839faadb4f1a6dd72c3179c1df56787 no existing result, test the revision testing commit 3a8660878839faadb4f1a6dd72c3179c1df56787 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: b387a4a6696ecdfa141272874cc4584b2434b9986b59d9892facaedd2a80302c all runs: crashed: KASAN: user-memory-access Write in __destroy_inode representative crash: KASAN: user-memory-access Write in __destroy_inode, types: [KASAN-WRITE] testing commit a45ff1c7c9e9447ffca83a9d219c50e9eb8bdaeb gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 0b841e3abc13d76a56fabf5529636f2d51f523abb9c6c24ae45e1d236a1a0b12 all runs: crashed: KASAN: user-memory-access Write in __destroy_inode representative crash: KASAN: user-memory-access Write in __destroy_inode, types: [KASAN-WRITE] # git bisect good a45ff1c7c9e9447ffca83a9d219c50e9eb8bdaeb Bisecting: 11 revisions left to test after this (roughly 4 steps) [a77a59592febd4179efa6b59f2ef5bdfe9a5b895] Merge patch series "Add and use folio_next_pos()" determine whether the revision contains the guilty commit revision 3a8660878839faadb4f1a6dd72c3179c1df56787 crashed and is reachable testing commit a77a59592febd4179efa6b59f2ef5bdfe9a5b895 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: d3f411f580d8b708b5369258a30d7d5dd5820d323392895f20d44ebbb62c758b all runs: crashed: KASAN: user-memory-access Write in __destroy_inode representative crash: KASAN: user-memory-access Write in __destroy_inode, types: [KASAN-WRITE] # git bisect good a77a59592febd4179efa6b59f2ef5bdfe9a5b895 Bisecting: 5 revisions left to test after this (roughly 3 steps) [dca3aa666fbd71118905d88bb1c353881002b647] fs: move inode fields used during fast path lookup closer together determine whether the revision contains the guilty commit revision dcb6fa37fd7bc9c3d2b066329b0d27dedf8becaa crashed and is reachable testing commit dca3aa666fbd71118905d88bb1c353881002b647 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: d82e1494b535bc642626b6367e91cc7d4e083f6dfca241a3ed1253219d7d5944 all runs: OK false negative chance: 0.000 # git bisect bad dca3aa666fbd71118905d88bb1c353881002b647 Bisecting: 2 revisions left to test after this (roughly 2 steps) [f7b3d14165222a3ad9c4d0d31dfa81e396751801] fs: add fs/super.h header determine whether the revision contains the guilty commit revision 3a8660878839faadb4f1a6dd72c3179c1df56787 crashed and is reachable testing commit f7b3d14165222a3ad9c4d0d31dfa81e396751801 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 6219bc8f45f1977bd1877e4f6fe349603e8a72d43414c5f03c29c7defb19a0cf all runs: crashed: KASAN: user-memory-access Write in __destroy_inode representative crash: KASAN: user-memory-access Write in __destroy_inode, types: [KASAN-WRITE] # git bisect good f7b3d14165222a3ad9c4d0d31dfa81e396751801 Bisecting: 0 revisions left to test after this (roughly 1 step) [5b8ed52866e3d19e02860c7cf1d6bbbd70b619e9] fs: inline current_umask() and move it to fs_struct.h determine whether the revision contains the guilty commit revision dcb6fa37fd7bc9c3d2b066329b0d27dedf8becaa crashed and is reachable testing commit 5b8ed52866e3d19e02860c7cf1d6bbbd70b619e9 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: d69e919491bd3ed4ec07590eb04d9bf9733fc97f62fc4d61d13ceb57f1a478a1 all runs: crashed: KASAN: user-memory-access Write in __destroy_inode representative crash: KASAN: user-memory-access Write in __destroy_inode, types: [KASAN-WRITE] # git bisect good 5b8ed52866e3d19e02860c7cf1d6bbbd70b619e9 dca3aa666fbd71118905d88bb1c353881002b647 is the first bad commit commit dca3aa666fbd71118905d88bb1c353881002b647 Author: Mateusz Guzik Date: Sun Nov 9 13:19:31 2025 +0100 fs: move inode fields used during fast path lookup closer together This should avoid *some* cache misses. Successful path lookup is guaranteed to load at least ->i_mode, ->i_opflags and ->i_acl. At the same time the common case will avoid looking at more fields. struct inode is not guaranteed to have any particular alignment, notably ext4 has it only aligned to 8 bytes meaning nearby fields might happen to be on the same or only adjacent cache lines depending on luck (or no luck). According to pahole: umode_t i_mode; /* 0 2 */ short unsigned int i_opflags; /* 2 2 */ kuid_t i_uid; /* 4 4 */ kgid_t i_gid; /* 8 4 */ unsigned int i_flags; /* 12 4 */ struct posix_acl * i_acl; /* 16 8 */ struct posix_acl * i_default_acl; /* 24 8 */ ->i_acl is unnecessarily separated by 8 bytes from the other fields. With struct inode being offset 48 bytes into the cacheline this means an avoidable miss. Note it will still be there for the 56 byte case. New layout: umode_t i_mode; /* 0 2 */ short unsigned int i_opflags; /* 2 2 */ unsigned int i_flags; /* 4 4 */ struct posix_acl * i_acl; /* 8 8 */ struct posix_acl * i_default_acl; /* 16 8 */ kuid_t i_uid; /* 24 4 */ kgid_t i_gid; /* 28 4 */ I verified with pahole there are no size or hole changes. This is stopgap until someone(tm) sanitizes the layout in the first place, allocation methods aside. Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20251109121931.1285366-1-mjguzik@gmail.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner include/linux/fs.h | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) accumulated error probability: 0.00 culprit signature: d82e1494b535bc642626b6367e91cc7d4e083f6dfca241a3ed1253219d7d5944 parent signature: d69e919491bd3ed4ec07590eb04d9bf9733fc97f62fc4d61d13ceb57f1a478a1 revisions tested: 23, total time: 9h7m45.872077711s (build: 5h26m8.530320253s, test: 2h54m58.73744849s) first good commit: dca3aa666fbd71118905d88bb1c353881002b647 fs: move inode fields used during fast path lookup closer together recipients (to): ["brauner@kernel.org" "jack@suse.cz" "mjguzik@gmail.com"] recipients (cc): []