ci2 starts bisection 2024-10-08 16:27:36.383202311 +0000 UTC m=+46131.984560231 bisecting fixing commit since 79436849ef1d9468c94af4c5b45478217aa9030d building syzkaller on 6f4edef43e90da260aa93c16da223a2a5569c978 ensuring issue is reproducible on original commit 79436849ef1d9468c94af4c5b45478217aa9030d testing commit 79436849ef1d9468c94af4c5b45478217aa9030d gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 37db482a43c088ec9f2e585999b08d820387edb651b769d8aa61ffe8fd48f4a3 all runs: crashed: UBSAN: shift-out-of-bounds in parse_audio_unit representative crash: UBSAN: shift-out-of-bounds in parse_audio_unit, types: [UBSAN] check whether we can drop unnecessary instrumentation disabling configs for [HANG LEAK BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 79436849ef1d9468c94af4c5b45478217aa9030d gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 4ad04a0b05c17147a173e30e169ee16aececac118368136059bea0475593d54d all runs: crashed: UBSAN: shift-out-of-bounds in parse_audio_unit representative crash: UBSAN: shift-out-of-bounds in parse_audio_unit, types: [UBSAN] the bug reproduces without the instrumentation disabling configs for [BUG KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed kconfig minimization: base=5179 full=6542 leaves diff=262 split chunks (needed=false): <262> split chunk #0 of len 262 into 5 parts testing without sub-chunk 1/5 disabling configs for [HANG LEAK BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 79436849ef1d9468c94af4c5b45478217aa9030d gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: b478b66f0c98e43d35bdb322e474a283df77dbc985d307b9b8c5e1add3fe3e7f all runs: crashed: UBSAN: shift-out-of-bounds in parse_audio_unit representative crash: UBSAN: shift-out-of-bounds in parse_audio_unit, types: [UBSAN] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [HANG LEAK BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 79436849ef1d9468c94af4c5b45478217aa9030d gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 387cc3dae510974a5048b9d42ee52baf39a7d1b40c1e4e0decd09a11c33f212e all runs: crashed: UBSAN: shift-out-of-bounds in parse_audio_unit representative crash: UBSAN: shift-out-of-bounds in parse_audio_unit, types: [UBSAN] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [BUG KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing commit 79436849ef1d9468c94af4c5b45478217aa9030d gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 7152b2f3a4e76bb859ad8e33faf76f55b52dccde99e14889bb38e29d10652667 all runs: OK false negative chance: 0.000 testing without sub-chunk 4/5 disabling configs for [ATOMIC_SLEEP HANG LEAK BUG KASAN LOCKDEP], they are not needed testing commit 79436849ef1d9468c94af4c5b45478217aa9030d gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 7da7a7ae2cc2881568f9bf0e3a289432f4a79b26d6da99319fc6e2628b0c9b56 all runs: crashed: UBSAN: shift-out-of-bounds in parse_audio_unit representative crash: UBSAN: shift-out-of-bounds in parse_audio_unit, types: [UBSAN] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK BUG KASAN], they are not needed testing commit 79436849ef1d9468c94af4c5b45478217aa9030d gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 failed building 79436849ef1d9468c94af4c5b45478217aa9030d: net/socket.c:1245: undefined reference to `wext_handle_ioctl' net/socket.c:3442: undefined reference to `compat_wext_handle_ioctl' net/core/net-procfs.c:329: undefined reference to `wext_proc_init' net/core/net-procfs.c:345: undefined reference to `wext_proc_exit' minimized to 103 configs; suspects: [DRM HAVE_CLK HID_PANTHERLORD HID_SMARTJOYPLUS HID_THRUSTMASTER HID_ZEROPLUS INPUT_TABLET MEDIA_RADIO_SUPPORT PAHOLE_HAS_BTF_TAG PAHOLE_HAS_LANG_EXCLUDE PANTHERLORD_FF PM_CLK RADIO_ADAPTERS REGMAP_SPI RESET_CONTROLLER RFKILL RFKILL_LEDS RMI4_2D_SENSOR RMI4_CORE RMI4_F03 RMI4_F03_SERIO RMI4_F11 RMI4_F12 RMI4_F30 SMARTJOYPLUS_FF SMSC_PHY SND SND_COMPRESS_OFFLOAD SND_CTL_FAST_LOOKUP SND_DMAENGINE_PCM SND_DMA_SGBUF SND_DYNAMIC_MINORS SND_HRTIMER SND_HWDEP SND_INTEL_DSP_CONFIG SND_INTEL_SOUNDWIRE_ACPI SND_PCI SND_PCM SND_PCM_TIMER SND_PROC_FS SND_RAWMIDI SND_SOC SND_SOC_ACPI SND_SOC_ACPI_INTEL_MATCH SND_SOC_COMPRESS SND_SOC_GENERIC_DMAENGINE_PCM SND_SOC_I2C_AND_SPI SND_SOC_INTEL_MACH SND_SOC_INTEL_SST_TOPLEVEL SND_SOC_TOPOLOGY SND_SPI SND_SST_ATOM_HIFI2_PLATFORM SND_SST_ATOM_HIFI2_PLATFORM_ACPI SND_TIMER SND_USB SND_USB_AUDIO SND_USB_AUDIO_USE_MEDIA_CONTROLLER SND_X86 SOUND TABLET_USB_ACECAD TABLET_USB_AIPTEK TABLET_USB_HANWANG TABLET_USB_KBTAB THRUSTMASTER_FF TYPEC_DP_ALTMODE TYPEC_FUSB302 USB_ARMLINUX USB_BELKIN USB_CONFIGFS USB_CONFIGFS_ACM USB_NET_CDC_SUBSET USB_NET_GL620A USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM V4L2_ASYNC V4L2_FWNODE VIDEO_CAMERA_SENSOR WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_PURELIFI WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_SILABS WLAN_VENDOR_ZYDAS X86_X32_ABI ZEROPLUS_FF] disabling configs for [HANG LEAK BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing current HEAD 0e8b65e41ffd6d3c08af4c826bc62dc2a6a8f9e2 testing commit 0e8b65e41ffd6d3c08af4c826bc62dc2a6a8f9e2 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 36b57b2c58e2315c633a7170c9c098a71d0083c10c8a552209f55211425700b4 all runs: crashed: UBSAN: shift-out-of-bounds in parse_audio_unit representative crash: UBSAN: shift-out-of-bounds in parse_audio_unit, types: [UBSAN] crash still not fixed/happens on the oldest tested release revisions tested: 7, total time: 2h39m24.04285476s (build: 1h59m28.27617937s, test: 33m27.436464442s) crash still not fixed or there were kernel test errors commit msg: ANDROID: sched: Make uclamp changes depend on CAP_SYS_NICE crash: UBSAN: shift-out-of-bounds in parse_audio_unit usb 1-1: 0:2 : does not exist ================================================================================ UBSAN: shift-out-of-bounds in sound/usb/mixer.c:2059:20 shift exponent 41 is too large for 32-bit type 'int' CPU: 0 PID: 36 Comm: kworker/0:1 Not tainted 6.1.99-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x68/0x91 lib/dump_stack.c:106 dump_stack+0x10/0x16 lib/dump_stack.c:113 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_shift_out_of_bounds+0x261/0x290 lib/ubsan.c:321 parse_audio_feature_unit sound/usb/mixer.c:2059 [inline] parse_audio_unit+0xf41/0x10e0 sound/usb/mixer.c:2909 snd_usb_mixer_controls sound/usb/mixer.c:3254 [inline] snd_usb_create_mixer+0x81a/0xda0 sound/usb/mixer.c:3601 usb_audio_probe+0x659/0x8a0 sound/usb/card.c:937 usb_probe_interface+0x1e1/0x340 drivers/usb/core/driver.c:397 really_probe+0xce/0x330 drivers/base/dd.c:639 __driver_probe_device+0x7c/0x110 drivers/base/dd.c:808 driver_probe_device+0x23/0x180 drivers/base/dd.c:838 __device_attach_driver+0x117/0x130 drivers/base/dd.c:966 bus_for_each_drv+0x96/0xe0 drivers/base/bus.c:427 __device_attach+0xf5/0x1b0 drivers/base/dd.c:1038 device_initial_probe+0xe/0x10 drivers/base/dd.c:1087 bus_probe_device+0x30/0xa0 drivers/base/bus.c:487 device_add+0x339/0x5b0 drivers/base/core.c:3689 usb_set_configuration+0x904/0xa90 drivers/usb/core/message.c:2165 usb_generic_driver_probe+0x2c/0x80 drivers/usb/core/generic.c:238 usb_probe_device+0x5d/0xc0 drivers/usb/core/driver.c:294 really_probe+0xce/0x330 drivers/base/dd.c:639 __driver_probe_device+0x7c/0x110 drivers/base/dd.c:808 driver_probe_device+0x23/0x180 drivers/base/dd.c:838 __device_attach_driver+0x117/0x130 drivers/base/dd.c:966 bus_for_each_drv+0x96/0xe0 drivers/base/bus.c:427 __device_attach+0xf5/0x1b0 drivers/base/dd.c:1038 device_initial_probe+0xe/0x10 drivers/base/dd.c:1087 bus_probe_device+0x30/0xa0 drivers/base/bus.c:487 device_add+0x339/0x5b0 drivers/base/core.c:3689 usb_new_device+0x494/0x650 drivers/usb/core/hub.c:2645 hub_port_connect drivers/usb/core/hub.c:5554 [inline] hub_port_connect_change drivers/usb/core/hub.c:5694 [inline] port_event drivers/usb/core/hub.c:5854 [inline] hub_event+0xf71/0x15f0 drivers/usb/core/hub.c:5936 process_one_work+0x1b2/0x380 kernel/workqueue.c:2299 worker_thread+0x222/0x390 kernel/workqueue.c:2446 kthread+0xda/0xf0 kernel/kthread.c:386 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 ================================================================================ usb 1-1: 5:0: cannot get min/max values for control 2 (id 5) usb 1-1: USB disconnect, device number 2 usb 1-1: new high-speed USB device number 3 using dummy_hcd usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 usb 1-1: SerialNumber: syz usb 1-1: 0:2 : does not exist usb 1-1: 5:0: cannot get min/max values for control 2 (id 5) usb 1-1: USB disconnect, device number 3 usb 1-1: new high-speed USB device number 4 using dummy_hcd usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 usb 1-1: SerialNumber: syz usb 1-1: 0:2 : does not exist usb 1-1: 5:0: cannot get min/max values for control 2 (id 5) usb 1-1: USB disconnect, device number 4 usb 1-1: new high-speed USB device number 5 using dummy_hcd usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 usb 1-1: SerialNumber: syz usb 1-1: 0:2 : does not exist usb 1-1: 5:0: cannot get min/max values for control 2 (id 5) usb 1-1: USB disconnect, device number 5 usb 1-1: new high-speed USB device number 6 using dummy_hcd usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 usb 1-1: SerialNumber: syz usb 1-1: 0:2 : does not exist usb 1-1: 5:0: cannot get min/max values for control 2 (id 5) usb 1-1: USB disconnect, device number 6 usb 1-1: new high-speed USB device number 7 using dummy_hcd usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 usb 1-1: SerialNumber: syz usb 1-1: 0:2 : does not exist usb 1-1: 5:0: cannot get min/max values for control 2 (id 5) usb 1-1: USB disconnect, device number 7 usb 1-1: new high-speed USB device number 8 using dummy_hcd usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 usb 1-1: SerialNumber: syz usb 1-1: 0:2 : does not exist usb 1-1: 5:0: cannot get min/max values for control 2 (id 5) usb 1-1: USB disconnect, device number 8 usb 1-1: new high-speed USB device number 9 using dummy_hcd usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 usb 1-1: SerialNumber: syz usb 1-1: 0:2 : does not exist