ci2 starts bisection 2026-10-09 04:25:30.466006936 +0000 UTC m=+41383.783156736 bisecting fixing commit since c85054db46181ee85f10be997f41b347c85bd89b building syzkaller on fb92f11c4789d9647a75c09c983dbee5c8488ccf ensuring issue is reproducible on original commit c85054db46181ee85f10be997f41b347c85bd89b testing commit c85054db46181ee85f10be997f41b347c85bd89b gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 13e0f9f58a37ba8313598d54ea526acfb4692e9c9c73e8c205843feeaa56e9f6 run #0: crashed: KASAN: use-after-free Read in atime_needs_update run #1: crashed: KASAN: use-after-free Read in link_path_walk run #2: crashed: KASAN: use-after-free Read in link_path_walk run #3: crashed: KASAN: use-after-free Read in atime_needs_update run #4: crashed: KASAN: use-after-free Read in link_path_walk run #5: crashed: KASAN: use-after-free Read in link_path_walk run #6: crashed: KASAN: use-after-free Read in atime_needs_update run #7: crashed: KASAN: use-after-free Read in step_into run #8: crashed: KASAN: use-after-free Read in step_into run #9: crashed: KASAN: use-after-free Read in step_into run #10: crashed: KASAN: use-after-free Read in atime_needs_update run #11: crashed: KASAN: use-after-free Read in atime_needs_update run #12: crashed: KASAN: use-after-free Read in selinux_inode_follow_link run #13: crashed: KASAN: use-after-free Read in step_into run #14: crashed: KASAN: use-after-free Read in link_path_walk run #15: crashed: KASAN: use-after-free Read in step_into run #16: crashed: KASAN: use-after-free Read in step_into run #17: crashed: KASAN: use-after-free Read in link_path_walk run #18: crashed: KASAN: use-after-free Read in step_into run #19: crashed: KASAN: use-after-free Read in link_path_walk representative crash: KASAN: use-after-free Read in atime_needs_update, types: [KASAN-USE-AFTER-FREE-READ] check whether we can drop unnecessary instrumentation disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed testing commit c85054db46181ee85f10be997f41b347c85bd89b gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: b75fa99ab8a36670d603425afa9abe1099d1a560111a215224e504c8d2ed5fd3 run #0: crashed: KASAN: use-after-free Read in atime_needs_update run #1: crashed: KASAN: use-after-free Read in atime_needs_update run #2: crashed: KASAN: use-after-free Read in security_inode_follow_link run #3: crashed: KASAN: use-after-free Read in link_path_walk run #4: crashed: KASAN: use-after-free Read in atime_needs_update run #5: crashed: KASAN: use-after-free Read in atime_needs_update run #6: crashed: KASAN: use-after-free Read in atime_needs_update run #7: crashed: KASAN: use-after-free Read in current_time run #8: crashed: KASAN: use-after-free Read in current_time run #9: crashed: KASAN: use-after-free Read in atime_needs_update representative crash: KASAN: use-after-free Read in atime_needs_update, types: [KASAN-USE-AFTER-FREE-READ] the bug reproduces without the instrumentation disabling configs for [memleak ubsan bug_or_warning locking atomic_sleep hang], they are not needed kconfig minimization: base=4925 full=6218 leaves diff=255 split chunks (needed=false): <255> split chunk #0 of len 255 into 5 parts testing without sub-chunk 1/5 disabling configs for [memleak ubsan bug_or_warning locking atomic_sleep hang], they are not needed testing commit c85054db46181ee85f10be997f41b347c85bd89b gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 85c952d90e234a0894cb3d517f87d53b76c6d13852438a351ae378a1b2e73408 run #0: crashed: KASAN: use-after-free Read in atime_needs_update run #1: crashed: KASAN: use-after-free Read in current_time run #2: crashed: KASAN: use-after-free Read in atime_needs_update run #3: crashed: KASAN: use-after-free Read in link_path_walk run #4: crashed: KASAN: use-after-free Read in link_path_walk run #5: crashed: KASAN: use-after-free Read in atime_needs_update run #6: crashed: KASAN: use-after-free Read in atime_needs_update run #7: crashed: KASAN: use-after-free Read in step_into run #8: crashed: KASAN: use-after-free Read in security_inode_follow_link run #9: crashed: KASAN: use-after-free Read in atime_needs_update representative crash: KASAN: use-after-free Read in atime_needs_update, types: [KASAN-USE-AFTER-FREE-READ] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed testing commit c85054db46181ee85f10be997f41b347c85bd89b gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: fac2254c470cf27b09fe9d4f44809b2541897c08347a7ae65b77d956b306f624 run #0: crashed: KASAN: use-after-free Read in link_path_walk run #1: crashed: KASAN: use-after-free Read in link_path_walk run #2: crashed: KASAN: use-after-free Read in link_path_walk run #3: crashed: KASAN: use-after-free Read in step_into run #4: crashed: KASAN: use-after-free Read in atime_needs_update run #5: crashed: KASAN: use-after-free Read in atime_needs_update run #6: crashed: KASAN: use-after-free Read in step_into run #7: crashed: KASAN: use-after-free Read in security_inode_follow_link run #8: crashed: KASAN: use-after-free Read in atime_needs_update run #9: crashed: KASAN: use-after-free Read in current_time representative crash: KASAN: use-after-free Read in link_path_walk, types: [KASAN-USE-AFTER-FREE-READ] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [locking atomic_sleep hang memleak ubsan bug_or_warning], they are not needed testing commit c85054db46181ee85f10be997f41b347c85bd89b gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 5e54fd47d2242d2aac3a9311a4c650fab3b8b75e249931f59bbcc1d64c0d513e run #0: crashed: KASAN: use-after-free Read in current_time run #1: crashed: KASAN: use-after-free Read in step_into run #2: crashed: KASAN: use-after-free Read in step_into run #3: crashed: KASAN: use-after-free Read in selinux_inode_follow_link run #4: crashed: KASAN: use-after-free Read in current_time run #5: crashed: KASAN: use-after-free Read in __inode_security_revalidate run #6: crashed: KASAN: use-after-free Read in link_path_walk run #7: crashed: KASAN: use-after-free Read in atime_needs_update run #8: crashed: KASAN: use-after-free Read in atime_needs_update run #9: crashed: KASAN: use-after-free Read in atime_needs_update representative crash: KASAN: use-after-free Read in current_time, types: [KASAN-USE-AFTER-FREE-READ] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [bug_or_warning locking atomic_sleep hang memleak ubsan], they are not needed testing commit c85054db46181ee85f10be997f41b347c85bd89b gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 1e7e81c7827b5e8c496bf945260fdde23aaea6ecfaef35b2861092b3f738301c run #0: crashed: KASAN: use-after-free Read in selinux_inode_follow_link run #1: crashed: KASAN: use-after-free Read in __inode_security_revalidate run #2: crashed: KASAN: use-after-free Read in link_path_walk run #3: crashed: KASAN: use-after-free Read in __inode_security_revalidate run #4: crashed: KASAN: use-after-free Read in security_inode_follow_link run #5: crashed: KASAN: use-after-free Read in link_path_walk run #6: crashed: KASAN: use-after-free Read in atime_needs_update run #7: crashed: KASAN: use-after-free Read in atime_needs_update run #8: crashed: KASAN: use-after-free Read in step_into run #9: crashed: KASAN: use-after-free Read in step_into representative crash: KASAN: use-after-free Read in selinux_inode_follow_link, types: [KASAN-USE-AFTER-FREE-READ] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [ubsan bug_or_warning locking atomic_sleep hang memleak], they are not needed testing commit c85054db46181ee85f10be997f41b347c85bd89b gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 failed building c85054db46181ee85f10be997f41b347c85bd89b: net/socket.c:1188:(.text+0x6d1a): undefined reference to `wext_handle_ioctl' net/socket.c:3389:(.text+0x7314): undefined reference to `compat_wext_handle_ioctl' net/core/net-procfs.c:343:(.text+0x33b): undefined reference to `wext_proc_exit' net/core/net-procfs.c:327:(.text+0x4e2): undefined reference to `wext_proc_init' minimized to 51 configs; suspects: [HID_ZEROPLUS USB_LINK_LAYER_TEST USB_MON USB_NET_CDC_MBIM USB_NET_CDC_SUBSET USB_NET_CDC_SUBSET_ENABLE USB_NET_DM9601 USB_NET_GL620A USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL USB_SERIAL_FTDI_SIO USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM USB_XHCI_PCI_RENESAS WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_ZYDAS ZEROPLUS_FF] disabling configs for [bug_or_warning locking atomic_sleep hang memleak ubsan], they are not needed testing current HEAD d6c8aee048e0871ae3942f60c655c146df22479d testing commit d6c8aee048e0871ae3942f60c655c146df22479d gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 33345b0a653899e72edae8a3b09d26d872a4c60639914d48def4865cb89e6380 all runs: OK false negative chance: 0.000 # git bisect start d6c8aee048e0871ae3942f60c655c146df22479d c85054db46181ee85f10be997f41b347c85bd89b Bisecting: 1796 revisions left to test after this (roughly 11 steps) [c5a0ae895432596b2f464172da8218e2d84e2932] net: sit: require CAP_NET_ADMIN in the device netns for changelink determine whether the revision contains the guilty commit checking the merge base 64ee49df839fd77e7f7f5d2cec3c9435f52f099b no existing result, test the revision testing commit 64ee49df839fd77e7f7f5d2cec3c9435f52f099b gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 2fb2737014875b691884f045c19680c50a9e8315cb53d1af8698848670065ec1 run #0: crashed: KASAN: use-after-free Read in step_into run #1: crashed: KASAN: use-after-free Read in selinux_inode_follow_link run #2: crashed: KASAN: use-after-free Read in link_path_walk run #3: crashed: KASAN: use-after-free Read in atime_needs_update run #4: crashed: KASAN: use-after-free Read in link_path_walk run #5: crashed: KASAN: use-after-free Read in link_path_walk run #6: crashed: KASAN: use-after-free Read in step_into run #7: crashed: KASAN: use-after-free Read in atime_needs_update run #8: crashed: KASAN: use-after-free Read in link_path_walk run #9: crashed: KASAN: use-after-free Read in link_path_walk representative crash: KASAN: use-after-free Read in step_into, types: [KASAN-USE-AFTER-FREE-READ] testing commit c5a0ae895432596b2f464172da8218e2d84e2932 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: e25c3d1f349db45867b97a67a0d2d827ceac744ab4a74a21f08db0adadba92f6 all runs: OK false negative chance: 0.000 # git bisect bad c5a0ae895432596b2f464172da8218e2d84e2932 Bisecting: 897 revisions left to test after this (roughly 10 steps) [714aa973da8163925eda7efd49361ccbee21ee46] net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() determine whether the revision contains the guilty commit revision 64ee49df839fd77e7f7f5d2cec3c9435f52f099b crashed and is reachable testing commit 714aa973da8163925eda7efd49361ccbee21ee46 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 812072c711b99a92c28bf58412f9b2f66673ff427da8b1a221b7d77b5ce02877 run #0: crashed: KASAN: use-after-free Read in atime_needs_update run #1: crashed: KASAN: use-after-free Read in link_path_walk run #2: crashed: KASAN: use-after-free Read in __inode_security_revalidate run #3: crashed: KASAN: use-after-free Read in atime_needs_update run #4: crashed: KASAN: use-after-free Read in step_into run #5: crashed: KASAN: use-after-free Read in step_into run #6: crashed: KASAN: use-after-free Read in atime_needs_update run #7: crashed: KASAN: use-after-free Read in link_path_walk run #8: crashed: KASAN: use-after-free Read in step_into run #9: crashed: KASAN: use-after-free Read in link_path_walk representative crash: KASAN: use-after-free Read in atime_needs_update, types: [KASAN-USE-AFTER-FREE-READ] # git bisect good 714aa973da8163925eda7efd49361ccbee21ee46 Bisecting: 448 revisions left to test after this (roughly 9 steps) [5740bf24cd23957297b408ca575e27fec356aced] net: dsa: tag_ksz: do not rely on skb_mac_header() in TX paths determine whether the revision contains the guilty commit revision 714aa973da8163925eda7efd49361ccbee21ee46 crashed and is reachable testing commit 5740bf24cd23957297b408ca575e27fec356aced gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 69bf75d586624a9dc9abab0f743fa1a2e8858e81226fe622ea855a7d39cebe7d run #0: crashed: KASAN: use-after-free Read in step_into run #1: crashed: KASAN: use-after-free Read in atime_needs_update run #2: crashed: KASAN: use-after-free Read in security_inode_follow_link run #3: crashed: KASAN: use-after-free Read in step_into run #4: crashed: KASAN: use-after-free Read in step_into run #5: crashed: KASAN: use-after-free Read in step_into run #6: crashed: KASAN: use-after-free Read in security_inode_follow_link run #7: crashed: KASAN: use-after-free Read in link_path_walk run #8: crashed: KASAN: use-after-free Read in step_into run #9: crashed: KASAN: use-after-free Read in step_into representative crash: KASAN: use-after-free Read in step_into, types: [KASAN-USE-AFTER-FREE-READ] # git bisect good 5740bf24cd23957297b408ca575e27fec356aced Bisecting: 224 revisions left to test after this (roughly 8 steps) [dc9834aac8fd8e17f51c4b22f1e944079d1f79ab] selftests/mm: clarify alternate unmapping in compaction_test determine whether the revision contains the guilty commit revision 64ee49df839fd77e7f7f5d2cec3c9435f52f099b crashed and is reachable testing commit dc9834aac8fd8e17f51c4b22f1e944079d1f79ab gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 4a2c6de7170ed74b3409e2b725321ea7c40eb38cbc4cabf99da0b0c4e2b59d05 all runs: OK false negative chance: 0.000 # git bisect bad dc9834aac8fd8e17f51c4b22f1e944079d1f79ab Bisecting: 111 revisions left to test after this (roughly 7 steps) [cbc9982c8573fb9e35040063aa78c8ebe768a1ff] IB/mlx5: Properly support implicit ODP rereg_mr determine whether the revision contains the guilty commit revision 5740bf24cd23957297b408ca575e27fec356aced crashed and is reachable testing commit cbc9982c8573fb9e35040063aa78c8ebe768a1ff gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 20791ad0c6768dcf163e375e45bad716a4a21ba7987a3c608ea93269363e041c all runs: OK false negative chance: 0.000 # git bisect bad cbc9982c8573fb9e35040063aa78c8ebe768a1ff Bisecting: 55 revisions left to test after this (roughly 6 steps) [e7d363c0ffa836ac1d89657686cad241392c5eb2] RDMA/hns: Fix warning in poll cq direct mode determine whether the revision contains the guilty commit revision 64ee49df839fd77e7f7f5d2cec3c9435f52f099b crashed and is reachable testing commit e7d363c0ffa836ac1d89657686cad241392c5eb2 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 47ad3e18129bcaf67e238998a496c0cd12f20ce739bf78eb943329550f0542ee run #0: crashed: KASAN: use-after-free Read in security_inode_follow_link run #1: crashed: KASAN: use-after-free Read in atime_needs_update run #2: crashed: KASAN: use-after-free Read in link_path_walk run #3: crashed: KASAN: use-after-free Read in link_path_walk run #4: crashed: KASAN: use-after-free Read in selinux_inode_follow_link run #5: crashed: KASAN: use-after-free Read in link_path_walk run #6: crashed: KASAN: use-after-free Read in atime_needs_update run #7: crashed: KASAN: use-after-free Read in atime_needs_update run #8: crashed: KASAN: use-after-free Read in selinux_inode_follow_link run #9: crashed: KASAN: use-after-free Read in atime_needs_update representative crash: KASAN: use-after-free Read in security_inode_follow_link, types: [KASAN-USE-AFTER-FREE-READ] # git bisect good e7d363c0ffa836ac1d89657686cad241392c5eb2 Bisecting: 27 revisions left to test after this (roughly 5 steps) [d3f81ace0a2e348690a4272a49f5c253b8ddf41c] ARM: imx3: Fix CCM node reference leak determine whether the revision contains the guilty commit revision e7d363c0ffa836ac1d89657686cad241392c5eb2 crashed and is reachable testing commit d3f81ace0a2e348690a4272a49f5c253b8ddf41c gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 9f01108b45477cb14c7ee379eb1d4cd20062db5365ea9a35722b3898ddcc09dc run #0: crashed: KASAN: use-after-free Read in __inode_security_revalidate run #1: crashed: KASAN: use-after-free Read in __inode_security_revalidate run #2: crashed: KASAN: use-after-free Read in step_into run #3: crashed: KASAN: use-after-free Read in atime_needs_update run #4: crashed: KASAN: use-after-free Read in link_path_walk run #5: crashed: KASAN: use-after-free Read in step_into run #6: crashed: KASAN: use-after-free Read in atime_needs_update run #7: crashed: KASAN: use-after-free Read in selinux_inode_follow_link run #8: crashed: KASAN: use-after-free Read in step_into run #9: crashed: KASAN: use-after-free Read in step_into representative crash: KASAN: use-after-free Read in __inode_security_revalidate, types: [KASAN-USE-AFTER-FREE-READ] # git bisect good d3f81ace0a2e348690a4272a49f5c253b8ddf41c Bisecting: 13 revisions left to test after this (roughly 4 steps) [c5dbf2784828886a66c61782324e4aa830de1e57] netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures determine whether the revision contains the guilty commit revision 64ee49df839fd77e7f7f5d2cec3c9435f52f099b crashed and is reachable testing commit c5dbf2784828886a66c61782324e4aa830de1e57 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 7229b0006b2b6426df90b9ef57a7f31e078bcf12c4861a05314992cd985ec9eb all runs: OK false negative chance: 0.000 # git bisect bad c5dbf2784828886a66c61782324e4aa830de1e57 Bisecting: 6 revisions left to test after this (roughly 3 steps) [3e83b2203aa59bd279e4f677ec793d49dc9d019e] configfs_lookup(): don't leave ->s_dentry dangling on failure determine whether the revision contains the guilty commit revision e7d363c0ffa836ac1d89657686cad241392c5eb2 crashed and is reachable testing commit 3e83b2203aa59bd279e4f677ec793d49dc9d019e gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 10b345b3f20ce1aaaa8e2711c2eb9366b2e55474bd82028c1c9ada8b9b0e5f81 all runs: OK false negative chance: 0.000 # git bisect bad 3e83b2203aa59bd279e4f677ec793d49dc9d019e Bisecting: 3 revisions left to test after this (roughly 2 steps) [472152df7c99132cd022907c47b6358fc645c2da] scsi: pm8001: Fix error code in non_fatal_log_show() determine whether the revision contains the guilty commit revision 64ee49df839fd77e7f7f5d2cec3c9435f52f099b crashed and is reachable testing commit 472152df7c99132cd022907c47b6358fc645c2da gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 450a81ad4d53bc1e576f2a5d277dacdb8e11949591c436cefc3be7a7663884de run #0: crashed: KASAN: use-after-free Read in atime_needs_update run #1: crashed: KASAN: use-after-free Read in atime_needs_update run #2: crashed: KASAN: use-after-free Read in link_path_walk run #3: crashed: KASAN: use-after-free Read in step_into run #4: crashed: KASAN: use-after-free Read in link_path_walk run #5: crashed: KASAN: use-after-free Read in __inode_security_revalidate run #6: crashed: KASAN: use-after-free Read in atime_needs_update run #7: crashed: KASAN: use-after-free Read in step_into run #8: crashed: KASAN: use-after-free Read in current_time run #9: crashed: KASAN: use-after-free Read in step_into representative crash: KASAN: use-after-free Read in atime_needs_update, types: [KASAN-USE-AFTER-FREE-READ] # git bisect good 472152df7c99132cd022907c47b6358fc645c2da Bisecting: 1 revision left to test after this (roughly 1 step) [49b9619c2c22630062e87dee98a298e8c632e3d4] mm/fake-numa: fix under-allocation detection in uniform split determine whether the revision contains the guilty commit revision d3f81ace0a2e348690a4272a49f5c253b8ddf41c crashed and is reachable testing commit 49b9619c2c22630062e87dee98a298e8c632e3d4 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 8ebff6751cbbf4fc7aa8269cd6008928aa6e27007ee81525ff5150107fe92da6 all runs: OK false negative chance: 0.000 # git bisect bad 49b9619c2c22630062e87dee98a298e8c632e3d4 Bisecting: 0 revisions left to test after this (roughly 0 steps) [ea1c243c39e32b7fc1c2edfe32081ff7e30a877c] bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs determine whether the revision contains the guilty commit revision 64ee49df839fd77e7f7f5d2cec3c9435f52f099b crashed and is reachable testing commit ea1c243c39e32b7fc1c2edfe32081ff7e30a877c gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: e0ac453bb9e05ffbfffbf4ff85377eae85f42f1e94a57c46bbbbe30cb54a6405 all runs: OK false negative chance: 0.000 # git bisect bad ea1c243c39e32b7fc1c2edfe32081ff7e30a877c ea1c243c39e32b7fc1c2edfe32081ff7e30a877c is the first bad commit commit ea1c243c39e32b7fc1c2edfe32081ff7e30a877c Author: Deepanshu Kartikey Date: Tue Jun 2 08:22:49 2026 +0530 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs [ Upstream commit b93c55b4932dd7e32dca8cf34a3443cc87a02906 ] commit 4f375ade6aa9 ("bpf: Avoid RCU context warning when unpinning htab with internal structs") moved inode cleanup from ->free_inode() into ->destroy_inode() to avoid sleeping in RCU context when calling bpf_any_put(). However this removed the RCU delay on freeing the inode itself and the cached symlink body (i_link), both of which can be accessed by RCU pathwalk (pick_link, may_lookup etc.). This causes a use-after-free when a concurrent unlinkat() drops the last inode reference and destroy_inode() frees the inode immediately, while another task is still walking the path in RCU mode and reads inode->i_opflags (offset +2) inside current_time() -> is_mgtime(). KASAN reports: BUG: KASAN: slab-use-after-free in is_mgtime include/linux/fs.h:2313 Read of size 2 at addr ffff8880407e4282 (offset +2 = i_opflags) The rules (per Al Viro): ->destroy_inode() called immediately, can sleep, use for blocking cleanup e.g. bpf_any_put() ->free_inode() called after RCU grace period, use for freeing inode and anything RCU-accessible e.g. i_link Fix: split the two concerns properly: - keep bpf_any_put() in bpf_destroy_inode() since it is blocking and needs to run promptly - introduce bpf_free_inode() to handle kfree(i_link) and free_inode_nonrcu() with proper RCU delay, preventing the UAF Fixes: 4f375ade6aa9 ("bpf: Avoid RCU context warning when unpinning htab with internal structs") Reported-by: syzbot+36e50496c8ac4bcde3f9@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=36e50496c8ac4bcde3f9 Suggested-by: Al Viro Link: https://lore.kernel.org/all/20260423043906.GN3518998@ZenIV/ Link: https://lore.kernel.org/all/20260602002607.110866-1-kartikey406@gmail.com/T/ [v1] Signed-off-by: Deepanshu Kartikey Acked-by: Al Viro Link: https://lore.kernel.org/r/20260602025249.113828-1-kartikey406@gmail.com Signed-off-by: Alexei Starovoitov Signed-off-by: Sasha Levin kernel/bpf/inode.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) accumulated error probability: 0.00 culprit signature: e0ac453bb9e05ffbfffbf4ff85377eae85f42f1e94a57c46bbbbe30cb54a6405 parent signature: 450a81ad4d53bc1e576f2a5d277dacdb8e11949591c436cefc3be7a7663884de revisions tested: 20, total time: 5h41m33.338491329s (build: 1h14m39.736321909s, test: 3h56m25.085166276s) first good commit: ea1c243c39e32b7fc1c2edfe32081ff7e30a877c bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs recipients (to): ["ast@kernel.org" "kartikey406@gmail.com" "sashal@kernel.org" "viro@zeniv.linux.org.uk"] recipients (cc): []