ci2 starts bisection 2026-10-18 19:22:10.683597142 +0000 UTC m=+157233.068110865 bisecting cause commit starting from 32c52ec87d6245ee2d12ed5dd509e40062939b50 building syzkaller on 6d32eb1ff35d349359a42fce2a16b243beb93c15 ensuring issue is reproducible on original commit 32c52ec87d6245ee2d12ed5dd509e40062939b50 testing commit 32c52ec87d6245ee2d12ed5dd509e40062939b50 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 4de12422aeabba16c2588fff2228dfe06c0a4db225b226c0cca1248f6949375a run #0: OK run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: crashed: general protection fault in jffs2_xattr_delete_inode run #13: crashed: general protection fault in jffs2_xattr_delete_inode run #14: crashed: general protection fault in jffs2_xattr_delete_inode run #15: crashed: general protection fault in jffs2_xattr_delete_inode run #16: crashed: general protection fault in jffs2_xattr_delete_inode run #17: crashed: general protection fault in jffs2_xattr_delete_inode run #18: crashed: general protection fault in jffs2_xattr_delete_inode run #19: crashed: general protection fault in jffs2_xattr_delete_inode representative crash: general protection fault in jffs2_xattr_delete_inode, types: [DoS] check whether we can drop unnecessary instrumentation disabling configs for [locking atomic_sleep hang memleak ubsan bug_or_warning kasan], they are not needed testing commit 32c52ec87d6245ee2d12ed5dd509e40062939b50 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 333ba7a5c5bbd3ce7ce0794cbc762777a9d5a2ae49ec30ada6f56c3b54ac10c1 run #0: OK run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: crashed: general protection fault in jffs2_xattr_delete_inode run #18: crashed: BUG: unable to handle kernel paging request in jffs2_xattr_delete_inode run #19: crashed: general protection fault in jffs2_xattr_delete_inode representative crash: general protection fault in jffs2_xattr_delete_inode, types: [DoS MEMORY_SAFETY_BUG] kconfig minimization: base=4169 full=8454 leaves diff=2104 split chunks (needed=false): <2104> split chunk #0 of len 2104 into 5 parts testing without sub-chunk 1/5 testing commit 32c52ec87d6245ee2d12ed5dd509e40062939b50 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 80721f210910d8adcc8935da909b5c128ce3c731ac59ec47e0a452f3d70a3245 run #0: OK run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: crashed: BUG: unable to handle kernel paging request in jffs2_set_inocache_state run #10: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #11: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #12: crashed: general protection fault in jffs2_xattr_delete_inode run #13: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #14: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #15: crashed: general protection fault in jffs2_xattr_delete_inode run #16: crashed: general protection fault in jffs2_xattr_delete_inode run #17: crashed: general protection fault in jffs2_xattr_delete_inode run #18: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #19: crashed: general protection fault in jffs2_xattr_delete_inode representative crash: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode, types: [KASAN-USE-AFTER-FREE-READ DoS] the chunk can be dropped testing without sub-chunk 2/5 testing commit 32c52ec87d6245ee2d12ed5dd509e40062939b50 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: f1d375fb18747e908fd052b03526cfa7d9ae0f39a38f74e1a325430c006db0e1 run #0: OK run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: crashed: general protection fault in jffs2_xattr_delete_inode run #12: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #13: crashed: general protection fault in jffs2_xattr_delete_inode run #14: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #15: crashed: general protection fault in jffs2_xattr_delete_inode run #16: crashed: general protection fault in jffs2_xattr_delete_inode run #17: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #18: crashed: general protection fault in jffs2_xattr_delete_inode run #19: crashed: general protection fault in jffs2_xattr_delete_inode representative crash: general protection fault in jffs2_xattr_delete_inode, types: [DoS KASAN-USE-AFTER-FREE-READ] the chunk can be dropped testing without sub-chunk 3/5 testing commit 32c52ec87d6245ee2d12ed5dd509e40062939b50 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: ed9e586a520e91194658d2aa3022225cdf597b7cc6ea02522e4e0107c427aa29 all runs: OK false negative chance: 0.000 testing without sub-chunk 4/5 testing commit 32c52ec87d6245ee2d12ed5dd509e40062939b50 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 1bb5c0646de9153f3a0ead8225a9da52b572a898d40930dbb5514560f79c4f7c run #0: OK run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #12: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #13: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #14: crashed: general protection fault in jffs2_xattr_delete_inode run #15: crashed: general protection fault in jffs2_xattr_delete_inode run #16: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #17: crashed: general protection fault in jffs2_xattr_delete_inode run #18: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #19: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode representative crash: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode, types: [KASAN-USE-AFTER-FREE-READ DoS] the chunk can be dropped testing without sub-chunk 5/5 testing commit 32c52ec87d6245ee2d12ed5dd509e40062939b50 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: c7fe5bf62bb09966b7ce331eddd83e6a71e7e323479682114750305e2ea78a97 run #0: OK run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #17: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #18: crashed: general protection fault in jffs2_xattr_delete_inode run #19: crashed: general protection fault in jffs2_xattr_delete_inode representative crash: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode, types: [KASAN-USE-AFTER-FREE-READ DoS] minimized to 841 configs; suspects: [ATM BCMA BLK_DEV_ZONED BPF_SYSCALL BRIDGE BRIDGE_NETFILTER CAN CARDBUS CFG80211 CFG80211_WEXT CHECKPOINT_RESTORE COMMON_CLK CONTIG_ALLOC DVB_CORE EXTCON FB_CORE GNSS GPIOLIB HAVE_ARCH_USERFAULTFD_WP HID_LOGITECH HID_NINTENDO HID_ZEROPLUS HSR I2C_MUX IIO INFINIBAND INFINIBAND_ADDR_TRANS INFINIBAND_USER_ACCESS INPUT_JOYSTICK INPUT_MOUSE IOMMUFD IPV6_MULTIPLE_TABLES IP_SET IP_SET_HASH_IPMARK IP_SET_HASH_IPPORT IP_SET_HASH_IPPORTIP IP_SET_HASH_IPPORTNET IP_SET_HASH_MAC IP_SET_HASH_NET IP_SET_HASH_NETIFACE IP_SET_HASH_NETNET IP_SET_HASH_NETPORT IP_SET_HASH_NETPORTNET IP_SET_LIST_SET IP_VS IP_VS_DH IP_VS_FO IP_VS_FTP IP_VS_IPV6 IP_VS_LBLC IP_VS_LBLCR IP_VS_LC IP_VS_MH IP_VS_NFCT IP_VS_NQ IP_VS_OVF IP_VS_PE_SIP IP_VS_PROTO_AH IP_VS_PROTO_AH_ESP IP_VS_PROTO_ESP IP_VS_PROTO_SCTP IP_VS_PROTO_TCP IP_VS_PROTO_UDP IP_VS_RR IP_VS_SED IP_VS_SH IP_VS_TWOS IP_VS_WLC IP_VS_WRR IRQ_BYPASS_MANAGER IRQ_POLL IR_IGORPLUGUSB IR_IGUANA IR_IMON IR_IMON_RAW IR_MCEUSB IR_REDRAT3 IR_STREAMZAP IR_TOY IR_TTUSBIR JFFS2_CMODE_PRIORITY JFFS2_COMPRESSION_OPTIONS JFFS2_FS JFFS2_FS_POSIX_ACL JFFS2_FS_SECURITY JFFS2_FS_WRITEBUFFER JFFS2_FS_XATTR JFFS2_LZO JFFS2_RTIME JFFS2_RUBIN JFFS2_SUMMARY JFFS2_ZLIB JFS_DEBUG JFS_FS JFS_POSIX_ACL JFS_SECURITY JOYSTICK_IFORCE JOYSTICK_IFORCE_USB JOYSTICK_PXRC JOYSTICK_XPAD JOYSTICK_XPAD_FF JOYSTICK_XPAD_LEDS KARMA_PARTITION KCOV KCOV_ENABLE_COMPARISONS KCOV_INSTRUMENT_ALL KEYS_REQUEST_CACHE KEY_DH_OPERATIONS KEY_NOTIFICATIONS KSM KVM KVM_AMD KVM_ASYNC_PF KVM_COMMON KVM_COMPAT KVM_ELIDE_TLB_FLUSH_IF_YOUNG KVM_GENERIC_DIRTYLOG_READ_PROTECT KVM_GENERIC_HARDWARE_ENABLING KVM_GENERIC_MEMORY_ATTRIBUTES KVM_GENERIC_PRE_FAULT_MEMORY KVM_GUEST_MEMFD KVM_HYPERV KVM_INTEL KVM_IOAPIC KVM_MMIO KVM_MMU_LOCKLESS_AGING KVM_PROVE_MMU KVM_SMM KVM_SW_PROTECTED_VM KVM_VFIO KVM_X86 KVM_XEN L2TP L2TP_ETH L2TP_IP L2TP_V3 LAPB LAPBETHER LDM_PARTITION LEDS_CLASS_MULTICOLOR LEGACY_PTYS LIBNVDIMM LINEAR_RANGES LLC LLC2 LOCALVERSION_AUTO LOGIG940_FF LOGIRUMBLEPAD2_FF LOGITECH_FF LOGIWHEELS_FF LOGO LOGO_LINUX_MONO LOGO_LINUX_VGA16 LPC_ICH LWTUNNEL LWTUNNEL_BPF LZ4HC_COMPRESS MAC80211 MAC80211_HAS_RC MAC80211_HWSIM MAC80211_MESH MAC80211_RC_DEFAULT_MINSTREL MAC80211_RC_MINSTREL MACSEC MACVLAN MACVTAP MAC_PARTITION MAPPING_DIRTY_HELPERS MCTP MDIO_MVUSB MD_RAID0 MD_RAID1 MD_RAID10 MD_RAID456 MEDIA_ANALOG_TV_SUPPORT MEDIA_ATTACH MEDIA_CAMERA_SUPPORT MEDIA_CEC_SUPPORT MEDIA_CONTROLLER MEDIA_CONTROLLER_DVB MEDIA_DIGITAL_TV_SUPPORT MEDIA_RADIO_SUPPORT MEDIA_SDR_SUPPORT MEDIA_SUPPORT MEDIA_SUPPORT_FILTER MEDIA_TEST_SUPPORT MEDIA_TUNER MEDIA_TUNER_MSI001 MEDIA_USB_SUPPORT MEMORY_HOTPLUG MEMORY_HOTREMOVE MEMORY_ISOLATION MEMREGION MEMSTICK MEMSTICK_REALTEK_USB MEM_SOFT_DIRTY MFD_CORE MFD_SYSCON MFD_VIPERBOARD MHI_BUS MHI_WWAN_CTRL MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO MHP_MEMMAP_ON_MEMORY MICROCHIP_PHY MINIX_FS MINIX_SUBPARTITION MISC_RTSX MISC_RTSX_USB MLX4_CORE MLX4_INFINIBAND MMC MMC_REALTEK_USB MMC_USHC MMC_VUB300 MODULE_SRCVERSION_ALL MOST MOST_USB_HDM MOUSE_APPLETOUCH MOUSE_BCM5974 MOUSE_PS2 MOUSE_PS2_ALPS MOUSE_PS2_BYD MOUSE_PS2_CYPRESS MOUSE_PS2_FOCALTECH MOUSE_PS2_LIFEBOOK MOUSE_PS2_LOGIPS2PP MOUSE_PS2_SMBUS MOUSE_PS2_SYNAPTICS MOUSE_PS2_SYNAPTICS_SMBUS MOUSE_PS2_TRACKPOINT MOUSE_SYNAPTICS_USB MPLS MPLS_IPTUNNEL MPLS_ROUTING MPTCP MPTCP_IPV6 MRP MTD MTD_BLKDEVS MTD_BLOCK MTD_BLOCK2MTD MTD_CFI_I1 MTD_CFI_I2 MTD_MAP_BANK_WIDTH_1 MTD_MAP_BANK_WIDTH_2 MTD_MAP_BANK_WIDTH_4 MTD_MTDRAM MTD_PHRAM MTD_SLRAM MUSB_PIO_ONLY ND_BTT ND_CLAIM ND_PFN NETDEVSIM NETFILTER_ADVANCED NETFILTER_BPF_LINK NETFILTER_FAMILY_ARP NETFILTER_FAMILY_BRIDGE NETFILTER_NETLINK_ACCT NETFILTER_NETLINK_GLUE_CT NETFILTER_NETLINK_OSF NETFILTER_NETLINK_QUEUE NETFILTER_SYNPROXY NETFILTER_XTABLES_COMPAT NETFILTER_XT_CONNMARK NETFILTER_XT_MATCH_BPF NETFILTER_XT_MATCH_CGROUP NETFILTER_XT_MATCH_CLUSTER NETFILTER_XT_MATCH_COMMENT NETFILTER_XT_MATCH_CONNBYTES NETFILTER_XT_MATCH_CONNLABEL NETFILTER_XT_MATCH_CONNLIMIT NETFILTER_XT_MATCH_CONNMARK NETFILTER_XT_MATCH_CPU NETFILTER_XT_MATCH_DCCP NETFILTER_XT_MATCH_DEVGROUP NETFILTER_XT_MATCH_DSCP NETFILTER_XT_MATCH_ECN NETFILTER_XT_MATCH_ESP NETFILTER_XT_MATCH_HASHLIMIT NETFILTER_XT_MATCH_HELPER NETFILTER_XT_MATCH_HL NETFILTER_XT_MATCH_IPCOMP NETFILTER_XT_MATCH_IPRANGE NETFILTER_XT_MATCH_IPVS NETFILTER_XT_MATCH_L2TP NETFILTER_XT_MATCH_LENGTH NETFILTER_XT_MATCH_LIMIT NETFILTER_XT_MATCH_MAC NETFILTER_XT_MATCH_MARK NETFILTER_XT_MATCH_MULTIPORT NETFILTER_XT_MATCH_NFACCT NETFILTER_XT_MATCH_OSF NETFILTER_XT_MATCH_OWNER NETFILTER_XT_MATCH_PHYSDEV NETFILTER_XT_MATCH_PKTTYPE NETFILTER_XT_MATCH_QUOTA NETFILTER_XT_MATCH_RATEEST NETFILTER_XT_MATCH_REALM NETFILTER_XT_MATCH_RECENT NETFILTER_XT_MATCH_SCTP NETFILTER_XT_MATCH_SOCKET NETFILTER_XT_MATCH_STATISTIC NETFILTER_XT_MATCH_STRING NETFILTER_XT_MATCH_TCPMSS NETFILTER_XT_MATCH_TIME NETFILTER_XT_MATCH_U32 NETFILTER_XT_NAT NETFILTER_XT_SET NETFILTER_XT_TARGET_AUDIT NETFILTER_XT_TARGET_CHECKSUM NETFILTER_XT_TARGET_CLASSIFY NETFILTER_XT_TARGET_CONNMARK NETFILTER_XT_TARGET_DSCP NETFILTER_XT_TARGET_HMARK NETFILTER_XT_TARGET_IDLETIMER NETFILTER_XT_TARGET_LED NETFILTER_XT_TARGET_MARK NETFILTER_XT_TARGET_NFQUEUE NETFILTER_XT_TARGET_RATEEST NETFILTER_XT_TARGET_TCPOPTSTRIP NETFILTER_XT_TARGET_TEE NETFILTER_XT_TARGET_TPROXY NETLINK_DIAG NET_9P_RDMA NET_ACT_BPF NET_ACT_CONNMARK NET_ACT_CSUM NET_ACT_CT NET_ACT_CTINFO NET_ACT_GATE NET_ACT_IFE NET_ACT_MPLS NET_ACT_NAT NET_ACT_PEDIT NET_ACT_POLICE NET_ACT_SAMPLE NET_ACT_SIMP NET_ACT_SKBEDIT NET_ACT_SKBMOD NET_ACT_TUNNEL_KEY NET_ACT_VLAN NET_CLS_BASIC NET_CLS_BPF NET_CLS_FLOW NET_CLS_FLOWER NET_CLS_FW NET_CLS_MATCHALL NET_CLS_ROUTE4 NET_CRC32C NET_DEVLINK NET_DROP_MONITOR NET_DSA NET_DSA_TAG_BRCM NET_DSA_TAG_BRCM_COMMON NET_DSA_TAG_BRCM_PREPEND NET_DSA_TAG_MTK NET_DSA_TAG_QCA NET_DSA_TAG_RTL4_A NET_EMATCH_CANID NET_EMATCH_CMP NET_EMATCH_IPSET NET_EMATCH_IPT NET_EMATCH_META NET_EMATCH_NBYTE NET_EMATCH_TEXT NET_EMATCH_U32 NET_FC NET_FOU NET_FOU_IP_TUNNELS NET_IFE NET_IFE_SKBMARK NET_IFE_SKBPRIO NET_IFE_SKBTCINDEX NET_IPGRE NET_IPGRE_BROADCAST NET_IPGRE_DEMUX NET_IPIP NET_IPVTI NET_KEY NET_KEY_MIGRATE NET_L3_MASTER_DEV NET_MPLS_GSO NET_NCSI NET_NSH NET_REDIRECT NET_SCH_CAKE NET_SCH_CBS NET_SCH_CHOKE NET_SCH_CODEL NET_SCH_DRR NET_SCH_ETF NET_SCH_ETS NET_SCH_FQ NET_SCH_FQ_CODEL NET_SCH_FQ_PIE NET_SCH_GRED NET_SCH_HFSC NET_SCH_HHF NET_SCH_HTB NET_SCH_INGRESS NET_SCH_MQPRIO NET_SCH_MQPRIO_LIB NET_SCH_MULTIQ NET_SCH_NETEM NET_SCH_PIE NET_SCH_PLUG NET_SCH_PRIO NET_SCH_QFQ NET_SCH_RED NET_SCH_SFB NET_SCH_SFQ NET_SCH_SKBPRIO NET_SCH_TAPRIO NET_SCH_TBF NET_SCH_TEQL NET_SHAPER NET_SOCK_MSG NET_SWITCHDEV NET_TC_SKB_EXT NET_TEAM NET_TEAM_MODE_ACTIVEBACKUP NET_TEAM_MODE_BROADCAST NET_TEAM_MODE_LOADBALANCE NET_TEAM_MODE_RANDOM NET_TEAM_MODE_ROUNDROBIN NET_UDP_TUNNEL NET_VENDOR_ZTE NET_VRF NFC NFC_DIGITAL NFC_FDP NFC_HCI NFC_MRVL NFC_MRVL_USB NFC_NCI NFC_NCI_UART NFC_PN533 NFC_PN533_USB NFC_PORT100 NFC_SHDLC NFC_SIM NFC_VIRTUAL_NCI NFSD NFSD_BLOCKLAYOUT NFSD_FLEXFILELAYOUT NFSD_PNFS NFSD_SCSILAYOUT NFSD_V3_ACL NFSD_V4 NFSD_V4_2_INTER_SSC NFSD_V4_SECURITY_LABEL NFS_FSCACHE NFS_V4_2 NFS_V4_2_READ_PLUS NFS_V4_2_SSC_HELPER NFS_V4_SECURITY_LABEL NFT_BRIDGE_META NFT_BRIDGE_REJECT NFT_COMPAT NFT_CONNLIMIT NFT_CT NFT_DUP_IPV4 NFT_DUP_IPV6 NFT_DUP_NETDEV NFT_EXTHDR_DCCP NFT_FIB NFT_FIB_INET NFT_FIB_IPV4 NFT_FIB_IPV6 NFT_FIB_NETDEV NFT_FLOW_OFFLOAD NFT_HASH NFT_LIMIT NFT_LOG NFT_MASQ NFT_NAT NFT_NUMGEN NFT_OSF NFT_QUEUE NFT_QUOTA NFT_REDIR NFT_REJECT NFT_REJECT_INET NFT_REJECT_IPV4 NFT_REJECT_IPV6 NFT_REJECT_NETDEV NFT_SOCKET NFT_SYNPROXY NFT_TPROXY NFT_TUNNEL NFT_XFRM NF_CONNTRACK_AMANDA NF_CONNTRACK_BRIDGE NF_CONNTRACK_BROADCAST NF_CONNTRACK_EVENTS NF_CONNTRACK_H323 NF_CONNTRACK_LABELS NF_CONNTRACK_MARK NF_CONNTRACK_NETBIOS_NS NF_CONNTRACK_OVS NF_CONNTRACK_PPTP NF_CONNTRACK_SANE NF_CONNTRACK_SNMP NF_CONNTRACK_TFTP NF_CONNTRACK_TIMEOUT NF_CONNTRACK_TIMESTAMP NF_CONNTRACK_ZONES NF_CT_NETLINK_HELPER NF_CT_NETLINK_TIMEOUT NF_CT_PROTO_GRE NF_CT_PROTO_SCTP NF_DUP_IPV4 NF_DUP_IPV6 NF_DUP_NETDEV NF_FLOW_TABLE NF_FLOW_TABLE_INET NF_NAT_AMANDA NF_NAT_H323 NF_NAT_OVS NF_NAT_PPTP NF_NAT_REDIRECT NF_NAT_SNMP_BASIC NF_NAT_TFTP NF_SOCKET_IPV4 NF_SOCKET_IPV6 NF_TABLES NF_TABLES_BRIDGE NF_TABLES_INET NF_TABLES_IPV4 NF_TABLES_IPV6 NF_TABLES_NETDEV NF_TPROXY_IPV4 NF_TPROXY_IPV6 NILFS2_FS NINTENDO_FF NOP_USB_XCEIV PARPORT PARTITION_ADVANCED PCCARD PCMCIA PHONET PSAMPLE RADIO_ADAPTERS RADIO_SI470X RADIO_SI4713 RC_CORE RC_DEVICES RFKILL SND SOUND SPI SSB TAP TARGET_CORE TUN USB_AMD5536UDC USB_ATM USB_CHIPIDEA USB_CHIPIDEA_HOST USB_CHIPIDEA_MSM USB_CHIPIDEA_NPCM USB_CHIPIDEA_PCI USB_CHIPIDEA_UDC USB_CONFIGFS USB_CONFIGFS_ACM USB_CONFIGFS_ECM USB_CONFIGFS_ECM_SUBSET USB_CONFIGFS_EEM USB_CONFIGFS_F_FS USB_CONFIGFS_F_HID USB_CONFIGFS_F_LB_SS USB_CONFIGFS_F_MIDI USB_CONFIGFS_F_MIDI2 USB_CONFIGFS_F_PRINTER USB_CONFIGFS_F_TCM USB_CONFIGFS_F_UAC1 USB_CONFIGFS_F_UAC1_LEGACY USB_CONFIGFS_F_UAC2 USB_CONFIGFS_F_UVC USB_CONFIGFS_MASS_STORAGE USB_CONFIGFS_NCM USB_CONFIGFS_OBEX USB_CONFIGFS_PHONET USB_CONFIGFS_RNDIS USB_CONFIGFS_SERIAL USB_CONN_GPIO USB_CXACRU USB_CYPRESS_CY7C63 USB_CYTHERM USB_DSBR USB_DUMMY_HCD USB_DWC2 USB_DWC2_HOST USB_DWC2_PCI USB_DWC3 USB_DWC3_GADGET USB_DWC3_GENERIC_PLAT USB_DWC3_HAPS USB_DWC3_OF_SIMPLE USB_DWC3_PCI USB_DWC3_ULPI USB_DYNAMIC_MINORS USB_EG20T USB_EHCI_FSL USB_EHCI_HCD_PLATFORM USB_EHCI_ROOT_HUB_TT USB_EHSET_TEST_FIXTURE USB_EMI26 USB_EMI62 USB_EPSON2888 USB_EZUSB_FX2 USB_FEW_INIT_RETRIES USB_F_ACM USB_F_ECM USB_F_EEM USB_F_FS USB_F_HID USB_F_MASS_STORAGE USB_F_MIDI USB_F_MIDI2 USB_F_NCM USB_F_OBEX USB_F_PHONET USB_F_PRINTER USB_F_RNDIS USB_F_SERIAL USB_F_SS_LB USB_F_SUBSET USB_F_TCM USB_F_UAC1 USB_F_UAC1_LEGACY USB_F_UAC2 USB_F_UVC USB_GADGET USB_GADGETFS USB_GADGET_DEBUG_FILES USB_GADGET_DEBUG_FS USB_GL860 USB_GOKU USB_GR_UDC USB_GSPCA USB_GSPCA_BENQ USB_GSPCA_CONEX USB_GSPCA_CPIA1 USB_GSPCA_DTCS033 USB_GSPCA_ETOMS USB_GSPCA_FINEPIX USB_GSPCA_JEILINJ USB_GSPCA_JL2005BCD USB_GSPCA_KINECT USB_GSPCA_KONICA USB_GSPCA_MARS USB_GSPCA_MR97310A USB_GSPCA_NW80X USB_GSPCA_OV519 USB_GSPCA_OV534 USB_GSPCA_OV534_9 USB_GSPCA_PAC207 USB_GSPCA_PAC7302 USB_GSPCA_PAC7311 USB_GSPCA_SE401 USB_GSPCA_SN9C2028 USB_GSPCA_SN9C20X USB_GSPCA_SONIXB USB_GSPCA_SONIXJ USB_GSPCA_SPCA1528 USB_GSPCA_SPCA500 USB_GSPCA_SPCA501 USB_GSPCA_SPCA505 USB_GSPCA_SPCA506 USB_GSPCA_SPCA508 USB_GSPCA_SPCA561 USB_GSPCA_SQ905 USB_GSPCA_SQ905C USB_GSPCA_SQ930X USB_GSPCA_STK014 USB_GSPCA_STK1135 USB_GSPCA_STV0680 USB_GSPCA_SUNPLUS USB_GSPCA_T613 USB_GSPCA_TOPRO USB_GSPCA_TOUPTEK USB_GSPCA_TV8532 USB_GSPCA_VC032X USB_GSPCA_VICAM USB_GSPCA_XIRLINK_CIT USB_GSPCA_ZC3XX USB_HACKRF USB_HCD_BCMA USB_HCD_SSB USB_HSIC_USB3503 USB_HSIC_USB4604 USB_HSO USB_HUB_USB251XB USB_IDMOUSE USB_IOWARRIOR USB_IPHETH USB_ISIGHTFW USB_ISP116X_HCD USB_ISP1301 USB_ISP1760 USB_ISP1760_DUAL_ROLE USB_ISP1760_HCD USB_ISP1761_UDC USB_KAWETH USB_KC2190 USB_KEENE USB_LAN78XX USB_LCD USB_LD USB_LEDS_TRIGGER_USBPORT USB_LED_TRIG USB_LEGOTOWER USB_LGM_PHY USB_LIBCOMPOSITE USB_LINK_LAYER_TEST USB_M5602 USB_MA901 USB_MAX3420_UDC USB_MAX3421_HCD USB_MDC800 USB_MICROTEK USB_MR800 USB_MSI2500 USB_MUSB_DUAL_ROLE USB_MUSB_HDRC USB_NET2280 USB_NET_AQC111 USB_NET_AX88179_178A USB_NET_AX8817X USB_NET_CDCETHER USB_NET_CDC_EEM USB_NET_CDC_MBIM USB_NET_CDC_NCM USB_NET_CDC_SUBSET USB_NET_CDC_SUBSET_ENABLE USB_NET_CH9200 USB_NET_CX82310_ETH USB_NET_DM9601 USB_NET_GL620A USB_NET_HUAWEI_CDC_NCM USB_NET_INT51X1 USB_NET_KALMIA USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_QMI_WWAN USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_OXU210HP_HCD USB_PEGASUS USB_PULSE8_CEC USB_PWC USB_PWC_INPUT_EVDEV USB_PXA27X USB_R8A66597 USB_R8A66597_HCD USB_RAINSHADOW_CEC USB_RAREMONO USB_RAW_GADGET USB_RTL8150 USB_RTL8152 USB_RTL8153_ECM USB_S2255 USB_SERIAL USB_SERIAL_AIRCABLE USB_SERIAL_ARK3116 USB_SERIAL_BELKIN USB_SERIAL_CH341 USB_SERIAL_CONSOLE USB_SERIAL_CP210X USB_SERIAL_CYBERJACK USB_SERIAL_CYPRESS_M8 USB_SERIAL_DEBUG USB_SERIAL_DIGI_ACCELEPORT USB_SERIAL_EDGEPORT USB_SERIAL_EDGEPORT_TI USB_SERIAL_EMPEG USB_SERIAL_F81232 USB_SERIAL_F8153X USB_SERIAL_FTDI_SIO USB_SERIAL_GARMIN USB_SERIAL_GENERIC USB_SERIAL_IPAQ USB_SERIAL_IPW USB_SERIAL_IR USB_SERIAL_IUU USB_SERIAL_KEYSPAN USB_SERIAL_KEYSPAN_PDA USB_SERIAL_KLSI USB_SERIAL_KOBIL_SCT USB_SERIAL_MCT_U232 USB_SERIAL_METRO USB_SERIAL_MOS7715_PARPORT USB_SERIAL_MOS7720 USB_SERIAL_MOS7840 USB_SERIAL_MXUPORT USB_SERIAL_NAVMAN USB_SERIAL_OMNINET USB_SERIAL_OPTICON USB_SERIAL_OPTION USB_SERIAL_OTI6858 USB_SERIAL_PL2303 USB_SERIAL_QCAUX USB_SERIAL_QT2 USB_SERIAL_QUALCOMM USB_SERIAL_SAFE USB_SERIAL_SIERRAWIRELESS USB_SERIAL_SIMPLE USB_SERIAL_SPCP8X5 USB_SERIAL_SSU100 USB_SERIAL_SYMBOL USB_SERIAL_TI USB_SERIAL_UPD78F0730 USB_SERIAL_VISOR USB_SERIAL_WHITEHEAT USB_SERIAL_WISHBONE USB_SERIAL_WWAN USB_SERIAL_XR USB_SERIAL_XSENS_MT USB_SEVSEG USB_SI470X USB_SI4713 USB_SIERRA_NET USB_SISUSBVGA USB_SL811_CS USB_SL811_HCD USB_SL811_HCD_ISO USB_SNP_CORE USB_SPEEDTOUCH USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_ENE_UB6250 USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_STV06XX USB_TEST USB_TMC USB_TRANCEVIBRATOR USB_UAS USB_UEAGLEATM USB_ULPI_BUS USB_USBNET USB_USS720 USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_VIDEO_CLASS USB_VIDEO_CLASS_INPUT_EVDEV USB_VL600 USB_WDM USB_XHCI_DBGCAP USB_XHCI_PCI_RENESAS USB_XHCI_PLATFORM USB_XUSBATM USB_YUREX USERFAULTFD USERFAULTFD_RWP USERIO USER_RETURN_NOTIFIER UVC_COMMON U_SERIAL_CONSOLE V4L2_MEM2MEM_DEV V4L_TEST_DRIVERS VALIDATE_FS_PARSER VDPA VDPA_SIM VDPA_SIM_BLOCK VDPA_SIM_NET VETH VFIO VFIO_DEVICE_CDEV VFIO_PCI VFIO_PCI_CORE VFIO_PCI_INTX VFIO_VIRQFD VGASTATE VHOST VHOST_CROSS_ENDIAN_LEGACY VHOST_IOTLB VHOST_NET VHOST_RING VHOST_TASK VHOST_VDPA VHOST_VSOCK VIDEO VIDEOBUF2_CORE VIDEOBUF2_DMA_CONTIG VIDEOBUF2_DMA_SG VIDEOBUF2_MEMOPS VIDEOBUF2_V4L2 VIDEOBUF2_VMALLOC VIDEOMODE_HELPERS VIDEO_AU0828 VIDEO_AU0828_RC VIDEO_AU0828_V4L2 VIDEO_CS53L32A VIDEO_CX231XX VIDEO_CX231XX_ALSA VIDEO_CX231XX_DVB VIDEO_CX231XX_RC VIDEO_CX2341X VIDEO_CX25840 VIDEO_DEV VIDEO_EM28XX VIDEO_EM28XX_ALSA VIDEO_EM28XX_DVB VIDEO_EM28XX_RC VIDEO_EM28XX_V4L2 VIDEO_GO7007 VIDEO_GO7007_LOADER VIDEO_GO7007_USB VIDEO_GO7007_USB_S2250_BOARD VIDEO_HDPVR VIDEO_MSP3400 VIDEO_PVRUSB2 VIDEO_PVRUSB2_DVB VIDEO_PVRUSB2_SYSFS VIDEO_SAA711X VIDEO_STK1160 VIDEO_TUNER VIDEO_TVEEPROM VIDEO_USBTV VIDEO_V4L2_I2C VIDEO_V4L2_SUBDEV_API VIDEO_V4L2_TPG VIDEO_VICODEC VIDEO_VIM2M VIDEO_VIMC VIDEO_VIVID VIDEO_VIVID_CEC VIDEO_WM8775 VIPERBOARD_ADC VIRTIO_BALLOON VIRTIO_DMA_SHARED_BUFFER VIRTIO_MEM VIRTIO_MMIO VIRTIO_MMIO_CMDLINE_DEVICES VIRTIO_PMEM VIRTIO_VDPA VIRTIO_VSOCKETS VIRTIO_VSOCKETS_COMMON VIRT_WIFI VIRT_XFER_TO_GUEST_WORK VLAN_8021Q VLAN_8021Q_GVRP VLAN_8021Q_MVRP VMWARE_VMCI VMXNET3 VP_VDPA VSOCKETS VSOCKETS_DIAG VSOCKETS_LOOPBACK VSOCKMON VT_HW_CONSOLE_BINDING VXLAN WAN WANT_DEV_COREDUMP WATCH_QUEUE WEXT_CORE WEXT_PROC WIREGUARD WIRELESS WLAN WLAN_VENDOR_ADMTEK WLAN_VENDOR_MORSEMICRO WLAN_VENDOR_NXP WLAN_VENDOR_SILABS WWAN X25 X86_FRED X86_SGX X86_SGX_KVM X86_USER_SHADOW_STACK XDP_SOCKETS XDP_SOCKETS_DIAG XFRM_ESPINTCP XFRM_INTERFACE XFRM_IPCOMP XFRM_IPTFS XFRM_MIGRATE XFRM_OFFLOAD XFRM_STATISTICS XFRM_SUB_POLICY XFRM_USER_COMPAT XFS_BTREE_IN_MEM XFS_DRAIN_INTENTS XFS_FS XFS_LIVE_HOOKS XFS_MEMORY_BUFS XFS_ONLINE_REPAIR XFS_ONLINE_SCRUB XFS_POSIX_ACL XFS_QUOTA XFS_RT XILLYBUS_CLASS XILLYUSB XOR_BLOCKS XOR_BLOCKS_ARCH YENTA YENTA_ENE_TUNE YENTA_O2 YENTA_RICOH YENTA_TI YENTA_TOSHIBA ZEROPLUS_FF ZLIB_DEFLATE ZONEFS_FS ZRAM ZRAM_BACKEND_FORCE_LZO ZRAM_BACKEND_LZO ZRAM_DEF_COMP_LZO ZSMALLOC ZSTD_COMPRESS ZSWAP ZSWAP_COMPRESSOR_DEFAULT_842 ZSWAP_DEFAULT_ON ZSWAP_SHRINKER_DEFAULT_ON] picked [v7.2 v7.1 v7.0 v6.18 v6.16 v6.14 v6.12 v6.10 v6.7 v6.4 v6.1 v5.18 v5.15 v5.12 v5.9 v5.6 v5.3 v5.0 v4.19] out of 45 release tags testing release v7.2 testing commit 8d3ae59288f1e7d58d76558a6ee96d533bc5019f gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: abc6cf2c2d20f638c271fa308b24eee9086ba6425265d0914972a64ed2b1a1ec run #0: OK run #1: OK run #2: OK run #3: OK run #4: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #5: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #6: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #7: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #8: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #9: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #10: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #11: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #12: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #13: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #14: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #15: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #16: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #17: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #18: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #19: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode representative crash: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode, types: [KASAN-USE-AFTER-FREE-READ] testing release v7.1 testing commit 8cd9520d35a6c38db6567e97dd93b1f11f185dc6 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 31cfd99435f5c367b6212fe13760bd263f382f445e6dc8e496c4a4441177ad07 run #0: OK run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #10: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #11: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #12: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #13: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #14: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #15: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #16: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #17: crashed: general protection fault in jffs2_xattr_delete_inode run #18: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #19: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode representative crash: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode, types: [KASAN-USE-AFTER-FREE-READ] testing release v7.0 testing commit 028ef9c96e96197026887c0f092424679298aae8 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 6e7bdb470ad0b436899db58b7b2688c3703b7030ebf13ea6903624b9f83b6089 run #0: OK run #1: OK run #2: OK run #3: OK run #4: OK run #5: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #6: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #7: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #8: crashed: general protection fault in jffs2_xattr_delete_inode run #9: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #10: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #11: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #12: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #13: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #14: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #15: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #16: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #17: crashed: general protection fault in jffs2_xattr_delete_inode run #18: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #19: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode representative crash: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode, types: [KASAN-USE-AFTER-FREE-READ] testing release v6.18 testing commit 7d0a66e4bb9081d75c82ec4957c50034cb0ea449 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 08f80f0861ef3331cca2512e7f9719f1e04aeeab976a8c084b8d173661f8885a run #0: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #1: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #2: crashed: general protection fault in jffs2_xattr_delete_inode run #3: crashed: general protection fault in jffs2_xattr_delete_inode run #4: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #5: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #6: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #7: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #8: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #9: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #10: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #11: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #12: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #13: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #14: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #15: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #16: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #17: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #18: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #19: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode representative crash: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode, types: [KASAN-USE-AFTER-FREE-READ] testing release v6.16 testing commit 038d61fd642278bab63ee8ef722c50d10ab01e8f gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: e6fddd2cd94920e2c3a170808eab54b01dc69e17b1d1d261e463a2066a0e979a all runs: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode representative crash: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode, types: [KASAN-USE-AFTER-FREE-READ] testing release v6.14 testing commit 38fec10eb60d687e30c8c6b5420d86e8149f7557 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 9c128d0a51f08e4dbda0f73b6633cc523a838fb18e10113f09e8d09b4465e546 run #0: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #1: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #2: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #3: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #4: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #5: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #6: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #7: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #8: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #9: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #10: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #11: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #12: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #13: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #14: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #15: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #16: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #17: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #18: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #19: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode representative crash: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode, types: [KASAN-USE-AFTER-FREE-READ] unable to determine the verdict: 0 good runs (wanted 15), for bad wanted 10 in total, got 5 testing release v6.12 testing commit adc218676eef25575469234709c2d87185ca223a gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 479a2364f8aa5d7c2778f651e7d25cb2fa40acec0cb6ca95a7e9db5dc89bbc04 run #0: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #1: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #2: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #3: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #4: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #5: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #6: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #7: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #8: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #9: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #10: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #11: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #12: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #13: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #14: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #15: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #16: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #17: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode run #18: basic kernel testing failed: UBSAN: signed-integer-overflow in __ip_select_ident run #19: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode representative crash: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode, types: [KASAN-USE-AFTER-FREE-READ] unable to determine the verdict: 0 good runs (wanted 15), for bad wanted 10 in total, got 6 testing release v6.10 testing commit 0c3836482481200ead7b416ca80c68a29cfdaabd gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 2e31ca8569c5bb4409757f44cbb7aa38e0d95763b4d7f415d43876d0b31def37 all runs: boot failed: UBSAN: signed-integer-overflow in __cancel_work unable to determine the verdict: 0 good runs (wanted 15), for bad wanted 10 in total, got 0 testing release v6.7 testing commit 0dd3ee31125508cd67f7e7172247f05b7fd1753a gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: f2598266a4d2179e86b6c7ebab84047b889a85edda0a61f03141bc9680b67fd6 all runs: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode representative crash: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode, types: [KASAN-USE-AFTER-FREE-READ] testing release v6.4 testing commit 6995e2de6891c724bfeb2db33d7b87775f913ad1 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: e4922db9928276c530e4a6d3070f21083e56b3322fc177135015f1591ccb6379 all runs: crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode representative crash: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode, types: [KASAN-USE-AFTER-FREE-READ] testing release v6.1 testing commit 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 failed building 830b3c68c1fb1e9176028d02ef86f3cf76aa2476: ./include/linux/fortify-string.h:543:4: error: call to '__read_overflow' declared with 'error' attribute: detected read beyond size of object (1st parameter) testing release v5.18 testing commit 4b0986a3613c92f4ec1bdc7f60ec66fea135991f gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 2738fd9b2c073f10739cb1014c508cbc7f5b4812f72a3f8ae713d6cb00953030 run #0: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #1: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #2: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #3: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #4: crashed: general protection fault in jffs2_xattr_delete_inode run #5: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #6: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #7: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #8: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #9: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #10: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #11: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #12: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #13: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #14: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #15: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #16: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #17: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #18: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #19: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode representative crash: KASAN: use-after-free Read in jffs2_xattr_delete_inode, types: [KASAN-USE-AFTER-FREE-READ] testing release v5.15 testing commit 8bb7eca972ad531c9b149c0a51ab43a417385813 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 8b941a3270dd7e312880c8aac70635b83a9ba8b130e0235a579956026c5c5e2e run #0: OK run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: basic kernel testing failed: WARNING: locking bug in get_page_from_freelist run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK false negative chance: 0.000 # git bisect start 4b0986a3613c92f4ec1bdc7f60ec66fea135991f 8bb7eca972ad531c9b149c0a51ab43a417385813 Bisecting: 22908 revisions left to test after this (roughly 15 steps) [6020c204be997e3f5129839ff9c801800fb4336e] Merge tag 'folio-5.17' of git://git.infradead.org/users/willy/pagecache testing commit 6020c204be997e3f5129839ff9c801800fb4336e gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 83742c152c53a408b5f1e397fe7681baf272bcdcf6212dd5a93cec94fe764be6 all runs: boot failed: UBSAN: null-ptr-deref in corrupted unable to determine the verdict: 0 good runs (wanted 15), for bad wanted 10 in total, got 0 # git bisect skip 6020c204be997e3f5129839ff9c801800fb4336e Bisecting: 22881 revisions left to test after this (roughly 15 steps) [f079ab01b5609fb0c9acc52c88168bf1eed82373] Merge tag 'iomap-5.17' of git://git.infradead.org/users/willy/linux testing commit f079ab01b5609fb0c9acc52c88168bf1eed82373 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: f4f46f0a81788268b576c9a06f8f946fab2697f3c72ac1c437b797e08db1905d all runs: boot failed: UBSAN: null-ptr-deref in corrupted unable to determine the verdict: 0 good runs (wanted 15), for bad wanted 10 in total, got 0 # git bisect skip f079ab01b5609fb0c9acc52c88168bf1eed82373 Bisecting: 22881 revisions left to test after this (roughly 15 steps) [b92f7ea556f8b74ba08cdc27258941e293400050] drm/omap: dss: Make use of the helper macro SET_RUNTIME_PM_OPS() testing commit b92f7ea556f8b74ba08cdc27258941e293400050 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: b16d69d4c2d6c2ef8bc8a366ea16fd01c0beac1f5554fe19cff86554ea0548c5 run #0: basic kernel testing failed: WARNING: locking bug in get_page_from_freelist run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK false negative chance: 0.000 # git bisect good b92f7ea556f8b74ba08cdc27258941e293400050 Bisecting: 22240 revisions left to test after this (roughly 15 steps) [46f57d2410150985f81da7cbbb5fdcda01d02ac2] perf arm: Fix off-by-one directory path testing commit 46f57d2410150985f81da7cbbb5fdcda01d02ac2 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 0661f1681e5c87473a5b7750f85181516f415e834de5c3dbd885e3a5b6cdda02 all runs: boot failed: UBSAN: null-ptr-deref in corrupted unable to determine the verdict: 0 good runs (wanted 15), for bad wanted 10 in total, got 0 # git bisect skip 46f57d2410150985f81da7cbbb5fdcda01d02ac2 Bisecting: 22240 revisions left to test after this (roughly 15 steps) [0b993fc1fec7b43a75b875763dc58c5940eea47a] serial: liteuart: relax compile-test dependencies testing commit 0b993fc1fec7b43a75b875763dc58c5940eea47a gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 1572239ff745a5b133296b71bb9a478687e3885a9b24001a751d60d302a7c069 run #0: basic kernel testing failed: WARNING: locking bug in fill_pool run #1: basic kernel testing failed: WARNING: locking bug in fill_pool run #2: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #3: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #4: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #5: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #6: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #7: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #8: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #9: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #10: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #11: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #12: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #13: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #14: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #15: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #16: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #17: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #18: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #19: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode representative crash: KASAN: use-after-free Read in jffs2_xattr_delete_inode, types: [KASAN-USE-AFTER-FREE-READ] # git bisect bad 0b993fc1fec7b43a75b875763dc58c5940eea47a Bisecting: 6226 revisions left to test after this (roughly 13 steps) [ff0700f03609b9f0defacd4ce96d9519d721e0a2] Merge tag 'sound-5.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound testing commit ff0700f03609b9f0defacd4ce96d9519d721e0a2 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 0d8020689aeefe3d5a09545973528762c81a5b3498cf373fdd3caa42b26a5183 all runs: OK false negative chance: 0.000 # git bisect good ff0700f03609b9f0defacd4ce96d9519d721e0a2 Bisecting: 3128 revisions left to test after this (roughly 12 steps) [5af06603c4090617be216a9185193a7be3ca60af] Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid testing commit 5af06603c4090617be216a9185193a7be3ca60af gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: c00ddbcef94801c63aadce9d0ef2d5faabcbe5cc9f35ebf9d5aa76b73c1b2e73 all runs: OK false negative chance: 0.000 # git bisect good 5af06603c4090617be216a9185193a7be3ca60af Bisecting: 1577 revisions left to test after this (roughly 11 steps) [bd485d274be3935da61c349dc82cb7471bac0a9a] Merge tag 'rproc-v5.16' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux testing commit bd485d274be3935da61c349dc82cb7471bac0a9a gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 1f729c0b368e2affd36bff11fc2b45ed0804abb9e3ba3a47aa666d2651bde4b3 all runs: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode representative crash: KASAN: use-after-free Read in jffs2_xattr_delete_inode, types: [KASAN-USE-AFTER-FREE-READ] # git bisect bad bd485d274be3935da61c349dc82cb7471bac0a9a Bisecting: 770 revisions left to test after this (roughly 10 steps) [00f178e15095fbcf04db00486378a6fa416a125e] Merge tag 'xtensa-20211105' of git://github.com/jcmvbkbc/linux-xtensa testing commit 00f178e15095fbcf04db00486378a6fa416a125e gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 75e275639d68cb496d3b34499f3b814b1a4a3a08718a3e0f623746d654872568 all runs: OK false negative chance: 0.000 # git bisect good 00f178e15095fbcf04db00486378a6fa416a125e Bisecting: 390 revisions left to test after this (roughly 9 steps) [dd72945c43d34bee496b847e021069dc31f7398f] Merge tag 'cxl-for-5.16' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl testing commit dd72945c43d34bee496b847e021069dc31f7398f gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 253fa35765e653119cb5f88e461242894a65b6cdfdb7439d6065fba26c2d8d8e run #0: basic kernel testing failed: WARNING: locking bug in get_page_from_freelist run #1: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #2: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #3: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #4: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #5: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #6: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #7: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #8: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #9: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #10: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #11: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #12: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #13: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #14: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #15: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #16: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #17: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #18: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode run #19: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode representative crash: KASAN: use-after-free Read in jffs2_xattr_delete_inode, types: [KASAN-USE-AFTER-FREE-READ] # git bisect bad dd72945c43d34bee496b847e021069dc31f7398f Bisecting: 140 revisions left to test after this (roughly 8 steps) [bbdbeb0048b443082bcce5ed65a336bcc578a60e] Merge tag 'perf-tools-for-v5.16-2021-11-07-without-bpftool-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux testing commit bbdbeb0048b443082bcce5ed65a336bcc578a60e gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 3df4ace1971575b80b83671ce3be2f6d5b95ff99938d3334fceed1b433797de7 all runs: OK false negative chance: 0.000 # git bisect good bbdbeb0048b443082bcce5ed65a336bcc578a60e Bisecting: 80 revisions left to test after this (roughly 6 steps) [206825f50f908771934e1fba2bfc2e1f1138b36a] Merge tag 'mtd/for-5.16' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux testing commit 206825f50f908771934e1fba2bfc2e1f1138b36a gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 0da6b217682f3bf8af7ead17159549eb04173a4382490978c5e97ef2c0b6a3a7 all runs: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode representative crash: KASAN: use-after-free Read in jffs2_xattr_delete_inode, types: [KASAN-USE-AFTER-FREE-READ] # git bisect bad 206825f50f908771934e1fba2bfc2e1f1138b36a Bisecting: 29 revisions left to test after this (roughly 5 steps) [b5b5b4dc6fcd8194b9dd38c8acdc5ab71adf44f8] mtd: rawnand: gpio: Keep the driver compatible with on-die ECC engines testing commit b5b5b4dc6fcd8194b9dd38c8acdc5ab71adf44f8 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 69ddac6c86ec0b06c65dbcef45269555ff66f5d9a106daa17dc6aaa2493c5bfe all runs: OK false negative chance: 0.000 # git bisect good b5b5b4dc6fcd8194b9dd38c8acdc5ab71adf44f8 Bisecting: 13 revisions left to test after this (roughly 4 steps) [bca20e6a73863f37eb5e04c505be219a65f26a38] Merge tag 'nand/for-5.16' into mtd/next testing commit bca20e6a73863f37eb5e04c505be219a65f26a38 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 0ee63218eda062f8e7ae75affd0d93c5126d005fe200c4b866bb5637ea88600c all runs: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode representative crash: KASAN: use-after-free Read in jffs2_xattr_delete_inode, types: [KASAN-USE-AFTER-FREE-READ] # git bisect bad bca20e6a73863f37eb5e04c505be219a65f26a38 Bisecting: 7 revisions left to test after this (roughly 3 steps) [73e197df1949347bbc1902605b6c7fe8e3b04249] MAINTAINERS: Add entry for Qualcomm NAND controller driver testing commit 73e197df1949347bbc1902605b6c7fe8e3b04249 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 69ddac6c86ec0b06c65dbcef45269555ff66f5d9a106daa17dc6aaa2493c5bfe run #0: basic kernel testing failed: WARNING: locking bug in get_page_from_freelist run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK false negative chance: 0.000 # git bisect good 73e197df1949347bbc1902605b6c7fe8e3b04249 Bisecting: 3 revisions left to test after this (roughly 2 steps) [7b09acdcb944a9be6acc38ab1aa8a0ffd08871c1] mtd: block2mtd: add support for an optional custom MTD label testing commit 7b09acdcb944a9be6acc38ab1aa8a0ffd08871c1 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 8d883190690b30793efe36d13e672cdc632812059067b6182840d188f905a36b all runs: crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode representative crash: KASAN: use-after-free Read in jffs2_xattr_delete_inode, types: [KASAN-USE-AFTER-FREE-READ] # git bisect bad 7b09acdcb944a9be6acc38ab1aa8a0ffd08871c1 Bisecting: 1 revision left to test after this (roughly 1 step) [603362b4a58393061dcfed1c7f0d0fd4aba61126] mtd: fixup CFI on ixp4xx testing commit 603362b4a58393061dcfed1c7f0d0fd4aba61126 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 56e10960d530a5a5a9ebcf8ed4af6570664c385774004cf5d8bf94bcb180d93d all runs: OK false negative chance: 0.000 # git bisect good 603362b4a58393061dcfed1c7f0d0fd4aba61126 Bisecting: 0 revisions left to test after this (roughly 0 steps) [a04e96537cc64b63fbeb300df2503167bb54f2a1] mtd: block2mtd: minor refactor to avoid hard coded constant testing commit a04e96537cc64b63fbeb300df2503167bb54f2a1 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: eafa774909634e0c2552d0679cf2903f92771d076eac440e58de968fc6b8b5a3 all runs: OK false negative chance: 0.000 # git bisect good a04e96537cc64b63fbeb300df2503167bb54f2a1 7b09acdcb944a9be6acc38ab1aa8a0ffd08871c1 is the first bad commit commit 7b09acdcb944a9be6acc38ab1aa8a0ffd08871c1 Author: Joachim Wiberg Date: Sat Oct 9 08:09:55 2021 +0200 mtd: block2mtd: add support for an optional custom MTD label This patch adds support for an optional MTD label for mtd2block emulated MTD devices. Useful when, e.g., testing device images using Qemu. The following line in /etc/fstab can then be used to mount a file system regardless if running on an embedded system, or emulated with block2mtd: mtd:Config /mnt jffs2 noatime,nodiratime 0 0 Kernel command line syntax in the emulated case: block2mtd.block2mtd=/dev/sda,,Config Notice the ',,' it is the optional erase_size, which like before this patch, defaults to PAGE_SIZE when omitted. Hence the strlen() check. Signed-off-by: Joachim Wiberg Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20211009060955.552636-3-troglobit@gmail.com drivers/mtd/devices/block2mtd.c | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) accumulated error probability: 0.00 culprit signature: 8d883190690b30793efe36d13e672cdc632812059067b6182840d188f905a36b parent signature: eafa774909634e0c2552d0679cf2903f92771d076eac440e58de968fc6b8b5a3 reproducer is flaky (0.45 repro chance estimate) revisions tested: 37, total time: 10h30m47.61051696s (build: 4h5m14.030049059s, test: 5h20m15.236353509s) first bad commit: 7b09acdcb944a9be6acc38ab1aa8a0ffd08871c1 mtd: block2mtd: add support for an optional custom MTD label recipients (to): ["miquel.raynal@bootlin.com" "troglobit@gmail.com"] recipients (cc): [] crash: KASAN: use-after-free Read in jffs2_xattr_delete_inode jffs2: warning: (2892) jffs2_acl_from_medium: Invalid ACL version. (=0) ================================================================== BUG: KASAN: use-after-free in jffs2_xattr_delete_inode+0x104/0x120 fs/jffs2/xattr.c:602 Read of size 4 at addr ffff888130016be8 by task syz-executor388/2892 CPU: 0 PID: 2892 Comm: syz-executor388 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0+0x1f/0x170 mm/kasan/report.c:256 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x7f/0x11b mm/kasan/report.c:459 jffs2_xattr_delete_inode+0x104/0x120 fs/jffs2/xattr.c:602 jffs2_do_clear_inode+0x48/0x530 fs/jffs2/readinode.c:1418 evict+0x2f0/0x6c0 fs/inode.c:586 iput_final fs/inode.c:1662 [inline] iput fs/inode.c:1688 [inline] iput+0x487/0x860 fs/inode.c:1674 jffs2_new_inode+0xb04/0xda0 fs/jffs2/fs.c:470 jffs2_mkdir+0x169/0xdf0 fs/jffs2/dir.c:479 vfs_mkdir+0x1d4/0x3f0 fs/namei.c:3885 do_mkdirat+0x285/0x300 fs/namei.c:3911 __do_sys_mkdir fs/namei.c:3931 [inline] __se_sys_mkdir fs/namei.c:3929 [inline] __x64_sys_mkdir+0xf2/0x140 fs/namei.c:3929 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3c/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f60f1278d87 Code: 77 01 c3 48 c7 c2 d0 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 53 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 d0 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007f60f023c1a8 EFLAGS: 00000202 ORIG_RAX: 0000000000000053 RAX: ffffffffffffffda RBX: 00000000000003c7 RCX: 00007f60f1278d87 RDX: 0000000000000000 RSI: 00000000000001ff RDI: 00007f60f023c1b0 RBP: 00007f60f023c1b0 R08: 0000000000000002 R09: 00000000fffffffe R10: 0000000000000000 R11: 0000000000000202 R12: 00007f60f12f006d R13: 00007ffc223e9b30 R14: 00007ffc223e9720 R15: 00007ffc223e9808 Allocated by task 2843: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] __kasan_slab_alloc+0x83/0xb0 mm/kasan/common.c:467 kasan_slab_alloc include/linux/kasan.h:254 [inline] slab_post_alloc_hook mm/slab.h:519 [inline] slab_alloc_node mm/slub.c:3206 [inline] slab_alloc mm/slub.c:3214 [inline] kmem_cache_alloc+0x209/0x390 mm/slub.c:3219 jffs2_scan_make_ino_cache fs/jffs2/scan.c:974 [inline] jffs2_scan_make_ino_cache+0x7c/0x170 fs/jffs2/scan.c:963 jffs2_scan_inode_node fs/jffs2/scan.c:1021 [inline] jffs2_scan_eraseblock fs/jffs2/scan.c:810 [inline] jffs2_scan_medium+0x5047/0x59f0 fs/jffs2/scan.c:151 jffs2_build_filesystem fs/jffs2/build.c:112 [inline] jffs2_do_mount_fs+0x8ab/0x2000 fs/jffs2/build.c:413 jffs2_do_fill_super+0x3c4/0xa60 fs/jffs2/fs.c:573 jffs2_fill_super+0x27e/0x370 fs/jffs2/super.c:288 mtd_get_sb+0x1fa/0x360 drivers/mtd/mtdsuper.c:79 mtd_get_sb_by_nr drivers/mtd/mtdsuper.c:110 [inline] get_tree_mtd+0x50e/0x880 drivers/mtd/mtdsuper.c:180 vfs_get_tree+0x95/0x340 fs/super.c:1498 do_new_mount fs/namespace.c:2988 [inline] path_mount+0x131f/0x1fb0 fs/namespace.c:3318 do_mount fs/namespace.c:3331 [inline] __do_sys_mount fs/namespace.c:3539 [inline] __se_sys_mount fs/namespace.c:3516 [inline] __x64_sys_mount+0x27e/0x300 fs/namespace.c:3516 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3c/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae The buggy address belongs to the object at ffff888130016bc0 which belongs to the cache jffs2_inode_cache of size 48 The buggy address is located 40 bytes inside of 48-byte region [ffff888130016bc0, ffff888130016bf0) The buggy address belongs to the page: page:ffffea0004c00580 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888130016fc0 pfn:0x130016 flags: 0x200000000000200(slab|node=0|zone=2) raw: 0200000000000200 ffffea0004ae2b80 0000000300000003 ffff88810af458c0 raw: ffff888130016fc0 0000000080400000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 2843, ts 60231381152, free_ts 59840236997 prep_new_page mm/page_alloc.c:2424 [inline] get_page_from_freelist+0x1682/0x2060 mm/page_alloc.c:4153 __alloc_pages+0x1fc/0x2210 mm/page_alloc.c:5375 alloc_pages+0x1a7/0x300 mm/mempolicy.c:2197 alloc_slab_page mm/slub.c:1763 [inline] allocate_slab mm/slub.c:1900 [inline] new_slab+0x30a/0x4a0 mm/slub.c:1963 ___slab_alloc+0x6c8/0xc10 mm/slub.c:2994 __slab_alloc mm/slub.c:3081 [inline] slab_alloc_node mm/slub.c:3172 [inline] slab_alloc mm/slub.c:3214 [inline] kmem_cache_alloc+0x35d/0x390 mm/slub.c:3219 jffs2_scan_make_ino_cache fs/jffs2/scan.c:974 [inline] jffs2_scan_make_ino_cache+0x7c/0x170 fs/jffs2/scan.c:963 jffs2_scan_inode_node fs/jffs2/scan.c:1021 [inline] jffs2_scan_eraseblock fs/jffs2/scan.c:810 [inline] jffs2_scan_medium+0x5047/0x59f0 fs/jffs2/scan.c:151 jffs2_build_filesystem fs/jffs2/build.c:112 [inline] jffs2_do_mount_fs+0x8ab/0x2000 fs/jffs2/build.c:413 jffs2_do_fill_super+0x3c4/0xa60 fs/jffs2/fs.c:573 jffs2_fill_super+0x27e/0x370 fs/jffs2/super.c:288 mtd_get_sb+0x1fa/0x360 drivers/mtd/mtdsuper.c:79 mtd_get_sb_by_nr drivers/mtd/mtdsuper.c:110 [inline] get_tree_mtd+0x50e/0x880 drivers/mtd/mtdsuper.c:180 vfs_get_tree+0x95/0x340 fs/super.c:1498 do_new_mount fs/namespace.c:2988 [inline] path_mount+0x131f/0x1fb0 fs/namespace.c:3318 do_mount fs/namespace.c:3331 [inline] __do_sys_mount fs/namespace.c:3539 [inline] __se_sys_mount fs/namespace.c:3516 [inline] __x64_sys_mount+0x27e/0x300 fs/namespace.c:3516 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1338 [inline] free_pcp_prepare+0x347/0x760 mm/page_alloc.c:1389 free_unref_page_prepare mm/page_alloc.c:3315 [inline] free_unref_page_list+0x1ce/0xeb0 mm/page_alloc.c:3431 release_pages+0x4d0/0x1b50 mm/swap.c:950 tlb_batch_pages_flush mm/mmu_gather.c:49 [inline] tlb_flush_mmu_free mm/mmu_gather.c:242 [inline] tlb_flush_mmu mm/mmu_gather.c:249 [inline] tlb_finish_mmu+0x165/0x8d0 mm/mmu_gather.c:340 exit_mmap+0x1b9/0x5e0 mm/mmap.c:3173 __mmput+0xd6/0x440 kernel/fork.c:1115 mmput+0x53/0x60 kernel/fork.c:1136 exit_mm kernel/exit.c:501 [inline] do_exit+0xab1/0x2890 kernel/exit.c:812 do_group_exit+0x125/0x310 kernel/exit.c:922 __do_sys_exit_group kernel/exit.c:933 [inline] __se_sys_exit_group kernel/exit.c:931 [inline] __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:931 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3c/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Memory state around the buggy address: ffff888130016a80: fb fb fb fb fb fb fc fc fb fb fb fb fb fb fc fc ffff888130016b00: fb fb fb fb fb fb fc fc fb fb fb fb fb fb fc fc >ffff888130016b80: fb fb fb fb fb fb fc fc fb fb fb fb fb fb fc fc ^ ffff888130016c00: fb fb fb fb fb fb fc fc fb fb fb fb fb fb fc fc ffff888130016c80: fb fb fb fb fb fb fc fc fb fb fb fb fb fb fc fc ==================================================================