ci2 starts bisection 2026-09-22 14:36:29.821962928 +0000 UTC m=+36943.561147165 bisecting fixing commit since aabd761612dbeb7d40750d485da219d11433718a building syzkaller on 746171eef8d3611ed06d1a92ef68d5bee5031150 ensuring issue is reproducible on original commit aabd761612dbeb7d40750d485da219d11433718a testing commit aabd761612dbeb7d40750d485da219d11433718a gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: d4743cb8fefeec0f703d0b9a9694c1d4a7664b5c5d0c4ea2bc6c32cd3c99a66d all runs: crashed: WARNING in pkcs1pad_verify representative crash: WARNING in pkcs1pad_verify, types: [WARNING] check whether we can drop unnecessary instrumentation disabling configs for [hang memleak ubsan kasan locking atomic_sleep], they are not needed testing commit aabd761612dbeb7d40750d485da219d11433718a gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 71abcd0add2815f2a687db81592e16f920c03377bbae29bfa70f76e14efa6ca2 run #0: crashed: WARNING in pkcs1pad_verify run #1: crashed: WARNING in pkcs1pad_verify run #2: crashed: WARNING in pkcs1pad_verify run #3: crashed: WARNING in pkcs1pad_verify run #4: crashed: WARNING in pkcs1pad_verify run #5: crashed: WARNING in pkcs1pad_verify run #6: crashed: WARNING in pkcs1pad_verify run #7: crashed: WARNING in pkcs1pad_verify run #8: basic kernel testing failed: failed to copy binary to VM: failed to run ["ssh" "-p" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "IdentitiesOnly=yes" "-o" "BatchMode=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "root@10.128.1.156" "mkdir" "-p" "ci2-linux-5-15-kasan-bisect-job"]: exit status 255 run #9: basic kernel testing failed: failed to copy binary to VM: failed to run ["ssh" "-p" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "IdentitiesOnly=yes" "-o" "BatchMode=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "root@10.128.1.14" "mkdir" "-p" "ci2-linux-5-15-kasan-bisect-job"]: exit status 255 representative crash: WARNING in pkcs1pad_verify, types: [WARNING] the bug reproduces without the instrumentation disabling configs for [hang memleak ubsan kasan locking atomic_sleep], they are not needed kconfig minimization: base=3707 full=7427 leaves diff=2100 split chunks (needed=false): <2100> split chunk #0 of len 2100 into 5 parts testing without sub-chunk 1/5 disabling configs for [atomic_sleep hang memleak ubsan kasan locking], they are not needed testing commit aabd761612dbeb7d40750d485da219d11433718a gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: a4c316a7abfbe75aab690a54304f8252b57c13c2bc59660b094e1d40e2de5a59 all runs: crashed: WARNING in pkcs1pad_verify representative crash: WARNING in pkcs1pad_verify, types: [WARNING] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [hang memleak ubsan kasan locking atomic_sleep], they are not needed testing commit aabd761612dbeb7d40750d485da219d11433718a gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: b921f6e3effb196404e21441ecc73c29f1fb3350b65004922a0c095b7e7dbebb all runs: crashed: WARNING in pkcs1pad_verify representative crash: WARNING in pkcs1pad_verify, types: [WARNING] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [atomic_sleep hang memleak ubsan kasan locking], they are not needed testing commit aabd761612dbeb7d40750d485da219d11433718a gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: c8de91ffb919a05cff00a23ba2e9f3045b02b1035a6eccf2d3db82f0327856db all runs: crashed: WARNING in pkcs1pad_verify representative crash: WARNING in pkcs1pad_verify, types: [WARNING] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [memleak ubsan kasan locking atomic_sleep hang], they are not needed testing commit aabd761612dbeb7d40750d485da219d11433718a gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: db605d7dc2e3d22e8713a0604aed354b2b72f56327f5053422b92048ddb78fc1 all runs: crashed: WARNING in pkcs1pad_verify representative crash: WARNING in pkcs1pad_verify, types: [WARNING] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [memleak ubsan kasan locking atomic_sleep hang], they are not needed testing commit aabd761612dbeb7d40750d485da219d11433718a gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 7ecc85ea4f60bed1f74c3368cffc009d89d9977232a720d24010c8bfc5284a98 all runs: crashed: WARNING in pkcs1pad_verify representative crash: WARNING in pkcs1pad_verify, types: [WARNING] the chunk can be dropped disabling configs for [hang memleak ubsan kasan locking atomic_sleep], they are not needed testing current HEAD 0248c33e835ecbec3a591f93fdaae53f7b90a4d6 testing commit 0248c33e835ecbec3a591f93fdaae53f7b90a4d6 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 5ca7ddbcfdfe4edee6183293924adee2f70ae9ee795e25fa6f8ad33f16a8e4f4 all runs: OK false negative chance: 0.000 # git bisect start 0248c33e835ecbec3a591f93fdaae53f7b90a4d6 aabd761612dbeb7d40750d485da219d11433718a Bisecting: 899 revisions left to test after this (roughly 10 steps) [3df1a4026662121011187247897fe95fd84e8a3a] media: cec: stm32: prevent out-of-bounds write on RX overflow determine whether the revision contains the guilty commit revision aabd761612dbeb7d40750d485da219d11433718a crashed and is reachable testing commit 3df1a4026662121011187247897fe95fd84e8a3a gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: cd44f9e487e2f3d22ad0015a7ff0c1ae26634f2673c04e7acbdaa92329e4ef4b all runs: OK false negative chance: 0.000 # git bisect bad 3df1a4026662121011187247897fe95fd84e8a3a Bisecting: 449 revisions left to test after this (roughly 9 steps) [0dadb0620ab65949a8bc2439dd28ea3c942fe87d] ip6_tunnel: clear skb2->cb[] in ip6ip6_err() determine whether the revision contains the guilty commit revision aabd761612dbeb7d40750d485da219d11433718a crashed and is reachable testing commit 0dadb0620ab65949a8bc2439dd28ea3c942fe87d gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 85ece9178b0fc09127569b90284af1d4ce09ea6df51b55b222d6e456982c9dcf all runs: OK false negative chance: 0.000 # git bisect bad 0dadb0620ab65949a8bc2439dd28ea3c942fe87d Bisecting: 224 revisions left to test after this (roughly 8 steps) [6eed5ae7887a93160803d2b81ff88e75eefd4a4c] pppoe: reload header pointer after dev_hard_header() determine whether the revision contains the guilty commit revision aabd761612dbeb7d40750d485da219d11433718a crashed and is reachable testing commit 6eed5ae7887a93160803d2b81ff88e75eefd4a4c gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: f4ae4e057bcc0e79d8986d4e0eff99d2a1ebae6f208445e298d7067bdee09e05 all runs: OK false negative chance: 0.000 # git bisect bad 6eed5ae7887a93160803d2b81ff88e75eefd4a4c Bisecting: 111 revisions left to test after this (roughly 7 steps) [eacd2e2117e8682f937967fda1022e7f1c22d91a] nexthop: initialize extack in nh_res_bucket_migrate() determine whether the revision contains the guilty commit revision aabd761612dbeb7d40750d485da219d11433718a crashed and is reachable testing commit eacd2e2117e8682f937967fda1022e7f1c22d91a gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: d590fb24594ca0751040d0eee1c042a183d0278c329853510240477d216c999d all runs: OK false negative chance: 0.000 # git bisect bad eacd2e2117e8682f937967fda1022e7f1c22d91a Bisecting: 55 revisions left to test after this (roughly 6 steps) [389d03992dabb80488228e8119b9dd6d0f58e1a6] net/sched: act_tunnel_key: Defer dst_release to RCU callback determine whether the revision contains the guilty commit revision aabd761612dbeb7d40750d485da219d11433718a crashed and is reachable testing commit 389d03992dabb80488228e8119b9dd6d0f58e1a6 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 0aa3fc7d3ddab034b44b2d5b3ff3c219c5d1d13e61d5d71b1c5e90593f0931cd all runs: crashed: WARNING in pkcs1pad_verify representative crash: WARNING in pkcs1pad_verify, types: [WARNING] # git bisect good 389d03992dabb80488228e8119b9dd6d0f58e1a6 Bisecting: 27 revisions left to test after this (roughly 5 steps) [35196a07603f8c94a4943093bc26d5b5826285f8] wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler determine whether the revision contains the guilty commit revision 389d03992dabb80488228e8119b9dd6d0f58e1a6 crashed and is reachable testing commit 35196a07603f8c94a4943093bc26d5b5826285f8 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: f921cf05dc14785ce3e816ec5b0d48658c5867432c25e04267754c059ead9f6b all runs: OK false negative chance: 0.000 # git bisect bad 35196a07603f8c94a4943093bc26d5b5826285f8 Bisecting: 13 revisions left to test after this (roughly 4 steps) [48a95d3c70dbc9992444904148641dff84c3e8cc] USB: serial: ftdi_sio: add support for E+H FXA291 determine whether the revision contains the guilty commit revision 389d03992dabb80488228e8119b9dd6d0f58e1a6 crashed and is reachable testing commit 48a95d3c70dbc9992444904148641dff84c3e8cc gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: fddcb26f61d6b1134024db6ead28130ab3bd2977121ae870f83d23b1faca1dfc all runs: crashed: WARNING in pkcs1pad_verify representative crash: WARNING in pkcs1pad_verify, types: [WARNING] # git bisect good 48a95d3c70dbc9992444904148641dff84c3e8cc Bisecting: 6 revisions left to test after this (roughly 3 steps) [723bf81751aec13b0c0750f02a15a1406e87985d] usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits determine whether the revision contains the guilty commit revision aabd761612dbeb7d40750d485da219d11433718a crashed and is reachable testing commit 723bf81751aec13b0c0750f02a15a1406e87985d gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: f921cf05dc14785ce3e816ec5b0d48658c5867432c25e04267754c059ead9f6b all runs: OK false negative chance: 0.000 # git bisect bad 723bf81751aec13b0c0750f02a15a1406e87985d Bisecting: 3 revisions left to test after this (roughly 2 steps) [6edeaed69753c0fd7e289ae325c1e3576008f494] USB: serial: option: add TDTECH MT5710-CN determine whether the revision contains the guilty commit revision aabd761612dbeb7d40750d485da219d11433718a crashed and is reachable testing commit 6edeaed69753c0fd7e289ae325c1e3576008f494 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: fddcb26f61d6b1134024db6ead28130ab3bd2977121ae870f83d23b1faca1dfc all runs: crashed: WARNING in pkcs1pad_verify representative crash: WARNING in pkcs1pad_verify, types: [WARNING] # git bisect good 6edeaed69753c0fd7e289ae325c1e3576008f494 Bisecting: 1 revision left to test after this (roughly 1 step) [84c47e05b38f576c285a8f3ff34673b054ff7d8e] Revert "drm/amd/display: Add missing kdoc for ALLM parameters" determine whether the revision contains the guilty commit revision aabd761612dbeb7d40750d485da219d11433718a crashed and is reachable testing commit 84c47e05b38f576c285a8f3ff34673b054ff7d8e gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: e4c3679938f6b95d946a53265d5130be839838123d269a786b2c2d196929b826 all runs: OK false negative chance: 0.000 # git bisect bad 84c47e05b38f576c285a8f3ff34673b054ff7d8e Bisecting: 0 revisions left to test after this (roughly 0 steps) [6b81b6f400d1818154b779f255f22eb170796dd1] crypto: rsa-pkcs1pad: Don't WARN on an empty digest determine whether the revision contains the guilty commit revision 389d03992dabb80488228e8119b9dd6d0f58e1a6 crashed and is reachable testing commit 6b81b6f400d1818154b779f255f22eb170796dd1 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: e4c3679938f6b95d946a53265d5130be839838123d269a786b2c2d196929b826 all runs: OK false negative chance: 0.000 # git bisect bad 6b81b6f400d1818154b779f255f22eb170796dd1 6b81b6f400d1818154b779f255f22eb170796dd1 is the first bad commit commit 6b81b6f400d1818154b779f255f22eb170796dd1 Author: Doruk Tan Ozturk Date: Mon Jul 20 21:15:33 2026 +0200 crypto: rsa-pkcs1pad: Don't WARN on an empty digest KEYCTL_PKEY_VERIFY lets an unprivileged caller supply a zero-length digest (in_len == 0). keyctl_pkey_params_get_2() accepts the zero length and the request reaches pkcs1pad_verify(), where the empty digest is rejected but only after being passed through WARN_ON(!req->dst_len). The warning is therefore directly user-triggerable, and on kernels built with panic_on_warn=1 an unprivileged process can panic the machine -- a local denial of service. Reproduced as UID 65534 in a setuid sandbox. Keep rejecting the invalid request with -EINVAL, but do not emit a warning for the user-controlled length. This is the 5.10.y/5.15.y form of the fix, where the length is read directly from req->dst_len rather than cached in a digest_size local. Mainline does not contain this code path; commit 1e562deacecc ("crypto: rsassa-pkcs1 - Migrate to sig_alg backend") removed pkcs1pad_verify() in v6.13-rc1. This is a minimal fix for the affected stable branches. The 6.1.y/6.6.y/6.12.y form (WARN_ON(!digest_size)) is sent as a separate patch. Found by 0sec automated security-research tooling (https://0sec.ai). Fixes: c7381b012872 ("crypto: akcipher - new verify API for public key algorithms") Cc: stable@vger.kernel.org Assisted-by: 0sec:multi-model Signed-off-by: Doruk Tan Ozturk Reviewed-by: Lukas Wunner Signed-off-by: Sasha Levin crypto/rsa-pkcs1pad.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) accumulated error probability: 0.00 culprit signature: e4c3679938f6b95d946a53265d5130be839838123d269a786b2c2d196929b826 parent signature: fddcb26f61d6b1134024db6ead28130ab3bd2977121ae870f83d23b1faca1dfc revisions tested: 19, total time: 4h55m26.939984809s (build: 1h26m21.181659607s, test: 3h6m9.242352706s) first good commit: 6b81b6f400d1818154b779f255f22eb170796dd1 crypto: rsa-pkcs1pad: Don't WARN on an empty digest recipients (to): ["doruk@0sec.ai" "lukas@wunner.de" "sashal@kernel.org"] recipients (cc): []