ci2 starts bisection 2026-09-04 05:23:55.68793002 +0000 UTC m=+31866.430189147 bisecting fixing commit since dc151d2e3144d50c64afa7e4a71a39b12f46f5ed building syzkaller on de6a700d843f1eae454018bc5041e06c62737db6 ensuring issue is reproducible on original commit dc151d2e3144d50c64afa7e4a71a39b12f46f5ed testing commit dc151d2e3144d50c64afa7e4a71a39b12f46f5ed gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: aa73e2f2efed3dcb11d5a28b22a4e5de6f80948c806120343921729fe00ebb9d all runs: crashed: general protection fault in __is_local_mountpoint representative crash: general protection fault in __is_local_mountpoint, types: [DoS] check whether we can drop unnecessary instrumentation disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep hang], they are not needed testing commit dc151d2e3144d50c64afa7e4a71a39b12f46f5ed gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: ef8a097262c519d94b1fcaefdee4bf779fe0703f785de88ae897efd906e0d5e1 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint representative crash: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint, types: [NULL-POINTER-DEREFERENCE] the bug reproduces without the instrumentation disabling configs for [hang memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed kconfig minimization: base=4921 full=6218 leaves diff=256 split chunks (needed=false): <256> split chunk #0 of len 256 into 5 parts testing without sub-chunk 1/5 disabling configs for [hang memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed testing commit dc151d2e3144d50c64afa7e4a71a39b12f46f5ed gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 693310cd169003bfd8f69d5956769882f6fa05c2f72a850575a6f2088d25a81d all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint representative crash: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint, types: [NULL-POINTER-DEREFERENCE] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep hang], they are not needed testing commit dc151d2e3144d50c64afa7e4a71a39b12f46f5ed gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 4575faba8a0a1f51e363be72a83fae8532874a173f4e2ef916eeb72a3f4f4ee6 run #0: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint run #1: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint run #2: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint run #3: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint run #4: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint run #5: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint run #6: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint run #7: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint run #8: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint run #9: OK representative crash: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint, types: [NULL-POINTER-DEREFERENCE] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [hang memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed testing commit dc151d2e3144d50c64afa7e4a71a39b12f46f5ed gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 8c76899d37e30176dd760c7e49d3bbe017ac8d16b85887c6d808d9c3eba5eee3 run #0: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint run #1: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint run #2: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint run #3: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint run #4: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint run #5: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint run #6: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint run #7: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint run #8: OK run #9: OK representative crash: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint, types: [NULL-POINTER-DEREFERENCE] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [hang memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed testing commit dc151d2e3144d50c64afa7e4a71a39b12f46f5ed gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 69bd8e053e79a1151159bde08f8460a98585c2c3e2bcf2165d3893ad6c4b1192 run #0: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint run #1: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint run #2: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint run #3: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint run #4: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint run #5: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint run #6: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint run #7: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint run #8: OK run #9: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint representative crash: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint, types: [NULL-POINTER-DEREFERENCE] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [atomic_sleep hang memleak ubsan bug_or_warning kasan locking], they are not needed testing commit dc151d2e3144d50c64afa7e4a71a39b12f46f5ed gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 failed building dc151d2e3144d50c64afa7e4a71a39b12f46f5ed: net/socket.c:1189:(.text+0x213b): undefined reference to `wext_handle_ioctl' net/socket.c:3390:(.text+0x238f): undefined reference to `compat_wext_handle_ioctl' net/core/net-procfs.c:343:(.text+0x109): undefined reference to `wext_proc_exit' net/core/net-procfs.c:327:(.text+0x1e4): undefined reference to `wext_proc_init' minimized to 48 configs; suspects: [HID_ZEROPLUS USB_NET_CDC_SUBSET USB_NET_CDC_SUBSET_ENABLE USB_NET_DM9601 USB_NET_GL620A USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL USB_SERIAL_FTDI_SIO USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM USB_XHCI_PCI_RENESAS WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_ZYDAS ZEROPLUS_FF] disabling configs for [hang memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed testing current HEAD e9b8a6529ffa211b85fc77f2646cace85b8bf849 testing commit e9b8a6529ffa211b85fc77f2646cace85b8bf849 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 3b45e2de3fdeaaf9b63ef45fb8fb380f0f91f07811fc016f884aac939a9e5014 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint representative crash: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint, types: [NULL-POINTER-DEREFERENCE] crash still not fixed/happens on the oldest tested release revisions tested: 7, total time: 2h6m26.674866193s (build: 15m12.25835861s, test: 1h44m8.824281992s) crash still not fixed or there were kernel test errors commit msg: Merge 2a2e5f7393b2 ("xfrm: use compat translator only for u64 alignment mismatch") into android13-5.15-lts crash: BUG: unable to handle kernel NULL pointer dereference in __is_local_mountpoint BUG: kernel NULL pointer dereference, address: 0000000000000018 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP CPU: 1 PID: 480 Comm: syz.0.22 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:__is_local_mountpoint+0x23/0xa0 fs/namespace.c:706 Code: ff 66 0f 1f 44 00 00 55 48 89 e5 41 55 65 48 8b 04 25 00 ae 01 00 41 54 49 89 fc 48 c7 c7 e0 50 0f 83 53 48 8b 80 20 08 00 00 <48> 8b 58 18 e8 f4 42 aa 00 4c 8d 6b 30 4c 89 ef e8 98 98 aa 00 48 RSP: 0018:ffffc900004dbbf0 EFLAGS: 00010206 RAX: 0000000000000000 RBX: ffff88810fe05000 RCX: 0000000400000000 RDX: 0000000000000001 RSI: ffff888111a4dc80 RDI: ffffffff830f50e0 RBP: ffffc900004dbc08 R08: ffffc900004dbb54 R09: 0000000000000005 R10: 0000000010000004 R11: ffff888100403600 R12: ffff88810b7c6b60 R13: ffff88810b7c6b60 R14: ffff88811ac74c98 R15: ffff888111a4e558 FS: 0000000000000000(0000) GS:ffff888237d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000018 CR3: 00000001139e4000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: is_local_mountpoint fs/mount.h:142 [inline] vfs_rmdir.part.0+0x93/0x180 fs/namei.c:4150 vfs_rmdir+0x33/0x40 fs/namei.c:4143 incfs_kill_sb+0x8e/0x90 fs/incfs/vfs.c:1989 deactivate_locked_super+0x31/0xa0 fs/super.c:335 deactivate_super+0x3b/0x50 fs/super.c:366 cleanup_mnt+0x112/0x160 fs/namespace.c:1149 __cleanup_mnt+0xd/0x10 fs/namespace.c:1156 task_work_run+0x5c/0x90 kernel/task_work.c:188 exit_task_work include/linux/task_work.h:33 [inline] do_exit+0x36f/0xb70 kernel/exit.c:890 do_group_exit+0x36/0xa0 kernel/exit.c:1004 get_signal+0xbd/0x990 kernel/signal.c:2908 arch_do_signal_or_restart+0x101/0x750 arch/x86/kernel/signal.c:867 handle_signal_work kernel/entry/common.c:154 [inline] exit_to_user_mode_loop+0x91/0xe0 kernel/entry/common.c:178 exit_to_user_mode_prepare kernel/entry/common.c:214 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x58/0x70 kernel/entry/common.c:307 do_syscall_64+0x40/0x80 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f494b967e99 Code: Unable to access opcode bytes at RIP 0x7f494b967e6f. RSP: 002b:00007f494b7c90e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f494bbeffa8 RCX: 00007f494b967e99 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f494bbeffa8 RBP: 00007f494bbeffa0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f494bbf0038 R14: 00007fff7bf663e0 R15: 00007fff7bf664c8 Modules linked in: CR2: 0000000000000018 ---[ end trace 8a03d375dbfbc738 ]--- RIP: 0010:__is_local_mountpoint+0x23/0xa0 fs/namespace.c:706 Code: ff 66 0f 1f 44 00 00 55 48 89 e5 41 55 65 48 8b 04 25 00 ae 01 00 41 54 49 89 fc 48 c7 c7 e0 50 0f 83 53 48 8b 80 20 08 00 00 <48> 8b 58 18 e8 f4 42 aa 00 4c 8d 6b 30 4c 89 ef e8 98 98 aa 00 48 RSP: 0018:ffffc900004dbbf0 EFLAGS: 00010206 RAX: 0000000000000000 RBX: ffff88810fe05000 RCX: 0000000400000000 RDX: 0000000000000001 RSI: ffff888111a4dc80 RDI: ffffffff830f50e0 RBP: ffffc900004dbc08 R08: ffffc900004dbb54 R09: 0000000000000005 R10: 0000000010000004 R11: ffff888100403600 R12: ffff88810b7c6b60 R13: ffff88810b7c6b60 R14: ffff88811ac74c98 R15: ffff888111a4e558 FS: 0000000000000000(0000) GS:ffff888237d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000018 CR3: 00000001139e4000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess), 1 bytes skipped: 0: 66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1) 6: 55 push %rbp 7: 48 89 e5 mov %rsp,%rbp a: 41 55 push %r13 c: 65 48 8b 04 25 00 ae mov %gs:0x1ae00,%rax 13: 01 00 15: 41 54 push %r12 17: 49 89 fc mov %rdi,%r12 1a: 48 c7 c7 e0 50 0f 83 mov $0xffffffff830f50e0,%rdi 21: 53 push %rbx 22: 48 8b 80 20 08 00 00 mov 0x820(%rax),%rax * 29: 48 8b 58 18 mov 0x18(%rax),%rbx <-- trapping instruction 2d: e8 f4 42 aa 00 call 0xaa4326 32: 4c 8d 6b 30 lea 0x30(%rbx),%r13 36: 4c 89 ef mov %r13,%rdi 39: e8 98 98 aa 00 call 0xaa98d6 3e: 48 rex.W