ci starts bisection 2025-10-24 18:29:20.250261327 +0000 UTC m=+164272.367478156 bisecting cause commit starting from cf1ea8854e4fb1341c08f66e6c91da97d038ab6a building syzkaller on 1c8c8cd830af4deee250ad11f1613d1d9a62ca0b ensuring issue is reproducible on original commit cf1ea8854e4fb1341c08f66e6c91da97d038ab6a testing commit cf1ea8854e4fb1341c08f66e6c91da97d038ab6a gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 4d7d7b80303eb59c2415cde5465f43f28e4e4f2d1f3ec10f573548c11874ae63 all runs: crashed: WARNING in xfrm6_tunnel_net_exit representative crash: WARNING in xfrm6_tunnel_net_exit, types: [WARNING] check whether we can drop unnecessary instrumentation disabling configs for [hang memleak ubsan kasan locking atomic_sleep], they are not needed testing commit cf1ea8854e4fb1341c08f66e6c91da97d038ab6a gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: ac502938561df1a88ba533b770f4390c516fbe22b250c4ee2757bace37937e86 all runs: crashed: WARNING in xfrm6_tunnel_net_exit representative crash: WARNING in xfrm6_tunnel_net_exit, types: [WARNING] the bug reproduces without the instrumentation disabling configs for [kasan locking atomic_sleep hang memleak ubsan], they are not needed kconfig minimization: base=4109 full=8370 leaves diff=2114 split chunks (needed=false): <2114> split chunk #0 of len 2114 into 5 parts testing without sub-chunk 1/5 disabling configs for [kasan locking atomic_sleep hang memleak ubsan], they are not needed testing commit cf1ea8854e4fb1341c08f66e6c91da97d038ab6a gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 455305f033f4b3886b56af0a276d05104b3f634707085febf8f7ad8e4ef25ef6 all runs: crashed: WARNING in xfrm6_tunnel_net_exit representative crash: WARNING in xfrm6_tunnel_net_exit, types: [WARNING] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [kasan locking atomic_sleep hang memleak ubsan], they are not needed testing commit cf1ea8854e4fb1341c08f66e6c91da97d038ab6a gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: ae31872afb30d41b1440fdd15c643c14e4f433c53a5cab6818e466e6f8507c13 all runs: OK false negative chance: 0.000 testing without sub-chunk 3/5 disabling configs for [atomic_sleep hang memleak ubsan kasan locking], they are not needed testing commit cf1ea8854e4fb1341c08f66e6c91da97d038ab6a gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 69c84017b090b7275f1411c3c3acd27e081fd3753e770156236e4fd350902e97 all runs: crashed: WARNING in xfrm6_tunnel_net_exit representative crash: WARNING in xfrm6_tunnel_net_exit, types: [WARNING] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [hang memleak ubsan kasan locking atomic_sleep], they are not needed testing commit cf1ea8854e4fb1341c08f66e6c91da97d038ab6a gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 9614d906f929b1d8d14328bb0acd60285861076cdb4fb13caba6aecb131de3c2 all runs: crashed: WARNING in xfrm6_tunnel_net_exit representative crash: WARNING in xfrm6_tunnel_net_exit, types: [WARNING] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [locking atomic_sleep hang memleak ubsan kasan], they are not needed testing commit cf1ea8854e4fb1341c08f66e6c91da97d038ab6a gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: de339a4df5ec43ff791c542104050f5ef25248e84a13e55d8dc105ad917e2a14 all runs: crashed: WARNING in xfrm6_tunnel_net_exit representative crash: WARNING in xfrm6_tunnel_net_exit, types: [WARNING] the chunk can be dropped minimized to 423 configs; suspects: [6LOWPAN ARCH_ENABLE_MEMORY_HOTREMOVE ASUS_WMI BLK_DEV_ZONED CHARGER_BQ24190 CMA COMMON_CLK DAX DLM DM_CRYPT DM_FLAKEY DM_INTEGRITY DM_MULTIPATH DM_MULTIPATH_QL DM_MULTIPATH_ST DM_PERSISTENT_DATA DM_RAID DM_SNAPSHOT DM_THIN_PROVISIONING DM_UEVENT DM_VERITY DM_VERITY_FEC DM_WRITECACHE DM_ZONED DRAGONRISE_FF DRM DRM_AUX_BRIDGE DRM_BOCHS DRM_BRIDGE DRM_CIRRUS_QEMU DRM_CLIENT DRM_CLIENT_DEFAULT_FBDEV DRM_CLIENT_LIB DRM_CLIENT_SELECTION DRM_CLIENT_SETUP DRM_DEBUG_MM DRM_DISPLAY_DP_AUX_BUS DRM_DISPLAY_DP_HELPER DRM_DISPLAY_HELPER DRM_FBDEV_EMULATION DRM_GEM_SHMEM_HELPER DRM_GM12U320 DRM_GUD DRM_KMS_HELPER DRM_PANEL DRM_PANEL_BRIDGE DRM_PANEL_EDP DRM_PANEL_ORIENTATION_QUIRKS DRM_SIMPLEDRM DRM_SYSFB_HELPER DRM_TTM DRM_TTM_HELPER DRM_UDL DRM_VGEM DRM_VIRTIO_GPU DRM_VIRTIO_GPU_KMS DRM_VKMS DRM_VMWGFX DUMMY DVB_AF9013 DVB_AF9033 DVB_AS102 DVB_AS102_FE DVB_B2C2_FLEXCOP DVB_B2C2_FLEXCOP_USB DVB_CORE DVB_DIB3000MB DVB_DIB3000MC DVB_EC100 DVB_GP8PSK_FE DVB_RTL2830 DVB_RTL2832 DVB_RTL2832_SDR DVB_TEST_DRIVERS DVB_TTUSB_BUDGET DVB_TTUSB_DEC DVB_USB DVB_USB_A800 DVB_USB_AF9005 DVB_USB_AF9005_REMOTE DVB_USB_AF9015 DVB_USB_AF9035 DVB_USB_ANYSEE DVB_USB_AU6610 DVB_USB_AZ6007 DVB_USB_AZ6027 DVB_USB_CE6230 DVB_USB_CINERGY_T2 DVB_USB_CXUSB DVB_USB_CXUSB_ANALOG DVB_USB_DIB0700 DVB_USB_DIB3000MC DVB_USB_DIBUSB_MB DVB_USB_DIBUSB_MC DVB_USB_DIGITV DVB_USB_DTT200U DVB_USB_DTV5100 DVB_USB_DVBSKY DVB_USB_DW2102 DVB_USB_EC168 DVB_USB_GL861 DVB_USB_GP8PSK DVB_USB_LME2510 DVB_USB_M920X DVB_USB_MXL111SF DVB_USB_NOVA_T_USB2 DVB_USB_OPERA1 DVB_USB_PCTV452E DVB_USB_RTL28XXU DVB_USB_TECHNISAT_USB2 DVB_USB_TTUSB2 DVB_USB_UMT_010 DVB_USB_V2 DVB_USB_VP702X DVB_USB_VP7045 DVB_USB_ZD1301 DVB_VIDTV DVB_ZL10353 ECRYPT_FS ECRYPT_FS_MESSAGING EDAC EFS_FS ENCRYPTED_KEYS EQUALIZER EROFS_FS EROFS_FS_POSIX_ACL EROFS_FS_SECURITY EROFS_FS_XATTR EROFS_FS_ZIP EVM EVM_ADD_XATTRS EVM_ATTR_FSUUID EVM_EXTRA_SMACK_XATTRS EXFAT_FS EXPORTFS_BLOCK_OPS EXTCON EXTCON_INTEL_CHT_WC EXTCON_PTN5150 EXTCON_USBC_TUSB320 EXTENDED_MODVERSIONS F2FS_CHECK_FS F2FS_FAULT_INJECTION F2FS_FS F2FS_FS_COMPRESSION F2FS_FS_LZ4 F2FS_FS_LZ4HC F2FS_FS_LZO F2FS_FS_LZORLE F2FS_FS_POSIX_ACL F2FS_FS_SECURITY F2FS_FS_XATTR F2FS_FS_ZSTD F2FS_STAT_FS FANOTIFY FANOTIFY_ACCESS_PERMISSIONS FB FB_CFB_COPYAREA FB_CFB_FILLRECT FB_CFB_IMAGEBLIT FB_CORE FB_DEFERRED_IO FB_DEVICE FB_IOMEM_FOPS FB_IOMEM_HELPERS FB_NOTIFY FB_SYSMEM_FOPS FB_SYSMEM_HELPERS FB_SYSMEM_HELPERS_DEFERRED FB_SYS_COPYAREA FB_SYS_FILLRECT FB_SYS_IMAGEBLIT FB_TILEBLITTING FB_VESA FB_VGA16 FB_VIRTUAL FDDI FIREWIRE FIREWIRE_NET FIREWIRE_OHCI FIREWIRE_SBP2 FONT_8x16 FONT_8x8 FONT_SUPPORT FRAMEBUFFER_CONSOLE FRAMEBUFFER_CONSOLE_DETECT_PRIMARY FRAMEBUFFER_CONSOLE_ROTATION FS_DAX FS_ENCRYPTION FS_ENCRYPTION_ALGS FS_STACK FS_VERITY FS_VERITY_BUILTIN_SIGNATURES FTL FUSE_DAX FUSE_FS FW_LOADER_COMPRESS FW_LOADER_PAGED_BUF FW_LOADER_SYSFS FW_LOADER_USER_HELPER FW_LOADER_USER_HELPER_FALLBACK GACT_PROB GARP GENERIC_PHY GET_FREE_REGION GFS2_FS GFS2_FS_LOCKING_DLM GNSS GNSS_USB GOOGLE_COREBOOT_TABLE GOOGLE_FIRMWARE GOOGLE_MEMCONSOLE GOOGLE_MEMCONSOLE_COREBOOT GOOGLE_VPD GPIOLIB GPIOLIB_IRQCHIP GPIO_ACPI GPIO_DLN2 GPIO_LJCA GPIO_VIPERBOARD GREENASIA_FF GREYBUS GREYBUS_BRIDGED_PHY GREYBUS_ES2 GREYBUS_HID GREYBUS_USB GROUP_SCHED_BANDWIDTH GTP GUEST_PERF_EVENTS HAS_LTO_CLANG HAVE_ARCH_NODE_DEV_GROUP HAVE_ARCH_USERFAULTFD_MINOR HAVE_ARCH_USERFAULTFD_WP HAVE_BOOTMEM_INFO_NODE HAVE_CLK_PREPARE HAVE_KVM_CPU_RELAX_INTERCEPT HAVE_KVM_DIRTY_RING HAVE_KVM_DIRTY_RING_ACQ_REL HAVE_KVM_DIRTY_RING_TSO HAVE_KVM_IRQCHIP HAVE_KVM_IRQ_BYPASS HAVE_KVM_IRQ_ROUTING HAVE_KVM_MSI HAVE_KVM_NO_POLL HAVE_KVM_PFNCACHE HAVE_KVM_PM_NOTIFIER HAVE_KVM_READONLY_MEM HAVE_SCHED_AVG_IRQ HDLC HDLC_CISCO HDLC_FR HDLC_PPP HDLC_RAW HDLC_RAW_ETH HDLC_X25 HDMI HFSPLUS_FS HFS_FS HID_ACCUTOUCH HID_ACRUX HID_ACRUX_FF HID_ALPS HID_APPLEIR HID_ASUS HID_AUREAL HID_BATTERY_STRENGTH HID_BETOP_FF HID_BIGBEN_FF HID_CMEDIA HID_CORSAIR HID_COUGAR HID_CP2112 HID_CREATIVE_SB0540 HID_DRAGONRISE HID_ELAN HID_ELECOM HID_ELO HID_EMS_FF HID_EVISION HID_FT260 HID_GEMBIRD HID_GFRM HID_GLORIOUS HID_GOOGLE_STADIA_FF HID_GREENASIA HID_GT683R HID_HOLTEK HID_ICADE HID_JABRA HID_KEYTOUCH HID_KYE HID_LCPOWER HID_LED HID_LENOVO HID_LETSKETCH HID_LOGITECH HID_LOGITECH_DJ HID_LOGITECH_HIDPP HID_MACALLY HID_MAGICMOUSE HID_MALTRON HID_MAYFLASH HID_MCP2200 HID_MCP2221 HID_MEGAWORLD_FF HID_MULTITOUCH HID_NTI HID_ORTEK HID_PENMOUNT HID_PICOLCD HID_PICOLCD_BACKLIGHT HID_PICOLCD_CIR HID_PICOLCD_FB HID_PICOLCD_LCD HID_PICOLCD_LEDS HID_PLANTRONICS HID_PRIMAX HID_PRODIKEYS HID_PXRC HID_RAZER HID_RETRODE HID_RMI HID_ROCCAT HID_SAITEK HID_SEMITEK HID_SENSOR_ACCEL_3D HID_SENSOR_ALS HID_SENSOR_CUSTOM_INTEL_HINGE HID_SENSOR_CUSTOM_SENSOR HID_SENSOR_DEVICE_ROTATION HID_SENSOR_GYRO_3D HID_SENSOR_HUB HID_SENSOR_HUMIDITY HID_SENSOR_IIO_COMMON HID_SENSOR_IIO_TRIGGER HID_SENSOR_INCLINOMETER_3D HID_SENSOR_MAGNETOMETER_3D HID_SENSOR_PRESS HID_SENSOR_PROX HID_SENSOR_TEMP HID_SIGMAMICRO HID_SPEEDLINK HID_STEELSERIES HID_THINGM HID_TIVO HID_TOPRE HID_TWINHAN HID_U2FZERO HID_UCLOGIC HID_UDRAW_PS3 HID_VIEWSONIC HID_VIVALDI HID_VIVALDI_COMMON HID_VRC2 HID_WACOM HID_WALTOP HID_WIIMOTE HID_XIAOMI HID_XINMO HID_ZYDACRON HMM_MIRROR HOLTEK_FF HOTPLUG_PCI_PCIE HPET_MMAP HPET_MMAP_DEFAULT HPFS_FS I2C_ALGOBIT I2C_CHARDEV I2C_CP2615 I2C_DESIGNWARE_CORE I2C_DESIGNWARE_PLATFORM I2C_DIOLAN_U2C I2C_DLN2 I2C_HID_ACPI I2C_HID_CORE I2C_HID_OF I2C_LJCA I2C_MUX I2C_MUX_REG I2C_ROBOTFUZZ_OSIF I2C_SI4713 I2C_SLAVE I2C_SLAVE_EEPROM I2C_TINY_USB I2C_VIPERBOARD IEEE802154 IEEE802154_6LOWPAN IEEE802154_ATUSB IEEE802154_DRIVERS IEEE802154_HWSIM IEEE802154_NL802154_EXPERIMENTAL IEEE802154_SOCKET IFB IIO IIO_BUFFER IIO_KFIFO_BUF IIO_TRIGGER IIO_TRIGGERED_BUFFER IKCONFIG IKCONFIG_PROC IMA IMA_APPRAISE IMA_APPRAISE_MODSIG IMA_DEFAULT_HASH_SHA256 IMA_LSM_RULES IMA_MEASURE_ASYMMETRIC_KEYS IMA_NG_TEMPLATE IMA_QUEUE_EARLY_BOOT_KEYS IMA_READ_POLICY IMA_WRITE_POLICY INET6_ESPINTCP INET6_ESP_OFFLOAD INET6_IPCOMP INET6_TUNNEL INET6_XFRM_TUNNEL INET_AH INET_DIAG INET_DIAG_DESTROY INET_ESP INET_ESPINTCP INET_ESP_OFFLOAD INET_IPCOMP INET_MPTCP_DIAG INET_RAW_DIAG INET_SCTP_DIAG INET_TCP_DIAG INET_UDP_DIAG INET_XFRM_TUNNEL INFINIBAND INFINIBAND_ADDR_TRANS INFINIBAND_ADDR_TRANS_CONFIGFS INFINIBAND_IPOIB INFINIBAND_IPOIB_CM INFINIBAND_IPOIB_DEBUG INFINIBAND_ISER INFINIBAND_ON_DEMAND_PAGING INFINIBAND_RTRS INFINIBAND_SRP INFINIBAND_USER_ACCESS INFINIBAND_USER_MAD INFINIBAND_USER_MEM INPUT_ATI_REMOTE2 INPUT_CM109 INPUT_IMS_PCU INPUT_JOYDEV INPUT_KEYSPAN_REMOTE INPUT_LEDS INPUT_MOUSEDEV INPUT_MOUSEDEV_PSAUX INPUT_POWERMATE INPUT_UINPUT INPUT_YEALINK INTEGRITY INTEGRITY_ASYMMETRIC_KEYS INTEGRITY_AUDIT INTEGRITY_SIGNATURE INTEGRITY_TRUSTED_KEYRING INTEL_CHTWC_INT33FE INTEL_IDMA64 INTEL_IOATDMA INTEL_IOMMU_DEFAULT_ON INTEL_IOMMU_SVM INTEL_ISHTP_ECLITE INTEL_ISH_FIRMWARE_DOWNLOADER INTEL_ISH_HID INTEL_SOC_PMIC_CHTWC INTERVAL_TREE_SPAN_ITER IOMMUFD IOMMUFD_DRIVER IOMMUFD_DRIVER_CORE IOMMUFD_TEST IO_URING_MOCK_FILE IP6_NF_MATCH_AH IP6_NF_MATCH_EUI64 IP6_NF_MATCH_FRAG IP6_NF_MATCH_HL IP6_NF_MATCH_MH IP6_NF_MATCH_OPTS IP6_NF_MATCH_RPFILTER IP6_NF_MATCH_RT IP6_NF_MATCH_SRH IP6_NF_TARGET_NPT IP6_NF_TARGET_REJECT IP6_NF_TARGET_SYNPROXY IPV6_FOU IPV6_FOU_TUNNEL IPV6_GRE IPV6_ILA IPV6_MIP6 IPV6_MROUTE IPV6_MROUTE_MULTIPLE_TABLES IPV6_MULTIPLE_TABLES IPV6_OPTIMISTIC_DAD IPV6_PIMSM_V2 IPV6_ROUTER_PREF IPV6_ROUTE_INFO IPV6_RPL_LWTUNNEL IPV6_SEG6_BPF IPV6_SEG6_HMAC IPV6_SEG6_LWTUNNEL IPV6_SIT_6RD IPV6_SUBTREES IPV6_TUNNEL IPV6_VTI IPVLAN IPVLAN_L3S IPVTAP IP_FIB_TRIE_STATS IP_MROUTE_MULTIPLE_TABLES IP_NF_ARP_MANGLE IP_NF_MATCH_AH IP_NF_MATCH_ECN IP_NF_MATCH_RPFILTER IP_NF_MATCH_TTL IP_NF_TARGET_ECN IP_NF_TARGET_REJECT IP_NF_TARGET_SYNPROXY IP_ROUTE_CLASSID IP_SCTP IP_SET IP_SET_BITMAP_IP IP_SET_BITMAP_IPMAC IRQ_TIME_ACCOUNTING LAPB LCD_CLASS_DEVICE LEDS_CLASS_MULTICOLOR MAC802154 MEDIA_DIGITAL_TV_SUPPORT MEDIA_RADIO_SUPPORT MEDIA_SDR_SUPPORT MEDIA_SUPPORT MEDIA_TEST_SUPPORT MEDIA_USB_SUPPORT MEMORY_HOTPLUG MEMORY_HOTREMOVE MFD_DLN2 MFD_VIPERBOARD MODVERSIONS MPTCP MTD NETFILTER_ADVANCED NET_ACT_GACT NET_ACT_MIRRED NET_IPGRE_DEMUX NFT_COMPAT NFT_COMPAT_ARP NFT_FWD_NETDEV NF_TABLES NF_TABLES_ARP NF_TABLES_NETDEV RADIO_ADAPTERS RADIO_SI4713 RAS RC_CORE REGULATOR RFKILL SND SOUND STAGING TRUSTED_KEYS TYPEC TYPEC_MUX_PI3USB30532 USB_LJCA USB_ROLES_INTEL_XHCI USB_ROLE_SWITCH VIDEO_DEV VIRTIO_FS WAN ZONE_DEVICE] disabling configs for [ubsan kasan locking atomic_sleep hang memleak], they are not needed picked [v6.17 v6.16 v6.15 v6.13 v6.11 v6.9 v6.7 v6.5 v6.2 v5.19 v5.16 v5.13 v5.10 v5.7 v5.4 v5.1 v4.19] out of 40 release tags testing release v6.17 testing commit e5f0a698b34ed76002dc5cff3804a61c80233a7a gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 1d5cbdd35a977a2dd2b2eb60661063746e4ff67d154c3df96ea2a8cf98f5e21b all runs: crashed: WARNING in xfrm6_tunnel_net_exit representative crash: WARNING in xfrm6_tunnel_net_exit, types: [WARNING] testing release v6.16 testing commit 038d61fd642278bab63ee8ef722c50d10ab01e8f gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 45e182ed44cdf50dad3c8ecb16b309cae56125eb453a6af553d65f24b4a17994 all runs: crashed: WARNING in xfrm6_tunnel_net_exit representative crash: WARNING in xfrm6_tunnel_net_exit, types: [WARNING] testing release v6.15 testing commit 0ff41df1cb268fc69e703a08a57ee14ae967d0ca gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 52508b48f03a0bc3b4112eb68ab3cc11dd7fd8c71f896d3e77fce9592f20df43 all runs: OK false negative chance: 0.000 # git bisect start 038d61fd642278bab63ee8ef722c50d10ab01e8f 0ff41df1cb268fc69e703a08a57ee14ae967d0ca Bisecting: 7873 revisions left to test after this (roughly 13 steps) [43db1111073049220381944af4a3b8a5400eda71] Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm testing commit 43db1111073049220381944af4a3b8a5400eda71 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: f628082711927a7496291da584a9cf68dea3383aa0ca31f672d00e3267ebf489 all runs: OK false negative chance: 0.000 # git bisect good 43db1111073049220381944af4a3b8a5400eda71 Bisecting: 3942 revisions left to test after this (roughly 12 steps) [11fcf368506d347088e613edf6cd2604d70c454f] uapi: bitops: use UAPI-safe variant of BITS_PER_LONG again testing commit 11fcf368506d347088e613edf6cd2604d70c454f gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 8acdc26620ffd7d6f6d5e594938f5e0884f8d3cedf7f4f2d160cce7f20c7571d all runs: OK false negative chance: 0.000 # git bisect good 11fcf368506d347088e613edf6cd2604d70c454f Bisecting: 1971 revisions left to test after this (roughly 11 steps) [601dddb6c5d6bf63c63b2efba98231db5f861696] Merge tag 'regulator-fix-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator testing commit 601dddb6c5d6bf63c63b2efba98231db5f861696 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 4bd6a0567fd66dffb9faf196551947f5e7edd35e113f5f4f0fe6bf05d436e79b all runs: OK false negative chance: 0.000 # git bisect good 601dddb6c5d6bf63c63b2efba98231db5f861696 Bisecting: 992 revisions left to test after this (roughly 10 steps) [923d401238c590f39833a2015f6f9493f146d98f] Merge tag 'iommu-fixes-v6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux testing commit 923d401238c590f39833a2015f6f9493f146d98f gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 8ec9e5ee0c93b34bf55b99803cdf2777bbba8557e8a316e85771abb3e9174991 all runs: OK false negative chance: 0.000 # git bisect good 923d401238c590f39833a2015f6f9493f146d98f Bisecting: 496 revisions left to test after this (roughly 9 steps) [4d33ed640ffc06734271cebda5ac2e3b5a79f453] Merge tag 'drm-xe-fixes-2025-07-17' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes testing commit 4d33ed640ffc06734271cebda5ac2e3b5a79f453 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 0cb75fcb9ee95cd57abfde0b823c92a91c7bb72d1976d23f5cc266f9d8d99e48 all runs: OK false negative chance: 0.000 # git bisect good 4d33ed640ffc06734271cebda5ac2e3b5a79f453 Bisecting: 248 revisions left to test after this (roughly 8 steps) [bd4a1567b6e3454eda1113ed3a537119208e9c7a] Merge tag 'hwmon-for-v6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging testing commit bd4a1567b6e3454eda1113ed3a537119208e9c7a gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: c97ce33dd366b74118e490e9ae78e056aa3370cc03e99cfd007cad295559ba25 all runs: OK false negative chance: 0.000 # git bisect good bd4a1567b6e3454eda1113ed3a537119208e9c7a Bisecting: 124 revisions left to test after this (roughly 7 steps) [01a412d06bc5786eb4e44a6c8f0f4659bd4c9864] Merge tag 'pull-ufs-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs testing commit 01a412d06bc5786eb4e44a6c8f0f4659bd4c9864 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 2d623c5773413b7f640ebd666b0b2fee3854b7da708adae478f5e1dead0bb7e0 all runs: OK false negative chance: 0.000 # git bisect good 01a412d06bc5786eb4e44a6c8f0f4659bd4c9864 Bisecting: 62 revisions left to test after this (roughly 6 steps) [cef6c8c92fafa58fa04d8622e89ed4871d121fc3] Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux testing commit cef6c8c92fafa58fa04d8622e89ed4871d121fc3 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 44a081cd8a82c4dc6f4db1d4fb032fdc67abfdfda20a080c7e797016fe4c72e9 all runs: crashed: WARNING in xfrm6_tunnel_net_exit representative crash: WARNING in xfrm6_tunnel_net_exit, types: [WARNING] # git bisect bad cef6c8c92fafa58fa04d8622e89ed4871d121fc3 Bisecting: 30 revisions left to test after this (roughly 5 steps) [89fd905dab912a5712149ec5c06d251ceaedf743] Merge branch 'there-are-some-bugfix-for-the-hns3-ethernet-driver' testing commit 89fd905dab912a5712149ec5c06d251ceaedf743 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 0d9a57cc064000f6dc15ac1147b0bbb39f9cfba9d7e7bf1ea3e2b7a51cd1b2f2 all runs: OK false negative chance: 0.000 # git bisect good 89fd905dab912a5712149ec5c06d251ceaedf743 Bisecting: 14 revisions left to test after this (roughly 4 steps) [25fae0b93d1d7ddb25958bcb90c3c0e5e0e202bd] Merge tag 'drm-fixes-2025-07-24' of https://gitlab.freedesktop.org/drm/kernel testing commit 25fae0b93d1d7ddb25958bcb90c3c0e5e0e202bd gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 133f4fe332173b9b9873fee668b5ba41c3a6e0b4dfe1e4753aa66ae5347d9c7d all runs: OK false negative chance: 0.000 # git bisect good 25fae0b93d1d7ddb25958bcb90c3c0e5e0e202bd Bisecting: 7 revisions left to test after this (roughly 3 steps) [a90b2a1aaacbcf0f91d7e4868ad6c51c5dee814b] xfrm: interface: fix use-after-free after changing collect_md xfrm interface testing commit a90b2a1aaacbcf0f91d7e4868ad6c51c5dee814b gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 3feb391d8be39c1a35f615d72b60a8c9ca923686da82396f72cfb90e56805e77 all runs: OK false negative chance: 0.000 # git bisect good a90b2a1aaacbcf0f91d7e4868ad6c51c5dee814b Bisecting: 3 revisions left to test after this (roughly 2 steps) [291d5dc80eca1fc67a0fa4c861d13c101345501a] Merge tag 'ipsec-2025-07-23' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec testing commit 291d5dc80eca1fc67a0fa4c861d13c101345501a gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 55444f2027719e73c9149a51157f5f6f2067fbf4a1556180d42061e6bb48df1e all runs: crashed: WARNING in xfrm6_tunnel_net_exit representative crash: WARNING in xfrm6_tunnel_net_exit, types: [WARNING] # git bisect bad 291d5dc80eca1fc67a0fa4c861d13c101345501a Bisecting: 1 revision left to test after this (roughly 1 step) [2a198bbec6913ae1c90ec963750003c6213668c7] Revert "xfrm: destroy xfrm_state synchronously on net exit path" testing commit 2a198bbec6913ae1c90ec963750003c6213668c7 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 413a7500dd7c2bb9ccf9a37a6ebdaf50714dcaad6136db1b26fb9cbc5b4ca6d5 all runs: crashed: WARNING in xfrm6_tunnel_net_exit representative crash: WARNING in xfrm6_tunnel_net_exit, types: [WARNING] # git bisect bad 2a198bbec6913ae1c90ec963750003c6213668c7 Bisecting: 0 revisions left to test after this (roughly 0 steps) [b441cf3f8c4b8576639d20c8eb4aa32917602ecd] xfrm: delete x->tunnel as we delete x testing commit b441cf3f8c4b8576639d20c8eb4aa32917602ecd gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 5c62e3a597b74a5c95391156fe4f26396f852617b39306a0d6dd045cc88fbe84 all runs: crashed: WARNING in xfrm6_tunnel_net_exit representative crash: WARNING in xfrm6_tunnel_net_exit, types: [WARNING] # git bisect bad b441cf3f8c4b8576639d20c8eb4aa32917602ecd b441cf3f8c4b8576639d20c8eb4aa32917602ecd is the first bad commit commit b441cf3f8c4b8576639d20c8eb4aa32917602ecd Author: Sabrina Dubroca Date: Fri Jul 4 16:54:33 2025 +0200 xfrm: delete x->tunnel as we delete x The ipcomp fallback tunnels currently get deleted (from the various lists and hashtables) as the last user state that needed that fallback is destroyed (not deleted). If a reference to that user state still exists, the fallback state will remain on the hashtables/lists, triggering the WARN in xfrm_state_fini. Because of those remaining references, the fix in commit f75a2804da39 ("xfrm: destroy xfrm_state synchronously on net exit path") is not complete. We recently fixed one such situation in TCP due to defered freeing of skbs (commit 9b6412e6979f ("tcp: drop secpath at the same time as we currently drop dst")). This can also happen due to IP reassembly: skbs with a secpath remain on the reassembly queue until netns destruction. If we can't guarantee that the queues are flushed by the time xfrm_state_fini runs, there may still be references to a (user) xfrm_state, preventing the timely deletion of the corresponding fallback state. Instead of chasing each instance of skbs holding a secpath one by one, this patch fixes the issue directly within xfrm, by deleting the fallback state as soon as the last user state depending on it has been deleted. Destruction will still happen when the final reference is dropped. A separate lockdep class for the fallback state is required since we're going to lock x->tunnel while x is locked. Fixes: 9d4139c76905 ("netns xfrm: per-netns xfrm_state_all list") Signed-off-by: Sabrina Dubroca Signed-off-by: Steffen Klassert include/net/xfrm.h | 1 - net/ipv4/ipcomp.c | 2 ++ net/ipv6/ipcomp6.c | 2 ++ net/ipv6/xfrm6_tunnel.c | 2 +- net/xfrm/xfrm_ipcomp.c | 1 - net/xfrm/xfrm_state.c | 19 ++++++++----------- 6 files changed, 13 insertions(+), 14 deletions(-) accumulated error probability: 0.00 culprit signature: 5c62e3a597b74a5c95391156fe4f26396f852617b39306a0d6dd045cc88fbe84 parent signature: 3feb391d8be39c1a35f615d72b60a8c9ca923686da82396f72cfb90e56805e77 revisions tested: 24, total time: 10h24m41.728411012s (build: 7h1m45.415444917s, test: 2h48m16.401624168s) first bad commit: b441cf3f8c4b8576639d20c8eb4aa32917602ecd xfrm: delete x->tunnel as we delete x recipients (to): ["davem@davemloft.net" "dsahern@kernel.org" "edumazet@google.com" "herbert@gondor.apana.org.au" "kuba@kernel.org" "netdev@vger.kernel.org" "pabeni@redhat.com" "sd@queasysnail.net" "steffen.klassert@secunet.com" "steffen.klassert@secunet.com"] recipients (cc): ["horms@kernel.org" "linux-kernel@vger.kernel.org"] crash: WARNING in xfrm6_tunnel_net_exit ------------[ cut here ]------------ WARNING: CPU: 0 PID: 36 at net/ipv6/xfrm6_tunnel.c:341 xfrm6_tunnel_net_exit+0x90/0xd0 net/ipv6/xfrm6_tunnel.c:341 Modules linked in: CPU: 0 UID: 0 PID: 36 Comm: kworker/u8:2 Not tainted syzkaller #0 PREEMPT(undef) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Workqueue: netns cleanup_net RIP: 0010:xfrm6_tunnel_net_exit+0x90/0xd0 net/ipv6/xfrm6_tunnel.c:341 Code: df 31 f6 31 d2 b9 01 00 00 00 e8 8b 92 f6 ff e8 56 99 f6 ff 4b 83 3c e7 00 75 0e 49 ff c4 49 81 fc 00 01 00 00 75 ed eb 06 90 <0f> 0b 90 eb ec 31 c0 49 83 bc c7 00 08 00 00 00 75 0d 48 ff c0 48 RSP: 0018:ffffc90000137d28 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff88810af34f80 RCX: d89a4dc3c848b700 RDX: dd0480f76140c1ee RSI: ffffffff83063d02 RDI: ffff888101e851c0 RBP: ffffc90000137db8 R08: 0000000000080000 R09: 000000000000004a R10: 0000000000000000 R11: ffffffff826370f0 R12: 000000000000007e R13: ffffffff835d2f80 R14: ffffffff82637111 R15: ffff88810ab30000 FS: 0000000000000000(0000) GS:ffff8882b3b3e000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fab146aae9c CR3: 00000001063b4000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ops_exit_list net/core/net_namespace.c:200 [inline] ops_undo_list+0x143/0x220 net/core/net_namespace.c:253 cleanup_net+0x22c/0x380 net/core/net_namespace.c:686 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0x311/0x6b0 kernel/workqueue.c:3321 worker_thread+0x1df/0x2f0 kernel/workqueue.c:3402 kthread+0x23c/0x270 kernel/kthread.c:464 ret_from_fork+0x9c/0x1b0 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245