ci2 starts bisection 2026-10-25 06:31:28.87779611 +0000 UTC m=+128951.135060823 bisecting cause commit starting from a1c2b1da93f5f612aa7a33190c4900c98e51f6da building syzkaller on d566bfda120f43b4b1ad638db2a0dc53716463be ensuring issue is reproducible on original commit a1c2b1da93f5f612aa7a33190c4900c98e51f6da testing commit a1c2b1da93f5f612aa7a33190c4900c98e51f6da gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: a11c0aff95b129146d15278bfea96c660633a6a65fe12a11d0963c52b1b55f1d run #0: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #1: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #2: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #3: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #4: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #5: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #6: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #7: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #8: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #9: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #10: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #11: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #12: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #13: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #14: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #15: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #16: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #17: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #18: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #19: OK representative crash: KASAN: slab-use-after-free Write in gadgetfs_bind, types: [KASAN-USE-AFTER-FREE-WRITE KASAN-USE-AFTER-FREE-READ] check whether we can drop unnecessary instrumentation disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed testing commit a1c2b1da93f5f612aa7a33190c4900c98e51f6da gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 15532aadf514252fc1c5a2ca3259bc58fe86c62b60bd54404a75e89a97ffa816 run #0: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #1: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #2: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #3: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #4: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #5: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #6: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #7: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #8: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #9: crashed: KASAN: slab-use-after-free Read in gadget_dev_open representative crash: KASAN: slab-use-after-free Write in gadgetfs_bind, types: [KASAN-USE-AFTER-FREE-WRITE KASAN-USE-AFTER-FREE-READ] the bug reproduces without the instrumentation disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed kconfig minimization: base=4206 full=8482 leaves diff=2101 split chunks (needed=false): <2101> split chunk #0 of len 2101 into 5 parts testing without sub-chunk 1/5 disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed testing commit a1c2b1da93f5f612aa7a33190c4900c98e51f6da gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 335c352898c481874c96392c0bde2c0e3e21edb4c3adaca948228f8c48f2cb7c run #0: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #1: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #2: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #3: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #4: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #5: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #6: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #7: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #8: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #9: crashed: KASAN: slab-use-after-free Read in gadget_dev_open representative crash: KASAN: slab-use-after-free Write in gadgetfs_bind, types: [KASAN-USE-AFTER-FREE-WRITE KASAN-USE-AFTER-FREE-READ] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [memleak ubsan bug_or_warning locking atomic_sleep hang], they are not needed testing commit a1c2b1da93f5f612aa7a33190c4900c98e51f6da gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: c0124760d86f9a172643c68bba892e6485ed4fae7dec3cae2591b10cf5c1d6e0 run #0: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #1: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #2: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #3: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #4: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #5: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #6: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #7: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #8: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #9: crashed: KASAN: slab-use-after-free Read in gadget_dev_open representative crash: KASAN: slab-use-after-free Write in gadgetfs_bind, types: [KASAN-USE-AFTER-FREE-WRITE KASAN-USE-AFTER-FREE-READ] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed testing commit a1c2b1da93f5f612aa7a33190c4900c98e51f6da gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: ed043d114041c2fdced5764df986daad341749573ee06a446c7aa2de079694bc run #0: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #1: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #2: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #3: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #4: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #5: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #6: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #7: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #8: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #9: crashed: KASAN: slab-use-after-free Read in gadget_dev_open representative crash: KASAN: slab-use-after-free Read in gadget_dev_open, types: [KASAN-USE-AFTER-FREE-READ] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [memleak ubsan bug_or_warning locking atomic_sleep hang], they are not needed testing commit a1c2b1da93f5f612aa7a33190c4900c98e51f6da gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: dc127eed118450e0ea8365b6e7600a7ae34c61f16687483628b34768f5f3e290 run #0: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #1: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #2: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #3: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #4: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #5: OK run #6: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #7: OK run #8: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #9: OK representative crash: KASAN: slab-use-after-free Read in gadget_dev_open, types: [KASAN-USE-AFTER-FREE-READ KASAN-USE-AFTER-FREE-WRITE] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [atomic_sleep hang memleak ubsan bug_or_warning locking], they are not needed testing commit a1c2b1da93f5f612aa7a33190c4900c98e51f6da gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 3288b0773d641abe2cf17d263808813fd5e174b835fe0a5478b66b9e83a403af all runs: OK false negative chance: 0.000 minimized to 417 configs; suspects: [ARCH_SUPPORTS_PER_VMA_LOCK ATM BCMA BLK_DEV_ZONED BPF_SYSCALL CARDBUS CFG80211 CFG80211_WEXT COMMON_CLK CONTIG_ALLOC DVB_CORE EXTCON GPIOLIB HAVE_ARCH_USERFAULTFD_WP HID_ZEROPLUS I2C_MUX IIO IOMMUFD KVM KVM_INTEL LIBNVDIMM MEDIA_ANALOG_TV_SUPPORT MEDIA_CAMERA_SUPPORT MEDIA_CEC_SUPPORT MEDIA_CONTROLLER MEDIA_DIGITAL_TV_SUPPORT MEDIA_RADIO_SUPPORT MEDIA_SDR_SUPPORT MEDIA_SUPPORT MEDIA_TEST_SUPPORT MEDIA_USB_SUPPORT MEMORY_HOTPLUG MEMORY_HOTREMOVE MFD_VIPERBOARD NOP_USB_XCEIV PARPORT PCCARD PCMCIA PER_VMA_LOCK PHONET RADIO_ADAPTERS RADIO_SI470X RADIO_SI4713 RC_CORE RFKILL SND SOUND SPI SSB TAP TARGET_CORE TUN USB_AMD5536UDC USB_ATM USB_CHIPIDEA USB_CHIPIDEA_PCI USB_CHIPIDEA_UDC USB_CONFIGFS USB_CONFIGFS_ACM USB_CONFIGFS_ECM USB_CONFIGFS_ECM_SUBSET USB_CONFIGFS_EEM USB_CONFIGFS_F_FS USB_CONFIGFS_F_HID USB_CONFIGFS_F_LB_SS USB_CONFIGFS_F_MIDI USB_CONFIGFS_F_MIDI2 USB_CONFIGFS_F_PRINTER USB_CONFIGFS_F_TCM USB_CONFIGFS_F_UAC1 USB_CONFIGFS_F_UAC1_LEGACY USB_CONFIGFS_F_UAC2 USB_CONFIGFS_F_UVC USB_CONFIGFS_MASS_STORAGE USB_CONFIGFS_NCM USB_CONFIGFS_OBEX USB_CONFIGFS_PHONET USB_CONFIGFS_RNDIS USB_CONFIGFS_SERIAL USB_CONN_GPIO USB_CXACRU USB_CYPRESS_CY7C63 USB_CYTHERM USB_DSBR USB_DUMMY_HCD USB_DWC2 USB_DWC2_HOST USB_DWC2_PCI USB_DWC3 USB_DWC3_GADGET USB_DWC3_GENERIC_PLAT USB_DWC3_HAPS USB_DWC3_OF_SIMPLE USB_DWC3_PCI USB_DWC3_ULPI USB_DYNAMIC_MINORS USB_EG20T USB_EHCI_FSL USB_EHCI_HCD_PLATFORM USB_EHCI_ROOT_HUB_TT USB_EHSET_TEST_FIXTURE USB_EMI26 USB_EMI62 USB_EPSON2888 USB_EZUSB_FX2 USB_FEW_INIT_RETRIES USB_F_ACM USB_F_ECM USB_F_EEM USB_F_FS USB_F_HID USB_F_MASS_STORAGE USB_F_MIDI USB_F_MIDI2 USB_F_NCM USB_F_OBEX USB_F_PHONET USB_F_PRINTER USB_F_RNDIS USB_F_SERIAL USB_F_SS_LB USB_F_SUBSET USB_F_TCM USB_F_UAC1 USB_F_UAC1_LEGACY USB_F_UAC2 USB_F_UVC USB_GADGET USB_GADGETFS USB_GADGET_DEBUG_FILES USB_GADGET_DEBUG_FS USB_GL860 USB_GOKU USB_GR_UDC USB_GSPCA USB_GSPCA_BENQ USB_GSPCA_CONEX USB_GSPCA_CPIA1 USB_GSPCA_DTCS033 USB_GSPCA_ETOMS USB_GSPCA_FINEPIX USB_GSPCA_JEILINJ USB_GSPCA_JL2005BCD USB_GSPCA_KINECT USB_GSPCA_KONICA USB_GSPCA_MARS USB_GSPCA_MR97310A USB_GSPCA_NW80X USB_GSPCA_OV519 USB_GSPCA_OV534 USB_GSPCA_OV534_9 USB_GSPCA_PAC207 USB_GSPCA_PAC7302 USB_GSPCA_PAC7311 USB_GSPCA_SE401 USB_GSPCA_SN9C2028 USB_GSPCA_SN9C20X USB_GSPCA_SONIXB USB_GSPCA_SONIXJ USB_GSPCA_SPCA1528 USB_GSPCA_SPCA500 USB_GSPCA_SPCA501 USB_GSPCA_SPCA505 USB_GSPCA_SPCA506 USB_GSPCA_SPCA508 USB_GSPCA_SPCA561 USB_GSPCA_SQ905 USB_GSPCA_SQ905C USB_GSPCA_SQ930X USB_GSPCA_STK014 USB_GSPCA_STK1135 USB_GSPCA_STV0680 USB_GSPCA_SUNPLUS USB_GSPCA_T613 USB_GSPCA_TOPRO USB_GSPCA_TOUPTEK USB_GSPCA_TV8532 USB_GSPCA_VC032X USB_GSPCA_VICAM USB_GSPCA_XIRLINK_CIT USB_GSPCA_ZC3XX USB_HACKRF USB_HCD_BCMA USB_HCD_SSB USB_HSIC_USB3503 USB_HSIC_USB4604 USB_HSO USB_HUB_USB251XB USB_IDMOUSE USB_IOWARRIOR USB_IPHETH USB_ISIGHTFW USB_ISP116X_HCD USB_ISP1301 USB_ISP1760 USB_ISP1760_DUAL_ROLE USB_ISP1760_HCD USB_ISP1761_UDC USB_KAWETH USB_KC2190 USB_KEENE USB_LAN78XX USB_LCD USB_LD USB_LEDS_TRIGGER_USBPORT USB_LED_TRIG USB_LEGOTOWER USB_LGM_PHY USB_LIBCOMPOSITE USB_LINK_LAYER_TEST USB_M5602 USB_MA901 USB_MAX3420_UDC USB_MAX3421_HCD USB_MDC800 USB_MICROTEK USB_MR800 USB_MSI2500 USB_MUSB_DUAL_ROLE USB_MUSB_HDRC USB_NET2280 USB_NET_AQC111 USB_NET_AX88179_178A USB_NET_AX8817X USB_NET_CDCETHER USB_NET_CDC_EEM USB_NET_CDC_MBIM USB_NET_CDC_NCM USB_NET_CDC_SUBSET USB_NET_CDC_SUBSET_ENABLE USB_NET_CH9200 USB_NET_CX82310_ETH USB_NET_DM9601 USB_NET_GL620A USB_NET_HUAWEI_CDC_NCM USB_NET_INT51X1 USB_NET_KALMIA USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_QMI_WWAN USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_OXU210HP_HCD USB_PEGASUS USB_PULSE8_CEC USB_PWC USB_PWC_INPUT_EVDEV USB_PXA27X USB_R8A66597 USB_R8A66597_HCD USB_RAINSHADOW_CEC USB_RAREMONO USB_RAW_GADGET USB_RTL8150 USB_RTL8152 USB_RTL8153_ECM USB_S2255 USB_SERIAL USB_SERIAL_AIRCABLE USB_SERIAL_ARK3116 USB_SERIAL_BELKIN USB_SERIAL_CH341 USB_SERIAL_CONSOLE USB_SERIAL_CP210X USB_SERIAL_CYBERJACK USB_SERIAL_CYPRESS_M8 USB_SERIAL_DEBUG USB_SERIAL_DIGI_ACCELEPORT USB_SERIAL_EDGEPORT USB_SERIAL_EDGEPORT_TI USB_SERIAL_EMPEG USB_SERIAL_F81232 USB_SERIAL_F8153X USB_SERIAL_FTDI_SIO USB_SERIAL_GARMIN USB_SERIAL_GENERIC USB_SERIAL_IPAQ USB_SERIAL_IPW USB_SERIAL_IR USB_SERIAL_IUU USB_SERIAL_KEYSPAN USB_SERIAL_KEYSPAN_PDA USB_SERIAL_KLSI USB_SERIAL_KOBIL_SCT USB_SERIAL_MCT_U232 USB_SERIAL_METRO USB_SERIAL_MOS7715_PARPORT USB_SERIAL_MOS7720 USB_SERIAL_MOS7840 USB_SERIAL_MXUPORT USB_SERIAL_NAVMAN USB_SERIAL_OMNINET USB_SERIAL_OPTICON USB_SERIAL_OPTION USB_SERIAL_OTI6858 USB_SERIAL_PL2303 USB_SERIAL_QCAUX USB_SERIAL_QT2 USB_SERIAL_QUALCOMM USB_SERIAL_SAFE USB_SERIAL_SIERRAWIRELESS USB_SERIAL_SIMPLE USB_SERIAL_SPCP8X5 USB_SERIAL_SSU100 USB_SERIAL_SYMBOL USB_SERIAL_TI USB_SERIAL_UPD78F0730 USB_SERIAL_VISOR USB_SERIAL_WHITEHEAT USB_SERIAL_WISHBONE USB_SERIAL_WWAN USB_SERIAL_XR USB_SERIAL_XSENS_MT USB_SEVSEG USB_SI470X USB_SI4713 USB_SIERRA_NET USB_SISUSBVGA USB_SL811_CS USB_SL811_HCD USB_SL811_HCD_ISO USB_SNP_CORE USB_SPEEDTOUCH USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_ENE_UB6250 USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_STV06XX USB_TEST USB_TMC USB_TRANCEVIBRATOR USB_UAS USB_UEAGLEATM USB_ULPI_BUS USB_USBNET USB_USS720 USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_VIDEO_CLASS USB_VIDEO_CLASS_INPUT_EVDEV USB_VL600 USB_WDM USB_XHCI_DBGCAP USB_XHCI_PCI_RENESAS USB_XHCI_PLATFORM USB_XUSBATM USB_YUREX USERFAULTFD USERFAULTFD_RWP USERIO USER_RETURN_NOTIFIER UVC_COMMON U_SERIAL_CONSOLE V4L2_MEM2MEM_DEV V4L_TEST_DRIVERS VALIDATE_FS_PARSER VDPA VDPA_SIM VDPA_SIM_BLOCK VDPA_SIM_NET VETH VFIO VFIO_DEVICE_CDEV VFIO_PCI VFIO_PCI_CORE VFIO_PCI_INTX VFIO_VIRQFD VGASTATE VHOST VHOST_CROSS_ENDIAN_LEGACY VHOST_IOTLB VHOST_NET VHOST_RING VHOST_TASK VHOST_VDPA VHOST_VSOCK VIDEO VIDEOBUF2_CORE VIDEOBUF2_DMA_CONTIG VIDEOBUF2_DMA_SG VIDEOBUF2_MEMOPS VIDEOBUF2_V4L2 VIDEOBUF2_VMALLOC VIDEOMODE_HELPERS VIDEO_AU0828 VIDEO_AU0828_RC VIDEO_AU0828_V4L2 VIDEO_CS53L32A VIDEO_CX231XX VIDEO_CX231XX_ALSA VIDEO_CX231XX_DVB VIDEO_CX231XX_RC VIDEO_CX2341X VIDEO_CX25840 VIDEO_DEV VIDEO_EM28XX VIDEO_EM28XX_ALSA VIDEO_EM28XX_DVB VIDEO_EM28XX_RC VIDEO_EM28XX_V4L2 VIDEO_GO7007 VIDEO_GO7007_LOADER VIDEO_GO7007_USB VIDEO_GO7007_USB_S2250_BOARD VIDEO_HDPVR VIDEO_MSP3400 VIDEO_PVRUSB2 VIDEO_PVRUSB2_DVB VIDEO_PVRUSB2_SYSFS VIDEO_SAA711X VIDEO_STK1160 VIDEO_TUNER VIDEO_TVEEPROM VIDEO_USBTV VIDEO_V4L2_I2C VIDEO_V4L2_SUBDEV_API VIDEO_V4L2_TPG VIDEO_VICODEC VIDEO_VIM2M VIDEO_VIMC VIDEO_VIVID VIDEO_VIVID_CEC VIDEO_WM8775 VIPERBOARD_ADC VIRTIO_BALLOON VIRTIO_DMA_SHARED_BUFFER VIRTIO_MEM VIRTIO_MMIO VIRTIO_MMIO_CMDLINE_DEVICES VIRTIO_PMEM VIRTIO_VDPA VIRTIO_VSOCKETS VIRTIO_VSOCKETS_COMMON VIRT_WIFI VIRT_XFER_TO_GUEST_WORK VLAN_8021Q VLAN_8021Q_GVRP VLAN_8021Q_MVRP VMWARE_VMCI VMXNET3 VP_VDPA VSOCKETS VSOCKETS_DIAG VSOCKETS_LOOPBACK VSOCKMON VT_HW_CONSOLE_BINDING VXLAN WANT_DEV_COREDUMP WEXT_CORE WEXT_PROC WIREGUARD WIRELESS WLAN WLAN_VENDOR_ADMTEK WLAN_VENDOR_MORSEMICRO WLAN_VENDOR_NXP WLAN_VENDOR_SILABS X86_FRED X86_SGX X86_SGX_KVM X86_USER_SHADOW_STACK XDP_SOCKETS XDP_SOCKETS_DIAG XFRM_ESPINTCP XFRM_INTERFACE XFRM_IPCOMP XFRM_IPTFS XFRM_MIGRATE XFRM_OFFLOAD XFRM_STATISTICS XFRM_SUB_POLICY XFRM_USER_COMPAT XFS_BTREE_IN_MEM XFS_DRAIN_INTENTS XFS_FS XFS_LIVE_HOOKS XFS_MEMORY_BUFS XFS_ONLINE_REPAIR XFS_ONLINE_SCRUB XFS_POSIX_ACL XFS_QUOTA XFS_RT XILLYBUS_CLASS XILLYUSB XOR_BLOCKS XOR_BLOCKS_ARCH YENTA YENTA_ENE_TUNE YENTA_O2 YENTA_RICOH YENTA_TI YENTA_TOSHIBA ZEROPLUS_FF ZLIB_DEFLATE ZONEFS_FS ZRAM ZRAM_BACKEND_FORCE_LZO ZRAM_BACKEND_LZO ZRAM_DEF_COMP_LZO ZSMALLOC ZSTD_COMPRESS ZSWAP ZSWAP_COMPRESSOR_DEFAULT_842 ZSWAP_DEFAULT_ON ZSWAP_SHRINKER_DEFAULT_ON] disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed picked [v7.3 v7.2 v7.1 v6.19 v6.17 v6.15 v6.13 v6.11 v6.8 v6.5 v6.2 v5.19 v5.16 v5.13 v5.10 v5.7 v5.4 v5.1 v4.19] out of 46 release tags testing release v7.3 testing commit c03c1a14507dfaf8b856c2608f9ac216021fc222 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 6ed894e18819c7615db44e1412fb1a1f177a8037846b804ce575aea4f623f57d run #0: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #1: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #2: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #3: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #4: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #5: OK run #6: OK run #7: OK run #8: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #9: crashed: KASAN: slab-use-after-free Read in gadget_dev_open representative crash: KASAN: slab-use-after-free Read in gadget_dev_open, types: [KASAN-USE-AFTER-FREE-READ] testing release v7.2 testing commit 8d3ae59288f1e7d58d76558a6ee96d533bc5019f gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 8f855610549eca2de42b1932f64bb1eb41a16b53f6b23e93d8592e5f722f9a55 all runs: OK false negative chance: 0.000 # git bisect start c03c1a14507dfaf8b856c2608f9ac216021fc222 8d3ae59288f1e7d58d76558a6ee96d533bc5019f Bisecting: 9270 revisions left to test after this (roughly 13 steps) [4e69c1856bfd9ffb7e9d335a25842fa211628929] Merge tag 'drm-next-2026-08-20' of https://gitlab.freedesktop.org/drm/kernel testing commit 4e69c1856bfd9ffb7e9d335a25842fa211628929 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 0014dc82df1de0b178ed3f0dfc98a0656fcc7ec747daf596b7920fd9904e594e all runs: OK false negative chance: 0.000 # git bisect good 4e69c1856bfd9ffb7e9d335a25842fa211628929 Bisecting: 4705 revisions left to test after this (roughly 12 steps) [3ba13f5e7180c034b0a1ef7e052fb780856b134e] Merge tag 'devicetree-fixes-for-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux testing commit 3ba13f5e7180c034b0a1ef7e052fb780856b134e gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 014be7f412cf5726926cbf0c1dd8942ab99b0fcdf527437f5cec3a2d867a3cca all runs: OK false negative chance: 0.000 # git bisect good 3ba13f5e7180c034b0a1ef7e052fb780856b134e Bisecting: 2270 revisions left to test after this (roughly 11 steps) [b5a051f6b840d48f159166ef073d3021989bfb50] Merge tag 'net-7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net testing commit b5a051f6b840d48f159166ef073d3021989bfb50 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: bf5e6fd82c6ba5338b6295517a0f060350e988b8faec69059d4bc2d08ad48e3d run #0: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #1: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #9: crashed: KASAN: slab-use-after-free Read in gadget_dev_open representative crash: KASAN: slab-use-after-free Read in gadget_dev_open, types: [KASAN-USE-AFTER-FREE-READ KASAN-USE-AFTER-FREE-WRITE] # git bisect bad b5a051f6b840d48f159166ef073d3021989bfb50 Bisecting: 1213 revisions left to test after this (roughly 10 steps) [214f4aeb2255f2f9b5f5de1a15f650a429c43490] Merge tag 'loongarch-fixes-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson testing commit 214f4aeb2255f2f9b5f5de1a15f650a429c43490 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: f058291b758d06ffd31c5365888d4e76d8670aa34b55582d524eda5f5d2729f3 run #0: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #1: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #2: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #3: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #4: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #14: OK run #15: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #16: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #17: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #18: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #19: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind representative crash: KASAN: slab-use-after-free Write in gadgetfs_bind, types: [KASAN-USE-AFTER-FREE-WRITE KASAN-USE-AFTER-FREE-READ] # git bisect bad 214f4aeb2255f2f9b5f5de1a15f650a429c43490 Bisecting: 606 revisions left to test after this (roughly 9 steps) [a99d741df7372f2175677673d78a6335f3e0706f] Merge tag 'drm-next-2026-08-29' of https://gitlab.freedesktop.org/drm/kernel testing commit a99d741df7372f2175677673d78a6335f3e0706f gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 1180fa0715bed96f1971e4edc632212b085860eec81df8a683876fffd8969ee4 run #0: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #1: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #19: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind representative crash: KASAN: slab-use-after-free Write in gadgetfs_bind, types: [KASAN-USE-AFTER-FREE-WRITE KASAN-USE-AFTER-FREE-READ] # git bisect bad a99d741df7372f2175677673d78a6335f3e0706f Bisecting: 291 revisions left to test after this (roughly 8 steps) [275bc4eedf2c6081200998954efcb5eb90413a41] Merge tag 'rtc-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux testing commit 275bc4eedf2c6081200998954efcb5eb90413a41 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 4f57f400880563ee7735f9d5eb661c0b20ae3cfee1a12bc9691f8a30e04f9c78 run #0: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #1: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #2: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK representative crash: KASAN: slab-use-after-free Read in gadget_dev_open, types: [KASAN-USE-AFTER-FREE-READ KASAN-USE-AFTER-FREE-WRITE] # git bisect bad 275bc4eedf2c6081200998954efcb5eb90413a41 Bisecting: 154 revisions left to test after this (roughly 7 steps) [b70b7b71561f2be1183b6046964d950c2b203bfc] Merge tag 'for-net-2026-08-24' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth testing commit b70b7b71561f2be1183b6046964d950c2b203bfc gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: be04840608220bf1c9e262d6dd8a0696c881093bb98409d025df7ffb9bd8f78c all runs: OK false negative chance: 0.002 # git bisect good b70b7b71561f2be1183b6046964d950c2b203bfc Bisecting: 76 revisions left to test after this (roughly 6 steps) [874b43b9f3c704f24f0bdcc347b2e596ad3228ec] Merge tag 'm68knommu-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu testing commit 874b43b9f3c704f24f0bdcc347b2e596ad3228ec gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 6bac14c1c95ac749455e40ccdf081d704b32e8039c5ce5b0d768ac1c5075d2fb run #0: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #1: crashed: KASAN: slab-use-after-free Read in gadget_dev_open run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #19: crashed: KASAN: slab-use-after-free Read in gadget_dev_open representative crash: KASAN: slab-use-after-free Write in gadgetfs_bind, types: [KASAN-USE-AFTER-FREE-WRITE KASAN-USE-AFTER-FREE-READ] # git bisect bad 874b43b9f3c704f24f0bdcc347b2e596ad3228ec Bisecting: 38 revisions left to test after this (roughly 5 steps) [dc170da3347e0f7b6d120d13882c4e1f04ca00d6] selftests: net: Wait for netserver to launch testing commit dc170da3347e0f7b6d120d13882c4e1f04ca00d6 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: b4d7e3da7ff95ee2f50fc82b62fd18183cd2c94275e5fb317bd3e1c38e26bc02 all runs: OK false negative chance: 0.005 # git bisect good dc170da3347e0f7b6d120d13882c4e1f04ca00d6 Bisecting: 19 revisions left to test after this (roughly 4 steps) [a60fd8c6dbaa76da4163cf225ed2b9e982540f39] usb: atm: usbatm: fix invalid ci_range initialization testing commit a60fd8c6dbaa76da4163cf225ed2b9e982540f39 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 failed building a60fd8c6dbaa76da4163cf225ed2b9e982540f39: mv: cannot stat 'arch/x86/include/generated/asm/.tmp_cpufeaturemasks.h': No such file or directory # git bisect skip a60fd8c6dbaa76da4163cf225ed2b9e982540f39 Bisecting: 19 revisions left to test after this (roughly 4 steps) [fc04229727d8fffbf02e0635de38413fe0102d02] netfilter: nf_tables: remove leftover set_update_list testing commit fc04229727d8fffbf02e0635de38413fe0102d02 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 707b73b6bce4abe147cad56f078d44fd6477540b2640f21fad983c9062fe9354 all runs: OK false negative chance: 0.005 # git bisect good fc04229727d8fffbf02e0635de38413fe0102d02 Bisecting: 14 revisions left to test after this (roughly 4 steps) [8f735d64382dcf162f4276d6699d03ad2f859c0b] net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup testing commit 8f735d64382dcf162f4276d6699d03ad2f859c0b gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 failed building 8f735d64382dcf162f4276d6699d03ad2f859c0b: mv: cannot stat 'arch/x86/include/generated/asm/.tmp_cpufeaturemasks.h': No such file or directory # git bisect skip 8f735d64382dcf162f4276d6699d03ad2f859c0b Bisecting: 14 revisions left to test after this (roughly 4 steps) [6fe66698b959357c8f780fd21c809b2d83d2a7ee] Merge branch 'net-stmmac-more-selftest-related-fixes' testing commit 6fe66698b959357c8f780fd21c809b2d83d2a7ee gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 154cb633573ee838f0b19033357e349d9574e7220cb2be263fe23300a4ed5f89 all runs: OK false negative chance: 0.005 # git bisect good 6fe66698b959357c8f780fd21c809b2d83d2a7ee Bisecting: 8 revisions left to test after this (roughly 3 steps) [6a7e91f890eceb4fd9d3662e7ffba1fcb55cc00e] selftests/net: packetdrill: add tcp_urg_ptr_retransmit testing commit 6a7e91f890eceb4fd9d3662e7ffba1fcb55cc00e gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: d87385fefbff6b9bec9dc6c9fe8070e53fb991725c1b651c63872f4249706499 all runs: OK false negative chance: 0.005 # git bisect good 6a7e91f890eceb4fd9d3662e7ffba1fcb55cc00e Bisecting: 4 revisions left to test after this (roughly 2 steps) [1b78070aaef63512688aebfbc82365ef9d6660f1] Merge tag 'net-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net testing commit 1b78070aaef63512688aebfbc82365ef9d6660f1 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 47cf6725c92220d9401f6fa5fcf9ad15b4f9714b19d16ccb09205db4f4fb8b37 run #0: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #1: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #2: crashed: KASAN: slab-use-after-free Write in gadgetfs_bind run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK representative crash: KASAN: slab-use-after-free Write in gadgetfs_bind, types: [KASAN-USE-AFTER-FREE-WRITE] # git bisect bad 1b78070aaef63512688aebfbc82365ef9d6660f1 Bisecting: 1 revision left to test after this (roughly 1 step) [d5dc1e69fd7258ea605c9952e5d5947539159ae3] inet: frags: strip GSO state from fragments before reassembly testing commit d5dc1e69fd7258ea605c9952e5d5947539159ae3 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: d2ff687e0c255622a9bc5a6a8554f5fac07645caa3aca2a5deba150d0109861b all runs: OK false negative chance: 0.015 # git bisect good d5dc1e69fd7258ea605c9952e5d5947539159ae3 Bisecting: 0 revisions left to test after this (roughly 0 steps) [4a9d62a8774f130a5b8de26ca9f415e6050a9d51] Merge tag 'nf-26-08-27' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf testing commit 4a9d62a8774f130a5b8de26ca9f415e6050a9d51 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 6de5d1ed6cf0c2933cbb09ee0bf87f564195e0731b48edaae099319337075c22 all runs: OK false negative chance: 0.015 # git bisect good 4a9d62a8774f130a5b8de26ca9f415e6050a9d51 1b78070aaef63512688aebfbc82365ef9d6660f1 is the first bad commit commit 1b78070aaef63512688aebfbc82365ef9d6660f1 Merge: 3ba13f5e7180c 4a9d62a8774f1 Author: Linus Torvalds Date: Thu Aug 27 13:53:43 2026 -0700 Merge tag 'net-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from Bluetooth, IPSec and Netfilter. Current release - fix to a fix: - netfilter: ipset: remove need to allocate memory on delete operations Current release - regressions: - macb: drop CONFIG_OF #if block, fix build Previous releases - always broken: - stream of fixes for SCTP continues - inet: frags: strip GSO state from fragments before reassembly - virtio-net: ensure that TCP packets don't overflow gso_segs - tcp-ao: fix use-after-free of current_key on reconnect to another peer - page_pool: remove zone/policy GFP flags when allocating XArray entries - Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN - tls: device: fix out-of-bounds write in tls_append_frag() - eth: bnxt: - ring the doorbell when SW USO exits early, avoid packets stuck in Tx - gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check, avoid users of older NICs seeing non-actionable warning messages - eth: qede: fix NULL pointer dereference in TPA fragment processing" * tag 'net-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (216 commits) inet: frags: strip GSO state from fragments before reassembly net/sched: sch_htb: limit htb_classify inner-class filter hops selftests/net: packetdrill: add tcp_urg_ptr_retransmit tcp: fix corruption of urgent data on multi-segment retransmit usb: atm: usbatm: fix invalid ci_range initialization net: fec: only stop PTP if it was initialized slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() net: bridge: mcast: fix use-after-free of a master VLAN's multicast context net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup net: dsa: mxl862xx: enable assisted learning on CPU port net: stmmac: restore NET_IP_ALIGN in the RX DMA offset net: stmmac: drop gso_enabled_types and rely on netdev features net: stmmac: selftests: Don't test flow control for small rx fifos net: stmmac: selftests: Account for the UC filter list for filtering tests net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering net: stmmac: dwmac4: Account for the primary MAC address for UC filtering net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering net: stmmac: selftests: Check multiple MMC counters selftests: net: Fix slow configurations in big_tcp_tunnels.sh selftests: net: Lower threshold with csum offload off in big_tcp_tunnels.sh ... Documentation/networking/oa-tc6-framework.rst | 2 +- drivers/bluetooth/btmtk.c | 11 +- drivers/bluetooth/btmtksdio.c | 33 +- drivers/bluetooth/btnxpuart.c | 39 +- drivers/bluetooth/btrtl.c | 13 - drivers/bluetooth/btusb.c | 8 + drivers/bluetooth/hci_bcm.c | 1 + drivers/bluetooth/hci_bcm4377.c | 1 + drivers/bluetooth/hci_h5.c | 4 +- drivers/bluetooth/hci_intel.c | 1 + drivers/bluetooth/hci_ldisc.c | 2 +- drivers/bluetooth/hci_serdev.c | 2 +- drivers/infiniband/hw/mlx5/main.c | 5 +- drivers/net/dsa/mxl862xx/mxl862xx.c | 1 + drivers/net/ethernet/airoha/airoha_npu.c | 2 +- drivers/net/ethernet/allwinner/sun4i-emac.c | 4 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 3 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 25 +- drivers/net/ethernet/broadcom/bnxt/bnxt_gso.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt_hwmon.c | 2 +- drivers/net/ethernet/cadence/macb_main.c | 4 +- drivers/net/ethernet/freescale/enetc/enetc.c | 72 +++- drivers/net/ethernet/freescale/enetc/enetc.h | 9 + drivers/net/ethernet/freescale/enetc/enetc4_pf.c | 16 +- drivers/net/ethernet/freescale/enetc/enetc_pf.c | 14 +- drivers/net/ethernet/freescale/fec_main.c | 6 +- drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.c | 2 +- drivers/net/ethernet/intel/igc/igc_main.c | 3 +- .../net/ethernet/marvell/octeontx2/af/cn20k/api.h | 1 + .../marvell/octeontx2/af/cn20k/mbox_init.c | 21 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 43 +- .../ethernet/marvell/octeontx2/af/rvu_debugfs.c | 6 + .../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 11 +- .../ethernet/marvell/octeontx2/nic/otx2_common.c | 6 +- .../ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 3 +- .../net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 20 +- .../net/ethernet/marvell/octeontx2/nic/otx2_xsk.c | 3 +- drivers/net/ethernet/mediatek/mtk_wed.c | 5 + drivers/net/ethernet/mediatek/mtk_wed_regs.h | 1 + .../net/ethernet/mellanox/mlx5/core/en/xsk/tx.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 20 +- .../ethernet/mellanox/mlx5/core/esw/adj_vport.c | 22 + .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 4 + drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 2 + drivers/net/ethernet/mellanox/mlx5/core/vport.c | 44 +- .../net/ethernet/microchip/sparx5/sparx5_netdev.c | 11 +- .../ethernet/microchip/sparx5/sparx5_vcap_impl.c | 5 +- .../net/ethernet/microchip/vcap/vcap_api_debugfs.c | 21 + .../net/ethernet/microchip/vcap/vcap_api_debugfs.h | 14 + drivers/net/ethernet/microsoft/mana/gdma_main.c | 19 + drivers/net/ethernet/nvidia/forcedeth.c | 6 +- drivers/net/ethernet/pensando/ionic/ionic_if.h | 6 +- drivers/net/ethernet/qlogic/qede/qede.h | 8 +- drivers/net/ethernet/qlogic/qede/qede_fp.c | 1 + drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c | 445 ++++++++++++--------- .../net/ethernet/qualcomm/rmnet/rmnet_map_data.c | 1 + drivers/net/ethernet/renesas/rswitch_main.c | 18 +- .../net/ethernet/stmicro/stmmac/dwmac1000_core.c | 2 +- drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 2 +- .../net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac.h | 2 - drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 26 +- .../net/ethernet/stmicro/stmmac/stmmac_platform.c | 6 +- .../net/ethernet/stmicro/stmmac/stmmac_selftests.c | 57 ++- drivers/net/ethernet/wangxun/libwx/wx_ptp.c | 18 +- drivers/net/ethernet/wangxun/libwx/wx_type.h | 2 +- drivers/net/ethernet/wangxun/txgbe/txgbe_irq.c | 5 +- drivers/net/ethernet/wangxun/txgbe/txgbe_type.h | 2 +- drivers/net/gtp.c | 23 +- drivers/net/ipa/ipa_main.c | 6 +- drivers/net/ipa/ipa_modem.c | 18 +- drivers/net/netdevsim/netdev.c | 2 + drivers/net/ntb_netdev.c | 38 +- drivers/net/phy/air_en8811h.c | 18 +- drivers/net/phy/phylink.c | 2 +- drivers/net/slip/slip.c | 19 +- drivers/net/thunderbolt/main.c | 6 +- drivers/net/usb/cdc_ncm.c | 6 + drivers/net/vxlan/vxlan_core.c | 20 +- drivers/ntb/ntb_transport.c | 38 +- drivers/ptp/ptp_netc.c | 10 +- drivers/usb/atm/usbatm.c | 4 +- include/linux/ethtool_netlink.h | 3 - include/linux/mlx5/vport.h | 3 +- include/linux/skbuff.h | 24 ++ include/linux/virtio_net.h | 4 + include/net/bluetooth/hci_core.h | 2 +- include/net/bluetooth/l2cap.h | 5 + include/net/inetpeer.h | 4 + include/net/ip.h | 25 ++ include/net/ip6_route.h | 37 ++ include/net/libeth/xsk.h | 2 +- include/net/netfilter/nf_tables.h | 3 +- include/net/pkt_sched.h | 1 + include/net/sctp/structs.h | 2 +- include/net/tcp.h | 5 + include/net/xdp_sock_drv.h | 22 +- include/net/xsk_buff_pool.h | 3 +- include/uapi/linux/if_xdp.h | 1 + net/8021q/vlan_dev.c | 39 +- net/batman-adv/bridge_loop_avoidance.c | 78 ++-- net/batman-adv/distributed-arp-table.c | 66 ++- net/batman-adv/main.c | 4 + net/batman-adv/mesh-interface.c | 7 +- net/batman-adv/multicast_forw.c | 7 +- net/batman-adv/tvlv.c | 5 +- net/batman-adv/types.h | 2 +- net/bluetooth/eir.c | 3 +- net/bluetooth/hci_conn.c | 3 +- net/bluetooth/hci_core.c | 2 +- net/bluetooth/hci_event.c | 7 +- net/bluetooth/hci_sync.c | 16 +- net/bluetooth/iso.c | 8 + net/bluetooth/l2cap_sock.c | 100 +++-- net/bluetooth/mgmt.c | 18 +- net/bluetooth/rfcomm/core.c | 14 +- net/bridge/br_arp_nd_proxy.c | 24 +- net/bridge/br_multicast.c | 4 +- net/bridge/br_netlink_tunnel.c | 3 +- net/core/net_namespace.c | 25 +- net/core/page_pool.c | 7 + net/core/skbuff.c | 28 +- net/core/xdp.c | 4 +- net/ife/ife.c | 14 +- net/ipv4/inet_fragment.c | 7 + net/ipv4/inetpeer.c | 38 +- net/ipv4/ipip.c | 2 +- net/ipv4/netfilter/ipt_ah.c | 10 +- net/ipv4/netfilter/nf_tproxy_ipv4.c | 2 +- net/ipv4/route.c | 4 +- net/ipv4/tcp.c | 3 +- net/ipv4/tcp_ao.c | 19 +- net/ipv4/tcp_ipv4.c | 2 +- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/tcp_output.c | 8 +- net/ipv6/ah6.c | 29 +- net/ipv6/exthdrs.c | 26 +- net/ipv6/ip6mr.c | 3 +- net/ipv6/netfilter/ip6t_ah.c | 27 +- net/ipv6/netfilter/ip6t_frag.c | 41 +- net/ipv6/netfilter/ip6t_hbh.c | 40 +- net/ipv6/netfilter/ip6t_mh.c | 3 - net/ipv6/netfilter/ip6t_rt.c | 6 +- net/ipv6/netfilter/nf_tproxy_ipv6.c | 2 +- net/ipv6/route.c | 6 +- net/ipv6/seg6_local.c | 16 + net/ipv6/tcp_ipv6.c | 2 +- net/ipv6/xfrm6_input.c | 2 +- net/iucv/af_iucv.c | 2 + net/l2tp/l2tp_netlink.c | 16 +- net/mctp/route.c | 19 +- net/mptcp/syncookies.c | 1 + net/netfilter/ipset/ip_set_hash_gen.h | 168 +++++--- net/netfilter/ipset/ip_set_hash_netiface.c | 1 - net/netfilter/ipset/ip_set_hash_netportnet.c | 1 - net/netfilter/ipvs/ip_vs_ftp.c | 10 +- net/netfilter/nf_conncount.c | 3 +- net/netfilter/nf_conntrack_expect.c | 11 +- net/netfilter/nf_conntrack_netlink.c | 2 +- net/netfilter/nf_tables_api.c | 212 +++++----- net/netfilter/nfnetlink_queue.c | 72 +++- net/netfilter/nft_dynset.c | 25 +- net/netfilter/nft_payload.c | 13 + net/netfilter/nft_set_pipapo_avx2.c | 17 +- net/netfilter/xt_IDLETIMER.c | 68 +--- net/netfilter/xt_LOG.c | 4 +- net/netfilter/xt_MASQUERADE.c | 4 +- net/netfilter/xt_NETMAP.c | 6 +- net/netfilter/xt_REDIRECT.c | 6 +- net/netfilter/xt_cgroup.c | 12 +- net/netfilter/xt_esp.c | 10 +- net/netfilter/xt_hl.c | 4 +- net/netfilter/xt_ipcomp.c | 8 +- net/netfilter/xt_iprange.c | 32 +- net/netfilter/xt_ipvs.c | 1 - net/netfilter/xt_multiport.c | 4 - net/netfilter/xt_sctp.c | 19 +- net/netfilter/xt_tcpudp.c | 8 +- net/openvswitch/conntrack.c | 120 ++++-- net/openvswitch/conntrack.h | 6 +- net/openvswitch/datapath.c | 16 +- net/openvswitch/datapath.h | 8 +- net/packet/af_packet.c | 96 ++++- net/rds/cong.c | 4 +- net/sched/act_api.c | 5 +- net/sched/act_bpf.c | 26 ++ net/sched/act_ct.c | 46 +++ net/sched/act_ctinfo.c | 11 + net/sched/act_ife.c | 55 ++- net/sched/act_pedit.c | 24 ++ net/sched/act_police.c | 12 + net/sched/act_sample.c | 9 + net/sched/act_skbmod.c | 12 +- net/sched/act_tunnel_key.c | 80 ++++ net/sched/cls_api.c | 3 +- net/sched/cls_basic.c | 6 +- net/sched/cls_bpf.c | 6 +- net/sched/cls_cgroup.c | 2 +- net/sched/cls_flow.c | 2 +- net/sched/cls_flower.c | 4 +- net/sched/cls_fw.c | 4 +- net/sched/cls_matchall.c | 4 +- net/sched/cls_route.c | 4 +- net/sched/cls_u32.c | 11 +- net/sched/sch_api.c | 7 +- net/sched/sch_cake.c | 1 + net/sched/sch_codel.c | 2 +- net/sched/sch_fifo.c | 2 +- net/sched/sch_fq.c | 14 +- net/sched/sch_fq_codel.c | 6 +- net/sched/sch_fq_pie.c | 3 +- net/sched/sch_generic.c | 2 +- net/sched/sch_gred.c | 4 +- net/sched/sch_hhf.c | 4 + net/sched/sch_htb.c | 7 +- net/sched/sch_plug.c | 2 +- net/sched/sch_sfq.c | 3 +- net/sched/sch_teql.c | 1 + net/sctp/inqueue.c | 7 +- net/sctp/stream.c | 48 ++- net/smc/smc.h | 6 +- net/smc/smc_core.c | 14 +- net/smc/smc_inet.c | 16 + net/smc/smc_llc.c | 125 ++++-- net/smc/smc_rx.c | 11 +- net/smc/smc_wr.c | 6 +- net/tls/tls_device.c | 3 +- net/vmw_vsock/virtio_transport.c | 2 +- net/xdp/xsk.c | 30 +- net/xdp/xsk_buff_pool.c | 7 +- net/xfrm/espintcp.c | 9 +- net/xfrm/xfrm_nat_keepalive.c | 53 ++- net/xfrm/xfrm_output.c | 4 +- net/xfrm/xfrm_user.c | 2 +- tools/include/uapi/linux/if_xdp.h | 1 + tools/net/ynl/lib/ynl.c | 3 + tools/testing/selftests/net/big_tcp_tunnels.sh | 38 +- tools/testing/selftests/net/fin_ack_lat.c | 5 +- tools/testing/selftests/net/fin_ack_lat.sh | 2 +- .../net/packetdrill/tcp_advmss_pmtu_ipv4.pkt | 67 ++++ .../net/packetdrill/tcp_advmss_pmtu_ipv6.pkt | 67 ++++ .../net/packetdrill/tcp_urg_ptr_retransmit.pkt | 65 +++ .../testing/selftests/net/tcp_ao/key-management.c | 67 ++-- tools/testing/selftests/net/tcp_ao/lib/aolib.h | 6 +- tools/testing/selftests/net/tcp_ao/lib/sock.c | 4 +- 245 files changed, 2969 insertions(+), 1418 deletions(-) create mode 100644 tools/testing/selftests/net/packetdrill/tcp_advmss_pmtu_ipv4.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_advmss_pmtu_ipv6.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_urg_ptr_retransmit.pkt accumulated error probability: 0.05 reproducer is flaky (0.19 repro chance estimate) revisions tested: 24, total time: 8h41m0.698513015s (build: 2h53m58.494160198s, test: 4h40m11.733033836s) first bad commit: 1b78070aaef63512688aebfbc82365ef9d6660f1 Merge tag 'net-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net recipients (to): ["torvalds@linux-foundation.org"] recipients (cc): [] crash: KASAN: slab-use-after-free Write in gadgetfs_bind gadgetfs gadget.0: probe with driver gadgetfs failed with error -12 udc dummy_udc.1: failed to start USB Gadget filesystem: -12 gadgetfs gadget.1: probe with driver gadgetfs failed with error -12 ================================================================== BUG: KASAN: slab-use-after-free in gadgetfs_bind+0xc0/0x970 drivers/usb/gadget/legacy/inode.c:1691 Write of size 8 at addr ffff888117abe0c0 by task syz.3.6284/18567 CPU: 0 UID: 0 PID: 18567 Comm: syz.3.6284 Not tainted syzkaller #0 PREEMPT(lazy) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Call Trace: dump_stack_lvl+0x52/0x80 lib/dump_stack.c:120 print_address_description+0x55/0x1e0 mm/kasan/report.c:378 print_report+0x58/0x70 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 gadgetfs_bind+0xc0/0x970 drivers/usb/gadget/legacy/inode.c:1691 gadget_bind_driver+0x27d/0x8c0 drivers/usb/gadget/udc/core.c:1662 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x2d2/0x9d0 drivers/base/dd.c:706 __driver_probe_device+0x17a/0x2c0 drivers/base/dd.c:868 driver_probe_device+0x4a/0x1e0 drivers/base/dd.c:898 __driver_attach+0x16b/0x490 drivers/base/dd.c:1292 bus_for_each_dev+0x221/0x290 drivers/base/bus.c:383 bus_add_driver+0x2f1/0x580 drivers/base/bus.c:763 driver_register+0x16e/0x2b0 drivers/base/driver.c:174 usb_gadget_register_driver_owner+0xf9/0x210 drivers/usb/gadget/udc/core.c:1752 dev_config+0xb98/0xff0 drivers/usb/gadget/legacy/inode.c:1892 vfs_write+0x2db/0xca0 fs/read_write.c:685 ksys_write+0x110/0x1f0 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0xca/0x370 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f192b60f559 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f192b467028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f192b895fa0 RCX: 00007f192b60f559 RDX: 000000000000001f RSI: 0000200000000440 RDI: 0000000000000005 RBP: 00007f192b6a6b20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f192b896038 R14: 00007f192b895fa0 R15: 00007ffc915ade98 Allocated by task 3657: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x2e9/0x580 mm/slub.c:5563 _kmalloc_noprof include/linux/slab.h:991 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] dev_new drivers/usb/gadget/legacy/inode.c:176 [inline] gadgetfs_fill_super+0x271/0x6f0 drivers/usb/gadget/legacy/inode.c:2063 vfs_get_super fs/super.c:1405 [inline] get_tree_single+0xa8/0x120 fs/super.c:1432 vfs_get_tree+0x87/0x1a0 fs/super.c:1947 fc_mount fs/namespace.c:1198 [inline] do_new_mount_fc fs/namespace.c:3772 [inline] do_new_mount+0x2e0/0xba0 fs/namespace.c:3848 do_mount fs/namespace.c:4181 [inline] __do_sys_mount fs/namespace.c:4397 [inline] __se_sys_mount+0x22a/0x2c0 fs/namespace.c:4374 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0xca/0x370 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 18567: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2748 [inline] slab_free mm/slub.c:6499 [inline] kfree+0x1ad/0x520 mm/slub.c:6792 gadgetfs_bind+0x825/0x970 drivers/usb/gadget/legacy/inode.c:1712 gadget_bind_driver+0x27d/0x8c0 drivers/usb/gadget/udc/core.c:1662 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x2d2/0x9d0 drivers/base/dd.c:706 __driver_probe_device+0x17a/0x2c0 drivers/base/dd.c:868 driver_probe_device+0x4a/0x1e0 drivers/base/dd.c:898 __driver_attach+0x16b/0x490 drivers/base/dd.c:1292 bus_for_each_dev+0x221/0x290 drivers/base/bus.c:383 bus_add_driver+0x2f1/0x580 drivers/base/bus.c:763 driver_register+0x16e/0x2b0 drivers/base/driver.c:174 usb_gadget_register_driver_owner+0xf9/0x210 drivers/usb/gadget/udc/core.c:1752 dev_config+0xb98/0xff0 drivers/usb/gadget/legacy/inode.c:1892 vfs_write+0x2db/0xca0 fs/read_write.c:685 ksys_write+0x110/0x1f0 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0xca/0x370 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888117abe000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 192 bytes inside of freed 1024-byte region [ffff888117abe000, ffff888117abe400) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x117ab8 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x200000000000040(head|node=0|zone=2) page_type: f5(slab) raw: 0200000000000040 ffff888100041dc0 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 0200000000000040 ffff888100041dc0 dead000000000100 dead000000000122 head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 0200000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3561, tgid 3561 (kworker/u8:0), ts 69573234965 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x112/0x140 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x2984/0x2a00 mm/page_alloc.c:3943 __alloc_frozen_pages_noprof+0x28b/0x560 mm/page_alloc.c:5436 alloc_slab_page mm/slub.c:3347 [inline] allocate_slab+0x7c/0x570 mm/slub.c:3462 new_slab mm/slub.c:3513 [inline] refill_objects+0x33f/0x3b0 mm/slub.c:7410 refill_sheaf mm/slub.c:2885 [inline] __pcs_replace_empty_main+0x25d/0x520 mm/slub.c:4774 alloc_from_pcs mm/slub.c:4850 [inline] slab_alloc_node mm/slub.c:4984 [inline] __do_kmalloc_node mm/slub.c:5413 [inline] __kmalloc_noprof+0x442/0x670 mm/slub.c:5439 _kmalloc_noprof include/linux/slab.h:995 [inline] load_elf_phdrs+0xcc/0x1e0 fs/binfmt_elf.c:537 load_elf_binary+0x795/0x2280 fs/binfmt_elf.c:969 search_binary_handler fs/exec.c:1759 [inline] exec_binprm fs/exec.c:1791 [inline] bprm_execve+0x719/0x1090 fs/exec.c:1847 kernel_execve+0x5fa/0x6f0 fs/exec.c:1991 call_usermodehelper_exec_async+0x1dc/0x2f0 kernel/umh.c:107 ret_from_fork+0x29c/0x620 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 page last free pid 829 tgid 829 ts 69513289695 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1418 [inline] free_pages_prepare+0x9c3/0xab0 mm/page_alloc.c:1463 __free_contig_range_common+0x166/0x310 mm/page_alloc.c:7072 __free_contig_range mm/page_alloc.c:7117 [inline] free_pages_bulk+0x48/0x110 mm/page_alloc.c:5322 vm_area_free_pages mm/vmalloc.c:3461 [inline] vfree+0x1ba/0x370 mm/vmalloc.c:3510 delayed_vfree_work+0x3c/0x70 mm/vmalloc.c:3414 process_one_work kernel/workqueue.c:3387 [inline] process_scheduled_works+0xa3d/0x1620 kernel/workqueue.c:3470 worker_thread+0x807/0xc40 kernel/workqueue.c:3551 kthread+0x297/0x340 kernel/kthread.c:436 ret_from_fork+0x29c/0x620 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Memory state around the buggy address: ffff888117abdf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888117abe000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888117abe080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888117abe100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888117abe180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================