ci2 starts bisection 2024-05-26 16:31:02.242640753 +0000 UTC m=+168871.103608678 bisecting fixing commit since 284087d4f7d57502b5a41b423b771f16cc6d157a building syzkaller on 18f6e127bf6e515fc3eee0936bde2415e676e160 ensuring issue is reproducible on original commit 284087d4f7d57502b5a41b423b771f16cc6d157a testing commit 284087d4f7d57502b5a41b423b771f16cc6d157a gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 106463a7cf52a2aff50da75a8b2e579bb82b9870ab561d850ca7f10b14698f0d run #0: crashed: possible deadlock in dquot_commit run #1: crashed: possible deadlock in ext4_map_blocks run #2: crashed: possible deadlock in ext4_map_blocks run #3: crashed: possible deadlock in ext4_map_blocks run #4: crashed: possible deadlock in ext4_map_blocks run #5: crashed: possible deadlock in ext4_map_blocks run #6: crashed: possible deadlock in ext4_map_blocks run #7: crashed: possible deadlock in ext4_map_blocks run #8: crashed: possible deadlock in ext4_map_blocks run #9: crashed: possible deadlock in ext4_map_blocks run #10: crashed: possible deadlock in ext4_map_blocks run #11: crashed: possible deadlock in ext4_map_blocks run #12: crashed: possible deadlock in ext4_map_blocks run #13: crashed: possible deadlock in ext4_map_blocks run #14: crashed: possible deadlock in ext4_map_blocks run #15: crashed: possible deadlock in ext4_map_blocks run #16: crashed: possible deadlock in ext4_map_blocks run #17: crashed: possible deadlock in ext4_map_blocks run #18: crashed: possible deadlock in ext4_map_blocks run #19: crashed: possible deadlock in ext4_map_blocks representative crash: possible deadlock in dquot_commit, types: [LOCKDEP] check whether we can drop unnecessary instrumentation disabling configs for [HANG LEAK UBSAN BUG KASAN ATOMIC_SLEEP], they are not needed testing commit 284087d4f7d57502b5a41b423b771f16cc6d157a gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 36686cc148e9b2096ed2a45147b8cd613ca07fb09d06eea639188cbb81f23105 run #0: crashed: possible deadlock in ext4_map_blocks run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK representative crash: possible deadlock in ext4_map_blocks, types: [LOCKDEP] kconfig minimization: base=3703 full=7269 leaves diff=1982 split chunks (needed=false): <1982> split chunk #0 of len 1982 into 5 parts testing without sub-chunk 1/5 testing commit 284087d4f7d57502b5a41b423b771f16cc6d157a gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: c3e073f6b9e00009b82655934711f15d4515f139228b19905bbb3a43966b7db0 run #0: crashed: possible deadlock in dquot_commit run #1: crashed: possible deadlock in dquot_commit run #2: crashed: possible deadlock in ext4_map_blocks run #3: crashed: possible deadlock in ext4_map_blocks run #4: crashed: possible deadlock in ext4_map_blocks run #5: crashed: possible deadlock in ext4_map_blocks run #6: crashed: possible deadlock in ext4_map_blocks run #7: crashed: possible deadlock in ext4_map_blocks run #8: crashed: possible deadlock in ext4_map_blocks run #9: crashed: possible deadlock in ext4_map_blocks run #10: crashed: possible deadlock in ext4_map_blocks run #11: crashed: possible deadlock in ext4_map_blocks run #12: crashed: possible deadlock in ext4_map_blocks run #13: crashed: possible deadlock in ext4_map_blocks run #14: crashed: possible deadlock in ext4_map_blocks run #15: crashed: possible deadlock in ext4_map_blocks run #16: crashed: possible deadlock in ext4_map_blocks run #17: crashed: possible deadlock in ext4_map_blocks run #18: crashed: possible deadlock in ext4_map_blocks run #19: crashed: possible deadlock in ext4_map_blocks representative crash: possible deadlock in dquot_commit, types: [LOCKDEP] the chunk can be dropped testing without sub-chunk 2/5 testing commit 284087d4f7d57502b5a41b423b771f16cc6d157a gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: eaa4248995f810f65f48b61e33ab62067ff340df3d673ec3025ead7c66166c0e all runs: crashed: possible deadlock in ext4_map_blocks representative crash: possible deadlock in ext4_map_blocks, types: [LOCKDEP] the chunk can be dropped testing without sub-chunk 3/5 testing commit 284087d4f7d57502b5a41b423b771f16cc6d157a gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 12bdceda86fd3f55da842fe202adb9f26c3768c92713585d53a5be1baaf7686d run #0: crashed: possible deadlock in dquot_commit run #1: crashed: possible deadlock in dquot_commit run #2: crashed: possible deadlock in ext4_map_blocks run #3: crashed: possible deadlock in ext4_map_blocks run #4: crashed: possible deadlock in ext4_map_blocks run #5: crashed: possible deadlock in ext4_map_blocks run #6: crashed: possible deadlock in ext4_map_blocks run #7: crashed: possible deadlock in ext4_map_blocks run #8: crashed: possible deadlock in ext4_map_blocks run #9: crashed: possible deadlock in ext4_map_blocks run #10: crashed: possible deadlock in ext4_map_blocks run #11: crashed: possible deadlock in ext4_map_blocks run #12: crashed: possible deadlock in ext4_map_blocks run #13: crashed: possible deadlock in ext4_map_blocks run #14: crashed: possible deadlock in ext4_map_blocks run #15: crashed: possible deadlock in ext4_map_blocks run #16: crashed: possible deadlock in ext4_map_blocks run #17: crashed: possible deadlock in ext4_map_blocks run #18: crashed: possible deadlock in ext4_map_blocks run #19: crashed: possible deadlock in ext4_map_blocks representative crash: possible deadlock in dquot_commit, types: [LOCKDEP] the chunk can be dropped testing without sub-chunk 4/5 testing commit 284087d4f7d57502b5a41b423b771f16cc6d157a gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: bf6378a33adc1345d2b84a8befa6c0d5c02b6334f008bb3cddf37c1db7d48116 run #0: crashed: possible deadlock in dquot_commit run #1: crashed: possible deadlock in dquot_commit run #2: crashed: possible deadlock in dquot_commit run #3: crashed: possible deadlock in ext4_map_blocks run #4: crashed: possible deadlock in dquot_commit run #5: crashed: possible deadlock in ext4_map_blocks run #6: crashed: possible deadlock in dquot_commit run #7: crashed: possible deadlock in ext4_map_blocks run #8: crashed: possible deadlock in ext4_map_blocks run #9: crashed: possible deadlock in ext4_map_blocks run #10: crashed: possible deadlock in ext4_map_blocks run #11: crashed: possible deadlock in ext4_map_blocks run #12: crashed: possible deadlock in ext4_map_blocks run #13: crashed: possible deadlock in ext4_map_blocks run #14: crashed: possible deadlock in ext4_map_blocks run #15: crashed: possible deadlock in ext4_map_blocks run #16: crashed: possible deadlock in ext4_map_blocks run #17: crashed: possible deadlock in ext4_map_blocks run #18: crashed: possible deadlock in ext4_map_blocks run #19: crashed: possible deadlock in ext4_map_blocks representative crash: possible deadlock in dquot_commit, types: [LOCKDEP] the chunk can be dropped testing without sub-chunk 5/5 testing commit 284087d4f7d57502b5a41b423b771f16cc6d157a gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 83574c2d29a4c1e9a3f6ba5b0fe011dbedf55fd936901b95b9c5bc38ac242be5 all runs: crashed: possible deadlock in ext4_map_blocks representative crash: possible deadlock in ext4_map_blocks, types: [LOCKDEP] the chunk can be dropped determining the merge base between 284087d4f7d57502b5a41b423b771f16cc6d157a and c13320499ba0efd93174ef6462ae8a7a2933f6e7 8bb7eca972ad531c9b149c0a51ab43a417385813/Linux 5.15 is a merge base, check if it has the bug testing commit 8bb7eca972ad531c9b149c0a51ab43a417385813 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 2f864fe6eda89924196d2b68060bcc9eac9c0678c8e1f2520dab75eb5f1634ec all runs: crashed: possible deadlock in ext4_map_blocks representative crash: possible deadlock in ext4_map_blocks, types: [LOCKDEP] testing current HEAD c13320499ba0efd93174ef6462ae8a7a2933f6e7 testing commit c13320499ba0efd93174ef6462ae8a7a2933f6e7 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 685764219d1a1fc073c5644811346c0833fd98d47949026dc988ee9aa03e0318 all runs: OK false negative chance: 0.000 # git bisect start c13320499ba0efd93174ef6462ae8a7a2933f6e7 8bb7eca972ad531c9b149c0a51ab43a417385813 Bisecting: 117242 revisions left to test after this (roughly 17 steps) [8762069330316392331e693befd8a5b632833618] Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi determine whether the revision contains the guilty commit revision 8bb7eca972ad531c9b149c0a51ab43a417385813 crashed and is reachable testing commit 8762069330316392331e693befd8a5b632833618 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 33df0ee2145569b8433bc5dfae9a3d96d85c042b3d57156792d1cd0d72fd10ec all runs: crashed: possible deadlock in ext4_map_blocks representative crash: possible deadlock in ext4_map_blocks, types: [LOCKDEP] # git bisect good 8762069330316392331e693befd8a5b632833618 Bisecting: 58653 revisions left to test after this (roughly 16 steps) [63ce50fff9240d66cf3b59663f458f55ba6dcfcc] Merge tag 'sched-core-2023-10-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip determine whether the revision contains the guilty commit revision 8762069330316392331e693befd8a5b632833618 crashed and is reachable testing commit 63ce50fff9240d66cf3b59663f458f55ba6dcfcc gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 6bcc48d1803577ae8b046008c515f11a5e02eef2d7894fa79d22f813f09d10b4 all runs: OK false negative chance: 0.000 # git bisect bad 63ce50fff9240d66cf3b59663f458f55ba6dcfcc Bisecting: 29180 revisions left to test after this (roughly 15 steps) [3a8a670eeeaa40d87bd38a587438952741980c18] Merge tag 'net-next-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next determine whether the revision contains the guilty commit revision 8762069330316392331e693befd8a5b632833618 crashed and is reachable testing commit 3a8a670eeeaa40d87bd38a587438952741980c18 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: d6b9b93c93dbde43fb2ebd6b0eec88082e3d6bd8bf5d327865feabd7a94f0bc7 all runs: basic kernel testing failed: UBSAN: array-index-out-of-bounds in alloc_pid unable to determine the verdict: 0 good runs (wanted 15), for bad wanted 10 in total, got 0 # git bisect skip 3a8a670eeeaa40d87bd38a587438952741980c18 Bisecting: 29180 revisions left to test after this (roughly 15 steps) [b34c7dcaf311521f6a0edaffc157d115d386ed9c] scsi: fnic: Use vmalloc_array() and vcalloc() determine whether the revision contains the guilty commit revision 8762069330316392331e693befd8a5b632833618 crashed and is reachable testing commit b34c7dcaf311521f6a0edaffc157d115d386ed9c gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 26c4a3c9c17b4c37e8942f4e3474a2ca11545ffd5c848ead30a93eae6cba62bc run #0: crashed: lost connection to test machine run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK representative crash: lost connection to test machine, types: [UNKNOWN] # git bisect good b34c7dcaf311521f6a0edaffc157d115d386ed9c Bisecting: 17676 revisions left to test after this (roughly 14 steps) [5a31cc7297072a7266a910ca5266b640d27803b4] Merge tag 'linux-kselftest-next-6.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest determine whether the revision contains the guilty commit revision 8bb7eca972ad531c9b149c0a51ab43a417385813 crashed and is reachable testing commit 5a31cc7297072a7266a910ca5266b640d27803b4 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: f7bc688d22a51f637abe1ba19ebd1af0da1f30459866a7dd5510d8243b81b712 all runs: OK false negative chance: 0.000 # git bisect bad 5a31cc7297072a7266a910ca5266b640d27803b4 Bisecting: 8469 revisions left to test after this (roughly 13 steps) [1b722407a13b7f8658d2e26917791f32805980a2] Merge tag 'drm-next-2023-06-29' of git://anongit.freedesktop.org/drm/drm determine whether the revision contains the guilty commit revision 8bb7eca972ad531c9b149c0a51ab43a417385813 crashed and is reachable testing commit 1b722407a13b7f8658d2e26917791f32805980a2 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 20de57940a12ff2af345eb4d03a967b81bfc5671c1f7c1670a6e21f19f231e37 all runs: basic kernel testing failed: UBSAN: array-index-out-of-bounds in alloc_pid unable to determine the verdict: 0 good runs (wanted 15), for bad wanted 10 in total, got 0 # git bisect skip 1b722407a13b7f8658d2e26917791f32805980a2 Bisecting: 8469 revisions left to test after this (roughly 13 steps) [6c8880fcaa5c45355179b759c1d11737775e31fc] selftests: mptcp: depend on SYN_COOKIES determine whether the revision contains the guilty commit revision 8bb7eca972ad531c9b149c0a51ab43a417385813 crashed and is reachable testing commit 6c8880fcaa5c45355179b759c1d11737775e31fc gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 5454ebc2f78ba7336a81a7eb9c067d6b9fc39f55a2b34cd49b4380b442ddcebc all runs: basic kernel testing failed: UBSAN: array-index-out-of-bounds in alloc_pid unable to determine the verdict: 0 good runs (wanted 15), for bad wanted 10 in total, got 0 # git bisect skip 6c8880fcaa5c45355179b759c1d11737775e31fc Bisecting: 8469 revisions left to test after this (roughly 13 steps) [b5cc3833f13ace75e26e3f7b51cd7b6da5e9cf17] Merge tag 'net-6.5-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net determine whether the revision contains the guilty commit revision 8762069330316392331e693befd8a5b632833618 crashed and is reachable testing commit b5cc3833f13ace75e26e3f7b51cd7b6da5e9cf17 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: da46aeae47902886a3bea4510453e1ec6c9cc51406174f6fdd7b181ad756259d all runs: OK false negative chance: 0.000 # git bisect bad b5cc3833f13ace75e26e3f7b51cd7b6da5e9cf17 Bisecting: 9109 revisions left to test after this (roughly 13 steps) [f8824e151fbfa0ac0a258015d606ea6f4a10251b] Merge tag 'sound-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound determine whether the revision contains the guilty commit revision 3a8a670eeeaa40d87bd38a587438952741980c18 crashed and is reachable testing commit f8824e151fbfa0ac0a258015d606ea6f4a10251b gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 59515aa85f560cb25a3366cb49c9ae87858f28129b239c68fd41311b44e34aab all runs: basic kernel testing failed: UBSAN: array-index-out-of-bounds in alloc_pid unable to determine the verdict: 0 good runs (wanted 15), for bad wanted 10 in total, got 0 # git bisect skip f8824e151fbfa0ac0a258015d606ea6f4a10251b Bisecting: 9109 revisions left to test after this (roughly 13 steps) [9a94d764e9bc6ee4b9424acde77c959270e2ac7a] Merge tag 'mlx5-updates-2023-06-16' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux determine whether the revision contains the guilty commit revision 8762069330316392331e693befd8a5b632833618 crashed and is reachable testing commit 9a94d764e9bc6ee4b9424acde77c959270e2ac7a gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: d281db884fda3e4cc9e715d0642c4e6fb2de937b8f8cfc3e4858c4e025de61c6 all runs: OK false negative chance: 0.000 # git bisect bad 9a94d764e9bc6ee4b9424acde77c959270e2ac7a Bisecting: 1476 revisions left to test after this (roughly 11 steps) [7ebe4eda4265642859507d1b3ca330d8c196cfe5] bnx2x: fix page fault following EEH recovery determine whether the revision contains the guilty commit revision 8bb7eca972ad531c9b149c0a51ab43a417385813 crashed and is reachable testing commit 7ebe4eda4265642859507d1b3ca330d8c196cfe5 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: f0c66fa64c192aaa9084d6474cf9f2279fbaff4adba9e0fe68114e4d53b1861c all runs: OK false negative chance: 0.000 # git bisect bad 7ebe4eda4265642859507d1b3ca330d8c196cfe5 Bisecting: 778 revisions left to test after this (roughly 10 steps) [eb03e318135419b8b781f83cdfa7dbb9252afad6] Merge tag 'for-v6.4-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply determine whether the revision contains the guilty commit revision 8bb7eca972ad531c9b149c0a51ab43a417385813 crashed and is reachable testing commit eb03e318135419b8b781f83cdfa7dbb9252afad6 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 7e90de919539f3abab95d15a6cf938065cbe34a4cd28ff72f31b0fa690753290 all runs: OK false negative chance: 0.000 # git bisect bad eb03e318135419b8b781f83cdfa7dbb9252afad6 Bisecting: 339 revisions left to test after this (roughly 9 steps) [1f594fe7c90746982569bd4f3489e809104a9176] Merge tag 'net-6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net determine whether the revision contains the guilty commit revision 8bb7eca972ad531c9b149c0a51ab43a417385813 crashed and is reachable testing commit 1f594fe7c90746982569bd4f3489e809104a9176 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 4d3f7d2f815fb7c3c38af5b294e1069cf80b9b188248bdecbea45ef2d251f2fc all runs: OK false negative chance: 0.000 # git bisect bad 1f594fe7c90746982569bd4f3489e809104a9176 Bisecting: 178 revisions left to test after this (roughly 8 steps) [491459b5ec3751a3a58129db4fb9f832e474bb95] Merge tag 'timers_urgent_for_v6.4_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip determine whether the revision contains the guilty commit revision 8bb7eca972ad531c9b149c0a51ab43a417385813 crashed and is reachable testing commit 491459b5ec3751a3a58129db4fb9f832e474bb95 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 8458ef77eff2a4f05136720b17d745435d9410e3047e0a8d54c2896e0dba88af all runs: OK false negative chance: 0.000 # git bisect bad 491459b5ec3751a3a58129db4fb9f832e474bb95 Bisecting: 97 revisions left to test after this (roughly 7 steps) [849a4f09730ba3c02da01924c7a6e7a000a4d27c] Merge tag 'xfs-6.4-rc1-fixes' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux determine whether the revision contains the guilty commit revision 8762069330316392331e693befd8a5b632833618 crashed and is reachable testing commit 849a4f09730ba3c02da01924c7a6e7a000a4d27c gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: f7aca2956323d0a4ac66f3876a43a0cc94ef561a60b2adc8b5d2e4b5a0aeeb8f all runs: OK false negative chance: 0.000 # git bisect bad 849a4f09730ba3c02da01924c7a6e7a000a4d27c Bisecting: 46 revisions left to test after this (roughly 5 steps) [cceac9267887753f3c9594f1f7b92237cb0f64fb] Merge tag 'nf-23-05-10' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf determine whether the revision contains the guilty commit revision 8bb7eca972ad531c9b149c0a51ab43a417385813 crashed and is reachable testing commit cceac9267887753f3c9594f1f7b92237cb0f64fb gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: f419b7cef1951accd8d9a403e2804673efd6b8295b07703a91b6bb2cae9068c2 all runs: OK false negative chance: 0.000 # git bisect bad cceac9267887753f3c9594f1f7b92237cb0f64fb Bisecting: 16 revisions left to test after this (roughly 4 steps) [4063384ef762cc5946fc7a3f89879e76c6ec51e2] net: add vlan_get_protocol_and_depth() helper determine whether the revision contains the guilty commit revision 8bb7eca972ad531c9b149c0a51ab43a417385813 crashed and is reachable testing commit 4063384ef762cc5946fc7a3f89879e76c6ec51e2 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 48878419d8efb46fc8b4cb1287863a1c33ff6ebc81393804ee28ddf116ed2f8b all runs: OK false negative chance: 0.000 # git bisect bad 4063384ef762cc5946fc7a3f89879e76c6ec51e2 Bisecting: 7 revisions left to test after this (roughly 3 steps) [84df83e0ecd3beba62c3d06b43ab51cc47efaca0] Documentation: bonding: fix the doc of peer_notif_delay determine whether the revision contains the guilty commit revision 8bb7eca972ad531c9b149c0a51ab43a417385813 crashed and is reachable testing commit 84df83e0ecd3beba62c3d06b43ab51cc47efaca0 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 318e5659951c30bbed2547aaf3dc1c0b6ba7cb896abe9f9e0f14c0d50fc2925e all runs: OK false negative chance: 0.000 # git bisect bad 84df83e0ecd3beba62c3d06b43ab51cc47efaca0 Bisecting: 4 revisions left to test after this (roughly 2 steps) [8efbdbfa99381a017dd2c0f6375a7d80a8118b74] net: stmmac: Initialize MAC_ONEUS_TIC_COUNTER register determine whether the revision contains the guilty commit revision 8bb7eca972ad531c9b149c0a51ab43a417385813 crashed and is reachable testing commit 8efbdbfa99381a017dd2c0f6375a7d80a8118b74 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 280ee9b46b911c558ae2f60ffd0d8ab0c7560b2a93b62cbc8ba0a02f6329c415 all runs: OK false negative chance: 0.000 # git bisect bad 8efbdbfa99381a017dd2c0f6375a7d80a8118b74 Bisecting: 1 revision left to test after this (roughly 1 step) [27c1eaa07283b0c94becf8241f95368267cf558b] net: mdio: mvusb: Fix an error handling path in mvusb_mdio_probe() determine whether the revision contains the guilty commit revision 8bb7eca972ad531c9b149c0a51ab43a417385813 crashed and is reachable testing commit 27c1eaa07283b0c94becf8241f95368267cf558b gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 621b5e88ae73daf00a514860af2df5b0e13a29bf485c832b1ba26b12dcb0060c all runs: OK false negative chance: 0.000 # git bisect bad 27c1eaa07283b0c94becf8241f95368267cf558b Bisecting: 0 revisions left to test after this (roughly 0 steps) [424f8416bb39936df6365442d651ee729b283460] net: skb_partial_csum_set() fix against transport header magic value determine whether the revision contains the guilty commit revision 8762069330316392331e693befd8a5b632833618 crashed and is reachable testing commit 424f8416bb39936df6365442d651ee729b283460 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: c06a56e55ea992ad062217b494b99c14d690476005da5427c65611d6055e771b all runs: OK false negative chance: 0.000 # git bisect bad 424f8416bb39936df6365442d651ee729b283460 424f8416bb39936df6365442d651ee729b283460 is the first bad commit commit 424f8416bb39936df6365442d651ee729b283460 Author: Eric Dumazet Date: Fri May 5 17:06:18 2023 +0000 net: skb_partial_csum_set() fix against transport header magic value skb->transport_header uses the special 0xFFFF value to mark if the transport header was set or not. We must prevent callers to accidentaly set skb->transport_header to 0xFFFF. Note that only fuzzers can possibly do this today. syzbot reported: WARNING: CPU: 0 PID: 2340 at include/linux/skbuff.h:2847 skb_transport_offset include/linux/skbuff.h:2956 [inline] WARNING: CPU: 0 PID: 2340 at include/linux/skbuff.h:2847 virtio_net_hdr_to_skb+0xbcc/0x10c0 include/linux/virtio_net.h:103 Modules linked in: CPU: 0 PID: 2340 Comm: syz-executor.0 Not tainted 6.3.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 RIP: 0010:skb_transport_header include/linux/skbuff.h:2847 [inline] RIP: 0010:skb_transport_offset include/linux/skbuff.h:2956 [inline] RIP: 0010:virtio_net_hdr_to_skb+0xbcc/0x10c0 include/linux/virtio_net.h:103 Code: 41 39 df 0f 82 c3 04 00 00 48 8b 7c 24 10 44 89 e6 e8 08 6e 59 ff 48 85 c0 74 54 e8 ce 36 7e fc e9 37 f8 ff ff e8 c4 36 7e fc <0f> 0b e9 93 f8 ff ff 44 89 f7 44 89 e6 e8 32 38 7e fc 45 39 e6 0f RSP: 0018:ffffc90004497880 EFLAGS: 00010293 RAX: ffffffff84fea55c RBX: 000000000000ffff RCX: ffff888120be2100 RDX: 0000000000000000 RSI: 000000000000ffff RDI: 000000000000ffff RBP: ffffc90004497990 R08: ffffffff84fe9de5 R09: 0000000000000034 R10: ffffea00048ebd80 R11: 0000000000000034 R12: ffff88811dc2d9c8 R13: dffffc0000000000 R14: ffff88811dc2d9ae R15: 1ffff11023b85b35 FS: 00007f9211a59700(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000200002c0 CR3: 00000001215a5000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: packet_snd net/packet/af_packet.c:3076 [inline] packet_sendmsg+0x4590/0x61a0 net/packet/af_packet.c:3115 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] __sys_sendto+0x472/0x630 net/socket.c:2144 __do_sys_sendto net/socket.c:2156 [inline] __se_sys_sendto net/socket.c:2152 [inline] __x64_sys_sendto+0xe5/0x100 net/socket.c:2152 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2f/0x50 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f9210c8c169 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f9211a59168 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f9210dabf80 RCX: 00007f9210c8c169 RDX: 000000000000ffed RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 00007f9210ce7ca1 R08: 0000000020000540 R09: 0000000000000014 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe135d65cf R14: 00007f9211a59300 R15: 0000000000022000 Fixes: 66e4c8d95008 ("net: warn if transport header was not set") Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: Willem de Bruijn Reviewed-by: Willem de Bruijn Signed-off-by: David S. Miller net/core/skbuff.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) accumulated error probability: 0.00 parent commit ed23734c23d2fc1e6a1ff80f8c2b82faeed0ed0c wasn't tested testing commit ed23734c23d2fc1e6a1ff80f8c2b82faeed0ed0c gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 871ed026b7a73cb094fc55efabcdf05d57cc1912c7668a9340336b1484bf3421 culprit signature: c06a56e55ea992ad062217b494b99c14d690476005da5427c65611d6055e771b parent signature: 871ed026b7a73cb094fc55efabcdf05d57cc1912c7668a9340336b1484bf3421 reproducer is flaky (0.53 repro chance estimate) revisions tested: 30, total time: 6h28m14.140195746s (build: 1h16m9.52988509s, test: 5h2m23.286851368s) first good commit: 424f8416bb39936df6365442d651ee729b283460 net: skb_partial_csum_set() fix against transport header magic value recipients (to): ["davem@davemloft.net" "edumazet@google.com" "willemb@google.com"] recipients (cc): []