ci2 starts bisection 2025-11-23 16:34:59.435461066 +0000 UTC m=+164447.302180450 bisecting fixing commit since 0a805b6ea8cda0caa268b396a2e5117f3772d849 building syzkaller on d291dd2d58a1885c00a60561048b6ceb1bf1206a ensuring issue is reproducible on original commit 0a805b6ea8cda0caa268b396a2e5117f3772d849 testing commit 0a805b6ea8cda0caa268b396a2e5117f3772d849 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: ba99a4b449cbf7a34c3e88536868829524496c204f2c4552a2f49f1075483fa4 all runs: crashed: INFO: task hung in iterate_supers representative crash: INFO: task hung in iterate_supers, types: [HANG] check whether we can drop unnecessary instrumentation disabling configs for [locking atomic_sleep memleak ubsan bug_or_warning kasan], they are not needed testing commit 0a805b6ea8cda0caa268b396a2e5117f3772d849 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 5db2210395d963425103eaac7e69092f6ecddf726ca322b9118237605544c218 all runs: crashed: INFO: task hung in iterate_supers representative crash: INFO: task hung in iterate_supers, types: [HANG] the bug reproduces without the instrumentation disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed kconfig minimization: base=3913 full=7799 leaves diff=2159 split chunks (needed=false): <2159> split chunk #0 of len 2159 into 5 parts testing without sub-chunk 1/5 disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed testing commit 0a805b6ea8cda0caa268b396a2e5117f3772d849 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: e4af97f0b3b52946f4215a35ccadbf72a2ff53bcd4f21b025948b339be1104b9 all runs: crashed: INFO: task hung in iterate_supers representative crash: INFO: task hung in iterate_supers, types: [HANG] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [atomic_sleep memleak ubsan bug_or_warning kasan locking], they are not needed testing commit 0a805b6ea8cda0caa268b396a2e5117f3772d849 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 0cb7d29397365c1ae3caf125b4c66a5110044eed72ff9b376262910c394b99cc all runs: crashed: INFO: task hung in iterate_supers representative crash: INFO: task hung in iterate_supers, types: [HANG] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed testing commit 0a805b6ea8cda0caa268b396a2e5117f3772d849 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 1991ea40fcd8b6bbdaec93c96f1cdba8639316df9b438d322b7c809767008377 all runs: crashed: INFO: task hung in iterate_supers representative crash: INFO: task hung in iterate_supers, types: [HANG] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed testing commit 0a805b6ea8cda0caa268b396a2e5117f3772d849 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 6942c3bfd5d8002e206503fec70cd275e92029038878f8cb995a7b2a0cee7715 all runs: crashed: INFO: task hung in iterate_supers representative crash: INFO: task hung in iterate_supers, types: [HANG] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [atomic_sleep memleak ubsan bug_or_warning kasan locking], they are not needed testing commit 0a805b6ea8cda0caa268b396a2e5117f3772d849 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 1de4acd9f287bd2298daefe2329fde304a6abf2fc76e312696328a03aaec3fbe all runs: crashed: INFO: task hung in iterate_supers representative crash: INFO: task hung in iterate_supers, types: [HANG] the chunk can be dropped disabling configs for [locking atomic_sleep memleak ubsan bug_or_warning kasan], they are not needed determining the merge base between 0a805b6ea8cda0caa268b396a2e5117f3772d849 and 1af5c1d3a90246a15225fc7de0ed7e5f9b2f3f98 ffc253263a1375a65fa6c9f62a893e9767fbebfa/Linux 6.6 is a merge base, check if it has the bug testing commit ffc253263a1375a65fa6c9f62a893e9767fbebfa gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 7293bdd097f9421829e87e55f24c4902c9d303acfcb8fede301e6a4e1748cf1f all runs: crashed: INFO: task hung in iterate_supers representative crash: INFO: task hung in iterate_supers, types: [HANG] testing current HEAD 1af5c1d3a90246a15225fc7de0ed7e5f9b2f3f98 testing commit 1af5c1d3a90246a15225fc7de0ed7e5f9b2f3f98 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: cdfd54a3982de87a490aa8c6bebeda790e3fd874e0671e43e705872eefc20dea all runs: OK false negative chance: 0.000 # git bisect start 1af5c1d3a90246a15225fc7de0ed7e5f9b2f3f98 ffc253263a1375a65fa6c9f62a893e9767fbebfa Bisecting: 90792 revisions left to test after this (roughly 17 steps) [b707512b8b07396f8982103a84285a165a1bd94c] Merge tag 'staging-6.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging determine whether the revision contains the guilty commit revision ffc253263a1375a65fa6c9f62a893e9767fbebfa crashed and is reachable testing commit b707512b8b07396f8982103a84285a165a1bd94c gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 0339017ea9387469535b0948ec3b483f8b1c0916f73d2ab194c341c6c1f51a20 all runs: crashed: INFO: task hung in iterate_supers representative crash: INFO: task hung in iterate_supers, types: [HANG] # git bisect good b707512b8b07396f8982103a84285a165a1bd94c Bisecting: 45390 revisions left to test after this (roughly 16 steps) [3349e275067f94ffb4141989aed9cbae7409429b] Merge 6.15-rc6 into staging-next determine whether the revision contains the guilty commit revision ffc253263a1375a65fa6c9f62a893e9767fbebfa crashed and is reachable testing commit 3349e275067f94ffb4141989aed9cbae7409429b gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 4b5fec8ff35a774967170de660443d5e57c8d65954ad7ffb391a47046d06f0a5 all runs: crashed: INFO: task hung in iterate_supers representative crash: INFO: task hung in iterate_supers, types: [HANG] # git bisect good 3349e275067f94ffb4141989aed9cbae7409429b Bisecting: 22778 revisions left to test after this (roughly 15 steps) [8be4d31cb8aaeea27bde4b7ddb26e28a89062ebf] Merge tag 'net-next-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next determine whether the revision contains the guilty commit revision ffc253263a1375a65fa6c9f62a893e9767fbebfa crashed and is reachable testing commit 8be4d31cb8aaeea27bde4b7ddb26e28a89062ebf gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: f5e0892ff6b2b55ed4bf329242f3b9c8385f1a1815aa28015b05f3c4f2724724 all runs: crashed: INFO: task hung in __iterate_supers representative crash: INFO: task hung in __iterate_supers, types: [HANG] # git bisect good 8be4d31cb8aaeea27bde4b7ddb26e28a89062ebf Bisecting: 11883 revisions left to test after this (roughly 14 steps) [a8253f807760e9c80eada9e5354e1240ccf325f9] Merge tag 'soc-newsoc-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc determine whether the revision contains the guilty commit revision b707512b8b07396f8982103a84285a165a1bd94c crashed and is reachable testing commit a8253f807760e9c80eada9e5354e1240ccf325f9 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: c7f5096bfc354527374ffdb8038c457f1c9664d158329279e970f830a30178f4 all runs: crashed: INFO: task hung in __iterate_supers representative crash: INFO: task hung in __iterate_supers, types: [HANG] # git bisect good a8253f807760e9c80eada9e5354e1240ccf325f9 Bisecting: 5772 revisions left to test after this (roughly 13 steps) [8804d970fab45726b3c7cd7f240b31122aa94219] Merge tag 'mm-stable-2025-10-01-19-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm determine whether the revision contains the guilty commit revision a8253f807760e9c80eada9e5354e1240ccf325f9 crashed and is reachable testing commit 8804d970fab45726b3c7cd7f240b31122aa94219 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 86f7ad751803670c3c94acad7390f63df66b1136f1d727ca7e1fb00186369ad5 all runs: crashed: INFO: task hung in __iterate_supers representative crash: INFO: task hung in __iterate_supers, types: [HANG] # git bisect good 8804d970fab45726b3c7cd7f240b31122aa94219 Bisecting: 2922 revisions left to test after this (roughly 12 steps) [971199ad2a0f1b2fbe14af13369704aff2999988] Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux determine whether the revision contains the guilty commit revision a8253f807760e9c80eada9e5354e1240ccf325f9 crashed and is reachable testing commit 971199ad2a0f1b2fbe14af13369704aff2999988 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: ec4891d613665fc4e3887aba9deec13e58c69755e740258b0ef02da7ccc43474 all runs: crashed: INFO: task hung in __iterate_supers representative crash: INFO: task hung in __iterate_supers, types: [HANG] # git bisect good 971199ad2a0f1b2fbe14af13369704aff2999988 Bisecting: 1464 revisions left to test after this (roughly 11 steps) [a0b12d7b04049343d544ac92c8eeb5a2271235c3] Merge tag 'acpi-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm determine whether the revision contains the guilty commit revision ffc253263a1375a65fa6c9f62a893e9767fbebfa crashed and is reachable testing commit a0b12d7b04049343d544ac92c8eeb5a2271235c3 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: fad0cab6aa1bf26067ffd3ce7567dfedc12e4243e989816960365c4a7b07382a all runs: OK false negative chance: 0.000 # git bisect bad a0b12d7b04049343d544ac92c8eeb5a2271235c3 Bisecting: 728 revisions left to test after this (roughly 10 steps) [21f4d45eba0b2dcae5dbc9e5e0ad08735c993f16] net/ip6_tunnel: Prevent perpetual tunnel growth determine whether the revision contains the guilty commit revision b707512b8b07396f8982103a84285a165a1bd94c crashed and is reachable testing commit 21f4d45eba0b2dcae5dbc9e5e0ad08735c993f16 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: f7715663a2c9f56f8ee6dc0a4bf4408ef8c1727cc68d6fd5030a5947514b8149 all runs: crashed: INFO: task hung in __iterate_supers representative crash: INFO: task hung in __iterate_supers, types: [HANG] # git bisect good 21f4d45eba0b2dcae5dbc9e5e0ad08735c993f16 Bisecting: 361 revisions left to test after this (roughly 9 steps) [4361f5aa8bfcecbab3fc8db987482b9e08115a6a] Merge tag 'kvm-x86-fixes-6.18-rc2' of https://github.com/kvm-x86/linux into HEAD determine whether the revision contains the guilty commit revision 8be4d31cb8aaeea27bde4b7ddb26e28a89062ebf crashed and is reachable testing commit 4361f5aa8bfcecbab3fc8db987482b9e08115a6a gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 9af82e268b22bd33d7ffb229ff3da80244fc85120eaab63d9f16d2ffcd0672a2 all runs: OK false negative chance: 0.000 # git bisect bad 4361f5aa8bfcecbab3fc8db987482b9e08115a6a Bisecting: 168 revisions left to test after this (roughly 8 steps) [284fc30e66e602a5df58393860f67477d6a79339] Merge tag 'drm-next-2025-10-11-1' of https://gitlab.freedesktop.org/drm/kernel determine whether the revision contains the guilty commit revision ffc253263a1375a65fa6c9f62a893e9767fbebfa crashed and is reachable testing commit 284fc30e66e602a5df58393860f67477d6a79339 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 6d730b6007dc2b9cf7f09b3399d68a191553ad219005390456ea0daf698fc3de all runs: OK false negative chance: 0.000 # git bisect bad 284fc30e66e602a5df58393860f67477d6a79339 Bisecting: 98 revisions left to test after this (roughly 7 steps) [eba41c0173c8c27702b720730ed9d399088409f0] Merge tag 'io_uring-6.18-20251009' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux determine whether the revision contains the guilty commit revision ffc253263a1375a65fa6c9f62a893e9767fbebfa crashed and is reachable testing commit eba41c0173c8c27702b720730ed9d399088409f0 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 524f0ae8cfd28a6dd72a2b2d3d55ed4de11a26a8ca2bf8d311220b52f0404d77 all runs: OK false negative chance: 0.000 # git bisect bad eba41c0173c8c27702b720730ed9d399088409f0 Bisecting: 48 revisions left to test after this (roughly 6 steps) [9976831f401eeb302d699b2d37624153d7cd2892] Merge tag 'gpio-fixes-for-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux determine whether the revision contains the guilty commit revision ffc253263a1375a65fa6c9f62a893e9767fbebfa crashed and is reachable testing commit 9976831f401eeb302d699b2d37624153d7cd2892 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 2544cfde30dba9db1ff2b4c16ca995f882f846b280a03f902a8c69f58619bc0c all runs: OK false negative chance: 0.000 # git bisect bad 9976831f401eeb302d699b2d37624153d7cd2892 Bisecting: 23 revisions left to test after this (roughly 5 steps) [0ae452440cb9fee9079dc925f40cd824c1a9de2a] Merge tag 'v6.18-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 determine whether the revision contains the guilty commit revision b707512b8b07396f8982103a84285a165a1bd94c crashed and is reachable testing commit 0ae452440cb9fee9079dc925f40cd824c1a9de2a gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: b7afaf2407e3ae9667a765e1cc5876c60c6800d03efae6ffc81f58dde8048137 all runs: OK false negative chance: 0.000 # git bisect bad 0ae452440cb9fee9079dc925f40cd824c1a9de2a Bisecting: 15 revisions left to test after this (roughly 4 steps) [80b7065ec19485943fa00d60f27b447c3f17069c] Merge tag '9p-for-6.18-rc1' of https://github.com/martinetd/linux determine whether the revision contains the guilty commit revision ffc253263a1375a65fa6c9f62a893e9767fbebfa crashed and is reachable testing commit 80b7065ec19485943fa00d60f27b447c3f17069c gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 77d117ccb4ee04266b6b2e2721e6948c9cf2429c49660154b098f1612360125d all runs: OK false negative chance: 0.000 # git bisect bad 80b7065ec19485943fa00d60f27b447c3f17069c Bisecting: 4 revisions left to test after this (roughly 2 steps) [674b56aa57f9379854cb6798c3bbcef7e7b51ab7] net/9p: fix double req put in p9_fd_cancelled determine whether the revision contains the guilty commit revision 3349e275067f94ffb4141989aed9cbae7409429b crashed and is reachable testing commit 674b56aa57f9379854cb6798c3bbcef7e7b51ab7 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 4ad9e68c1b88aa03f7dafec9ad1d7bb019706fba3a2524fe48b878c3077918af all runs: crashed: INFO: task hung in __iterate_supers representative crash: INFO: task hung in __iterate_supers, types: [HANG] # git bisect good 674b56aa57f9379854cb6798c3bbcef7e7b51ab7 Bisecting: 2 revisions left to test after this (roughly 1 step) [623fa18f6c94e589b29c4e6277943364f1bb71d6] 9p: clean up comment typos determine whether the revision contains the guilty commit revision ffc253263a1375a65fa6c9f62a893e9767fbebfa crashed and is reachable testing commit 623fa18f6c94e589b29c4e6277943364f1bb71d6 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: fb538834b0976b53bca699c4156e3cbe06887bc24f5afc7f0de13f9f59e12320 all runs: OK false negative chance: 0.000 # git bisect bad 623fa18f6c94e589b29c4e6277943364f1bb71d6 Bisecting: 0 revisions left to test after this (roughly 0 steps) [e8fe3f07a357c39d429e02ca34f740692d88967a] 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN determine whether the revision contains the guilty commit revision ffc253263a1375a65fa6c9f62a893e9767fbebfa crashed and is reachable testing commit e8fe3f07a357c39d429e02ca34f740692d88967a gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 59034705ad3440fb4e2bcd386219d1bd5506f1557793974766b9cd61629dbd4e all runs: OK false negative chance: 0.000 # git bisect bad e8fe3f07a357c39d429e02ca34f740692d88967a e8fe3f07a357c39d429e02ca34f740692d88967a is the first bad commit commit e8fe3f07a357c39d429e02ca34f740692d88967a Author: Oleg Nesterov Date: Tue Aug 19 18:10:13 2025 +0200 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN p9_read_work() doesn't set Rworksched and doesn't do schedule_work(m->rq) if list_empty(&m->req_list). However, if the pipe is full, we need to read more data and this used to work prior to commit aaec5a95d59615 ("pipe_read: don't wake up the writer if the pipe is still full"). p9_read_work() does p9_fd_read() -> ... -> anon_pipe_read() which (before the commit above) triggered the unnecessary wakeup. This wakeup calls p9_pollwake() which kicks p9_poll_workfn() -> p9_poll_mux(), p9_poll_mux() will notice EPOLLIN and schedule_work(&m->rq). This no longer happens after the optimization above, change p9_fd_request() to use p9_poll_mux() instead of only checking for EPOLLOUT. Reported-by: syzbot+d1b5dace43896bc386c3@syzkaller.appspotmail.com Tested-by: syzbot+d1b5dace43896bc386c3@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68a2de8f.050a0220.e29e5.0097.GAE@google.com/ Link: https://lore.kernel.org/all/67dedd2f.050a0220.31a16b.003f.GAE@google.com/ Co-developed-by: K Prateek Nayak Signed-off-by: K Prateek Nayak Signed-off-by: Oleg Nesterov Tested-by: K Prateek Nayak Message-ID: <20250819161013.GB11345@redhat.com> Signed-off-by: Dominique Martinet net/9p/trans_fd.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) accumulated error probability: 0.00 culprit signature: 59034705ad3440fb4e2bcd386219d1bd5506f1557793974766b9cd61629dbd4e parent signature: 4ad9e68c1b88aa03f7dafec9ad1d7bb019706fba3a2524fe48b878c3077918af revisions tested: 26, total time: 7h54m39.887047179s (build: 3h12m22.397444259s, test: 4h14m10.994620177s) first good commit: e8fe3f07a357c39d429e02ca34f740692d88967a 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN recipients (to): ["asmadeus@codewreck.org" "kprateek.nayak@amd.com" "oleg@redhat.com" "syzbot+d1b5dace43896bc386c3@syzkaller.appspotmail.com"] recipients (cc): []