ci2 starts bisection 2023-12-26 04:29:37.398570876 +0000 UTC m=+304780.722456447
bisecting fixing commit since 61cfd264993d07540f60a5c53d77a14c818e54a9
building syzkaller on c4ac074caa7ae68aef44c619a09b02832cc91f35
ensuring issue is reproducible on original commit 61cfd264993d07540f60a5c53d77a14c818e54a9

testing commit 61cfd264993d07540f60a5c53d77a14c818e54a9 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 61be419b307929e3cd7f045bd688e3de983e976ea62f4dd42eef8b4f065a55d7
run #0: crashed: BUG: corrupted list in p9_fd_cancelled
run #1: crashed: BUG: corrupted list in p9_fd_cancelled
run #2: crashed: BUG: corrupted list in p9_fd_cancelled
run #3: crashed: general protection fault in p9_conn_cancel
run #4: crashed: BUG: corrupted list in p9_fd_cancelled
run #5: crashed: BUG: corrupted list in p9_fd_cancelled
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: crashed: BUG: corrupted list in p9_fd_cancelled
run #17: OK
run #18: OK
run #19: OK
representative crash: BUG: corrupted list in p9_fd_cancelled, types: [BUG]
check whether we can drop unnecessary instrumentation
disabling configs for [HANG LEAK UBSAN KASAN LOCKDEP ATOMIC_SLEEP], they are not needed
testing commit 61cfd264993d07540f60a5c53d77a14c818e54a9 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 2f617551444bc343dc723fa4edd70bc2d995b8ae54d911a016226669adc62618
all runs: OK
false negative chance: 0.000
kconfig minimization: base=4920 full=6161 leaves diff=243
split chunks (needed=false): <243>
split chunk #0 of len 243 into 5 parts
testing without sub-chunk 1/5
testing commit 61cfd264993d07540f60a5c53d77a14c818e54a9 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: a8b9125e7f3eb5f4a8f366738aef6f76ea22283db784ca555378c190f9e7b1d2
run #0: crashed: BUG: corrupted list in p9_fd_cancelled
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: crashed: BUG: corrupted list in p9_fd_cancelled
run #17: OK
run #18: OK
run #19: OK
representative crash: BUG: corrupted list in p9_fd_cancelled, types: [BUG]
testing without sub-chunk 2/5
testing commit 61cfd264993d07540f60a5c53d77a14c818e54a9 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 7364aa0dfe82401ef92631124016b382de8d8f3081f88e27316c76aea030fe18
run #0: crashed: BUG: corrupted list in p9_fd_cancelled
run #1: crashed: BUG: corrupted list in p9_fd_cancelled
run #2: crashed: BUG: corrupted list in p9_fd_cancelled
run #3: crashed: BUG: corrupted list in p9_fd_cancelled
run #4: crashed: BUG: corrupted list in p9_fd_cancelled
run #5: crashed: BUG: corrupted list in p9_fd_cancelled
run #6: crashed: BUG: corrupted list in p9_fd_cancelled
run #7: OK
run #8: OK
run #9: crashed: BUG: corrupted list in p9_fd_cancelled
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: BUG: corrupted list in p9_fd_cancelled, types: [BUG]
the chunk can be dropped
testing without sub-chunk 3/5
testing commit 61cfd264993d07540f60a5c53d77a14c818e54a9 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 38c1ba36d7a61d2eec16e46be4cff9cb4e6b544f3d90c8388249239a7f07022d
run #0: crashed: BUG: corrupted list in p9_fd_cancelled
run #1: crashed: BUG: corrupted list in p9_fd_cancelled
run #2: crashed: BUG: corrupted list in p9_fd_cancelled
run #3: crashed: BUG: corrupted list in p9_fd_cancelled
run #4: crashed: BUG: corrupted list in p9_fd_cancelled
run #5: crashed: BUG: corrupted list in p9_fd_cancelled
run #6: crashed: BUG: corrupted list in p9_fd_cancelled
run #7: OK
run #8: OK
run #9: OK
run #10: crashed: BUG: corrupted list in p9_fd_cancelled
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: BUG: corrupted list in p9_fd_cancelled, types: [BUG]
the chunk can be dropped
testing without sub-chunk 4/5
testing commit 61cfd264993d07540f60a5c53d77a14c818e54a9 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 94a983f748f7075417cc6bc57ff9b899acef002bfac99bbd2bf75ac79b75db99
run #0: crashed: BUG: corrupted list in p9_fd_cancelled
run #1: crashed: BUG: corrupted list in p9_fd_cancelled
run #2: crashed: BUG: corrupted list in p9_fd_cancelled
run #3: crashed: BUG: corrupted list in p9_fd_cancelled
run #4: crashed: BUG: corrupted list in p9_fd_cancelled
run #5: crashed: BUG: corrupted list in p9_fd_cancelled
run #6: crashed: BUG: corrupted list in p9_fd_cancelled
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: crashed: BUG: corrupted list in p9_fd_cancelled
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: BUG: corrupted list in p9_fd_cancelled, types: [BUG]
the chunk can be dropped
testing without sub-chunk 5/5
testing commit 61cfd264993d07540f60a5c53d77a14c818e54a9 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 3be078a04a0d4d2f321959a981ea1a451c28abf565793a6e7d703925fdb3e0b1
run #0: crashed: BUG: corrupted list in p9_fd_cancelled
run #1: crashed: BUG: corrupted list in p9_fd_cancelled
run #2: crashed: BUG: corrupted list in p9_fd_cancelled
run #3: crashed: BUG: corrupted list in p9_fd_cancelled
run #4: crashed: BUG: corrupted list in p9_fd_cancelled
run #5: crashed: BUG: corrupted list in p9_fd_cancelled
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: BUG: corrupted list in p9_fd_cancelled, types: [BUG]
minimized to 96 configs; suspects: [ARCH_HAS_CPU_FINALIZE_INIT BLK_DEV_INITRD CFG80211 CFG80211_REQUIRE_SIGNED_REGDB CFG80211_USE_KERNEL_REGDB_KEYS DEBUG_INFO_BTF DEBUG_INFO_BTF_MODULES DRAGONRISE_FF DRM DRM_BRIDGE DRM_GEM_SHMEM_HELPER DRM_KMS_HELPER DRM_PANEL DRM_PANEL_BRIDGE DRM_PANEL_ORIENTATION_QUIRKS DRM_TTM DRM_VIRTIO_GPU DUMMY_CONSOLE DVB_CORE FB FB_CMDLINE FB_DEFERRED_IO FB_NOTIFY FB_SYS_COPYAREA FB_SYS_FILLRECT FB_SYS_FOPS FB_SYS_IMAGEBLIT GPIOLIB_IRQCHIP GREENASIA_FF HDMI HID_A4TECH HID_ACRUX HID_ACRUX_FF HID_APPLEIR HID_AUREAL HID_BELKIN HID_BETOP_FF HID_CHERRY HID_CHICONY HID_CP2112 HID_CYPRESS HID_DRAGONRISE HID_ELO HID_EMS_FF HID_EZKEY HID_GREENASIA HID_GT683R HID_GYRATION HID_ICADE HID_ITE HID_KENSINGTON HID_KEYTOUCH HID_KYE HID_LCPOWER HID_LED HID_LENOVO HID_MONTEREY HID_NTI HID_ZEROPLUS MEDIA_DIGITAL_TV_SUPPORT PAHOLE_HAS_SPLIT_BTF RFKILL USB_NET_DM9601 USB_NET_GL620A USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL USB_SERIAL_FTDI_SIO USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM VT WIRELESS WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_ZYDAS X86_X32 ZEROPLUS_FF]
testing current HEAD 28e3f5851a993d680ac5a14fd70cce739e78375d
testing commit 28e3f5851a993d680ac5a14fd70cce739e78375d gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: fa0857343cddaed9b9b0ce0a198a2c36daae342a439a20ca4b403d3852de4dcb
run #0: crashed: BUG: corrupted list in p9_fd_cancelled
run #1: crashed: BUG: corrupted list in p9_fd_cancelled
run #2: crashed: BUG: corrupted list in p9_fd_cancelled
run #3: crashed: BUG: corrupted list in p9_fd_cancelled
run #4: crashed: BUG: corrupted list in p9_fd_cancelled
run #5: crashed: BUG: corrupted list in p9_fd_cancelled
run #6: crashed: BUG: corrupted list in p9_fd_cancelled
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: crashed: BUG: corrupted list in p9_fd_cancelled
run #19: OK
representative crash: BUG: corrupted list in p9_fd_cancelled, types: [BUG]
crash still not fixed/happens on the oldest tested release
reproducer is flaky (0.40 repro chance estimate)
revisions tested: 8, total time: 1h41m50.684439768s (build: 17m37.546921831s, test: 1h22m8.853356141s)
crash still not fixed or there were kernel test errors
commit msg: Revert "HID: core: store the unique system identifier in hid_device"
crash: BUG: corrupted list in p9_fd_cancelled
list_del corruption, ffff888124d76910->next is LIST_POISON1 (dead000000000100)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:53!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 1455 Comm: syz-executor.5 Not tainted 5.15.141-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
RIP: 0010:__list_del_entry_valid.cold+0x59/0x6c lib/list_debug.c:53
Code: e8 25 37 fc ff 0f 0b 4c 89 e6 48 c7 c7 a0 3a e4 84 e8 14 37 fc ff 0f 0b 4c 89 f2 4c 89 e6 48 c7 c7 60 3b e4 84 e8 00 37 fc ff <0f> 0b 4c 89 e6 48 c7 c7 80 3c e4 84 e8 ef 36 fc ff 0f 0b 48 63 d1
RSP: 0018:ffffc90003c876c8 EFLAGS: 00010282
RAX: 000000000000004e RBX: ffff888124d76918 RCX: 0000000000000000
RDX: 0000000000000002 RSI: ffffffff84e43740 RDI: fffff52000790ecc
RBP: ffffc90003c876e0 R08: 000000000000004e R09: ffff8881f72330c7
R10: ffffed103ee46618 R11: 6c65645f7473696c R12: ffff888124d76910
R13: dead000000000122 R14: dead000000000100 R15: ffff888124d76910
FS:  00007fde2c4756c0(0000) GS:ffff8881f7200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555556436818 CR3: 000000010d628000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __list_del_entry include/linux/list.h:132 [inline]
 list_del include/linux/list.h:146 [inline]
 p9_fd_cancelled+0x87/0x260 net/9p/trans_fd.c:736
 p9_client_flush+0x344/0x520 net/9p/client.c:679
 p9_client_rpc+0xbc2/0xd60 net/9p/client.c:786
 p9_client_version net/9p/client.c:954 [inline]
 p9_client_create+0x966/0x10a0 net/9p/client.c:1054
 v9fs_session_init+0x1d7/0x13b0 fs/9p/v9fs.c:409
 v9fs_mount+0x72/0x810 fs/9p/vfs_super.c:126
 legacy_get_tree+0xf5/0x1d0 fs/fs_context.c:611
 vfs_get_tree+0x7f/0x2b0 fs/super.c:1517
 do_new_mount fs/namespace.c:2994 [inline]
 path_mount+0x475/0x1d70 fs/namespace.c:3324
 do_mount fs/namespace.c:3337 [inline]
 __do_sys_mount fs/namespace.c:3545 [inline]
 __se_sys_mount fs/namespace.c:3522 [inline]
 __x64_sys_mount+0x20e/0x280 fs/namespace.c:3522
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7fde2c913ae9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fde2c4750c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fde2ca33050 RCX: 00007fde2c913ae9
RDX: 00000000200001c0 RSI: 0000000020000040 RDI: 0000000000000000
RBP: 00007fde2c95f47a R08: 0000000020000300 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000006e R14: 00007fde2ca33050 R15: 00007ffea5618ee8
 </TASK>
Modules linked in:
---[ end trace e7aaadb9835db543 ]---
RIP: 0010:__list_del_entry_valid.cold+0x59/0x6c lib/list_debug.c:53
Code: e8 25 37 fc ff 0f 0b 4c 89 e6 48 c7 c7 a0 3a e4 84 e8 14 37 fc ff 0f 0b 4c 89 f2 4c 89 e6 48 c7 c7 60 3b e4 84 e8 00 37 fc ff <0f> 0b 4c 89 e6 48 c7 c7 80 3c e4 84 e8 ef 36 fc ff 0f 0b 48 63 d1
RSP: 0018:ffffc90003c876c8 EFLAGS: 00010282
RAX: 000000000000004e RBX: ffff888124d76918 RCX: 0000000000000000
RDX: 0000000000000002 RSI: ffffffff84e43740 RDI: fffff52000790ecc
RBP: ffffc90003c876e0 R08: 000000000000004e R09: ffff8881f72330c7
R10: ffffed103ee46618 R11: 6c65645f7473696c R12: ffff888124d76910
R13: dead000000000122 R14: dead000000000100 R15: ffff888124d76910
FS:  00007fde2c4756c0(0000) GS:ffff8881f7200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555556436818 CR3: 000000010d628000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400