ci2 starts bisection 2026-01-20 01:22:24.171719 +0000 UTC m=+14109.019630787 bisecting fixing commit since 462bdb2cb1b1128240c73573ea233571dc856dc7 building syzkaller on 0ac7291ca51f87df8022da0f66178546e855701a ensuring issue is reproducible on original commit 462bdb2cb1b1128240c73573ea233571dc856dc7 testing commit 462bdb2cb1b1128240c73573ea233571dc856dc7 gcc compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 kernel signature: 026d1fadf3feaea93223bbd30d0e0b89812688c93cb851f23e1fc18bebfeaaa5 all runs: crashed: general protection fault in bpf_get_local_storage representative crash: general protection fault in bpf_get_local_storage, types: [DoS] check whether we can drop unnecessary instrumentation disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep hang], they are not needed testing commit 462bdb2cb1b1128240c73573ea233571dc856dc7 gcc compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 kernel signature: f992d111047994c8f8309474375db253955cf80535462b1877cd7cc719e18653 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in bpf_get_local_storage representative crash: BUG: unable to handle kernel NULL pointer dereference in bpf_get_local_storage, types: [NULL-POINTER-DEREFERENCE] the bug reproduces without the instrumentation disabling configs for [ubsan bug_or_warning kasan locking atomic_sleep hang memleak], they are not needed kconfig minimization: base=5186 full=6556 leaves diff=265 split chunks (needed=false): <265> split chunk #0 of len 265 into 5 parts testing without sub-chunk 1/5 disabling configs for [bug_or_warning kasan locking atomic_sleep hang memleak ubsan], they are not needed testing commit 462bdb2cb1b1128240c73573ea233571dc856dc7 gcc compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 kernel signature: e4d9adb2d695f5fc300b1e441aaa34a807d27db2dcde4b58f7c7199acb63665f all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in bpf_get_local_storage representative crash: BUG: unable to handle kernel NULL pointer dereference in bpf_get_local_storage, types: [NULL-POINTER-DEREFERENCE] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep hang], they are not needed testing commit 462bdb2cb1b1128240c73573ea233571dc856dc7 gcc compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 kernel signature: 46ec35ba147b7b7b12d27b81fe0ba330755a88a05cf023ac0dcb7a21d0f5f174 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in bpf_get_local_storage representative crash: BUG: unable to handle kernel NULL pointer dereference in bpf_get_local_storage, types: [NULL-POINTER-DEREFERENCE] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep hang], they are not needed testing commit 462bdb2cb1b1128240c73573ea233571dc856dc7 gcc compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 kernel signature: 9f8217aaf9dd6f7bb796d220cf32e0a5e82b8ee3d69d331b87f417feb3969d8c all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in bpf_get_local_storage representative crash: BUG: unable to handle kernel NULL pointer dereference in bpf_get_local_storage, types: [NULL-POINTER-DEREFERENCE] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep hang], they are not needed testing commit 462bdb2cb1b1128240c73573ea233571dc856dc7 gcc compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 kernel signature: d4653b909eb9b4c56649c3ab1b0d3d03ca01ad6f067a64b0d5f1b62fafa76e44 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in bpf_get_local_storage representative crash: BUG: unable to handle kernel NULL pointer dereference in bpf_get_local_storage, types: [NULL-POINTER-DEREFERENCE] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [hang memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed testing commit 462bdb2cb1b1128240c73573ea233571dc856dc7 gcc compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 failed building 462bdb2cb1b1128240c73573ea233571dc856dc7: ld.lld: error: undefined symbol: wext_proc_init ld.lld: error: undefined symbol: wext_proc_exit ld.lld: error: undefined symbol: wext_handle_ioctl ld.lld: error: undefined symbol: compat_wext_handle_ioctl minimized to 53 configs; suspects: [HID_ZEROPLUS USB_MON USB_NET_CDC_MBIM USB_NET_CDC_SUBSET USB_NET_CDC_SUBSET_ENABLE USB_NET_DM9601 USB_NET_GL620A USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM V4L2_ASYNC V4L2_FWNODE VIDEO_CAMERA_SENSOR WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_PURELIFI WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_SILABS WLAN_VENDOR_ZYDAS ZEROPLUS_FF] disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep hang], they are not needed testing current HEAD 37a76cbe8f87054f1981bb5310d7984add28bf7e testing commit 37a76cbe8f87054f1981bb5310d7984add28bf7e gcc compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 kernel signature: 41ae06594e64acacdae1b1055caffbef1f2d916414f8e4002b5cd2cef5bcadb3 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in bpf_get_local_storage representative crash: BUG: unable to handle kernel NULL pointer dereference in bpf_get_local_storage, types: [NULL-POINTER-DEREFERENCE] crash still not fixed/happens on the oldest tested release revisions tested: 7, total time: 1h47m42.529894398s (build: 1h5m5.52239196s, test: 37m52.445646337s) crash still not fixed or there were kernel test errors commit msg: ANDROID: GKI: Update symbol list for bcmstb crash: BUG: unable to handle kernel NULL pointer dereference in bpf_get_local_storage BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 10c75f067 P4D 10c75f067 PUD 112e38067 PMD 0 Oops: 0000 [#1] PREEMPT SMP CPU: 0 PID: 381 Comm: syz-execprog Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:____bpf_get_local_storage kernel/bpf/cgroup.c:1575 [inline] RIP: 0010:bpf_get_local_storage+0x27/0x50 kernel/bpf/cgroup.c:1557 Code: 09 47 9e 65 48 8b 05 b8 cb cd 7e 31 c9 83 7f 18 15 0f 94 c1 48 8b 80 c0 0b 00 00 48 8b 00 48 8b 44 c8 08 75 1f 55 48 89 e5 53 <48> 8b 18 e8 21 ec d6 00 89 c1 48 89 d8 89 c9 48 03 04 cd a0 a9 07 RSP: 0018:ffffc90000003b10 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8881115d58f8 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888111a2a600 RBP: ffffc90000003b18 R08: 00000000ffffefbf R09: 00000000dd697791 R10: ffff888108d80000 R11: 000000000000010c R12: ffff888112eea600 R13: ffff888113616c28 R14: 0000000000000014 R15: ffffc90003883000 FS: 000000c000126098(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000001135cd000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: bpf_prog_3647604f6c8667e9+0x25/0x38 bpf_dispatcher_nop_func include/linux/bpf.h:987 [inline] __bpf_prog_run include/linux/filter.h:603 [inline] bpf_prog_run include/linux/filter.h:610 [inline] __bpf_prog_run_save_cb include/linux/filter.h:733 [inline] bpf_prog_run_array_cg kernel/bpf/cgroup.c:68 [inline] __cgroup_bpf_run_filter_skb+0x317/0x500 kernel/bpf/cgroup.c:1427 sk_filter_trim_cap+0x1cc/0x260 net/core/filter.c:141 tcp_filter net/ipv4/tcp_ipv4.c:1911 [inline] tcp_v4_rcv+0x703/0xa80 net/ipv4/tcp_ipv4.c:2093 ip_protocol_deliver_rcu+0xb9/0x1b0 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x73/0xb0 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:305 [inline] ip_local_deliver+0x67/0x100 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:463 [inline] ip_rcv_finish net/ipv4/ip_input.c:449 [inline] NF_HOOK include/linux/netfilter.h:305 [inline] ip_rcv+0x77/0x100 net/ipv4/ip_input.c:569 __netif_receive_skb_one_core net/core/dev.c:5597 [inline] __netif_receive_skb+0x64/0x110 net/core/dev.c:5711 process_backlog+0xdb/0x190 net/core/dev.c:6039 __napi_poll+0x3c/0x1e0 net/core/dev.c:6606 napi_poll net/core/dev.c:6673 [inline] net_rx_action+0x145/0x2a0 net/core/dev.c:6787 handle_softirqs+0x12c/0x330 kernel/softirq.c:642 __do_softirq+0xb/0xd kernel/softirq.c:680 do_softirq+0x81/0xc0 kernel/softirq.c:524 __local_bh_enable_ip+0x63/0x70 kernel/softirq.c:448 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:870 [inline] __dev_queue_xmit+0x5db/0xdd0 net/core/dev.c:4384 dev_queue_xmit include/linux/netdevice.h:3085 [inline] neigh_hh_output include/net/neighbour.h:536 [inline] neigh_output include/net/neighbour.h:550 [inline] ip_finish_output2+0x2f7/0x340 net/ipv4/ip_output.c:228 __ip_finish_output+0x151/0x220 net/ipv4/ip_output.c:-1 ip_finish_output+0x12/0xd0 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:294 [inline] ip_output+0x5b/0x110 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:453 [inline] ip_local_out net/ipv4/ip_output.c:126 [inline] __ip_queue_xmit+0x443/0x460 net/ipv4/ip_output.c:532 ip_queue_xmit+0x10/0x20 net/ipv4/ip_output.c:546 __tcp_transmit_skb+0x743/0xb30 net/ipv4/tcp_output.c:1406 tcp_transmit_skb net/ipv4/tcp_output.c:1424 [inline] tcp_write_xmit+0x71b/0x1070 net/ipv4/tcp_output.c:2721 __tcp_push_pending_frames+0x31/0xc0 net/ipv4/tcp_output.c:2906 tcp_push+0xfc/0x100 net/ipv4/tcp.c:734 tcp_sendmsg_locked+0xb9d/0xdc0 net/ipv4/tcp.c:1460 tcp_sendmsg+0x27/0x40 net/ipv4/tcp.c:1488 inet6_sendmsg+0x41/0x50 net/ipv6/af_inet6.c:673 sock_sendmsg_nosec net/socket.c:716 [inline] __sock_sendmsg net/socket.c:728 [inline] sock_write_iter+0xfb/0x150 net/socket.c:1133 call_write_iter include/linux/fs.h:2282 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x346/0x430 fs/read_write.c:584 ksys_write+0x70/0xf0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x16/0x20 fs/read_write.c:646 x64_sys_call+0x27b/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x40dd0e Code: 24 28 44 8b 44 24 2c e9 70 ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 89 f2 48 89 fa 48 89 ce 48 89 df 0f 05 <48> 3d 01 f0 ff ff 76 15 48 f7 d8 48 89 c1 48 c7 c0 ff ff ff ff 48 RSP: 002b:000000c004e033e8 EFLAGS: 00000206 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000040dd0e RDX: 0000000000000698 RSI: 000000c0069783e8 RDI: 0000000000000006 RBP: 000000c004e03428 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 000000c004e03558 R13: 0000000000000406 R14: 000000c0011776c0 R15: 000000c006978000 Modules linked in: CR2: 0000000000000000 ---[ end trace 0000000000000000 ]--- RIP: 0010:____bpf_get_local_storage kernel/bpf/cgroup.c:1575 [inline] RIP: 0010:bpf_get_local_storage+0x27/0x50 kernel/bpf/cgroup.c:1557 Code: 09 47 9e 65 48 8b 05 b8 cb cd 7e 31 c9 83 7f 18 15 0f 94 c1 48 8b 80 c0 0b 00 00 48 8b 00 48 8b 44 c8 08 75 1f 55 48 89 e5 53 <48> 8b 18 e8 21 ec d6 00 89 c1 48 89 d8 89 c9 48 03 04 cd a0 a9 07 RSP: 0018:ffffc90000003b10 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8881115d58f8 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888111a2a600 RBP: ffffc90000003b18 R08: 00000000ffffefbf R09: 00000000dd697791 R10: ffff888108d80000 R11: 000000000000010c R12: ffff888112eea600 R13: ffff888113616c28 R14: 0000000000000014 R15: ffffc90003883000 FS: 000000c000126098(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000001135cd000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 09 47 9e or %eax,-0x62(%rdi) 3: 65 48 8b 05 b8 cb cd mov %gs:0x7ecdcbb8(%rip),%rax # 0x7ecdcbc3 a: 7e b: 31 c9 xor %ecx,%ecx d: 83 7f 18 15 cmpl $0x15,0x18(%rdi) 11: 0f 94 c1 sete %cl 14: 48 8b 80 c0 0b 00 00 mov 0xbc0(%rax),%rax 1b: 48 8b 00 mov (%rax),%rax 1e: 48 8b 44 c8 08 mov 0x8(%rax,%rcx,8),%rax 23: 75 1f jne 0x44 25: 55 push %rbp 26: 48 89 e5 mov %rsp,%rbp 29: 53 push %rbx * 2a: 48 8b 18 mov (%rax),%rbx <-- trapping instruction 2d: e8 21 ec d6 00 call 0xd6ec53 32: 89 c1 mov %eax,%ecx 34: 48 89 d8 mov %rbx,%rax 37: 89 c9 mov %ecx,%ecx 39: 48 rex.W 3a: 03 .byte 0x3 3b: 04 cd add $0xcd,%al 3d: a0 .byte 0xa0 3e: a9 .byte 0xa9 3f: 07 (bad)