ci2 starts bisection 2026-01-21 19:26:03.43317094 +0000 UTC m=+11316.043380436
bisecting fixing commit since 094fc3778d6b9c795d8075cf20171fe70ace5af2
building syzkaller on c799dfdd5648677612604d10e2c13075eda21582
ensuring issue is reproducible on original commit 094fc3778d6b9c795d8075cf20171fe70ace5af2

testing commit 094fc3778d6b9c795d8075cf20171fe70ace5af2 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44
kernel signature: 73412fea1f6b3edcbe4fa90784dd6c1a8b18c3d0371ca16bb617f0fdb8352c54
all runs: crashed: KASAN: null-ptr-deref Write in f2fs_stop_gc_thread
representative crash: KASAN: null-ptr-deref Write in f2fs_stop_gc_thread, types: [KASAN-NULL-POINTER-DEREFERENCE-WRITE]
check whether we can drop unnecessary instrumentation
disabling configs for [locking atomic_sleep hang memleak ubsan bug_or_warning], they are not needed
testing commit 094fc3778d6b9c795d8075cf20171fe70ace5af2 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44
kernel signature: e16567ae960861c058b29463c477ef81ee600248324f7e66c379480b98ba5d6e
all runs: crashed: KASAN: null-ptr-deref Write in f2fs_stop_gc_thread
representative crash: KASAN: null-ptr-deref Write in f2fs_stop_gc_thread, types: [KASAN-NULL-POINTER-DEREFERENCE-WRITE]
the bug reproduces without the instrumentation
disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed
kconfig minimization: base=4788 full=6023 leaves diff=246
split chunks (needed=false): <246>
split chunk #0 of len 246 into 5 parts
testing without sub-chunk 1/5
disabling configs for [locking atomic_sleep hang memleak ubsan bug_or_warning], they are not needed
testing commit 094fc3778d6b9c795d8075cf20171fe70ace5af2 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44
kernel signature: 2f2ca2cdacc8fbcb414ea4912cb4f3bd2042bb14c60661365b7567cc9b7bbd93
all runs: crashed: KASAN: null-ptr-deref Write in f2fs_stop_gc_thread
representative crash: KASAN: null-ptr-deref Write in f2fs_stop_gc_thread, types: [KASAN-NULL-POINTER-DEREFERENCE-WRITE]
the chunk can be dropped
testing without sub-chunk 2/5
disabling configs for [atomic_sleep hang memleak ubsan bug_or_warning locking], they are not needed
testing commit 094fc3778d6b9c795d8075cf20171fe70ace5af2 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44
kernel signature: 667cb21abedf7c41404e0c5e8e5977427c9aa27e122c7fcc2cb34b55d69a8c2a
all runs: crashed: KASAN: null-ptr-deref Write in f2fs_stop_gc_thread
representative crash: KASAN: null-ptr-deref Write in f2fs_stop_gc_thread, types: [KASAN-NULL-POINTER-DEREFERENCE-WRITE]
the chunk can be dropped
testing without sub-chunk 3/5
disabling configs for [memleak ubsan bug_or_warning locking atomic_sleep hang], they are not needed
testing commit 094fc3778d6b9c795d8075cf20171fe70ace5af2 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44
kernel signature: 081f17641e68ed8507997911103acec8afcffdf19af58dda58304a4c3eb5dc3e
all runs: crashed: KASAN: null-ptr-deref Write in f2fs_stop_gc_thread
representative crash: KASAN: null-ptr-deref Write in f2fs_stop_gc_thread, types: [KASAN-NULL-POINTER-DEREFERENCE-WRITE]
the chunk can be dropped
testing without sub-chunk 4/5
disabling configs for [locking atomic_sleep hang memleak ubsan bug_or_warning], they are not needed
testing commit 094fc3778d6b9c795d8075cf20171fe70ace5af2 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44
kernel signature: 80f05bb4c09fb8aaaf6d339a34dfc2cbdfd7aaaa487a0afcdc5701b0b3387d5f
all runs: crashed: KASAN: null-ptr-deref Write in f2fs_stop_gc_thread
representative crash: KASAN: null-ptr-deref Write in f2fs_stop_gc_thread, types: [KASAN-NULL-POINTER-DEREFERENCE-WRITE]
the chunk can be dropped
testing without sub-chunk 5/5
disabling configs for [locking atomic_sleep hang memleak ubsan bug_or_warning], they are not needed
testing commit 094fc3778d6b9c795d8075cf20171fe70ace5af2 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44
failed building 094fc3778d6b9c795d8075cf20171fe70ace5af2: net/socket.c:1128:(.text+0x1307): undefined reference to `wext_handle_ioctl'
net/socket.c:3397:(.text+0x17c7): undefined reference to `compat_wext_handle_ioctl'
net/core/net-procfs.c:346:(.text+0x33b): undefined reference to `wext_proc_exit'
net/core/net-procfs.c:330:(.text+0x4e2): undefined reference to `wext_proc_init'
minimized to 46 configs; suspects: [HID_ZEROPLUS USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL USB_SERIAL_FTDI_SIO USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM USB_XHCI_PCI_RENESAS WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_ZYDAS X86_X32 ZEROPLUS_FF]
disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed
testing current HEAD c74681d01ab2a662d10dbe33da37f95f410a8d2e
testing commit c74681d01ab2a662d10dbe33da37f95f410a8d2e gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44
kernel signature: 29879da1c84428a426a0c2da7d43df5dc65794b61ce30ffc5261bad54b23ad6a
all runs: crashed: KASAN: null-ptr-deref Write in f2fs_stop_gc_thread
representative crash: KASAN: null-ptr-deref Write in f2fs_stop_gc_thread, types: [KASAN-NULL-POINTER-DEREFERENCE-WRITE]
crash still not fixed/happens on the oldest tested release
revisions tested: 7, total time: 1h20m6.943087447s (build: 22m30.906900675s, test: 55m48.556809938s)
crash still not fixed or there were kernel test errors
commit msg: ANDROID: GKI: fix crc build error in blk-mq.c
crash: KASAN: null-ptr-deref Write in f2fs_stop_gc_thread
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: null-ptr-deref in atomic_fetch_add_relaxed include/asm-generic/atomic-instrumented.h:142 [inline]
BUG: KASAN: null-ptr-deref in __refcount_add include/linux/refcount.h:193 [inline]
BUG: KASAN: null-ptr-deref in __refcount_inc include/linux/refcount.h:250 [inline]
BUG: KASAN: null-ptr-deref in refcount_inc include/linux/refcount.h:267 [inline]
BUG: KASAN: null-ptr-deref in get_task_struct include/linux/sched/task.h:108 [inline]
BUG: KASAN: null-ptr-deref in kthread_stop+0x25/0x2e0 kernel/kthread.c:640
Write of size 4 at addr 0000000000000020 by task syz.1.33/676

CPU: 1 PID: 676 Comm: syz.1.33 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack_lvl+0x81/0xac lib/dump_stack.c:118
 __kasan_report mm/kasan/report.c:439 [inline]
 kasan_report.cold+0x64/0xdb mm/kasan/report.c:452
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0x148/0x190 mm/kasan/generic.c:189
 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 atomic_fetch_add_relaxed include/asm-generic/atomic-instrumented.h:142 [inline]
 __refcount_add include/linux/refcount.h:193 [inline]
 __refcount_inc include/linux/refcount.h:250 [inline]
 refcount_inc include/linux/refcount.h:267 [inline]
 get_task_struct include/linux/sched/task.h:108 [inline]
 kthread_stop+0x25/0x2e0 kernel/kthread.c:640
 f2fs_stop_gc_thread+0x56/0xc0 fs/f2fs/gc.c:199
 f2fs_ioc_shutdown+0x2b5/0x680 fs/f2fs/file.c:2414
 __f2fs_ioctl+0x2094/0x9070 fs/f2fs/file.c:4383
 f2fs_ioctl+0x162/0x4c0 fs/f2fs/file.c:4468
 vfs_ioctl fs/ioctl.c:48 [inline]
 __do_sys_ioctl fs/ioctl.c:753 [inline]
 __se_sys_ioctl fs/ioctl.c:739 [inline]
 __x64_sys_ioctl+0x129/0x1a0 fs/ioctl.c:739
 do_syscall_64+0x32/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f46943db8f9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f4693e22028 EFLAGS: 00000246
 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f469460a080 RCX: 00007f46943db8f9
RDX: 0000200000000140 RSI: 000000008004587d RDI: 0000000000000005
RBP: 00007f469446d1bc R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f469460a080 R15: 00007ffdaed064c8
==================================================================