ci starts bisection 2025-10-17 03:28:07.178679093 +0000 UTC m=+135509.007901854 bisecting cause commit starting from 48a97ffc6c826640907d13b199e29008f4fe2c15 building syzkaller on 19568248c8bdb031004760d49df5045a85aa517b ensuring issue is reproducible on original commit 48a97ffc6c826640907d13b199e29008f4fe2c15 testing commit 48a97ffc6c826640907d13b199e29008f4fe2c15 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 078f4dad6bce394d696adacc3f2c57cf365f72e25280df0406576b4f19c24c62 all runs: crashed: kernel BUG in set_ipsecrequest representative crash: kernel BUG in set_ipsecrequest, types: [BUG] check whether we can drop unnecessary instrumentation disabling configs for [hang memleak ubsan kasan locking atomic_sleep], they are not needed testing commit 48a97ffc6c826640907d13b199e29008f4fe2c15 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: c85e4dd15f78d3243e999e0810090083fcd2297469b68df0b730c62bc68eba54 all runs: crashed: kernel BUG in set_ipsecrequest representative crash: kernel BUG in set_ipsecrequest, types: [BUG] the bug reproduces without the instrumentation disabling configs for [locking atomic_sleep hang memleak ubsan kasan], they are not needed kconfig minimization: base=4115 full=8560 leaves diff=2152 split chunks (needed=false): <2152> split chunk #0 of len 2152 into 5 parts testing without sub-chunk 1/5 disabling configs for [locking atomic_sleep hang memleak ubsan kasan], they are not needed testing commit 48a97ffc6c826640907d13b199e29008f4fe2c15 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: bdaa1bfe31bfab40ac4c6a0b338c98ae3b02f9ba8403e273e8eea8aec6b5931c all runs: crashed: kernel BUG in set_ipsecrequest representative crash: kernel BUG in set_ipsecrequest, types: [BUG] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [hang memleak ubsan kasan locking atomic_sleep], they are not needed testing commit 48a97ffc6c826640907d13b199e29008f4fe2c15 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 0b61123fa6166900f77e66eb0b40108b733deedc2080fb3f6d5cd067989d161b all runs: crashed: kernel BUG in set_ipsecrequest representative crash: kernel BUG in set_ipsecrequest, types: [BUG] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [locking atomic_sleep hang memleak ubsan kasan], they are not needed testing commit 48a97ffc6c826640907d13b199e29008f4fe2c15 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 30610d1ffec9eaf9a369a170e0048afe535024f14c93492316280bbe7174fd00 all runs: OK false negative chance: 0.000 testing without sub-chunk 4/5 disabling configs for [atomic_sleep hang memleak ubsan kasan locking], they are not needed testing commit 48a97ffc6c826640907d13b199e29008f4fe2c15 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 4306fa94ca0aa60a180f3f4f50458bf723f00bd2adb55363e501f6580a997fc7 all runs: crashed: kernel BUG in set_ipsecrequest representative crash: kernel BUG in set_ipsecrequest, types: [BUG] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [atomic_sleep hang memleak ubsan kasan locking], they are not needed testing commit 48a97ffc6c826640907d13b199e29008f4fe2c15 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 08b31288db26571b8c3eb4b73c0bcbbbc483a53f02f7e7e09c8a873ebf527d5f all runs: crashed: kernel BUG in set_ipsecrequest representative crash: kernel BUG in set_ipsecrequest, types: [BUG] the chunk can be dropped minimized to 431 configs; suspects: [AX25 BRIDGE BRIDGE_NETFILTER CAN CFG80211 CHECKPOINT_RESTORE DVB_CORE FB_CORE HAMRADIO HID_LOGITECH HSR INFINIBAND INFINIBAND_ADDR_TRANS INFINIBAND_USER_ACCESS INPUT_JOYSTICK INPUT_MOUSE IP6_NF_IPTABLES_LEGACY IP6_NF_MANGLE IP6_NF_RAW IPV6_MULTIPLE_TABLES IP_NF_FILTER IP_NF_IPTABLES_LEGACY IP_NF_MANGLE IP_NF_NAT IP_NF_RAW IP_NF_TARGET_MASQUERADE IP_NF_TARGET_NETMAP IP_NF_TARGET_REDIRECT IP_NF_TARGET_REJECT IP_NF_TARGET_SYNPROXY IP_NF_TARGET_TTL IP_ROUTE_CLASSID IP_SET IP_SET_BITMAP_IP IP_SET_BITMAP_IPMAC IP_SET_BITMAP_PORT IP_SET_HASH_IP IP_SET_HASH_IPMAC IP_SET_HASH_IPMARK IP_SET_HASH_IPPORT IP_SET_HASH_IPPORTIP IP_SET_HASH_IPPORTNET IP_SET_HASH_MAC IP_SET_HASH_NET IP_SET_HASH_NETIFACE IP_SET_HASH_NETNET IP_SET_HASH_NETPORT IP_SET_HASH_NETPORTNET IP_SET_LIST_SET IP_VS IP_VS_DH IP_VS_FO IP_VS_FTP IP_VS_IPV6 IP_VS_LBLC IP_VS_LBLCR IP_VS_LC IP_VS_MH IP_VS_NFCT IP_VS_NQ IP_VS_OVF IP_VS_PE_SIP IP_VS_PROTO_AH IP_VS_PROTO_AH_ESP IP_VS_PROTO_ESP IP_VS_PROTO_SCTP IP_VS_PROTO_TCP IP_VS_PROTO_UDP IP_VS_RR IP_VS_SED IP_VS_SH IP_VS_TWOS IP_VS_WLC IP_VS_WRR IRQ_BYPASS_MANAGER IRQ_POLL IR_IGORPLUGUSB IR_IGUANA IR_IMON IR_IMON_RAW IR_MCEUSB IR_REDRAT3 IR_STREAMZAP IR_TOY IR_TTUSBIR ISDN ISDN_CAPI JFFS2_CMODE_PRIORITY JFFS2_COMPRESSION_OPTIONS JFFS2_FS JFFS2_FS_POSIX_ACL JFFS2_FS_SECURITY JFFS2_FS_WRITEBUFFER JFFS2_FS_XATTR JFFS2_LZO JFFS2_RTIME JFFS2_RUBIN JFFS2_SUMMARY JFFS2_ZLIB JFS_DEBUG JFS_FS JFS_POSIX_ACL JFS_SECURITY JOYSTICK_IFORCE JOYSTICK_IFORCE_USB JOYSTICK_PXRC JOYSTICK_XPAD JOYSTICK_XPAD_FF JOYSTICK_XPAD_LEDS KARMA_PARTITION KCOV KCOV_ENABLE_COMPARISONS KCOV_INSTRUMENT_ALL KEYS_REQUEST_CACHE KEY_DH_OPERATIONS KEY_NOTIFICATIONS KSM KVM KVM_AMD KVM_ASYNC_PF KVM_COMMON KVM_COMPAT KVM_ELIDE_TLB_FLUSH_IF_YOUNG KVM_GENERIC_DIRTYLOG_READ_PROTECT KVM_GENERIC_HARDWARE_ENABLING KVM_GENERIC_MEMORY_ATTRIBUTES KVM_GENERIC_MMU_NOTIFIER KVM_GENERIC_PRE_FAULT_MEMORY KVM_GUEST_MEMFD KVM_HYPERV KVM_IOAPIC KVM_MMIO KVM_MMU_LOCKLESS_AGING KVM_PROVE_MMU KVM_SW_PROTECTED_VM KVM_VFIO KVM_X86 KVM_XEN L2TP L2TP_ETH L2TP_IP L2TP_V3 LAPB LAPBETHER LDM_PARTITION LEDS_CLASS_MULTICOLOR LEGACY_PTYS LIBNVDIMM LINEAR_RANGES LLC LLC2 LOGIG940_FF LOGIRUMBLEPAD2_FF LOGITECH_FF LOGIWHEELS_FF LOGO LOGO_LINUX_MONO LOGO_LINUX_VGA16 LPC_ICH LWTUNNEL LWTUNNEL_BPF LZ4HC_COMPRESS LZ4_COMPRESS MAC80211 MAC80211_HAS_RC MAC80211_HWSIM MAC80211_MESH MAC80211_RC_DEFAULT_MINSTREL MAC80211_RC_MINSTREL MACSEC MACVLAN MACVTAP MAC_PARTITION MAPPING_DIRTY_HELPERS MCTP MDIO_MVUSB MD_RAID0 MD_RAID1 MD_RAID10 MD_RAID456 MEDIA_ANALOG_TV_SUPPORT MEDIA_ATTACH MEDIA_CONTROLLER MEDIA_CONTROLLER_DVB MEDIA_DIGITAL_TV_SUPPORT MEDIA_RADIO_SUPPORT MEDIA_SDR_SUPPORT MEDIA_SUPPORT MEDIA_SUPPORT_FILTER MEDIA_TUNER MEDIA_TUNER_MSI001 MEMORY_BALLOON MEMORY_HOTPLUG MEMORY_ISOLATION MEMREGION MEMSTICK MEMSTICK_REALTEK_USB MEM_SOFT_DIRTY MFD_CORE MFD_SYSCON MHI_BUS MHI_WWAN_CTRL MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO MHP_MEMMAP_ON_MEMORY MICROCHIP_PHY MINIX_FS MINIX_SUBPARTITION MISC_RTSX MISC_RTSX_USB MISDN MISDN_DSP MISDN_HFCUSB MISDN_L1OIP MKISS MLX4_CORE MLX4_INFINIBAND MMC MMC_REALTEK_USB MMC_USHC MMC_VUB300 MM_ID MODULE_SRCVERSION_ALL MOST MOST_USB_HDM MOUSE_APPLETOUCH MOUSE_BCM5974 MOUSE_PS2 MOUSE_PS2_ALPS MOUSE_PS2_BYD MOUSE_PS2_CYPRESS MOUSE_PS2_FOCALTECH MOUSE_PS2_LIFEBOOK MOUSE_PS2_LOGIPS2PP MOUSE_PS2_SMBUS MOUSE_PS2_SYNAPTICS MOUSE_PS2_SYNAPTICS_SMBUS MOUSE_PS2_TRACKPOINT MOUSE_SYNAPTICS_USB MPLS MPLS_IPTUNNEL MPLS_ROUTING MPTCP MPTCP_IPV6 MRP MTD MTD_BLKDEVS MTD_BLOCK MTD_BLOCK2MTD MTD_CFI_I1 MTD_CFI_I2 MTD_MAP_BANK_WIDTH_1 MTD_MAP_BANK_WIDTH_2 MTD_MAP_BANK_WIDTH_4 MTD_MTDRAM MTD_PHRAM MTD_SLRAM MUSB_PIO_ONLY ND_BTT ND_CLAIM ND_PFN NETDEVSIM NETFILTER_ADVANCED NETFILTER_BPF_LINK NETFILTER_FAMILY_ARP NETFILTER_FAMILY_BRIDGE NETFILTER_NETLINK_ACCT NETFILTER_NETLINK_GLUE_CT NETFILTER_NETLINK_OSF NETFILTER_NETLINK_QUEUE NETFILTER_SYNPROXY NETFILTER_XTABLES_COMPAT NETFILTER_XTABLES_LEGACY NETFILTER_XT_CONNMARK NETFILTER_XT_MATCH_BPF NETFILTER_XT_MATCH_CGROUP NETFILTER_XT_MATCH_CLUSTER NETFILTER_XT_MATCH_COMMENT NETFILTER_XT_MATCH_CONNBYTES NETFILTER_XT_MATCH_CONNLABEL NETFILTER_XT_MATCH_CONNLIMIT NETFILTER_XT_MATCH_CONNMARK NETFILTER_XT_MATCH_CPU NETFILTER_XT_MATCH_DCCP NETFILTER_XT_MATCH_DEVGROUP NETFILTER_XT_MATCH_DSCP NETFILTER_XT_MATCH_ECN NETFILTER_XT_MATCH_ESP NETFILTER_XT_MATCH_HASHLIMIT NETFILTER_XT_MATCH_HELPER NETFILTER_XT_MATCH_HL NETFILTER_XT_MATCH_IPCOMP NETFILTER_XT_MATCH_IPRANGE NETFILTER_XT_MATCH_IPVS NETFILTER_XT_MATCH_L2TP NETFILTER_XT_MATCH_LENGTH NETFILTER_XT_MATCH_LIMIT NETFILTER_XT_MATCH_MAC NETFILTER_XT_MATCH_MARK NETFILTER_XT_MATCH_MULTIPORT NETFILTER_XT_MATCH_NFACCT NETFILTER_XT_MATCH_OSF NETFILTER_XT_MATCH_OWNER NETFILTER_XT_MATCH_PHYSDEV NETFILTER_XT_MATCH_PKTTYPE NETFILTER_XT_MATCH_QUOTA NETFILTER_XT_MATCH_RATEEST NETFILTER_XT_MATCH_REALM NETFILTER_XT_MATCH_RECENT NETFILTER_XT_MATCH_SCTP NETFILTER_XT_MATCH_SOCKET NETFILTER_XT_MATCH_STATISTIC NETFILTER_XT_MATCH_STRING NETFILTER_XT_MATCH_TCPMSS NETFILTER_XT_MATCH_TIME NETFILTER_XT_MATCH_U32 NETFILTER_XT_NAT NETFILTER_XT_SET NETFILTER_XT_TARGET_AUDIT NETFILTER_XT_TARGET_CHECKSUM NETFILTER_XT_TARGET_CLASSIFY NETFILTER_XT_TARGET_CONNMARK NETFILTER_XT_TARGET_CT NETFILTER_XT_TARGET_DSCP NETFILTER_XT_TARGET_HL NETFILTER_XT_TARGET_HMARK NETFILTER_XT_TARGET_IDLETIMER NETFILTER_XT_TARGET_LED NETFILTER_XT_TARGET_MARK NETFILTER_XT_TARGET_NETMAP NETFILTER_XT_TARGET_NFQUEUE NETFILTER_XT_TARGET_NOTRACK NETFILTER_XT_TARGET_RATEEST NETFILTER_XT_TARGET_REDIRECT NETFILTER_XT_TARGET_TCPOPTSTRIP NETFILTER_XT_TARGET_TEE NETFILTER_XT_TARGET_TPROXY NETFILTER_XT_TARGET_TRACE NETLABEL NETLINK_DIAG NETROM NET_9P_RDMA NET_ACT_BPF NET_ACT_CONNMARK NET_ACT_CSUM NET_ACT_CT NET_ACT_CTINFO NET_ACT_GATE NET_ACT_IFE NET_ACT_MPLS NET_ACT_NAT NET_ACT_PEDIT NET_ACT_POLICE NET_ACT_SAMPLE NET_ACT_SIMP NET_ACT_SKBEDIT NET_ACT_SKBMOD NET_ACT_TUNNEL_KEY NET_ACT_VLAN NET_CLS_BASIC NET_CLS_BPF NET_CLS_FLOW NET_CLS_FLOWER NET_CLS_FW NET_CLS_MATCHALL NET_CLS_ROUTE4 NET_CRC32C NET_DEVLINK NET_DROP_MONITOR NET_DSA NET_DSA_TAG_BRCM NET_DSA_TAG_BRCM_COMMON NET_DSA_TAG_BRCM_PREPEND NET_DSA_TAG_MTK NET_DSA_TAG_QCA NET_DSA_TAG_RTL4_A NET_EMATCH_CANID NET_EMATCH_CMP NET_EMATCH_IPSET NET_EMATCH_IPT NET_EMATCH_META NET_EMATCH_NBYTE NET_EMATCH_TEXT NET_EMATCH_U32 NET_FC NET_FOU NET_FOU_IP_TUNNELS NET_IFE NET_IFE_SKBMARK NET_IFE_SKBPRIO NET_IFE_SKBTCINDEX NET_IPGRE NET_IPGRE_BROADCAST NET_IPGRE_DEMUX NET_IPIP NET_IPVTI NET_KEY NET_KEY_MIGRATE NET_L3_MASTER_DEV NET_MPLS_GSO NET_NCSI NET_NSH NET_REDIRECT NET_SCH_CAKE NET_SCH_CBS NET_SCH_CHOKE NET_SCH_CODEL NET_SCH_DRR NET_SCH_ETF NET_SCH_ETS NET_SCH_FQ NET_SCH_FQ_CODEL NET_SCH_FQ_PIE NET_SCH_GRED NET_SCH_HFSC NET_SCH_HHF NET_SCH_HTB NET_SCH_INGRESS NET_SCH_MQPRIO NET_SCH_MQPRIO_LIB NET_SCH_MULTIQ NET_SCH_NETEM NET_SCH_PIE NET_SCH_PLUG NET_SCH_PRIO NET_SCH_QFQ NET_SCH_RED NET_SCH_SFB NET_SCH_SFQ NET_SCH_SKBPRIO NET_SCH_TAPRIO NET_SCH_TBF NET_SCH_TEQL NET_SHAPER NET_SOCK_MSG NET_SWITCHDEV NET_TC_SKB_EXT NET_TEAM NET_TEAM_MODE_ACTIVEBACKUP NET_TEAM_MODE_BROADCAST NET_TEAM_MODE_LOADBALANCE NET_TEAM_MODE_RANDOM NET_TEAM_MODE_ROUNDROBIN NET_UDP_TUNNEL NET_VRF NFC NFC_DIGITAL NFC_FDP NFC_HCI NFC_MRVL NFC_MRVL_USB NFC_NCI NFC_NCI_UART NFC_PN533 NFC_PN533_USB NFC_PORT100 NFC_SHDLC NFC_SIM NFC_VIRTUAL_NCI NFSD NFSD_BLOCKLAYOUT NFSD_FLEXFILELAYOUT NFSD_PNFS NFSD_SCSILAYOUT NFSD_V3_ACL NFSD_V4 NFSD_V4_2_INTER_SSC NFSD_V4_SECURITY_LABEL NFS_FSCACHE NFS_V4_1 NFS_V4_2 NFS_V4_2_READ_PLUS NFS_V4_2_SSC_HELPER NFS_V4_SECURITY_LABEL NFT_BRIDGE_META NFT_BRIDGE_REJECT NFT_COMPAT NFT_CONNLIMIT NFT_CT NFT_DUP_IPV4 NFT_DUP_IPV6 NFT_DUP_NETDEV NFT_EXTHDR_DCCP NFT_FIB NFT_FIB_INET NFT_FIB_IPV4 NFT_FIB_IPV6 NFT_FIB_NETDEV NFT_FLOW_OFFLOAD NFT_HASH NFT_LIMIT NFT_LOG NFT_MASQ NFT_NAT NFT_NUMGEN NFT_OSF NFT_QUEUE NFT_QUOTA NFT_REDIR NFT_REJECT NFT_REJECT_INET NFT_REJECT_IPV4 NFT_REJECT_IPV6 NFT_REJECT_NETDEV NFT_SOCKET NFT_SYNPROXY NFT_TPROXY NFT_TUNNEL NFT_XFRM NF_CONNTRACK_AMANDA NF_CONNTRACK_BRIDGE NF_CONNTRACK_BROADCAST NF_CONNTRACK_EVENTS NF_CONNTRACK_H323 NF_CONNTRACK_LABELS NF_CONNTRACK_MARK NF_CONNTRACK_NETBIOS_NS NF_CONNTRACK_OVS NF_CONNTRACK_PPTP NF_CONNTRACK_SANE NF_CONNTRACK_TFTP NF_CONNTRACK_TIMEOUT NF_CONNTRACK_TIMESTAMP NF_CONNTRACK_ZONES NF_CT_NETLINK_HELPER NF_CT_NETLINK_TIMEOUT NF_CT_PROTO_GRE NF_CT_PROTO_SCTP NF_CT_PROTO_UDPLITE NF_DUP_IPV4 NF_FLOW_TABLE NF_TABLES NF_TABLES_BRIDGE NF_TABLES_INET NF_TABLES_IPV4 NF_TABLES_IPV6 NF_TABLES_NETDEV PARTITION_ADVANCED PSAMPLE RC_CORE RC_DEVICES RFKILL SPI USB_GADGET USB_MUSB_HDRC VIDEO_DEV WAN WATCH_QUEUE WIRELESS WLAN WWAN X25] disabling configs for [hang memleak ubsan kasan locking atomic_sleep], they are not needed picked [v6.17 v6.16 v6.15 v6.13 v6.11 v6.9 v6.7 v6.5 v6.2 v5.19 v5.16 v5.13 v5.10 v5.7 v5.4 v5.1 v4.19] out of 40 release tags testing release v6.17 testing commit e5f0a698b34ed76002dc5cff3804a61c80233a7a gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: f1f2407097316cb9c22b3f2a9df820cbe0fe88e677863bb65270ee2edb290ce1 all runs: crashed: kernel BUG in set_ipsecrequest representative crash: kernel BUG in set_ipsecrequest, types: [BUG] testing release v6.16 testing commit 038d61fd642278bab63ee8ef722c50d10ab01e8f gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: df7f779b0f1b4fd9b0cadf6cf3279fcdd51b2b6cd51b3ed8fb1c55050dba42b2 all runs: crashed: kernel BUG in set_ipsecrequest representative crash: kernel BUG in set_ipsecrequest, types: [BUG] testing release v6.15 testing commit 0ff41df1cb268fc69e703a08a57ee14ae967d0ca gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: f2cb3b7922e646d903e0326a701eab4a0d5edd0e573aeeb727db7a952ca8527a all runs: crashed: kernel BUG in set_ipsecrequest representative crash: kernel BUG in set_ipsecrequest, types: [BUG] testing release v6.13 testing commit ffd294d346d185b70e28b1a28abe367bbfe53c04 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 2cbb92b417ceedf2f6f7ac91e805fc236b18204ccec97a4dff06497eebbb5ce3 all runs: OK false negative chance: 0.000 # git bisect start 0ff41df1cb268fc69e703a08a57ee14ae967d0ca ffd294d346d185b70e28b1a28abe367bbfe53c04 Bisecting: 13999 revisions left to test after this (roughly 14 steps) [7d20aa5c32ac8bd272b5470ddbd7ac6e0cb35714] Merge tag 'pm-6.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm testing commit 7d20aa5c32ac8bd272b5470ddbd7ac6e0cb35714 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 9ebdef8d568ddc9f1f5b5f5de21db9b1c29c6643ce384c1abde873e354435e9b all runs: boot failed: BUG: unable to handle kernel NULL pointer dereference in msix_capability_init unable to determine the verdict: 0 good runs (wanted 5), for bad wanted 5 in total, got 0 # git bisect skip 7d20aa5c32ac8bd272b5470ddbd7ac6e0cb35714 Bisecting: 13999 revisions left to test after this (roughly 14 steps) [6a53fc5a877098889b4bce45ec7ea44948819905] tap: Use tun's vnet-related code testing commit 6a53fc5a877098889b4bce45ec7ea44948819905 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: d3d5c4b0c283a6e234bb8f0c98757342ec8795ad13bb037a67b31915a09249ea all runs: OK false negative chance: 0.000 # git bisect good 6a53fc5a877098889b4bce45ec7ea44948819905 Bisecting: 8949 revisions left to test after this (roughly 13 steps) [f79adee883586b94cf977e4d28384ea0288473ed] Merge tag 'jfs-6.14' of github.com:kleikamp/linux-shaggy testing commit f79adee883586b94cf977e4d28384ea0288473ed gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: b4faa03513309c06de7627171410400ee857c4fe119a1120d9f3d3fb635d2c00 all runs: crashed: kernel BUG in set_ipsecrequest representative crash: kernel BUG in set_ipsecrequest, types: [BUG] # git bisect bad f79adee883586b94cf977e4d28384ea0288473ed Bisecting: 4432 revisions left to test after this (roughly 12 steps) [c84907a1459588c883ef84a35bb69d46ca37e4e7] Merge tag 'auxdisplay-v6.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-auxdisplay testing commit c84907a1459588c883ef84a35bb69d46ca37e4e7 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 933892ab36ddb2b6e9fadddab248803015f2ef8ee796c3196e5185dc9bef47d4 all runs: boot failed: BUG: unable to handle kernel NULL pointer dereference in msix_capability_init unable to determine the verdict: 0 good runs (wanted 5), for bad wanted 5 in total, got 0 # git bisect skip c84907a1459588c883ef84a35bb69d46ca37e4e7 Bisecting: 4432 revisions left to test after this (roughly 12 steps) [a19f40d919ca6d16bbc03d858690f60f1a9bf3ed] Merge branch 'net-usb-asix-ax88772-fix-potential-string-cut' testing commit a19f40d919ca6d16bbc03d858690f60f1a9bf3ed gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 8fd9722e6f60abf2b6c22767c36a79ab9f32b42f3d17133fa9901b6a36bbe4b2 all runs: crashed: kernel BUG in set_ipsecrequest representative crash: kernel BUG in set_ipsecrequest, types: [BUG] # git bisect bad a19f40d919ca6d16bbc03d858690f60f1a9bf3ed Bisecting: 1800 revisions left to test after this (roughly 11 steps) [a144da586c6bdf345c80598533673e1150c90b25] Merge branch 'mptcp-improve-code-coverage-and-small-optimisations' testing commit a144da586c6bdf345c80598533673e1150c90b25 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: dd8ec284d9731ba6369c9af1dd881ebbf4ff40e1b794332b0e3cef988c1d4e52 all runs: crashed: kernel BUG in set_ipsecrequest representative crash: kernel BUG in set_ipsecrequest, types: [BUG] # git bisect bad a144da586c6bdf345c80598533673e1150c90b25 Bisecting: 901 revisions left to test after this (roughly 10 steps) [2c24478e5f6e8a1060f5ad2f52210549a4819204] Merge tag 'for-6.14/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm testing commit 2c24478e5f6e8a1060f5ad2f52210549a4819204 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 24d462c72b256b4c973c069e5a11f6925e6b62821b2cf2b9636214d9334c38a6 all runs: crashed: kernel BUG in set_ipsecrequest representative crash: kernel BUG in set_ipsecrequest, types: [BUG] # git bisect bad 2c24478e5f6e8a1060f5ad2f52210549a4819204 Bisecting: 449 revisions left to test after this (roughly 9 steps) [f92a80bdb445e4e73e810ea7e94bebb10717f40a] Merge tag 'mmc-v6.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc testing commit f92a80bdb445e4e73e810ea7e94bebb10717f40a gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 914cd05dde4f9429be5fea288f80ac31a367eb9316c334dcf12bbd62a8b99c07 all runs: OK false negative chance: 0.000 # git bisect good f92a80bdb445e4e73e810ea7e94bebb10717f40a Bisecting: 226 revisions left to test after this (roughly 8 steps) [87a132e73910e8689902aed7f2fc229d6908383b] Merge tag 'mm-hotfixes-stable-2025-02-19-17-49' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm testing commit 87a132e73910e8689902aed7f2fc229d6908383b gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 88520c1e6177571f010437156692d1dd9d02d91502b051c7d6f62ac92c52fc73 all runs: OK false negative chance: 0.000 # git bisect good 87a132e73910e8689902aed7f2fc229d6908383b Bisecting: 114 revisions left to test after this (roughly 7 steps) [f679ebf6aa9b42d0edb5b261e16dc7b1e3c3550e] Merge tag 'io_uring-6.14-20250221' of git://git.kernel.dk/linux testing commit f679ebf6aa9b42d0edb5b261e16dc7b1e3c3550e gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 3e9a01122514a4054e7487bea9e5b929684da341e72f3ef57221565b751e102f all runs: crashed: kernel BUG in set_ipsecrequest representative crash: kernel BUG in set_ipsecrequest, types: [BUG] # git bisect bad f679ebf6aa9b42d0edb5b261e16dc7b1e3c3550e Bisecting: 53 revisions left to test after this (roughly 6 steps) [27eddbf3449026a73d6ed52d55b192bfcf526a03] Merge tag 'net-6.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net testing commit 27eddbf3449026a73d6ed52d55b192bfcf526a03 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: aef89320693ae5340411dbc71dac51190235e816e2e0ce8c5adee7b032810e4e all runs: crashed: kernel BUG in set_ipsecrequest representative crash: kernel BUG in set_ipsecrequest, types: [BUG] # git bisect bad 27eddbf3449026a73d6ed52d55b192bfcf526a03 Bisecting: 28 revisions left to test after this (roughly 5 steps) [15de6ba95dbe98af7eb71e644205a37c2f1a9aea] selftests/bpf: Add a specific dst port matching testing commit 15de6ba95dbe98af7eb71e644205a37c2f1a9aea gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: ca88c859707f72761d983ebe7c5899a74f0d605a6af3711fe61f938436f8252b all runs: OK false negative chance: 0.000 # git bisect good 15de6ba95dbe98af7eb71e644205a37c2f1a9aea Bisecting: 11 revisions left to test after this (roughly 4 steps) [e9a8cac0bf895efe0bc7b11d174e8dae9b195da8] Merge tag 'v6.14-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 testing commit e9a8cac0bf895efe0bc7b11d174e8dae9b195da8 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 0789daeb9067cc5efbe5e61783b95393f67de0e9e00656db7617a7a3c27f14a7 all runs: OK false negative chance: 0.000 # git bisect good e9a8cac0bf895efe0bc7b11d174e8dae9b195da8 Bisecting: 5 revisions left to test after this (roughly 3 steps) [a370295367b55662a32a4be92565fe72a5aa79bb] net: axienet: Set mac_managed_pm testing commit a370295367b55662a32a4be92565fe72a5aa79bb gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 03c71e0da0ef7d58ce92ef0e0e0263e27b6f5db67e78ea09c26273e3d8ae0675 all runs: OK false negative chance: 0.000 # git bisect good a370295367b55662a32a4be92565fe72a5aa79bb Bisecting: 2 revisions left to test after this (roughly 2 steps) [14ad6ed30a10afbe91b0749d6378285f4225d482] net: allow small head cache usage with large MAX_SKB_FRAGS values testing commit 14ad6ed30a10afbe91b0749d6378285f4225d482 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 9e4af63b3155470e8fafa03d05276b80742a56ab699454eacd6ad99d30d5c036 all runs: crashed: kernel BUG in set_ipsecrequest representative crash: kernel BUG in set_ipsecrequest, types: [BUG] # git bisect bad 14ad6ed30a10afbe91b0749d6378285f4225d482 Bisecting: 0 revisions left to test after this (roughly 1 step) [878e7b11736e062514e58f3b445ff343e6705537] nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() testing commit 878e7b11736e062514e58f3b445ff343e6705537 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 316160ad8e0786d734c4f06ce8d186eb1cee971e9a2283223f080d2b0aaa4c9a all runs: OK false negative chance: 0.000 # git bisect good 878e7b11736e062514e58f3b445ff343e6705537 14ad6ed30a10afbe91b0749d6378285f4225d482 is the first bad commit commit 14ad6ed30a10afbe91b0749d6378285f4225d482 Author: Paolo Abeni Date: Tue Feb 18 19:29:39 2025 +0100 net: allow small head cache usage with large MAX_SKB_FRAGS values Sabrina reported the following splat: WARNING: CPU: 0 PID: 1 at net/core/dev.c:6935 netif_napi_add_weight_locked+0x8f2/0xba0 Modules linked in: CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.14.0-rc1-net-00092-g011b03359038 #996 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 RIP: 0010:netif_napi_add_weight_locked+0x8f2/0xba0 Code: e8 c3 e6 6a fe 48 83 c4 28 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc c7 44 24 10 ff ff ff ff e9 8f fb ff ff e8 9e e6 6a fe <0f> 0b e9 d3 fe ff ff e8 92 e6 6a fe 48 8b 04 24 be ff ff ff ff 48 RSP: 0000:ffffc9000001fc60 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff88806ce48128 RCX: 1ffff11001664b9e RDX: ffff888008f00040 RSI: ffffffff8317ca42 RDI: ffff88800b325cb6 RBP: ffff88800b325c40 R08: 0000000000000001 R09: ffffed100167502c R10: ffff88800b3a8163 R11: 0000000000000000 R12: ffff88800ac1c168 R13: ffff88800ac1c168 R14: ffff88800ac1c168 R15: 0000000000000007 FS: 0000000000000000(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff888008201000 CR3: 0000000004c94001 CR4: 0000000000370ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: gro_cells_init+0x1ba/0x270 xfrm_input_init+0x4b/0x2a0 xfrm_init+0x38/0x50 ip_rt_init+0x2d7/0x350 ip_init+0xf/0x20 inet_init+0x406/0x590 do_one_initcall+0x9d/0x2e0 do_initcalls+0x23b/0x280 kernel_init_freeable+0x445/0x490 kernel_init+0x20/0x1d0 ret_from_fork+0x46/0x80 ret_from_fork_asm+0x1a/0x30 irq event stamp: 584330 hardirqs last enabled at (584338): [] __up_console_sem+0x77/0xb0 hardirqs last disabled at (584345): [] __up_console_sem+0x5c/0xb0 softirqs last enabled at (583242): [] netlink_insert+0x14d/0x470 softirqs last disabled at (583754): [] netif_napi_add_weight_locked+0x77d/0xba0 on kernel built with MAX_SKB_FRAGS=45, where SKB_WITH_OVERHEAD(1024) is smaller than GRO_MAX_HEAD. Such built additionally contains the revert of the single page frag cache so that napi_get_frags() ends up using the page frag allocator, triggering the splat. Note that the underlying issue is independent from the mentioned revert; address it ensuring that the small head cache will fit either TCP and GRO allocation and updating napi_alloc_skb() and __netdev_alloc_skb() to select kmalloc() usage for any allocation fitting such cache. Reported-by: Sabrina Dubroca Suggested-by: Eric Dumazet Fixes: 3948b05950fd ("net: introduce a config option to tweak MAX_SKB_FRAGS") Reviewed-by: Eric Dumazet Signed-off-by: Paolo Abeni include/net/gro.h | 3 +++ net/core/gro.c | 3 --- net/core/skbuff.c | 10 +++++++--- 3 files changed, 10 insertions(+), 6 deletions(-) accumulated error probability: 0.00 culprit signature: 9e4af63b3155470e8fafa03d05276b80742a56ab699454eacd6ad99d30d5c036 parent signature: 316160ad8e0786d734c4f06ce8d186eb1cee971e9a2283223f080d2b0aaa4c9a revisions tested: 27, total time: 7h24m0.339373712s (build: 3h58m29.189886156s, test: 2h34m19.573058061s) first bad commit: 14ad6ed30a10afbe91b0749d6378285f4225d482 net: allow small head cache usage with large MAX_SKB_FRAGS values recipients (to): ["davem@davemloft.net" "edumazet@google.com" "edumazet@google.com" "kuba@kernel.org" "netdev@vger.kernel.org" "pabeni@redhat.com" "pabeni@redhat.com"] recipients (cc): ["alexanderduyck@fb.com" "chuck.lever@oracle.com" "horms@kernel.org" "linux-kernel@vger.kernel.org" "linyunsheng@huawei.com"] crash: kernel BUG in set_ipsecrequest skbuff: skb_over_panic: text:ffffffff82d901b4 len:392 put:16 head:ffff8881053d5e40 data:ffff8881053d5e40 tail:0x188 end:0x180 dev: ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:209! Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 0 UID: 0 PID: 4912 Comm: syz.2.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 RIP: 0010:skb_panic+0x5c/0x60 net/core/skbuff.c:209 Code: b9 b2 bb 83 4c 0f 45 f7 48 c7 c7 09 86 b6 83 48 89 ce 44 89 d1 41 56 53 41 53 ff b0 d8 00 00 00 e8 b9 14 fe ff 48 83 c4 20 90 <0f> 0b cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f RSP: 0018:ffffc90001adb300 EFLAGS: 00010286 RAX: 0000000000000088 RBX: 0000000000000180 RCX: 2b44971ef206af00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000188 R08: 0000000000000000 R09: 0000000000000009 R10: 0000000000000002 R11: 0000000000000000 R12: 0000000000000180 R13: 0000000000000178 R14: ffffffff83bbb2b9 R15: ffff8881053d5e40 FS: 00007fd8b4c8f6c0(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000001f40 CR3: 0000000120fcc000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: skb_over_panic net/core/skbuff.c:214 [inline] skb_put+0x92/0xa0 net/core/skbuff.c:2621 skb_put_zero include/linux/skbuff.h:2737 [inline] set_ipsecrequest+0x64/0x160 net/key/af_key.c:3532 pfkey_send_migrate+0x758/0x840 net/key/af_key.c:3636 km_migrate+0xab/0x120 net/xfrm/xfrm_state.c:2824 xfrm_migrate+0xf2f/0x10c0 net/xfrm/xfrm_policy.c:4689 xfrm_do_migrate+0x395/0x400 net/xfrm/xfrm_user.c:3090 xfrm_user_rcv_msg+0x3fb/0x4b0 net/xfrm/xfrm_user.c:3447 netlink_rcv_skb+0xeb/0x1d0 net/netlink/af_netlink.c:2543 xfrm_netlink_rcv+0x36/0x50 net/xfrm/xfrm_user.c:3469 netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline] netlink_unicast+0x3cb/0x4a0 net/netlink/af_netlink.c:1348 netlink_sendmsg+0x490/0x580 net/netlink/af_netlink.c:1892 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg+0xc6/0xf0 net/socket.c:733 ____sys_sendmsg+0x25f/0x3b0 net/socket.c:2573 ___sys_sendmsg+0x2df/0x320 net/socket.c:2627 __sys_sendmsg net/socket.c:2659 [inline] __do_sys_sendmsg net/socket.c:2664 [inline] __se_sys_sendmsg net/socket.c:2662 [inline] __x64_sys_sendmsg+0x111/0x1a0 net/socket.c:2662 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xe2/0x210 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd8b4e1eec9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd8b4c8f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fd8b5075fa0 RCX: 00007fd8b4e1eec9 RDX: 0000000000000000 RSI: 0000200000000380 RDI: 0000000000000004 RBP: 00007fd8b4ea1f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fd8b5076038 R14: 00007fd8b5075fa0 R15: 00007ffddd6855f8 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:skb_panic+0x5c/0x60 net/core/skbuff.c:209 Code: b9 b2 bb 83 4c 0f 45 f7 48 c7 c7 09 86 b6 83 48 89 ce 44 89 d1 41 56 53 41 53 ff b0 d8 00 00 00 e8 b9 14 fe ff 48 83 c4 20 90 <0f> 0b cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f RSP: 0018:ffffc90001adb300 EFLAGS: 00010286 RAX: 0000000000000088 RBX: 0000000000000180 RCX: 2b44971ef206af00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000188 R08: 0000000000000000 R09: 0000000000000009 R10: 0000000000000002 R11: 0000000000000000 R12: 0000000000000180 R13: 0000000000000178 R14: ffffffff83bbb2b9 R15: ffff8881053d5e40 FS: 00007fd8b4c8f6c0(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000001f40 CR3: 0000000120fcc000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400