ci2 starts bisection 2026-10-10 15:41:29.291066625 +0000 UTC m=+79734.730187991 bisecting fixing commit since c85054db46181ee85f10be997f41b347c85bd89b building syzkaller on fb92f11c4789d9647a75c09c983dbee5c8488ccf ensuring issue is reproducible on original commit c85054db46181ee85f10be997f41b347c85bd89b testing commit c85054db46181ee85f10be997f41b347c85bd89b gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: c96d48131186e624bceb4bc984dcc93c9dd6cf524fcd9d729950e0f1aaf4f50d run #0: crashed: KASAN: use-after-free Read in timestamp_truncate run #1: crashed: KASAN: use-after-free Read in atime_needs_update run #2: crashed: KASAN: use-after-free Read in security_inode_follow_link run #3: crashed: KASAN: use-after-free Read in step_into run #4: crashed: KASAN: use-after-free Read in step_into run #5: crashed: KASAN: use-after-free Read in link_path_walk run #6: crashed: KASAN: use-after-free Read in atime_needs_update run #7: crashed: KASAN: use-after-free Read in link_path_walk run #8: crashed: KASAN: use-after-free Read in link_path_walk run #9: crashed: KASAN: use-after-free Read in link_path_walk run #10: crashed: KASAN: use-after-free Read in link_path_walk run #11: crashed: KASAN: use-after-free Read in link_path_walk run #12: crashed: KASAN: use-after-free Read in atime_needs_update run #13: crashed: KASAN: use-after-free Read in link_path_walk run #14: crashed: KASAN: use-after-free Read in link_path_walk run #15: crashed: KASAN: use-after-free Read in atime_needs_update run #16: crashed: KASAN: use-after-free Read in selinux_inode_follow_link run #17: OK run #18: crashed: KASAN: use-after-free Read in link_path_walk run #19: OK representative crash: KASAN: use-after-free Read in timestamp_truncate, types: [KASAN-USE-AFTER-FREE-READ] check whether we can drop unnecessary instrumentation disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed testing commit c85054db46181ee85f10be997f41b347c85bd89b gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 48bd0b3d485f6341d59548dfb64ce43142132f8fbdf28d2482b0be235a3d3a2d run #0: crashed: KASAN: use-after-free Read in step_into run #1: crashed: KASAN: use-after-free Read in link_path_walk run #2: crashed: KASAN: use-after-free Read in link_path_walk run #3: crashed: KASAN: use-after-free Read in atime_needs_update run #4: crashed: KASAN: use-after-free Read in atime_needs_update run #5: crashed: KASAN: use-after-free Read in atime_needs_update run #6: crashed: KASAN: use-after-free Read in __inode_security_revalidate run #7: OK run #8: OK run #9: OK representative crash: KASAN: use-after-free Read in step_into, types: [KASAN-USE-AFTER-FREE-READ] the bug reproduces without the instrumentation disabling configs for [ubsan bug_or_warning locking atomic_sleep hang memleak], they are not needed kconfig minimization: base=4925 full=6218 leaves diff=255 split chunks (needed=false): <255> split chunk #0 of len 255 into 5 parts testing without sub-chunk 1/5 disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed testing commit c85054db46181ee85f10be997f41b347c85bd89b gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: d1b55fbfd194e053b83389958b89cf1ad8c532324a8a584677702896d33e10b6 run #0: crashed: KASAN: use-after-free Read in atime_needs_update run #1: crashed: KASAN: use-after-free Read in step_into run #2: crashed: KASAN: use-after-free Read in step_into run #3: crashed: KASAN: use-after-free Read in step_into run #4: crashed: KASAN: use-after-free Read in link_path_walk run #5: crashed: KASAN: use-after-free Read in step_into run #6: crashed: KASAN: use-after-free Read in step_into run #7: crashed: KASAN: use-after-free Read in link_path_walk run #8: OK run #9: OK representative crash: KASAN: use-after-free Read in atime_needs_update, types: [KASAN-USE-AFTER-FREE-READ] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed testing commit c85054db46181ee85f10be997f41b347c85bd89b gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 8c6e331a6aba55e346f37b84645acf22dcc0fbcf11f39216a3d55b62ccd25408 run #0: crashed: KASAN: use-after-free Read in atime_needs_update run #1: crashed: KASAN: use-after-free Read in link_path_walk run #2: crashed: KASAN: use-after-free Read in atime_needs_update run #3: crashed: KASAN: use-after-free Read in step_into run #4: crashed: KASAN: use-after-free Read in security_inode_follow_link run #5: crashed: KASAN: use-after-free Read in link_path_walk run #6: OK run #7: OK run #8: OK run #9: OK representative crash: KASAN: use-after-free Read in atime_needs_update, types: [KASAN-USE-AFTER-FREE-READ] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed testing commit c85054db46181ee85f10be997f41b347c85bd89b gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: ea9d9c3a919e1212d0e9fc1e3ab97f8c1faf36d40a0f00bbe8a8a3b28a51e756 run #0: crashed: KASAN: use-after-free Read in atime_needs_update run #1: crashed: KASAN: use-after-free Read in step_into run #2: crashed: KASAN: use-after-free Read in __inode_security_revalidate run #3: crashed: KASAN: use-after-free Read in atime_needs_update run #4: crashed: KASAN: use-after-free Read in security_inode_follow_link run #5: crashed: KASAN: use-after-free Read in link_path_walk run #6: OK run #7: OK run #8: OK run #9: OK representative crash: KASAN: use-after-free Read in atime_needs_update, types: [KASAN-USE-AFTER-FREE-READ] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [bug_or_warning locking atomic_sleep hang memleak ubsan], they are not needed testing commit c85054db46181ee85f10be997f41b347c85bd89b gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 4351b8c8f1b3e3f7fea71da595aed0d86a748a873b69bc1606f8e2e900cd3a4d run #0: crashed: KASAN: use-after-free Read in step_into run #1: crashed: KASAN: use-after-free Read in link_path_walk run #2: crashed: KASAN: use-after-free Read in atime_needs_update run #3: crashed: KASAN: use-after-free Read in __inode_security_revalidate run #4: crashed: KASAN: use-after-free Read in step_into run #5: crashed: KASAN: use-after-free Read in step_into run #6: crashed: KASAN: use-after-free Read in security_inode_follow_link run #7: OK run #8: OK run #9: OK representative crash: KASAN: use-after-free Read in step_into, types: [KASAN-USE-AFTER-FREE-READ] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [bug_or_warning locking atomic_sleep hang memleak ubsan], they are not needed testing commit c85054db46181ee85f10be997f41b347c85bd89b gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 failed building c85054db46181ee85f10be997f41b347c85bd89b: net/socket.c:1188:(.text+0x6d1a): undefined reference to `wext_handle_ioctl' net/socket.c:3389:(.text+0x7314): undefined reference to `compat_wext_handle_ioctl' net/core/net-procfs.c:343:(.text+0x33b): undefined reference to `wext_proc_exit' net/core/net-procfs.c:327:(.text+0x4e2): undefined reference to `wext_proc_init' minimized to 51 configs; suspects: [HID_ZEROPLUS USB_LINK_LAYER_TEST USB_MON USB_NET_CDC_MBIM USB_NET_CDC_SUBSET USB_NET_CDC_SUBSET_ENABLE USB_NET_DM9601 USB_NET_GL620A USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL USB_SERIAL_FTDI_SIO USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM USB_XHCI_PCI_RENESAS WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_ZYDAS ZEROPLUS_FF] disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed testing current HEAD d6c8aee048e0871ae3942f60c655c146df22479d testing commit d6c8aee048e0871ae3942f60c655c146df22479d gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: d9d1f21f0324f507d987a1ce0dd5e7afa339a908ab982541095674c23f475f3e all runs: OK false negative chance: 0.000 # git bisect start d6c8aee048e0871ae3942f60c655c146df22479d c85054db46181ee85f10be997f41b347c85bd89b Bisecting: 1796 revisions left to test after this (roughly 11 steps) [c5a0ae895432596b2f464172da8218e2d84e2932] net: sit: require CAP_NET_ADMIN in the device netns for changelink determine whether the revision contains the guilty commit checking the merge base 64ee49df839fd77e7f7f5d2cec3c9435f52f099b no existing result, test the revision testing commit 64ee49df839fd77e7f7f5d2cec3c9435f52f099b gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 85a62757ed0603b14be5ca4a0426abfa43012e943a7ba7c2b692f37b34b57467 run #0: crashed: KASAN: use-after-free Read in step_into run #1: crashed: KASAN: use-after-free Read in link_path_walk run #2: crashed: KASAN: use-after-free Read in link_path_walk run #3: crashed: KASAN: use-after-free Read in link_path_walk run #4: crashed: KASAN: use-after-free Read in link_path_walk run #5: crashed: KASAN: use-after-free Read in step_into run #6: crashed: KASAN: use-after-free Read in security_inode_follow_link run #7: OK run #8: OK run #9: OK representative crash: KASAN: use-after-free Read in step_into, types: [KASAN-USE-AFTER-FREE-READ] testing commit c5a0ae895432596b2f464172da8218e2d84e2932 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: e344417a330ba002fbdf094a901d9b0ac118299afb0113481ce7a0cd282ebbf7 all runs: OK false negative chance: 0.000 # git bisect bad c5a0ae895432596b2f464172da8218e2d84e2932 Bisecting: 897 revisions left to test after this (roughly 10 steps) [714aa973da8163925eda7efd49361ccbee21ee46] net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() determine whether the revision contains the guilty commit revision 64ee49df839fd77e7f7f5d2cec3c9435f52f099b crashed and is reachable testing commit 714aa973da8163925eda7efd49361ccbee21ee46 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 3185181d1d5cfcddb56b70b0646a18b494594b4c9b0b381b4e0112fb3ae1652f run #0: crashed: KASAN: use-after-free Read in step_into run #1: crashed: KASAN: use-after-free Read in link_path_walk run #2: crashed: KASAN: use-after-free Read in link_path_walk run #3: crashed: KASAN: use-after-free Read in link_path_walk run #4: crashed: KASAN: use-after-free Read in atime_needs_update run #5: crashed: KASAN: use-after-free Read in security_inode_follow_link run #6: crashed: KASAN: use-after-free Read in __inode_security_revalidate run #7: OK run #8: OK run #9: OK representative crash: KASAN: use-after-free Read in step_into, types: [KASAN-USE-AFTER-FREE-READ] # git bisect good 714aa973da8163925eda7efd49361ccbee21ee46 Bisecting: 448 revisions left to test after this (roughly 9 steps) [5740bf24cd23957297b408ca575e27fec356aced] net: dsa: tag_ksz: do not rely on skb_mac_header() in TX paths determine whether the revision contains the guilty commit revision 64ee49df839fd77e7f7f5d2cec3c9435f52f099b crashed and is reachable testing commit 5740bf24cd23957297b408ca575e27fec356aced gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 74030228b47cb66837b5991f4986e80ee15eeaf67af4c43d1e8e11a08cc7dbc7 run #0: crashed: KASAN: use-after-free Read in atime_needs_update run #1: crashed: KASAN: use-after-free Read in step_into run #2: crashed: KASAN: use-after-free Read in current_time run #3: crashed: KASAN: use-after-free Read in step_into run #4: crashed: KASAN: use-after-free Read in step_into run #5: crashed: KASAN: use-after-free Read in link_path_walk run #6: crashed: KASAN: use-after-free Read in link_path_walk run #7: crashed: KASAN: use-after-free Read in link_path_walk run #8: crashed: KASAN: use-after-free Read in link_path_walk run #9: OK representative crash: KASAN: use-after-free Read in atime_needs_update, types: [KASAN-USE-AFTER-FREE-READ] # git bisect good 5740bf24cd23957297b408ca575e27fec356aced Bisecting: 224 revisions left to test after this (roughly 8 steps) [dc9834aac8fd8e17f51c4b22f1e944079d1f79ab] selftests/mm: clarify alternate unmapping in compaction_test determine whether the revision contains the guilty commit revision 64ee49df839fd77e7f7f5d2cec3c9435f52f099b crashed and is reachable testing commit dc9834aac8fd8e17f51c4b22f1e944079d1f79ab gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: a8881c4565a88700f08343081e109541e2ac79c8e7f11e3a30043550e736b39f all runs: OK false negative chance: 0.000 # git bisect bad dc9834aac8fd8e17f51c4b22f1e944079d1f79ab Bisecting: 111 revisions left to test after this (roughly 7 steps) [cbc9982c8573fb9e35040063aa78c8ebe768a1ff] IB/mlx5: Properly support implicit ODP rereg_mr determine whether the revision contains the guilty commit revision 64ee49df839fd77e7f7f5d2cec3c9435f52f099b crashed and is reachable testing commit cbc9982c8573fb9e35040063aa78c8ebe768a1ff gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 32411abf5f0d8f77dc32c07e57a62c47740e9eb63f3635b119b786db6ffb7155 all runs: OK false negative chance: 0.000 # git bisect bad cbc9982c8573fb9e35040063aa78c8ebe768a1ff Bisecting: 55 revisions left to test after this (roughly 6 steps) [e7d363c0ffa836ac1d89657686cad241392c5eb2] RDMA/hns: Fix warning in poll cq direct mode determine whether the revision contains the guilty commit revision 714aa973da8163925eda7efd49361ccbee21ee46 crashed and is reachable testing commit e7d363c0ffa836ac1d89657686cad241392c5eb2 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 1f573016e785018da0a52b1bf284a0d76f0207e22b88c7e229d6410a4b43a104 run #0: crashed: KASAN: use-after-free Read in link_path_walk run #1: crashed: KASAN: use-after-free Read in step_into run #2: crashed: KASAN: use-after-free Read in step_into run #3: crashed: KASAN: use-after-free Read in atime_needs_update run #4: crashed: KASAN: use-after-free Read in link_path_walk run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK representative crash: KASAN: use-after-free Read in link_path_walk, types: [KASAN-USE-AFTER-FREE-READ] # git bisect good e7d363c0ffa836ac1d89657686cad241392c5eb2 Bisecting: 27 revisions left to test after this (roughly 5 steps) [d3f81ace0a2e348690a4272a49f5c253b8ddf41c] ARM: imx3: Fix CCM node reference leak determine whether the revision contains the guilty commit revision e7d363c0ffa836ac1d89657686cad241392c5eb2 crashed and is reachable testing commit d3f81ace0a2e348690a4272a49f5c253b8ddf41c gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 3a99d39d910757f0b100ddeeb8e44d4d2ef6d22afbe9f3df82b6c27b84b4e22c run #0: crashed: KASAN: use-after-free Read in step_into run #1: crashed: KASAN: use-after-free Read in step_into run #2: crashed: KASAN: use-after-free Read in step_into run #3: crashed: KASAN: use-after-free Read in security_inode_follow_link run #4: crashed: KASAN: use-after-free Read in atime_needs_update run #5: crashed: KASAN: use-after-free Read in link_path_walk run #6: OK run #7: OK run #8: OK run #9: OK representative crash: KASAN: use-after-free Read in step_into, types: [KASAN-USE-AFTER-FREE-READ] # git bisect good d3f81ace0a2e348690a4272a49f5c253b8ddf41c Bisecting: 13 revisions left to test after this (roughly 4 steps) [c5dbf2784828886a66c61782324e4aa830de1e57] netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures determine whether the revision contains the guilty commit revision 714aa973da8163925eda7efd49361ccbee21ee46 crashed and is reachable testing commit c5dbf2784828886a66c61782324e4aa830de1e57 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: a143252611e2e9f1f2986d88ba9d9d7b8655b6eb14ce6103deeebb5716c30e8e all runs: OK false negative chance: 0.000 # git bisect bad c5dbf2784828886a66c61782324e4aa830de1e57 Bisecting: 6 revisions left to test after this (roughly 3 steps) [3e83b2203aa59bd279e4f677ec793d49dc9d019e] configfs_lookup(): don't leave ->s_dentry dangling on failure determine whether the revision contains the guilty commit revision 714aa973da8163925eda7efd49361ccbee21ee46 crashed and is reachable testing commit 3e83b2203aa59bd279e4f677ec793d49dc9d019e gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 995d0f0d51091ee05bd7bacfcb50f4c78686343f7a7b73ac15d9d1abcd78b9ed all runs: OK false negative chance: 0.000 # git bisect bad 3e83b2203aa59bd279e4f677ec793d49dc9d019e Bisecting: 3 revisions left to test after this (roughly 2 steps) [472152df7c99132cd022907c47b6358fc645c2da] scsi: pm8001: Fix error code in non_fatal_log_show() determine whether the revision contains the guilty commit revision 714aa973da8163925eda7efd49361ccbee21ee46 crashed and is reachable testing commit 472152df7c99132cd022907c47b6358fc645c2da gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 9cb973154d568006c2c9d25b625a9d469cb91109c431c8f0dcac651f7a5d76c1 run #0: crashed: KASAN: use-after-free Read in step_into run #1: crashed: KASAN: use-after-free Read in step_into run #2: crashed: KASAN: use-after-free Read in step_into run #3: crashed: KASAN: use-after-free Read in link_path_walk run #4: crashed: KASAN: use-after-free Read in atime_needs_update run #5: crashed: KASAN: use-after-free Read in link_path_walk run #6: OK run #7: OK run #8: OK run #9: OK representative crash: KASAN: use-after-free Read in step_into, types: [KASAN-USE-AFTER-FREE-READ] # git bisect good 472152df7c99132cd022907c47b6358fc645c2da Bisecting: 1 revision left to test after this (roughly 1 step) [49b9619c2c22630062e87dee98a298e8c632e3d4] mm/fake-numa: fix under-allocation detection in uniform split determine whether the revision contains the guilty commit revision 714aa973da8163925eda7efd49361ccbee21ee46 crashed and is reachable testing commit 49b9619c2c22630062e87dee98a298e8c632e3d4 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: c198395a50c316bc22566a2e8c87fab4dbbb298d26560aaa18c37b0defe448df all runs: OK false negative chance: 0.000 # git bisect bad 49b9619c2c22630062e87dee98a298e8c632e3d4 Bisecting: 0 revisions left to test after this (roughly 0 steps) [ea1c243c39e32b7fc1c2edfe32081ff7e30a877c] bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs determine whether the revision contains the guilty commit revision 64ee49df839fd77e7f7f5d2cec3c9435f52f099b crashed and is reachable testing commit ea1c243c39e32b7fc1c2edfe32081ff7e30a877c gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: c3fe037acccff67e37bd24b5efada3af990b8646e7aa49e297c6466dbe021e67 run #0: ignore: lost connection to test machine run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK false negative chance: 0.000 # git bisect bad ea1c243c39e32b7fc1c2edfe32081ff7e30a877c ea1c243c39e32b7fc1c2edfe32081ff7e30a877c is the first bad commit commit ea1c243c39e32b7fc1c2edfe32081ff7e30a877c Author: Deepanshu Kartikey Date: Tue Jun 2 08:22:49 2026 +0530 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs [ Upstream commit b93c55b4932dd7e32dca8cf34a3443cc87a02906 ] commit 4f375ade6aa9 ("bpf: Avoid RCU context warning when unpinning htab with internal structs") moved inode cleanup from ->free_inode() into ->destroy_inode() to avoid sleeping in RCU context when calling bpf_any_put(). However this removed the RCU delay on freeing the inode itself and the cached symlink body (i_link), both of which can be accessed by RCU pathwalk (pick_link, may_lookup etc.). This causes a use-after-free when a concurrent unlinkat() drops the last inode reference and destroy_inode() frees the inode immediately, while another task is still walking the path in RCU mode and reads inode->i_opflags (offset +2) inside current_time() -> is_mgtime(). KASAN reports: BUG: KASAN: slab-use-after-free in is_mgtime include/linux/fs.h:2313 Read of size 2 at addr ffff8880407e4282 (offset +2 = i_opflags) The rules (per Al Viro): ->destroy_inode() called immediately, can sleep, use for blocking cleanup e.g. bpf_any_put() ->free_inode() called after RCU grace period, use for freeing inode and anything RCU-accessible e.g. i_link Fix: split the two concerns properly: - keep bpf_any_put() in bpf_destroy_inode() since it is blocking and needs to run promptly - introduce bpf_free_inode() to handle kfree(i_link) and free_inode_nonrcu() with proper RCU delay, preventing the UAF Fixes: 4f375ade6aa9 ("bpf: Avoid RCU context warning when unpinning htab with internal structs") Reported-by: syzbot+36e50496c8ac4bcde3f9@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=36e50496c8ac4bcde3f9 Suggested-by: Al Viro Link: https://lore.kernel.org/all/20260423043906.GN3518998@ZenIV/ Link: https://lore.kernel.org/all/20260602002607.110866-1-kartikey406@gmail.com/T/ [v1] Signed-off-by: Deepanshu Kartikey Acked-by: Al Viro Link: https://lore.kernel.org/r/20260602025249.113828-1-kartikey406@gmail.com Signed-off-by: Alexei Starovoitov Signed-off-by: Sasha Levin kernel/bpf/inode.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) accumulated error probability: 0.00 culprit signature: c3fe037acccff67e37bd24b5efada3af990b8646e7aa49e297c6466dbe021e67 parent signature: 9cb973154d568006c2c9d25b625a9d469cb91109c431c8f0dcac651f7a5d76c1 revisions tested: 20, total time: 7h4m5.23902807s (build: 43m34.406255566s, test: 5h30m46.655508074s) first good commit: ea1c243c39e32b7fc1c2edfe32081ff7e30a877c bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs recipients (to): ["ast@kernel.org" "kartikey406@gmail.com" "sashal@kernel.org" "viro@zeniv.linux.org.uk"] recipients (cc): []