ci2 starts bisection 2025-11-13 00:06:37.523881931 +0000 UTC m=+39874.540447275 bisecting fixing commit since 462bdb2cb1b1128240c73573ea233571dc856dc7 building syzkaller on 0ac7291ca51f87df8022da0f66178546e855701a ensuring issue is reproducible on original commit 462bdb2cb1b1128240c73573ea233571dc856dc7 testing commit 462bdb2cb1b1128240c73573ea233571dc856dc7 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 91e7e04824926a49a014903673013057661f0fa35c11da096979aa0b10a5ce5e all runs: crashed: general protection fault in bpf_get_local_storage representative crash: general protection fault in bpf_get_local_storage, types: [DoS] check whether we can drop unnecessary instrumentation disabling configs for [ubsan bug_or_warning kasan locking atomic_sleep hang memleak], they are not needed testing commit 462bdb2cb1b1128240c73573ea233571dc856dc7 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 433373239d648f079835809e4c2bc728080dcb6ed3e47880b4019b2f0f9a4f2a all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in bpf_get_local_storage representative crash: BUG: unable to handle kernel NULL pointer dereference in bpf_get_local_storage, types: [NULL-POINTER-DEREFERENCE] the bug reproduces without the instrumentation disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep hang], they are not needed kconfig minimization: base=5186 full=6556 leaves diff=265 split chunks (needed=false): <265> split chunk #0 of len 265 into 5 parts testing without sub-chunk 1/5 disabling configs for [kasan locking atomic_sleep hang memleak ubsan bug_or_warning], they are not needed testing commit 462bdb2cb1b1128240c73573ea233571dc856dc7 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 8ddb1ba14808fcd2df667ba48e62c98b2dbd17e112af92ae0ba44a0ee40414e5 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in bpf_get_local_storage representative crash: BUG: unable to handle kernel NULL pointer dereference in bpf_get_local_storage, types: [NULL-POINTER-DEREFERENCE] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [kasan locking atomic_sleep hang memleak ubsan bug_or_warning], they are not needed testing commit 462bdb2cb1b1128240c73573ea233571dc856dc7 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 1163a814d0302319cc9c7f61e5b53ee944f159ce51a56615d2bea474dcedcd93 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in bpf_get_local_storage representative crash: BUG: unable to handle kernel NULL pointer dereference in bpf_get_local_storage, types: [NULL-POINTER-DEREFERENCE] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [atomic_sleep hang memleak ubsan bug_or_warning kasan locking], they are not needed testing commit 462bdb2cb1b1128240c73573ea233571dc856dc7 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: a22f57dbab2a583277c781d7983c962f966daf889a3abd46e35fc67b24186f82 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in bpf_get_local_storage representative crash: BUG: unable to handle kernel NULL pointer dereference in bpf_get_local_storage, types: [NULL-POINTER-DEREFERENCE] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [bug_or_warning kasan locking atomic_sleep hang memleak ubsan], they are not needed testing commit 462bdb2cb1b1128240c73573ea233571dc856dc7 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: daba41be9ad0b0691ea3e6503993fabc85e5acfe32532f90968351100bb0b48d all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in bpf_get_local_storage representative crash: BUG: unable to handle kernel NULL pointer dereference in bpf_get_local_storage, types: [NULL-POINTER-DEREFERENCE] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [locking atomic_sleep hang memleak ubsan bug_or_warning kasan], they are not needed testing commit 462bdb2cb1b1128240c73573ea233571dc856dc7 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 failed building 462bdb2cb1b1128240c73573ea233571dc856dc7: ld.lld: error: undefined symbol: wext_proc_init ld.lld: error: undefined symbol: wext_proc_exit ld.lld: error: undefined symbol: wext_handle_ioctl ld.lld: error: undefined symbol: compat_wext_handle_ioctl minimized to 53 configs; suspects: [HID_ZEROPLUS USB_MON USB_NET_CDC_MBIM USB_NET_CDC_SUBSET USB_NET_CDC_SUBSET_ENABLE USB_NET_DM9601 USB_NET_GL620A USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM V4L2_ASYNC V4L2_FWNODE VIDEO_CAMERA_SENSOR WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_PURELIFI WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_SILABS WLAN_VENDOR_ZYDAS ZEROPLUS_FF] disabling configs for [hang memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed testing current HEAD c638897860ca9741a28811dd69a43e2c9d685ec6 testing commit c638897860ca9741a28811dd69a43e2c9d685ec6 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 6dba3405a85e2af954cbc2de3fa2300e437f4af075f80cf6837e68de76a186c1 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in bpf_get_local_storage representative crash: BUG: unable to handle kernel NULL pointer dereference in bpf_get_local_storage, types: [NULL-POINTER-DEREFERENCE] crash still not fixed/happens on the oldest tested release revisions tested: 7, total time: 1h10m48.218666182s (build: 21m18.435278951s, test: 46m24.956731363s) crash still not fixed or there were kernel test errors commit msg: ANDROID: usb: gadget: configfs: Add sysfs toggle for in-kernel AOA driver crash: BUG: unable to handle kernel NULL pointer dereference in bpf_get_local_storage BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 110469067 P4D 110469067 PUD 115826067 PMD 0 Oops: 0000 [#1] PREEMPT SMP CPU: 1 PID: 382 Comm: syz-execprog Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 RIP: 0010:____bpf_get_local_storage kernel/bpf/cgroup.c:1575 [inline] RIP: 0010:bpf_get_local_storage+0x27/0x50 kernel/bpf/cgroup.c:1557 Code: 09 47 9e 65 48 8b 05 28 d3 cd 7e 31 c9 83 7f 18 15 0f 94 c1 48 8b 80 c0 0b 00 00 48 8b 00 48 8b 44 c8 08 75 1f 55 48 89 e5 53 <48> 8b 18 e8 d1 c3 d6 00 89 c1 48 89 d8 89 c9 48 03 04 cd a0 39 07 RSP: 0018:ffffc900000d4b10 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888100342af8 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8881110a8800 RBP: ffffc900000d4b18 R08: 00000000ffffefbf R09: 00000000f4521abe R10: ffff888109180000 R11: 000000000000010c R12: ffff888111105f00 R13: ffff888112532428 R14: 0000000000000014 R15: ffffc9000210d000 FS: 000000c00007f898(0000) GS:ffff888237d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010ead5000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: bpf_prog_3647604f6c8667e9+0x25/0x38 bpf_dispatcher_nop_func include/linux/bpf.h:987 [inline] __bpf_prog_run include/linux/filter.h:603 [inline] bpf_prog_run include/linux/filter.h:610 [inline] __bpf_prog_run_save_cb include/linux/filter.h:733 [inline] bpf_prog_run_array_cg kernel/bpf/cgroup.c:68 [inline] __cgroup_bpf_run_filter_skb+0x317/0x500 kernel/bpf/cgroup.c:1427 sk_filter_trim_cap+0x1cc/0x260 net/core/filter.c:141 tcp_filter net/ipv4/tcp_ipv4.c:1911 [inline] tcp_v4_rcv+0x703/0xa80 net/ipv4/tcp_ipv4.c:2093 ip_protocol_deliver_rcu+0xb9/0x1b0 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x73/0xb0 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:305 [inline] ip_local_deliver+0x67/0x100 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:463 [inline] ip_rcv_finish net/ipv4/ip_input.c:449 [inline] NF_HOOK include/linux/netfilter.h:305 [inline] ip_rcv+0x77/0x100 net/ipv4/ip_input.c:569 __netif_receive_skb_one_core net/core/dev.c:5597 [inline] __netif_receive_skb+0x64/0x110 net/core/dev.c:5711 process_backlog+0xdb/0x190 net/core/dev.c:6039 __napi_poll+0x3c/0x1e0 net/core/dev.c:6606 napi_poll net/core/dev.c:6673 [inline] net_rx_action+0x145/0x2a0 net/core/dev.c:6787 handle_softirqs+0x12c/0x330 kernel/softirq.c:642 __do_softirq+0xb/0xd kernel/softirq.c:680 do_softirq+0x81/0xc0 kernel/softirq.c:524 __local_bh_enable_ip+0x63/0x70 kernel/softirq.c:448 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:870 [inline] __dev_queue_xmit+0x5db/0xdd0 net/core/dev.c:4384 dev_queue_xmit include/linux/netdevice.h:3085 [inline] neigh_hh_output include/net/neighbour.h:536 [inline] neigh_output include/net/neighbour.h:550 [inline] ip_finish_output2+0x2f7/0x340 net/ipv4/ip_output.c:228 __ip_finish_output+0x151/0x220 net/ipv4/ip_output.c:-1 ip_finish_output+0x12/0xd0 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:294 [inline] ip_output+0x5b/0x110 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:453 [inline] ip_local_out net/ipv4/ip_output.c:126 [inline] __ip_queue_xmit+0x448/0x460 net/ipv4/ip_output.c:532 ip_queue_xmit+0x10/0x20 net/ipv4/ip_output.c:546 __tcp_transmit_skb+0x743/0xb30 net/ipv4/tcp_output.c:1406 tcp_transmit_skb net/ipv4/tcp_output.c:1424 [inline] tcp_write_xmit+0x708/0x1060 net/ipv4/tcp_output.c:2710 __tcp_push_pending_frames+0x31/0xc0 net/ipv4/tcp_output.c:2895 tcp_push+0xfc/0x100 net/ipv4/tcp.c:734 tcp_sendmsg_locked+0xb9d/0xdc0 net/ipv4/tcp.c:1460 tcp_sendmsg+0x27/0x40 net/ipv4/tcp.c:1488 inet6_sendmsg+0x41/0x50 net/ipv6/af_inet6.c:673 sock_sendmsg_nosec net/socket.c:716 [inline] __sock_sendmsg net/socket.c:728 [inline] sock_write_iter+0xfb/0x150 net/socket.c:1133 call_write_iter include/linux/fs.h:2282 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x346/0x430 fs/read_write.c:584 ksys_write+0x6e/0xe0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x16/0x20 fs/read_write.c:646 x64_sys_call+0x27b/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x40dd0e Code: 24 28 44 8b 44 24 2c e9 70 ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 89 f2 48 89 fa 48 89 ce 48 89 df 0f 05 <48> 3d 01 f0 ff ff 76 15 48 f7 d8 48 89 c1 48 c7 c0 ff ff ff ff 48 RSP: 002b:000000c00001d3e8 EFLAGS: 00000206 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000040dd0e RDX: 0000000000000698 RSI: 000000c0069243e8 RDI: 0000000000000006 RBP: 000000c00001d428 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 000000c00001d558 R13: 0000000000000406 R14: 000000c003da4e00 R15: 000000c006924000 Modules linked in: CR2: 0000000000000000 ---[ end trace 0000000000000000 ]--- RIP: 0010:____bpf_get_local_storage kernel/bpf/cgroup.c:1575 [inline] RIP: 0010:bpf_get_local_storage+0x27/0x50 kernel/bpf/cgroup.c:1557 Code: 09 47 9e 65 48 8b 05 28 d3 cd 7e 31 c9 83 7f 18 15 0f 94 c1 48 8b 80 c0 0b 00 00 48 8b 00 48 8b 44 c8 08 75 1f 55 48 89 e5 53 <48> 8b 18 e8 d1 c3 d6 00 89 c1 48 89 d8 89 c9 48 03 04 cd a0 39 07 RSP: 0018:ffffc900000d4b10 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888100342af8 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8881110a8800 RBP: ffffc900000d4b18 R08: 00000000ffffefbf R09: 00000000f4521abe R10: ffff888109180000 R11: 000000000000010c R12: ffff888111105f00 R13: ffff888112532428 R14: 0000000000000014 R15: ffffc9000210d000 FS: 000000c00007f898(0000) GS:ffff888237d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010ead5000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 09 47 9e or %eax,-0x62(%rdi) 3: 65 48 8b 05 28 d3 cd mov %gs:0x7ecdd328(%rip),%rax # 0x7ecdd333 a: 7e b: 31 c9 xor %ecx,%ecx d: 83 7f 18 15 cmpl $0x15,0x18(%rdi) 11: 0f 94 c1 sete %cl 14: 48 8b 80 c0 0b 00 00 mov 0xbc0(%rax),%rax 1b: 48 8b 00 mov (%rax),%rax 1e: 48 8b 44 c8 08 mov 0x8(%rax,%rcx,8),%rax 23: 75 1f jne 0x44 25: 55 push %rbp 26: 48 89 e5 mov %rsp,%rbp 29: 53 push %rbx * 2a: 48 8b 18 mov (%rax),%rbx <-- trapping instruction 2d: e8 d1 c3 d6 00 call 0xd6c403 32: 89 c1 mov %eax,%ecx 34: 48 89 d8 mov %rbx,%rax 37: 89 c9 mov %ecx,%ecx 39: 48 rex.W 3a: 03 .byte 0x3 3b: 04 cd add $0xcd,%al 3d: a0 .byte 0xa0 3e: 39 07 cmp %eax,(%rdi)