ci starts bisection 2024-07-20 21:31:25.538820527 +0000 UTC m=+82493.282968711 bisecting cause commit starting from 0be9ae5486cd9e767138c13638820d240713f5f1 building syzkaller on b88348e926b1f214763f45a5457bd91aafd36fab ensuring issue is reproducible on original commit 0be9ae5486cd9e767138c13638820d240713f5f1 testing commit 0be9ae5486cd9e767138c13638820d240713f5f1 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 822d5e20b4eb1686036ff0c20b1d586e7961745f794d16e1ddb5368b3a888063 all runs: crashed: WARNING: refcount bug in inet_create representative crash: WARNING: refcount bug in inet_create, types: [WARNING] check whether we can drop unnecessary instrumentation disabling configs for [HANG LEAK UBSAN KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 0be9ae5486cd9e767138c13638820d240713f5f1 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 6def46a3f1797d1f5e36b312a66f7bf7d18e6c90ae00ed8688ee2faba52de496 all runs: crashed: WARNING: refcount bug in inet_create representative crash: WARNING: refcount bug in inet_create, types: [WARNING] the bug reproduces without the instrumentation disabling configs for [UBSAN KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed kconfig minimization: base=4001 full=8050 leaves diff=2006 split chunks (needed=false): <2006> split chunk #0 of len 2006 into 5 parts testing without sub-chunk 1/5 disabling configs for [KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed testing commit 0be9ae5486cd9e767138c13638820d240713f5f1 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 3bfb1b681db867012e06a9edb68e106528b7be2f0144e833b1009ed5371f7d21 all runs: crashed: WARNING: refcount bug in inet_create representative crash: WARNING: refcount bug in inet_create, types: [WARNING] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN KASAN], they are not needed testing commit 0be9ae5486cd9e767138c13638820d240713f5f1 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 7500a1518b924167435683accda4984fe1fbe0010128e88cdde62011eb6b3adf all runs: crashed: WARNING: refcount bug in inet_create representative crash: WARNING: refcount bug in inet_create, types: [WARNING] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [HANG LEAK UBSAN KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 0be9ae5486cd9e767138c13638820d240713f5f1 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: b476db6413374dd0b4ecc0eef5519ed9fe5f793b6f6aa71f759283252e522b6b all runs: crashed: WARNING: refcount bug in inet_create representative crash: WARNING: refcount bug in inet_create, types: [WARNING] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [HANG LEAK UBSAN KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 0be9ae5486cd9e767138c13638820d240713f5f1 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 0ade5ba6de3877859f0a23627e5a6dfbe3c37f01d44b941767b55860f5d71606 all runs: OK false negative chance: 0.000 testing without sub-chunk 5/5 disabling configs for [HANG LEAK UBSAN KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 0be9ae5486cd9e767138c13638820d240713f5f1 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 396e31e040e6a9062a4847650498a610e40758574833f92b4f56c28c065f0c49 all runs: crashed: WARNING: refcount bug in inet_create representative crash: WARNING: refcount bug in inet_create, types: [WARNING] the chunk can be dropped minimized to 402 configs; suspects: [AF_RXRPC ARCH_ENABLE_MEMORY_HOTREMOVE ATM AX25 CFG80211 CMA DAX DLM DVB_CORE ENCRYPTED_KEYS EXTCON GENEVE GPIOLIB HAMRADIO HAVE_CLK HID_SENSOR_HUB HID_SMARTJOYPLUS HID_THRUSTMASTER IIO INFINIBAND INFINIBAND_ADDR_TRANS INFINIBAND_IPOIB INFINIBAND_USER_ACCESS INFINIBAND_VIRT_DMA INPUT_TABLET INPUT_TOUCHSCREEN IP_SCTP L2TP LIBNVDIMM MEDIA_COMMON_OPTIONS MEDIA_DIGITAL_TV_SUPPORT MEDIA_RADIO_SUPPORT MEDIA_SDR_SUPPORT MEDIA_SUPPORT MEDIA_USB_SUPPORT MEMORY_HOTPLUG MEMORY_HOTREMOVE MFD_DLN2 MFD_RETU MMC MTD MTD_UBI NETFILTER_CONNCOUNT NET_IPGRE NET_IPGRE_DEMUX NFS_V4_1 NF_TPROXY_IPV6 NILFS2_FS NLMON NLS_CODEPAGE_1250 NLS_CODEPAGE_1251 NLS_CODEPAGE_737 NLS_CODEPAGE_775 NLS_CODEPAGE_850 NLS_CODEPAGE_852 NLS_CODEPAGE_855 NLS_CODEPAGE_857 NLS_CODEPAGE_860 NLS_CODEPAGE_861 NLS_CODEPAGE_862 NLS_CODEPAGE_863 NLS_CODEPAGE_864 NLS_CODEPAGE_865 NLS_CODEPAGE_866 NLS_CODEPAGE_869 NLS_CODEPAGE_874 NLS_CODEPAGE_932 NLS_CODEPAGE_936 NLS_CODEPAGE_949 NLS_CODEPAGE_950 NLS_ISO8859_13 NLS_ISO8859_14 NLS_ISO8859_15 NLS_ISO8859_2 NLS_ISO8859_3 NLS_ISO8859_4 NLS_ISO8859_5 NLS_ISO8859_6 NLS_ISO8859_7 NLS_ISO8859_8 NLS_ISO8859_9 NLS_KOI8_R NLS_KOI8_U NLS_MAC_CELTIC NLS_MAC_CENTEURO NLS_MAC_CROATIAN NLS_MAC_CYRILLIC NLS_MAC_GAELIC NLS_MAC_GREEK NLS_MAC_ICELAND NLS_MAC_INUIT NLS_MAC_ROMAN NLS_MAC_ROMANIAN NLS_MAC_TURKISH NLS_UCS2_UTILS NOP_USB_XCEIV NOZOMI NTFS3_FS NTFS3_FS_POSIX_ACL NTFS3_LZX_XPRESS NULL_TTY NUMA_BALANCING NUMA_BALANCING_DEFAULT_ENABLED NUMA_EMU NUMA_KEEP_MEMINFO NVDIMM_DAX NVDIMM_KEYS NVDIMM_PFN NVME_CORE NVME_FABRICS NVME_FC NVME_MULTIPATH NVME_RDMA NVME_TARGET NVME_TARGET_FC NVME_TARGET_FCLOOP NVME_TARGET_LOOP NVME_TARGET_RDMA NVME_TARGET_TCP NVME_TCP N_GSM N_HDLC OCFS2_DEBUG_FS OCFS2_FS OCFS2_FS_O2CB OCFS2_FS_STATS OCFS2_FS_USERSPACE_CLUSTER OF_GPIO OF_PMEM OMFS_FS OPENVSWITCH OPENVSWITCH_GENEVE OPENVSWITCH_GRE OPENVSWITCH_VXLAN ORANGEFS_FS OSF_PARTITION OVERLAY_FS OVERLAY_FS_DEBUG OVERLAY_FS_INDEX OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW OVERLAY_FS_REDIRECT_DIR PACKET_DIAG PAGE_IDLE_FLAG PAGE_POOL PAGE_REPORTING PAHOLE_HAS_BTF_TAG PAHOLE_HAS_LANG_EXCLUDE PAHOLE_HAS_SPLIT_BTF PARPORT PARPORT_NOT_PC PARTITION_ADVANCED PCCARD PCCARD_NONSTATIC PCIEAER PCI_ENDPOINT PCI_IOV PCMCIA PCMCIA_LOAD_CIS PERCPU_STATS PERSISTENT_KEYRINGS PHONET PHYLINK PHY_CPCAP_USB PHY_QCOM_USB_HS PHY_QCOM_USB_HSIC PHY_SAMSUNG_USB2 PHY_TUSB1210 PKCS7_TEST_KEY PKCS8_PRIVATE_KEY_PARSER PM_CLK PNFS_BLOCK PNFS_FILE_LAYOUT PNFS_FLEXFILE_LAYOUT PPP PPPOATM PPPOE PPPOE_HASH_BITS_4 PPPOL2TP PPP_ASYNC PPP_BSDCOMP PPP_DEFLATE PPP_FILTER PPP_MPPE PPP_MULTILINK PPP_SYNC_TTY PPTP PREEMPT PREEMPT_NOTIFIERS PROC_CHILDREN PSAMPLE PSI PSTORE PSTORE_COMPRESS QCOM_QMI_HELPERS QNX4FS_FS QNX6FS_FS QRTR QRTR_TUN R8712U RADIO_ADAPTERS RADIO_SHARK RADIO_SHARK2 RADIO_TEA575X RAID6_PQ RAID_ATTRS RC_ATI_REMOTE RC_CORE RC_DEVICES RDMA_RXE RDMA_SIW RDS RDS_RDMA RDS_TCP READ_ONLY_THP_FOR_FS REALTEK_AUTOPM REED_SOLOMON REED_SOLOMON_DEC8 REGMAP REGMAP_I2C REGMAP_IRQ REGMAP_MMIO REGMAP_SPI REGULATOR REGULATOR_TWL4030 REISERFS_FS REISERFS_FS_POSIX_ACL REISERFS_FS_SECURITY REISERFS_FS_XATTR REISERFS_PROC_INFO RESET_CONTROLLER RFKILL RFKILL_INPUT RFKILL_LEDS RMI4_2D_SENSOR RMI4_CORE RMI4_F03 RMI4_F03_SERIO RMI4_F11 RMI4_F12 RMI4_F30 ROMFS_BACKED_BY_BOTH ROMFS_FS ROMFS_ON_BLOCK ROMFS_ON_MTD ROSE RTC_DRV_HID_SENSOR_TIME RXKAD SCHED_CORE SCREEN_INFO SCSI_FC_ATTRS SCSI_HPSA SCSI_ISCSI_ATTRS SCSI_LOGGING SCSI_NETLINK SCSI_SAS_ATA SCSI_SAS_ATTRS SCSI_SAS_LIBSAS SCSI_SCAN_ASYNC SCSI_SRP_ATTRS SCTP_COOKIE_HMAC_MD5 SCTP_COOKIE_HMAC_SHA1 SCTP_DEFAULT_COOKIE_HMAC_MD5 SECONDARY_TRUSTED_KEYRING SECURITY_INFINIBAND SECURITY_NETWORK_XFRM SERIAL_DEV_BUS SERIAL_DEV_CTRL_TTYPORT SERIAL_MCTRL_GPIO SGI_PARTITION SIGNATURE SIGNED_PE_FILE_VERIFICATION SKB_DECRYPTED SLHC SLIP SLIP_COMPRESSED SLIP_MODE_SLIP6 SLIP_SMART SMARTJOYPLUS_FF SMBFS SMC SMC_DIAG SMSC_PHY SMS_SIANO_MDTV SMS_SIANO_RC SMS_USB_DRV SND SND_ALOOP SND_BCD2000 SND_CTL_FAST_LOOKUP SND_CTL_LED SND_DEBUG SND_DMA_SGBUF SND_DRIVERS SND_DUMMY SND_DYNAMIC_MINORS SND_HDA SND_HDA_CODEC_ANALOG SND_HDA_CODEC_CA0110 SND_HDA_CODEC_CA0132 SND_HDA_CODEC_CIRRUS SND_HDA_CODEC_CMEDIA SND_HDA_CODEC_CONEXANT SND_HDA_CODEC_HDMI SND_HDA_CODEC_REALTEK SND_HDA_CODEC_SI3054 SND_HDA_CODEC_SIGMATEL SND_HDA_CODEC_VIA SND_HDA_COMPONENT SND_HDA_CORE SND_HDA_GENERIC SND_HDA_GENERIC_LEDS SND_HDA_HWDEP SND_HDA_I915 SND_HDA_INPUT_BEEP SND_HDA_INTEL SND_HDA_PATCH_LOADER SND_HDA_RECONFIG SND_HDA_SCODEC_COMPONENT SND_HRTIMER SND_HWDEP SND_INTEL_DSP_CONFIG SND_INTEL_NHLT SND_INTEL_SOUNDWIRE_ACPI SND_JACK SND_JACK_INPUT_DEV SND_MIXER_OSS SND_OSSEMUL SND_PCI SND_PCM SND_PCMCIA SND_PCM_OSS SND_PCM_OSS_PLUGINS SND_PCM_TIMER SND_PCM_XRUN_DEBUG SND_PROC_FS SND_RAWMIDI SND_SEQUENCER SND_SEQUENCER_OSS SND_SEQ_DEVICE SND_SEQ_DUMMY SND_SEQ_HRTIMER_DEFAULT SND_SEQ_MIDI SND_SEQ_MIDI_EVENT SND_SEQ_VIRMIDI SND_SOC SND_SOC_I2C_AND_SPI SND_SUPPORT_OLD_API SND_TIMER SND_USB SND_USB_6FIRE SND_USB_AUDIO SND_USB_AUDIO_USE_MEDIA_CONTROLLER SND_USB_CAIAQ SND_USB_CAIAQ_INPUT SND_USB_HIFACE SND_USB_LINE6 SND_USB_POD SND_USB_PODHD SND_USB_TONEPORT SND_USB_UA101 SND_USB_US122L SND_USB_USX2Y SND_USB_VARIAX SND_VERBOSE_PROCFS SND_VIRMIDI SND_VIRTIO SND_VMASTER SND_X86 SOCK_VALIDATE_XMIT SOLARIS_X86_PARTITION SONY_FF SOUND SOUNDWIRE SOUND_OSS_CORE SOUND_OSS_CORE_PRECLAIM SPI SPI_DLN2 SPI_DYNAMIC SPI_MASTER SQUASHFS SQUASHFS_4K_DEVBLK_SIZE SQUASHFS_COMPILE_DECOMP_SINGLE SQUASHFS_DECOMP_SINGLE SQUASHFS_FILE_DIRECT SQUASHFS_LZ4 SQUASHFS_LZO SQUASHFS_XATTR SQUASHFS_XZ SQUASHFS_ZLIB SQUASHFS_ZSTD SSB SSB_PCIHOST_POSSIBLE SSB_PCMCIAHOST_POSSIBLE SSB_SDIOHOST_POSSIBLE STAGING STP STREAM_PARSER SUNRPC_BACKCHANNEL SUN_PARTITION SW_SYNC SYSFB SYSV68_PARTITION SYSV_FS TABLET_USB_ACECAD TABLET_USB_AIPTEK TABLET_USB_HANWANG TABLET_USB_KBTAB TABLET_USB_PEGASUS TAHVO_USB TAHVO_USB_HOST_BY_DEFAULT TASKS_TRACE_RCU TCG_CRB TCG_TIS TCG_TIS_CORE TCG_TPM TCP_CONG_BBR TCP_CONG_BIC TCP_CONG_CDG TCP_CONG_DCTCP TCP_CONG_HSTCP TCP_CONG_HTCP TCP_CONG_HYBLA TCP_CONG_ILLINOIS TCP_CONG_LP TCP_CONG_NV TCP_CONG_SCALABLE TCP_CONG_VEGAS TCP_CONG_VENO TCP_CONG_WESTWOOD TCP_CONG_YEAH TEXTSEARCH TEXTSEARCH_BM TEXTSEARCH_FSM TEXTSEARCH_KMP THERMAL_NETLINK THP_SWAP THRUSTMASTER_FF TIPC TIPC_CRYPTO TIPC_DIAG TIPC_MEDIA_IB TIPC_MEDIA_UDP TLS TLS_TOE TMPFS_QUOTA TOUCHSCREEN_SUR40 TOUCHSCREEN_USB_3M TOUCHSCREEN_USB_COMPOSITE TOUCHSCREEN_USB_DMC_TSC10 TOUCHSCREEN_USB_E2I TOUCHSCREEN_USB_EASYTOUCH TOUCHSCREEN_USB_EGALAX TOUCHSCREEN_USB_ELO TOUCHSCREEN_USB_ETT_TC45USB TOUCHSCREEN_USB_ETURBO TOUCHSCREEN_USB_GENERAL_TOUCH TOUCHSCREEN_USB_GOTOP TOUCHSCREEN_USB_GUNZE TOUCHSCREEN_USB_IDEALTEK TOUCHSCREEN_USB_IRTOUCH TOUCHSCREEN_USB_ITM TOUCHSCREEN_USB_JASTEC TOUCHSCREEN_USB_NEXIO TOUCHSCREEN_USB_PANJIT TOUCHSCREEN_USB_ZYTRONIC TRANSPARENT_HUGEPAGE TRANSPARENT_HUGEPAGE_MADVISE TTPCI_EEPROM TTY_PRINTK TUN_VNET_CROSS_LE TWL4030_CORE TYPEC TYPEC_FUSB302 TYPEC_TCPCI TYPEC_TCPM TYPEC_TPS6598X TYPEC_UCSI UBIFS_ATIME_SUPPORT UBIFS_FS UBIFS_FS_ADVANCED_COMPR UBIFS_FS_LZO UBIFS_FS_SECURITY UBIFS_FS_XATTR UBIFS_FS_ZLIB UBIFS_FS_ZSTD UCSI_ACPI UDF_FS UDMABUF UFS_FS UFS_FS_WRITE UHID ULTRIX_PARTITION UNICODE UNIXWARE_DISKLABEL UNIX_DIAG USB4 USB4_NET USBIP_CORE USBIP_HOST USBIP_VHCI_HCD USBIP_VUDC USBPCWATCHDOG USB_ACM USB_ADUTUX USB_AIRSPY USB_ALI_M5632 USB_AN2720 USB_APPLEDISPLAY USB_ARMLINUX USB_BDC_UDC USB_BELKIN USB_C67X00_HCD USB_CATC USB_CDC_PHONET USB_CHAOSKEY USB_CHIPIDEA USB_CHIPIDEA_HOST USB_CHIPIDEA_PCI USB_CHIPIDEA_UDC USB_CONFIGFS USB_CONFIGFS_ACM USB_CONFIGFS_ECM USB_CONFIGFS_ECM_SUBSET USB_CONFIGFS_EEM USB_CONFIGFS_F_FS USB_DWC2 USB_GADGET USB_MUSB_HDRC USB_NET_CDC_SUBSET USB_ROLE_SWITCH USB_STORAGE_REALTEK USB_ULPI_BUS USB_USBNET VIDEO_DEV VXLAN WIRELESS WLAN ZONE_DEVICE] disabling configs for [HANG LEAK UBSAN KASAN LOCKDEP ATOMIC_SLEEP], they are not needed picked [v6.10 v6.9 v6.8 v6.6 v6.4 v6.2 v6.0 v5.18 v5.15 v5.12 v5.9 v5.6 v5.3 v5.0 v4.19] out of 33 release tags testing release v6.10 testing commit 0c3836482481200ead7b416ca80c68a29cfdaabd gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 9b04ef1b8e9913e8122b36417b0628481d1cabaf226aaf88495bc2679fbd5738 run #0: crashed: lost connection to test machine run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK representative crash: lost connection to test machine, types: [UNKNOWN] unable to determine the verdict: 9 good runs (wanted 5), for bad wanted 5 in total, got 10 testing release v6.9 testing commit a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: a5a4689f15001cef8aa87b17208b8417cd53788db5546f2dc85a1e4e6fff017c all runs: OK false negative chance: 0.000 # git bisect start 0be9ae5486cd9e767138c13638820d240713f5f1 a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6 Bisecting: 9563 revisions left to test after this (roughly 13 steps) [a90f1cd105c6c5c246f07ca371d873d35b78c7d9] Merge tag 'turbostat-for-Linux-6.10-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux testing commit a90f1cd105c6c5c246f07ca371d873d35b78c7d9 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 1c9933ad69e2c25a31031165293264da4ff16f15c2025ddd98755b18a60bf8eb all runs: OK false negative chance: 0.000 # git bisect good a90f1cd105c6c5c246f07ca371d873d35b78c7d9 Bisecting: 4785 revisions left to test after this (roughly 12 steps) [b673f2bda0c9d306e330a236c87706d8de18107a] Merge tag 'riscv-for-linus-6.10-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux testing commit b673f2bda0c9d306e330a236c87706d8de18107a gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 99d026fd93f3f895d02400dd0d78346b097e8d0d7c14a8603c83db69a20941f2 all runs: OK false negative chance: 0.000 # git bisect good b673f2bda0c9d306e330a236c87706d8de18107a Bisecting: 2249 revisions left to test after this (roughly 11 steps) [e3950967f6e6b74a3606739ec50ed19f3398c7d8] Merge tag 'soc-dt-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc testing commit e3950967f6e6b74a3606739ec50ed19f3398c7d8 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: c1a63905f45c8c2c5d330e9c3d093d42d1fe76266f16033c6d9bd4471305ba29 all runs: OK false negative chance: 0.000 # git bisect good e3950967f6e6b74a3606739ec50ed19f3398c7d8 Bisecting: 1125 revisions left to test after this (roughly 10 steps) [dabcfd5e116800496eb9bec2ba7c015ca2043aa0] Merge tag 'mt76-for-kvalo-2024-07-08' of https://github.com/nbd168/wireless testing commit dabcfd5e116800496eb9bec2ba7c015ca2043aa0 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 089573135ed9f4f440829d1d0c0d0c1dc595c7c859618bc5abfe76a67692b54f all runs: crashed: WARNING: refcount bug in inet_create representative crash: WARNING: refcount bug in inet_create, types: [WARNING] # git bisect bad dabcfd5e116800496eb9bec2ba7c015ca2043aa0 Bisecting: 561 revisions left to test after this (roughly 9 steps) [cbfad55322ceee283ff1dd053725b93c86018b88] net: stmmac: dwmac-stm32: Fix Mhz to MHz testing commit cbfad55322ceee283ff1dd053725b93c86018b88 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 255158a1c3975728cbe05181a58b1b79ee3d041aba93871de9da43207bb7de3d all runs: OK false negative chance: 0.000 # git bisect good cbfad55322ceee283ff1dd053725b93c86018b88 Bisecting: 319 revisions left to test after this (roughly 8 steps) [193b9b200224dab4eaec407eb2955303a521f5b6] Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net testing commit 193b9b200224dab4eaec407eb2955303a521f5b6 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 1d82acf80cef1d90b0dc25c7af85527ba31b6380659ed7c4078f000307bf7e3d all runs: crashed: WARNING: refcount bug in inet_create representative crash: WARNING: refcount bug in inet_create, types: [WARNING] # git bisect bad 193b9b200224dab4eaec407eb2955303a521f5b6 Bisecting: 120 revisions left to test after this (roughly 7 steps) [4fce809e4062b7e73642dfb3f5abf86026ea14f0] Merge branch 'l2tp-sk_user_data' testing commit 4fce809e4062b7e73642dfb3f5abf86026ea14f0 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 42a5e47ff03cb1dd01670ad371beaded22a53340bed522acb058e525f2a5affa all runs: crashed: WARNING: refcount bug in inet_create representative crash: WARNING: refcount bug in inet_create, types: [WARNING] # git bisect bad 4fce809e4062b7e73642dfb3f5abf86026ea14f0 Bisecting: 60 revisions left to test after this (roughly 6 steps) [ce9a2424e9da2cd4e790f2498621bc2aa5e5d298] net: raw: use sk_skb_reason_drop to free rx packets testing commit ce9a2424e9da2cd4e790f2498621bc2aa5e5d298 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: fe362799bf12de410c9a9233de8d6640517a7b3464e8d1c473be9b8fc6e4a027 all runs: crashed: WARNING: refcount bug in inet_create representative crash: WARNING: refcount bug in inet_create, types: [WARNING] # git bisect bad ce9a2424e9da2cd4e790f2498621bc2aa5e5d298 Bisecting: 29 revisions left to test after this (roughly 5 steps) [69776921e82d48a165a37438f48c46edf0456275] Merge branch 'mlx5-genl-queue-stats' testing commit 69776921e82d48a165a37438f48c46edf0456275 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 3f850d26c2fca83742b1ad13b1196507fe1c212d83e99845df639467b92499b7 all runs: OK false negative chance: 0.000 # git bisect good 69776921e82d48a165a37438f48c46edf0456275 Bisecting: 14 revisions left to test after this (roughly 4 steps) [e52e010395dc5232f7dd5c271367f4bdd18ab74c] net/mlx4_en: Use ethtool_puts to fill priv flags strings testing commit e52e010395dc5232f7dd5c271367f4bdd18ab74c gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 4792a10dd418e90efb97fc59731a6252fbae7caad8bf2db65ec6aa173e09a6d5 all runs: crashed: WARNING: refcount bug in inet_create representative crash: WARNING: refcount bug in inet_create, types: [WARNING] # git bisect bad e52e010395dc5232f7dd5c271367f4bdd18ab74c Bisecting: 7 revisions left to test after this (roughly 3 steps) [e275e19c918b502aa4534e56dc2e25b5095e9005] net: mana: Use mana_cleanup_port_context() for rxq cleanup testing commit e275e19c918b502aa4534e56dc2e25b5095e9005 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 583fa2cd0ac3120a041ad271fe260c6e328cf5b696a0d4a5c174de1b778fc6ba all runs: crashed: WARNING: refcount bug in inet_create representative crash: WARNING: refcount bug in inet_create, types: [WARNING] # git bisect bad e275e19c918b502aa4534e56dc2e25b5095e9005 Bisecting: 3 revisions left to test after this (roughly 2 steps) [13543d02c90d6195b31bef8fb51dfeff77c0b368] net/smc: expose smc proto operations testing commit 13543d02c90d6195b31bef8fb51dfeff77c0b368 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 4762b7c005bde19c074f2972bbce2377ff1b23b8a5b8140d344338bed7bc28ab all runs: OK false negative chance: 0.000 # git bisect good 13543d02c90d6195b31bef8fb51dfeff77c0b368 Bisecting: 1 revision left to test after this (roughly 1 step) [4314175af49668ab20c0d60d7d7657986e1d0c7c] Merge branch 'net-smc-IPPROTO_SMC' testing commit 4314175af49668ab20c0d60d7d7657986e1d0c7c gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 9603d7b8bd901746e5a94ca662c67c09bbbc254173c6619515da905f90832195 all runs: crashed: WARNING: refcount bug in inet_create representative crash: WARNING: refcount bug in inet_create, types: [WARNING] # git bisect bad 4314175af49668ab20c0d60d7d7657986e1d0c7c Bisecting: 0 revisions left to test after this (roughly 0 steps) [d25a92ccae6bed02327b63d138e12e7806830f78] net/smc: Introduce IPPROTO_SMC testing commit d25a92ccae6bed02327b63d138e12e7806830f78 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 8d65bbe33dc289c74cb78a460951ab4b41773ecd89271e755786b5f65e596360 all runs: crashed: WARNING: refcount bug in inet_create representative crash: WARNING: refcount bug in inet_create, types: [WARNING] # git bisect bad d25a92ccae6bed02327b63d138e12e7806830f78 d25a92ccae6bed02327b63d138e12e7806830f78 is the first bad commit commit d25a92ccae6bed02327b63d138e12e7806830f78 Author: D. Wythe Date: Fri Jun 14 02:00:30 2024 +0800 net/smc: Introduce IPPROTO_SMC This patch allows to create smc socket via AF_INET, similar to the following code, /* create v4 smc sock */ v4 = socket(AF_INET, SOCK_STREAM, IPPROTO_SMC); /* create v6 smc sock */ v6 = socket(AF_INET6, SOCK_STREAM, IPPROTO_SMC); There are several reasons why we believe it is appropriate here: 1. For smc sockets, it actually use IPv4 (AF-INET) or IPv6 (AF-INET6) address. There is no AF_SMC address at all. 2. Create smc socket in the AF_INET(6) path, which allows us to reuse the infrastructure of AF_INET(6) path, such as common ebpf hooks. Otherwise, smc have to implement it again in AF_SMC path. Signed-off-by: D. Wythe Reviewed-by: Wenjia Zhang Reviewed-by: Dust Li Tested-by: Niklas Schnelle Tested-by: Wenjia Zhang Signed-off-by: David S. Miller include/uapi/linux/in.h | 2 + net/smc/Makefile | 2 +- net/smc/af_smc.c | 16 ++++- net/smc/smc_inet.c | 159 ++++++++++++++++++++++++++++++++++++++++++++++++ net/smc/smc_inet.h | 22 +++++++ 5 files changed, 198 insertions(+), 3 deletions(-) create mode 100644 net/smc/smc_inet.c create mode 100644 net/smc/smc_inet.h accumulated error probability: 0.00 culprit signature: 8d65bbe33dc289c74cb78a460951ab4b41773ecd89271e755786b5f65e596360 parent signature: 4762b7c005bde19c074f2972bbce2377ff1b23b8a5b8140d344338bed7bc28ab revisions tested: 23, total time: 7h49m49.454495516s (build: 4h31m58.055435579s, test: 2h59m51.84207075s) first bad commit: d25a92ccae6bed02327b63d138e12e7806830f78 net/smc: Introduce IPPROTO_SMC recipients (to): ["alibuda@linux.alibaba.com" "davem@davemloft.net" "dust.li@linux.alibaba.com" "schnelle@linux.ibm.com" "wenjia@linux.ibm.com"] recipients (cc): [] crash: WARNING: refcount bug in inet_create RSP: 002b:00007f11c3781048 EFLAGS: 00000246 ORIG_RAX: 0000000000000035 RAX: ffffffffffffffda RBX: 00007f11c2b05f60 RCX: 00007f11c2975b59 RDX: 0000000000000100 RSI: 0000000000000001 RDI: 0000000000000002 RBP: 00007f11c37810a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000020000140 R11: 0000000000000246 R12: 0000000000000002 R13: 0000000000000006 R14: 00007f11c2b05f60 R15: 00007ffe5fc37128 socket: no more sockets ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 1 PID: 3555 at lib/refcount.c:28 refcount_warn_saturate+0xad/0x130 lib/refcount.c:28 Modules linked in: CPU: 1 PID: 3555 Comm: syz.0.16 Not tainted 6.10.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 RIP: 0010:refcount_warn_saturate+0xad/0x130 lib/refcount.c:28 Code: 7c ff 90 0f 0b 90 90 c3 cc cc cc cc 80 3d 3e 3b 0d 02 00 75 97 c6 05 35 3b 0d 02 01 90 48 c7 c7 d7 18 21 83 e8 74 62 7c ff 90 <0f> 0b 90 90 c3 cc cc cc cc 80 3d 14 3b 0d 02 00 0f 85 6c ff ff ff RSP: 0018:ffffc9000281fdf8 EFLAGS: 00010246 RAX: a63557c52cac3600 RBX: ffffffff823a984b RCX: 0000000000000002 RDX: ffff88813bd29380 RSI: ffffffff832eb9f9 RDI: 00000000ffffffff RBP: ffff88810dd20000 R08: 0000000000000000 R09: ffffffff836c3f70 R10: ffffc9000281fcc8 R11: ffffc9000281fc70 R12: ffff888111f51900 R13: 0000000000000000 R14: 00000000ffffffe9 R15: 0000000000000004 FS: 00007f11c37816c0(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000140 CR3: 000000010b866000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: inet_create+0x388/0x3b0 net/ipv4/af_inet.c:388 __sock_create+0x183/0x320 net/socket.c:1571 sock_create net/socket.c:1622 [inline] __sys_socketpair+0x10d/0x2d0 net/socket.c:1769 __do_sys_socketpair net/socket.c:1822 [inline] __se_sys_socketpair net/socket.c:1819 [inline] __x64_sys_socketpair+0x18/0x20 net/socket.c:1819 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xe0/0x200 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f11c2975b59 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f11c3781048 EFLAGS: 00000246 ORIG_RAX: 0000000000000035 RAX: ffffffffffffffda RBX: 00007f11c2b05f60 RCX: 00007f11c2975b59 RDX: 0000000000000100 RSI: 0000000000000001 RDI: 0000000000000002 RBP: 00007f11c37810a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000020000140 R11: 0000000000000246 R12: 0000000000000002 R13: 0000000000000006 R14: 00007f11c2b05f60 R15: 00007ffe5fc37128