Re: [syzbot] [block?] kernel BUG in bio_chain

[syzbot <syzbot+f6539d4ce3f775aee0cc@syzkaller.appspotmail.com>]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

SYZFAIL: failed to recv rpc

SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)


Warning: Permanently added '10.128.1.220' (ED25519) to the list of known hosts.
2025/12/08 06:08:45 parsed 1 programs
[   80.568471][ T5835] cgroup: Unknown subsys name 'net'
[   80.737895][ T5835] cgroup: Unknown subsys name 'cpuset'
[   80.747550][ T5835] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   82.378701][ T5835] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   85.176358][ T5846] chnl_net:caif_netlink_parms(): no params data found
[   85.252037][ T5846] bridge0: port 1(bridge_slave_0) entered blocking state
[   85.259854][ T5846] bridge0: port 1(bridge_slave_0) entered disabled state
[   85.267947][ T5846] bridge_slave_0: entered allmulticast mode
[   85.275836][ T5846] bridge_slave_0: entered promiscuous mode
[   85.285305][ T5846] bridge0: port 2(bridge_slave_1) entered blocking state
[   85.292659][ T5846] bridge0: port 2(bridge_slave_1) entered disabled state
[   85.301042][ T5846] bridge_slave_1: entered allmulticast mode
[   85.308395][ T5846] bridge_slave_1: entered promiscuous mode
[   85.339609][ T5846] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   85.351781][ T5846] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   85.383521][ T5846] team0: Port device team_slave_0 added
[   85.391461][ T5846] team0: Port device team_slave_1 added
[   85.418135][ T5846] batman_adv: batadv0: Adding interface: batadv_slave_0
[   85.426158][ T5846] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   85.452312][ T5846] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   85.465292][ T5846] batman_adv: batadv0: Adding interface: batadv_slave_1
[   85.472528][ T5846] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   85.499953][ T5846] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   85.542273][ T5846] hsr_slave_0: entered promiscuous mode
[   85.549470][ T5846] hsr_slave_1: entered promiscuous mode
[   85.698098][ T5846] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   85.710372][ T5846] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   85.720791][ T5846] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   85.731671][ T5846] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   85.763570][ T5846] bridge0: port 2(bridge_slave_1) entered blocking state
[   85.771157][ T5846] bridge0: port 2(bridge_slave_1) entered forwarding state
[   85.779469][ T5846] bridge0: port 1(bridge_slave_0) entered blocking state
[   85.786758][ T5846] bridge0: port 1(bridge_slave_0) entered forwarding state
[   85.841622][ T5846] 8021q: adding VLAN 0 to HW filter on device bond0
[   85.861268][   T12] bridge0: port 1(bridge_slave_0) entered disabled state
[   85.871035][   T12] bridge0: port 2(bridge_slave_1) entered disabled state
[   85.888626][ T5846] 8021q: adding VLAN 0 to HW filter on device team0
[   85.902665][ T1167] bridge0: port 1(bridge_slave_0) entered blocking state
[   85.910991][ T1167] bridge0: port 1(bridge_slave_0) entered forwarding state
[   85.926919][   T12] bridge0: port 2(bridge_slave_1) entered blocking state
[   85.934428][   T12] bridge0: port 2(bridge_slave_1) entered forwarding state
[   86.106940][ T5846] 8021q: adding VLAN 0 to HW filter on device batadv0
[   86.148700][ T5846] veth0_vlan: entered promiscuous mode
[   86.161121][ T5846] veth1_vlan: entered promiscuous mode
[   86.190643][ T5846] veth0_macvtap: entered promiscuous mode
[   86.201565][ T5846] veth1_macvtap: entered promiscuous mode
[   86.221704][ T5846] batman_adv: batadv0: Interface activated: batadv_slave_0
[   86.238028][ T5846] batman_adv: batadv0: Interface activated: batadv_slave_1
[   86.255901][ T1167] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   86.267532][ T1167] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   86.282145][ T1167] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   86.291809][ T1167] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   86.358097][ T5846] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   86.499947][ T1130] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   86.579593][ T1130] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   86.653786][ T1130] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   86.773456][ T1130] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   86.920449][  T980] cfg80211: failed to load regulatory.db
[   88.255927][   T52] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   88.269511][   T52] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   88.278235][   T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   88.286903][   T52] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   88.295498][   T52] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   88.606147][   T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   88.618956][   T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   88.649294][ T3455] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   88.658849][ T3455] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   89.147456][ T1130] bridge_slave_1: left allmulticast mode
[   89.153339][ T1130] bridge_slave_1: left promiscuous mode
[   89.162769][ T1130] bridge0: port 2(bridge_slave_1) entered disabled state
[   89.198441][ T1130] bridge_slave_0: left allmulticast mode
[   89.208602][ T1130] bridge_slave_0: left promiscuous mode
[   89.214467][ T1130] bridge0: port 1(bridge_slave_0) entered disabled state
[   89.471176][ T1130] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   89.482915][ T1130] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   89.493918][ T1130] bond0 (unregistering): Released all slaves
[   89.606581][ T1130] hsr_slave_0: left promiscuous mode
[   89.614935][ T1130] hsr_slave_1: left promiscuous mode
[   89.621473][ T1130] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   89.629576][ T1130] batman_adv: batadv0: Removing interface: batadv_slave_0
[   89.639972][ T1130] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   89.648991][ T1130] batman_adv: batadv0: Removing interface: batadv_slave_1
[   89.678051][ T1130] veth1_macvtap: left promiscuous mode
[   89.683876][ T1130] veth0_macvtap: left promiscuous mode
[   89.695563][ T1130] veth1_vlan: left promiscuous mode
[   89.701061][ T1130] veth0_vlan: left promiscuous mode
[   90.151748][ T1130] team0 (unregistering): Port device team_slave_1 removed
[   90.180639][ T1130] team0 (unregistering): Port device team_slave_0 removed
2025/12/08 06:08:58 executed programs: 0
[   91.531760][ T5151] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   91.542382][ T5151] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   91.555029][ T5151] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   91.575161][ T5151] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   91.583559][ T5151] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   92.038753][ T5975] chnl_net:caif_netlink_parms(): no params data found
[   92.337812][ T5975] bridge0: port 1(bridge_slave_0) entered blocking state
[   92.353902][ T5975] bridge0: port 1(bridge_slave_0) entered disabled state
[   92.361276][ T5975] bridge_slave_0: entered allmulticast mode
[   92.370465][ T5975] bridge_slave_0: entered promiscuous mode
[   92.390146][ T5975] bridge0: port 2(bridge_slave_1) entered blocking state
[   92.400511][ T5975] bridge0: port 2(bridge_slave_1) entered disabled state
[   92.409232][ T5975] bridge_slave_1: entered allmulticast mode
[   92.419786][ T5975] bridge_slave_1: entered promiscuous mode
[   92.498010][ T5975] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   92.510867][ T5975] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   92.553735][ T5975] team0: Port device team_slave_0 added
[   92.562693][ T5975] team0: Port device team_slave_1 added
[   92.606007][ T5975] batman_adv: batadv0: Adding interface: batadv_slave_0
[   92.613249][ T5975] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   92.640999][ T5975] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   92.654890][ T5975] batman_adv: batadv0: Adding interface: batadv_slave_1
[   92.661922][ T5975] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   92.689373][ T5975] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   92.812894][ T5975] hsr_slave_0: entered promiscuous mode
[   92.835971][ T5975] hsr_slave_1: entered promiscuous mode
[   93.511142][ T5975] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   93.527073][ T5975] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   93.539458][ T5975] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   93.552749][ T5975] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   93.636218][   T52] Bluetooth: hci0: command tx timeout
[   93.674308][ T5975] 8021q: adding VLAN 0 to HW filter on device bond0
[   93.699493][ T5975] 8021q: adding VLAN 0 to HW filter on device team0
[   93.713279][ T1167] bridge0: port 1(bridge_slave_0) entered blocking state
[   93.721106][ T1167] bridge0: port 1(bridge_slave_0) entered forwarding state
[   93.749309][ T1167] bridge0: port 2(bridge_slave_1) entered blocking state
[   93.756886][ T1167] bridge0: port 2(bridge_slave_1) entered forwarding state
[   94.005681][ T5975] 8021q: adding VLAN 0 to HW filter on device batadv0
[   94.073867][ T5975] veth0_vlan: entered promiscuous mode
[   94.089021][ T5975] veth1_vlan: entered promiscuous mode
[   94.135082][ T5975] veth0_macvtap: entered promiscuous mode
[   94.148238][ T5975] veth1_macvtap: entered promiscuous mode
[   94.177415][ T5975] batman_adv: batadv0: Interface activated: batadv_slave_0
[   94.196611][ T5975] batman_adv: batadv0: Interface activated: batadv_slave_1
[   94.214009][ T1130] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   94.222880][ T1130] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   94.257357][ T1130] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   94.283049][ T1130] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   94.334841][   T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   94.342899][   T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   94.399046][   T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   94.408247][   T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)


syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3183255281=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.4'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at d6526ea3e
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d6526ea3e6ad9081c902859bbb80f9f840377cb4 -X github.com/google/syzkaller/prog.gitRevisionDate=20251126-113115"  ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d6526ea3e6ad9081c902859bbb80f9f840377cb4 -X github.com/google/syzkaller/prog.gitRevisionDate=20251126-113115"  ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d6526ea3e6ad9081c902859bbb80f9f840377cb4 -X github.com/google/syzkaller/prog.gitRevisionDate=20251126-113115"  -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"d6526ea3e6ad9081c902859bbb80f9f840377cb4\"
/usr/bin/ld: /tmp/ccCOMUne.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null



Tested on:

commit:         82bcd04d Add linux-next specific files for 20251208
git tree:       linux-next
kernel config:  https://syzkaller.appspot.com/x/.config?x=a94030c847137a18
dashboard link: https://syzkaller.appspot.com/bug?extid=f6539d4ce3f775aee0cc
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=122fd21a580000