From: syzbot ci <syzbot+ci3d302dfdee3ed7e8@syzkaller.appspotmail.com>
To: 2407018371@qq.com, a.hindborg@kernel.org,
ada.coupriediaz@arm.com, adilger.kernel@dilger.ca,
akpm@linux-foundation.org, alex.gaynor@gmail.com,
alexander.shishkin@linux.intel.com, aliceryhl@google.com,
amir73il@gmail.com, andi.shyti@kernel.org, andrii@kernel.org,
anna@kernel.org, arnd@arndb.de, ast@kernel.org,
bagasdotme@gmail.com, baolin.wang@linux.alibaba.com,
bigeasy@linutronix.de, bjorn3_gh@protonmail.com,
boqun.feng@gmail.com, bp@alien8.de, brauner@kernel.org,
broonie@kernel.org, bsegall@google.com, byungchul@sk.com,
catalin.marinas@arm.com, chenhuacai@kernel.org,
chris.p.wilson@intel.com, christian.koenig@amd.com,
chuck.lever@oracle.com, cl@linux.com, clrkwllms@kernel.org,
corbet@lwn.net, da.gomez@kernel.org, dai.ngo@oracle.com,
dakr@kernel.org, damien.lemoal@opensource.wdc.com,
dan.j.williams@intel.com, daniel.vetter@ffwll.ch,
dave.hansen@intel.com, david@fromorbit.com, dennis@kernel.org,
dietmar.eggemann@arm.com, djwong@kernel.org,
dri-devel@lists.freedesktop.org, duyuyang@gmail.com,
dwmw@amazon.co.uk, francesco@valla.it, frederic@kernel.org,
gary@garyguo.net, geert@glider.be
Cc: syzbot@lists.linux.dev, syzkaller-bugs@googlegroups.com
Subject: [syzbot ci] Re: DEPT(DEPendency Tracker)
Date: Mon, 06 Jul 2026 04:32:59 -0700 [thread overview]
Message-ID: <6a4b926b.b42ede87.8bd1.0024.GAE@google.com> (raw)
In-Reply-To: <20260706061928.66713-1-byungchul@sk.com>
syzbot ci has tested the following series
[v19] DEPT(DEPendency Tracker)
https://lore.kernel.org/all/20260706061928.66713-1-byungchul@sk.com
* [PATCH v19 01/40] dept: implement DEPT(DEPendency Tracker)
* [PATCH v19 02/40] dept: add single event dependency tracker APIs
* [PATCH v19 03/40] dept: add lock dependency tracker APIs
* [PATCH v19 04/40] dept: tie to lockdep and IRQ tracing
* [PATCH v19 05/40] dept: add proc knobs to show stats and dependency graph
* [PATCH v19 06/40] dept: distinguish each kernel context from another
* [PATCH v19 07/40] dept: distinguish each work from another
* [PATCH v19 08/40] dept: add a mechanism to refill the internal memory pools on running out
* [PATCH v19 09/40] dept: record the latest one out of consecutive waits of the same class
* [PATCH v19 10/40] dept: apply sdt_might_sleep_{start,end}() to wait_for_completion()/complete()
* [PATCH v19 11/40] dept: apply sdt_might_sleep_{start,end}() to swait
* [PATCH v19 12/40] dept: apply sdt_might_sleep_{start,end}() to waitqueue wait
* [PATCH v19 13/40] dept: apply sdt_might_sleep_{start,end}() to hashed-waitqueue wait
* [PATCH v19 14/40] dept: apply sdt_might_sleep_{start,end}() to dma fence
* [PATCH v19 15/40] dept: track timeout waits separately with a new Kconfig
* [PATCH v19 16/40] dept: apply timeout consideration to wait_for_completion()/complete()
* [PATCH v19 17/40] dept: apply timeout consideration to swait
* [PATCH v19 18/40] dept: apply timeout consideration to waitqueue wait
* [PATCH v19 19/40] dept: apply timeout consideration to hashed-waitqueue wait
* [PATCH v19 20/40] dept: apply timeout consideration to dma fence wait
* [PATCH v19 21/40] dept: make dept able to work with an external wgen
* [PATCH v19 22/40] dept: track PG_locked with dept
* [PATCH v19 23/40] dept: print staged wait's stacktrace on report
* [PATCH v19 24/40] locking/lockdep: prevent various lockdep assertions when lockdep_off()'ed
* [PATCH v19 25/40] dept: add documents for dept
* [PATCH v19 26/40] cpu/hotplug: use a weaker annotation in AP thread
* [PATCH v19 27/40] dept: assign dept map to mmu notifier invalidation synchronization
* [PATCH v19 28/40] dept: assign unique dept_key to each distinct dma fence caller
* [PATCH v19 29/40] dept: make dept aware of lockdep_set_lock_cmp_fn() annotation
* [PATCH v19 30/40] dept: make dept stop from working on debug_locks_off()
* [PATCH v19 31/40] dept: assign unique dept_key to each distinct wait_for_completion() caller
* [PATCH v19 32/40] completion, dept: introduce init_completion_dmap() API
* [PATCH v19 33/40] dept: call dept_hardirqs_off() in local_irq_*() regardless of irq state
* [PATCH v19 34/40] rcu/update: fix same dept key collision between various types of RCU
* [PATCH v19 35/40] dept: introduce APIs to set page usage and use subclasses_evt for the usage
* [PATCH v19 36/40] dept: track PG_writeback with dept
* [PATCH v19 37/40] SUNRPC: relocate struct rcu_head to the first field of struct rpc_xprt
* [PATCH v19 38/40] mm: percpu: increase PERCPU_DYNAMIC_SIZE_SHIFT on DEPT and large PAGE_SIZE
* [PATCH v19 39/40] rust: completion: Add __rust_helper to rust_helper_wait_for_completion()
* [PATCH v19 40/40] dept: implement a basic unit test for dept
and found the following issue:
KASAN: slab-use-after-free Read in __dept_wait
Full report is available here:
https://ci.syzbot.org/series/bad70fd4-71dd-485d-92ef-f266796152e3
***
KASAN: slab-use-after-free Read in __dept_wait
tree: bpf-next
URL: https://kernel.googlesource.com/pub/scm/linux/kernel/git/bpf/bpf-next.git
base: 028ef9c96e96197026887c0f092424679298aae8
arch: amd64
compiler: Debian clang version 22.1.6 (++20260514074242+fc4aad7b5db3-1~exp1~20260514074407.73), Debian LLD 22.1.6
config: https://ci.syzbot.org/builds/e0007242-bbfe-42b9-ad3e-e15fe3f29261/config
syz repro: https://ci.syzbot.org/findings/1c2fe55b-5fa6-4b20-a73c-b9bbc70528f7/syz_repro
==================================================================
BUG: KASAN: slab-use-after-free in lockdep_cmp_fn kernel/dependency/dept.c:1647 [inline]
BUG: KASAN: slab-use-after-free in add_wait kernel/dependency/dept.c:1710 [inline]
BUG: KASAN: slab-use-after-free in __dept_wait+0xe66/0x1b70 kernel/dependency/dept.c:2422
Read of size 8 at addr ffff8881a7a30190 by task syz.1.18/5874
CPU: 1 UID: 0 PID: 5874 Comm: syz.1.18 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
<IRQ>
dump_stack_lvl+0xed/0x160 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xbe/0x230 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
lockdep_cmp_fn kernel/dependency/dept.c:1647 [inline]
add_wait kernel/dependency/dept.c:1710 [inline]
__dept_wait+0xe66/0x1b70 kernel/dependency/dept.c:2422
dept_wait+0x135/0x1a0 kernel/dependency/dept.c:2483
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline]
_raw_spin_lock_irqsave+0x5b/0xc0 kernel/locking/spinlock.c:162
debug_object_active_state+0x77/0x390 lib/debugobjects.c:1063
debug_rcu_head_unqueue kernel/rcu/rcu.h:246 [inline]
rcu_do_batch kernel/rcu/tree.c:2609 [inline]
rcu_core+0x6f9/0xff0 kernel/rcu/tree.c:2869
handle_softirqs+0x231/0x890 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x66/0x150 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:lock_acquire+0x20b/0x2e0 kernel/locking/lockdep.c:5893
Code: e9 30 ff ff ff e8 c5 62 fd 09 f7 c3 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 d1 2e 84 11 48 3b 44 24 30 75 33 fb 48 83 c4 38 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 48 8d 3d 6e 8d 82
RSP: 0018:ffffc900041e74a8 EFLAGS: 00000282
RAX: e0efb026e1546b00 RBX: 0000000000000246 RCX: 0000000000000046
RDX: 00000000279c9488 RSI: ffffffff8e150025 RDI: ffffffff8c281c40
RBP: 0000000000000000 R08: ffffffff81764955 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff8e7da2a0 R12: 0000000000000002
R13: ffffffff8e7da2a0 R14: 0000000000000000 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
rcu_read_lock include/linux/rcupdate.h:850 [inline]
class_rcu_constructor include/linux/rcupdate.h:1193 [inline]
unwind_next_frame+0xb2/0x2380 arch/x86/kernel/unwind_orc.c:495
__unwind_start+0x4f2/0x640 arch/x86/kernel/unwind_orc.c:773
unwind_start arch/x86/include/asm/unwind.h:64 [inline]
arch_stack_walk+0xe3/0x150 arch/x86/kernel/stacktrace.c:24
stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2685 [inline]
slab_free mm/slub.c:6165 [inline]
kfree+0x1c5/0x640 mm/slub.c:6483
xfs_mountfs+0x1458/0x2350 fs/xfs/xfs_mount.c:1280
xfs_fs_fill_super+0x11a2/0x15f0 fs/xfs/xfs_super.c:1938
get_tree_bdev_flags+0x430/0x4f0 fs/super.c:1694
vfs_get_tree+0x92/0x2a0 fs/super.c:1754
fc_mount fs/namespace.c:1193 [inline]
do_new_mount_fc fs/namespace.c:3763 [inline]
do_new_mount+0x319/0xdd0 fs/namespace.c:3839
do_mount fs/namespace.c:4172 [inline]
__do_sys_mount fs/namespace.c:4361 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4338
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x175/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6977f9e0ca
Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6978ec5e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f6978ec5ee0 RCX: 00007f6977f9e0ca
RDX: 0000200000000040 RSI: 00002000000000c0 RDI: 00007f6978ec5ea0
RBP: 0000200000000040 R08: 00007f6978ec5ee0 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000246 R12: 00002000000000c0
R13: 00007f6978ec5ea0 R14: 0000000000009888 R15: 0000200000000080
</TASK>
Allocated by task 5874:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4538 [inline]
slab_alloc_node mm/slub.c:4866 [inline]
kmem_cache_alloc_lru_noprof+0x2b4/0x640 mm/slub.c:4885
xfs_inode_alloc+0x7e/0x710 fs/xfs/xfs_icache.c:97
xfs_iget_cache_miss fs/xfs/xfs_icache.c:637 [inline]
xfs_iget+0xa6b/0x2ef0 fs/xfs/xfs_icache.c:808
xfs_mountfs+0x1165/0x2350 fs/xfs/xfs_mount.c:1073
xfs_fs_fill_super+0x11a2/0x15f0 fs/xfs/xfs_super.c:1938
get_tree_bdev_flags+0x430/0x4f0 fs/super.c:1694
vfs_get_tree+0x92/0x2a0 fs/super.c:1754
fc_mount fs/namespace.c:1193 [inline]
do_new_mount_fc fs/namespace.c:3763 [inline]
do_new_mount+0x319/0xdd0 fs/namespace.c:3839
do_mount fs/namespace.c:4172 [inline]
__do_sys_mount fs/namespace.c:4361 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4338
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x175/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 5874:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2685 [inline]
slab_free mm/slub.c:6165 [inline]
kmem_cache_free+0x18c/0x630 mm/slub.c:6295
rcu_do_batch kernel/rcu/tree.c:2617 [inline]
rcu_core+0x794/0xff0 kernel/rcu/tree.c:2869
handle_softirqs+0x231/0x890 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x66/0x150 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
Last potentially related work creation:
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:57
kasan_record_aux_stack+0xcb/0xe0 mm/kasan/generic.c:556
__call_rcu_common kernel/rcu/tree.c:3131 [inline]
call_rcu+0xf7/0x890 kernel/rcu/tree.c:3251
xfs_reclaim_inode fs/xfs/xfs_icache.c:1049 [inline]
xfs_icwalk_process_inode fs/xfs/xfs_icache.c:1736 [inline]
xfs_icwalk_ag+0x1204/0x18c0 fs/xfs/xfs_icache.c:1818
xfs_icwalk fs/xfs/xfs_icache.c:1866 [inline]
xfs_reclaim_inodes+0x1b6/0x2b0 fs/xfs/xfs_icache.c:1082
xfs_unmount_flush_inodes+0xb1/0xd0 fs/xfs/xfs_mount.c:628
xfs_mountfs+0x1325/0x2350 fs/xfs/xfs_mount.c:1267
xfs_fs_fill_super+0x11a2/0x15f0 fs/xfs/xfs_super.c:1938
get_tree_bdev_flags+0x430/0x4f0 fs/super.c:1694
vfs_get_tree+0x92/0x2a0 fs/super.c:1754
fc_mount fs/namespace.c:1193 [inline]
do_new_mount_fc fs/namespace.c:3763 [inline]
do_new_mount+0x319/0xdd0 fs/namespace.c:3839
do_mount fs/namespace.c:4172 [inline]
__do_sys_mount fs/namespace.c:4361 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4338
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x175/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff8881a7a30000
which belongs to the cache xfs_inode of size 2672
The buggy address is located 400 bytes inside of
freed 2672-byte region [ffff8881a7a30000, ffff8881a7a30a70)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8881a7a30b00 pfn:0x1a7a30
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff8881a7a37901
flags: 0x57ff00000000240(workingset|head|node=1|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 057ff00000000240 ffff8881604168c0 ffff888163eabc88 ffff888163eabc88
raw: ffff8881a7a30b00 00000008000b0001 00000000f5000000 ffff8881a7a37901
raw: 0000000000000000 0000000000000000
head: 057ff00000000240 ffff8881604168c0 ffff888163eabc88 ffff888163eabc88
head: ffff8881a7a30b00 00000008000b0001 00000000f5000000 ffff8881a7a37901
head: 0000000000000000 0000000000000000 057ff00000000003 ffffea0008462f01
head: 00000000ffffffff 00000000ffffffff ffffffffffffffff 0000000000000000
head: 00000000ffffffff 0000000000000008 0000000000000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5874, tgid 5873 (syz.1.18), ts 154889839111, free_ts 140490269358
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x239/0x290 mm/page_alloc.c:1889
prep_new_page mm/page_alloc.c:1897 [inline]
get_page_from_freelist+0x2541/0x25e0 mm/page_alloc.c:3962
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5250
alloc_slab_page mm/slub.c:3292 [inline]
allocate_slab+0x77/0x6a0 mm/slub.c:3481
new_slab mm/slub.c:3539 [inline]
refill_objects+0x331/0x3c0 mm/slub.c:7175
refill_sheaf mm/slub.c:2812 [inline]
alloc_full_sheaf mm/slub.c:2834 [inline]
__pcs_replace_empty_main+0x428/0x760 mm/slub.c:4626
alloc_from_pcs mm/slub.c:4717 [inline]
slab_alloc_node mm/slub.c:4851 [inline]
kmem_cache_alloc_lru_noprof+0x372/0x640 mm/slub.c:4885
xfs_inode_alloc+0x7e/0x710 fs/xfs/xfs_icache.c:97
xfs_iget_cache_miss fs/xfs/xfs_icache.c:637 [inline]
xfs_iget+0xa6b/0x2ef0 fs/xfs/xfs_icache.c:808
xfs_mountfs+0x1165/0x2350 fs/xfs/xfs_mount.c:1073
xfs_fs_fill_super+0x11a2/0x15f0 fs/xfs/xfs_super.c:1938
get_tree_bdev_flags+0x430/0x4f0 fs/super.c:1694
vfs_get_tree+0x92/0x2a0 fs/super.c:1754
fc_mount fs/namespace.c:1193 [inline]
do_new_mount_fc fs/namespace.c:3763 [inline]
do_new_mount+0x319/0xdd0 fs/namespace.c:3839
do_mount fs/namespace.c:4172 [inline]
__do_sys_mount fs/namespace.c:4361 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4338
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x175/0xf80 arch/x86/entry/syscall_64.c:94
page last free pid 5668 tgid 5668 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1433 [inline]
__free_frozen_pages+0xc81/0xe10 mm/page_alloc.c:2978
vfree+0x25b/0x400 mm/vmalloc.c:3479
kcov_put kernel/kcov.c:444 [inline]
kcov_close+0x2e/0x60 kernel/kcov.c:543
__fput+0x440/0xa80 fs/file_table.c:469
task_work_run+0x1d9/0x270 kernel/task_work.c:233
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x73a/0x2470 kernel/exit.c:976
do_group_exit+0x22d/0x2f0 kernel/exit.c:1119
get_signal+0x121b/0x12c0 kernel/signal.c:3034
arch_do_signal_or_restart+0xbb/0x810 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
exit_to_user_mode_loop+0xa8/0x5f0 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:260 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x37e/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff8881a7a30080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881a7a30100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8881a7a30180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881a7a30200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881a7a30280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
0: e9 30 ff ff ff jmp 0xffffff35
5: e8 c5 62 fd 09 call 0x9fd62cf
a: f7 c3 00 02 00 00 test $0x200,%ebx
10: 0f 84 38 ff ff ff je 0xffffff4e
16: 65 48 8b 05 d1 2e 84 mov %gs:0x11842ed1(%rip),%rax # 0x11842eef
1d: 11
1e: 48 3b 44 24 30 cmp 0x30(%rsp),%rax
23: 75 33 jne 0x58
25: fb sti
26: 48 83 c4 38 add $0x38,%rsp
* 2a: 5b pop %rbx <-- trapping instruction
2b: 41 5c pop %r12
2d: 41 5d pop %r13
2f: 41 5e pop %r14
31: 41 5f pop %r15
33: 5d pop %rbp
34: c3 ret
35: cc int3
36: cc int3
37: cc int3
38: cc int3
39: cc int3
3a: 48 rex.W
3b: 8d .byte 0x8d
3c: 3d .byte 0x3d
3d: 6e outsb %ds:(%rsi),(%dx)
3e: 8d .byte 0x8d
3f: 82 .byte 0x82
***
If these findings have caused you to resend the series or submit a
separate fix, please add the following tag to your commit message:
Tested-by: syzbot@syzkaller.appspotmail.com
---
This report is generated by a bot. It may contain errors.
syzbot ci engineers can be reached at syzkaller@googlegroups.com.
To test a patch for this bug, please reply with `#syz test`
(should be on a separate line).
The patch should be attached to the email.
Note: arguments like custom git repos and branches are not supported.
prev parent reply other threads:[~2026-07-06 11:33 UTC|newest]
Thread overview: 81+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-06 6:18 [PATCH v19 00/40] DEPT(DEPendency Tracker) Byungchul Park
2026-07-06 6:18 ` [PATCH v19 01/40] dept: implement " Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:18 ` [PATCH v19 02/40] dept: add single event dependency tracker APIs Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:18 ` [PATCH v19 03/40] dept: add lock " Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:18 ` [PATCH v19 04/40] dept: tie to lockdep and IRQ tracing Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:18 ` [PATCH v19 05/40] dept: add proc knobs to show stats and dependency graph Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:18 ` [PATCH v19 06/40] dept: distinguish each kernel context from another Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:18 ` [PATCH v19 07/40] dept: distinguish each work " Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:18 ` [PATCH v19 08/40] dept: add a mechanism to refill the internal memory pools on running out Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:18 ` [PATCH v19 09/40] dept: record the latest one out of consecutive waits of the same class Byungchul Park
2026-07-06 6:18 ` [PATCH v19 10/40] dept: apply sdt_might_sleep_{start,end}() to wait_for_completion()/complete() Byungchul Park
2026-07-06 6:18 ` [PATCH v19 10/40] dept: apply sdt_might_sleep_{start, end}() " Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:18 ` [PATCH v19 11/40] dept: apply sdt_might_sleep_{start,end}() to swait Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:19 ` [PATCH v19 12/40] dept: apply sdt_might_sleep_{start,end}() to waitqueue wait Byungchul Park
2026-07-06 6:19 ` [PATCH v19 12/40] dept: apply sdt_might_sleep_{start, end}() " Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:19 ` [PATCH v19 13/40] dept: apply sdt_might_sleep_{start,end}() to hashed-waitqueue wait Byungchul Park
2026-07-06 6:19 ` [PATCH v19 13/40] dept: apply sdt_might_sleep_{start, end}() " Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:19 ` [PATCH v19 14/40] dept: apply sdt_might_sleep_{start,end}() to dma fence Byungchul Park
2026-07-06 6:19 ` [PATCH v19 14/40] dept: apply sdt_might_sleep_{start, end}() " Byungchul Park
2026-07-06 6:19 ` [PATCH v19 15/40] dept: track timeout waits separately with a new Kconfig Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:19 ` [PATCH v19 16/40] dept: apply timeout consideration to wait_for_completion()/complete() Byungchul Park
2026-07-06 6:19 ` [PATCH v19 17/40] dept: apply timeout consideration to swait Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:19 ` [PATCH v19 18/40] dept: apply timeout consideration to waitqueue wait Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:19 ` [PATCH v19 19/40] dept: apply timeout consideration to hashed-waitqueue wait Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:19 ` [PATCH v19 20/40] dept: apply timeout consideration to dma fence wait Byungchul Park
2026-07-06 6:19 ` [PATCH v19 21/40] dept: make dept able to work with an external wgen Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:19 ` [PATCH v19 22/40] dept: track PG_locked with dept Byungchul Park
2026-07-06 18:05 ` Matthew Wilcox
2026-07-07 2:35 ` Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:19 ` [PATCH v19 23/40] dept: print staged wait's stacktrace on report Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:19 ` [PATCH v19 24/40] locking/lockdep: prevent various lockdep assertions when lockdep_off()'ed Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:19 ` [PATCH v19 25/40] dept: add documents for dept Byungchul Park
2026-07-06 6:19 ` [PATCH v19 26/40] cpu/hotplug: use a weaker annotation in AP thread Byungchul Park
2026-07-06 6:19 ` [PATCH v19 27/40] dept: assign dept map to mmu notifier invalidation synchronization Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:19 ` [PATCH v19 28/40] dept: assign unique dept_key to each distinct dma fence caller Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:19 ` [PATCH v19 29/40] dept: make dept aware of lockdep_set_lock_cmp_fn() annotation Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:19 ` [PATCH v19 30/40] dept: make dept stop from working on debug_locks_off() Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:19 ` [PATCH v19 31/40] dept: assign unique dept_key to each distinct wait_for_completion() caller Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-07 14:18 ` Gary Guo
2026-07-06 6:19 ` [PATCH v19 32/40] completion, dept: introduce init_completion_dmap() API Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:19 ` [PATCH v19 33/40] dept: call dept_hardirqs_off() in local_irq_*() regardless of irq state Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:19 ` [PATCH v19 34/40] rcu/update: fix same dept key collision between various types of RCU Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:19 ` [PATCH v19 35/40] dept: introduce APIs to set page usage and use subclasses_evt for the usage Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:19 ` [PATCH v19 36/40] dept: track PG_writeback with dept Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:19 ` [PATCH v19 37/40] SUNRPC: relocate struct rcu_head to the first field of struct rpc_xprt Byungchul Park
2026-07-06 6:19 ` [PATCH v19 38/40] mm: percpu: increase PERCPU_DYNAMIC_SIZE_SHIFT on DEPT and large PAGE_SIZE Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 6:19 ` [PATCH v19 39/40] rust: completion: Add __rust_helper to rust_helper_wait_for_completion() Byungchul Park
2026-07-06 6:19 ` [PATCH v19 40/40] dept: implement a basic unit test for dept Byungchul Park
2026-07-07 7:33 ` sashiko-bot
2026-07-06 11:32 ` syzbot ci [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a4b926b.b42ede87.8bd1.0024.GAE@google.com \
--to=syzbot+ci3d302dfdee3ed7e8@syzkaller.appspotmail.com \
--cc=2407018371@qq.com \
--cc=a.hindborg@kernel.org \
--cc=ada.coupriediaz@arm.com \
--cc=adilger.kernel@dilger.ca \
--cc=akpm@linux-foundation.org \
--cc=alex.gaynor@gmail.com \
--cc=alexander.shishkin@linux.intel.com \
--cc=aliceryhl@google.com \
--cc=amir73il@gmail.com \
--cc=andi.shyti@kernel.org \
--cc=andrii@kernel.org \
--cc=anna@kernel.org \
--cc=arnd@arndb.de \
--cc=ast@kernel.org \
--cc=bagasdotme@gmail.com \
--cc=baolin.wang@linux.alibaba.com \
--cc=bigeasy@linutronix.de \
--cc=bjorn3_gh@protonmail.com \
--cc=boqun.feng@gmail.com \
--cc=bp@alien8.de \
--cc=brauner@kernel.org \
--cc=broonie@kernel.org \
--cc=bsegall@google.com \
--cc=byungchul@sk.com \
--cc=catalin.marinas@arm.com \
--cc=chenhuacai@kernel.org \
--cc=chris.p.wilson@intel.com \
--cc=christian.koenig@amd.com \
--cc=chuck.lever@oracle.com \
--cc=cl@linux.com \
--cc=clrkwllms@kernel.org \
--cc=corbet@lwn.net \
--cc=da.gomez@kernel.org \
--cc=dai.ngo@oracle.com \
--cc=dakr@kernel.org \
--cc=damien.lemoal@opensource.wdc.com \
--cc=dan.j.williams@intel.com \
--cc=daniel.vetter@ffwll.ch \
--cc=dave.hansen@intel.com \
--cc=david@fromorbit.com \
--cc=dennis@kernel.org \
--cc=dietmar.eggemann@arm.com \
--cc=djwong@kernel.org \
--cc=dri-devel@lists.freedesktop.org \
--cc=duyuyang@gmail.com \
--cc=dwmw@amazon.co.uk \
--cc=francesco@valla.it \
--cc=frederic@kernel.org \
--cc=gary@garyguo.net \
--cc=geert@glider.be \
--cc=syzbot@lists.linux.dev \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.