syzbot


KASAN: use-after-free Read in inet_twsk_purge

Status: premoderation: reported on 2025/06/06 21:54
Reported-by: syzbot+f9ca9cf446af5c78ed52@syzkaller.appspotmail.com
First crash: 30d, last: 12h27m
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-5-15 KASAN: use-after-free Read in inet_twsk_purge 12 4d06h 28d 0/2 premoderation: reported on 2025/06/08 04:39
linux-4.14 KASAN: use-after-free Read in inet_twsk_purge (2) 2 1558d 1593d 0/1 auto-closed as invalid on 2021/07/30 01:43
linux-4.14 KASAN: use-after-free Read in inet_twsk_purge 3 2043d 2142d 0/1 auto-closed as invalid on 2020/03/31 12:08

Sample crash report:
bridge0: port 1(bridge_slave_0) entered disabled state
==================================================================
BUG: KASAN: use-after-free in instrument_atomic_read include/linux/instrumented.h:71 [inline]
BUG: KASAN: use-after-free in atomic_read include/asm-generic/atomic-instrumented.h:27 [inline]
BUG: KASAN: use-after-free in refcount_read include/linux/refcount.h:147 [inline]
BUG: KASAN: use-after-free in inet_twsk_purge+0x1fe/0x620 net/ipv4/inet_timewait_sock.c:278
Read of size 4 at addr ffff88811e928004 by task kworker/u4:3/296

CPU: 1 PID: 296 Comm: kworker/u4:3 Tainted: G        W         5.10.238-syzkaller-00008-g59e9a7228857 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: netns cleanup_net
Call Trace:
 __dump_stack+0x21/0x24 lib/dump_stack.c:77
 dump_stack_lvl+0x169/0x1d8 lib/dump_stack.c:118
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:435 [inline]
 kasan_report+0xe2/0x130 mm/kasan/report.c:452
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x280/0x290 mm/kasan/generic.c:189
 __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31
 instrument_atomic_read include/linux/instrumented.h:71 [inline]
 atomic_read include/asm-generic/atomic-instrumented.h:27 [inline]
 refcount_read include/linux/refcount.h:147 [inline]
 inet_twsk_purge+0x1fe/0x620 net/ipv4/inet_timewait_sock.c:278
 tcpv6_net_exit_batch+0x1a/0x20 net/ipv6/tcp_ipv6.c:2194
 ops_exit_list net/core/net_namespace.c:190 [inline]
 cleanup_net+0x5fb/0xb70 net/core/net_namespace.c:609
 process_one_work+0x6e1/0xba0 kernel/workqueue.c:2301
 worker_thread+0xa6a/0x13b0 kernel/workqueue.c:2447
 kthread+0x346/0x3d0 kernel/kthread.c:313
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298

Allocated by task 3533:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:430 [inline]
 __kasan_slab_alloc+0xbd/0xf0 mm/kasan/common.c:463
 kasan_slab_alloc include/linux/kasan.h:244 [inline]
 slab_post_alloc_hook+0x5d/0x2f0 mm/slab.h:583
 slab_alloc_node mm/slub.c:2947 [inline]
 slab_alloc mm/slub.c:2955 [inline]
 kmem_cache_alloc+0x165/0x2e0 mm/slub.c:2960
 kmem_cache_zalloc include/linux/slab.h:654 [inline]
 net_alloc net/core/net_namespace.c:421 [inline]
 copy_net_ns+0x13f/0x520 net/core/net_namespace.c:473
 create_new_namespaces+0x3a2/0x650 kernel/nsproxy.c:110
 unshare_nsproxy_namespaces+0x120/0x170 kernel/nsproxy.c:231
 ksys_unshare+0x4ac/0x7d0 kernel/fork.c:3156
 __do_sys_unshare kernel/fork.c:3224 [inline]
 __se_sys_unshare kernel/fork.c:3222 [inline]
 __x64_sys_unshare+0x38/0x40 kernel/fork.c:3222
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

Freed by task 296:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4a/0x70 mm/kasan/common.c:45
 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:362
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370
 kasan_slab_free include/linux/kasan.h:220 [inline]
 slab_free_hook mm/slub.c:1595 [inline]
 slab_free_freelist_hook+0xc5/0x190 mm/slub.c:1621
 slab_free mm/slub.c:3203 [inline]
 kmem_cache_free+0x100/0x2d0 mm/slub.c:3219
 net_free net/core/net_namespace.c:449 [inline]
 net_drop_ns net/core/net_namespace.c:456 [inline]
 cleanup_net+0xae3/0xb70 net/core/net_namespace.c:630
 process_one_work+0x6e1/0xba0 kernel/workqueue.c:2301
 worker_thread+0xa6a/0x13b0 kernel/workqueue.c:2447
 kthread+0x346/0x3d0 kernel/kthread.c:313
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298

The buggy address belongs to the object at ffff88811e928000
 which belongs to the cache net_namespace of size 4672
The buggy address is located 4 bytes inside of
 4672-byte region [ffff88811e928000, ffff88811e929240)
The buggy address belongs to the page:
page:ffffea00047a4a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88811e92cd00 pfn:0x11e928
head:ffffea00047a4a00 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x4000000000010200(slab|head)
raw: 4000000000010200 0000000000000000 0000000100000001 ffff888107fdde00
raw: ffff88811e92cd00 0000000080060002 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 1449, ts 70766811259, free_ts 70747055190
 set_page_owner include/linux/page_owner.h:35 [inline]
 post_alloc_hook mm/page_alloc.c:2456 [inline]
 prep_new_page+0x179/0x180 mm/page_alloc.c:2462
 get_page_from_freelist+0x2235/0x23d0 mm/page_alloc.c:4254
 __alloc_pages_nodemask+0x268/0x5f0 mm/page_alloc.c:5357
 alloc_slab_page mm/slub.c:-1 [inline]
 allocate_slab mm/slub.c:1808 [inline]
 new_slab+0x84/0x3f0 mm/slub.c:1869
 new_slab_objects mm/slub.c:2627 [inline]
 ___slab_alloc+0x2a6/0x450 mm/slub.c:2791
 __slab_alloc+0x63/0xa0 mm/slub.c:2831
 slab_alloc_node mm/slub.c:2913 [inline]
 slab_alloc mm/slub.c:2955 [inline]
 kmem_cache_alloc+0x1af/0x2e0 mm/slub.c:2960
 kmem_cache_zalloc include/linux/slab.h:654 [inline]
 net_alloc net/core/net_namespace.c:421 [inline]
 copy_net_ns+0x13f/0x520 net/core/net_namespace.c:473
 create_new_namespaces+0x3a2/0x650 kernel/nsproxy.c:110
 unshare_nsproxy_namespaces+0x120/0x170 kernel/nsproxy.c:231
 ksys_unshare+0x4ac/0x7d0 kernel/fork.c:3156
 __do_sys_unshare kernel/fork.c:3224 [inline]
 __se_sys_unshare kernel/fork.c:3222 [inline]
 __x64_sys_unshare+0x38/0x40 kernel/fork.c:3222
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:28 [inline]
 free_pages_prepare mm/page_alloc.c:1349 [inline]
 __free_pages_ok+0x7fc/0x820 mm/page_alloc.c:1629
 free_the_page mm/page_alloc.c:5418 [inline]
 __free_pages+0xdd/0x380 mm/page_alloc.c:5427
 __free_slab+0xcf/0x190 mm/slub.c:1894
 free_slab mm/slub.c:1909 [inline]
 discard_slab mm/slub.c:1915 [inline]
 unfreeze_partials+0x15f/0x190 mm/slub.c:2410
 put_cpu_partial+0xc1/0x180 mm/slub.c:2446
 __slab_free+0x2c9/0x3a0 mm/slub.c:3095
 do_slab_free mm/slub.c:3191 [inline]
 ___cache_free+0x111/0x130 mm/slub.c:3210
 qlink_free+0x50/0x90 mm/kasan/quarantine.c:157
 qlist_free_all+0x5f/0xb0 mm/kasan/quarantine.c:176
 kasan_quarantine_reduce+0x14a/0x160 mm/kasan/quarantine.c:283
 __kasan_slab_alloc+0x2f/0xf0 mm/kasan/common.c:440
 kasan_slab_alloc include/linux/kasan.h:244 [inline]
 slab_post_alloc_hook+0x5d/0x2f0 mm/slab.h:583
 slab_alloc_node mm/slub.c:2947 [inline]
 slab_alloc mm/slub.c:2955 [inline]
 kmem_cache_alloc+0x165/0x2e0 mm/slub.c:2960
 kmem_cache_zalloc include/linux/slab.h:654 [inline]
 locks_alloc_lock fs/locks.c:346 [inline]
 flock_make_lock fs/locks.c:487 [inline]
 __do_sys_flock fs/locks.c:2238 [inline]
 __se_sys_flock+0x14f/0x5b0 fs/locks.c:2219
 __x64_sys_flock+0x5b/0x70 fs/locks.c:2219
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46

Memory state around the buggy address:
 ffff88811e927f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88811e927f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88811e928000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff88811e928080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88811e928100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (67):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/07/06 14:11 android13-5.10-lts 59e9a7228857 4f67c4ae .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/07/06 09:53 android13-5.10-lts 59e9a7228857 4f67c4ae .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/07/06 04:59 android13-5.10-lts 59e9a7228857 4f67c4ae .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/07/06 01:30 android13-5.10-lts 59e9a7228857 4f67c4ae .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/07/04 13:36 android13-5.10-lts 59e9a7228857 76ad128c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/07/04 13:29 android13-5.10-lts 59e9a7228857 76ad128c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/07/03 00:34 android13-5.10-lts 59e9a7228857 bc80e4f0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/07/01 08:35 android13-5.10-lts 59e9a7228857 6e83b42d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/07/01 06:58 android13-5.10-lts 59e9a7228857 6e83b42d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/30 16:27 android13-5.10-lts 59e9a7228857 fc9d8ee5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/30 13:42 android13-5.10-lts 59e9a7228857 fc9d8ee5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/30 05:45 android13-5.10-lts 59e9a7228857 fc9d8ee5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/29 06:48 android13-5.10-lts 59e9a7228857 fc9d8ee5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/28 11:15 android13-5.10-lts 59e9a7228857 fc9d8ee5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/27 17:31 android13-5.10-lts 59e9a7228857 803ce19b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/23 09:12 android13-5.10-lts d76d4cd0623a d6cdfb8a .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/22 23:55 android13-5.10-lts d76d4cd0623a d6cdfb8a .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/22 13:19 android13-5.10-lts d76d4cd0623a d6cdfb8a .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/22 02:44 android13-5.10-lts d76d4cd0623a d6cdfb8a .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/20 06:15 android13-5.10-lts d76d4cd0623a ed3e87f7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/19 18:16 android13-5.10-lts d76d4cd0623a ed3e87f7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/18 10:57 android13-5.10-lts d76d4cd0623a e77fae15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/17 14:07 android13-5.10-lts d76d4cd0623a cfebc887 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/17 11:30 android13-5.10-lts d76d4cd0623a cfebc887 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/17 11:20 android13-5.10-lts d76d4cd0623a cfebc887 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/17 11:19 android13-5.10-lts d76d4cd0623a cfebc887 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/17 11:18 android13-5.10-lts d76d4cd0623a cfebc887 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/17 11:15 android13-5.10-lts d76d4cd0623a cfebc887 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/17 11:13 android13-5.10-lts d76d4cd0623a cfebc887 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/16 09:05 android13-5.10-lts d76d4cd0623a 5f4b362d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/15 23:07 android13-5.10-lts d76d4cd0623a 5f4b362d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/15 22:07 android13-5.10-lts d76d4cd0623a 5f4b362d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/15 18:48 android13-5.10-lts d76d4cd0623a 5f4b362d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/15 09:59 android13-5.10-lts d76d4cd0623a 5f4b362d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/14 12:10 android13-5.10-lts d76d4cd0623a 0e8da31f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/13 17:39 android13-5.10-lts d76d4cd0623a 98683f8f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/13 17:06 android13-5.10-lts d76d4cd0623a 98683f8f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/13 15:12 android13-5.10-lts d76d4cd0623a 98683f8f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/13 03:42 android13-5.10-lts d76d4cd0623a 98683f8f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/12 17:30 android13-5.10-lts d76d4cd0623a 98683f8f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/12 03:24 android13-5.10-lts d76d4cd0623a 98683f8f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/12 02:31 android13-5.10-lts d76d4cd0623a 98683f8f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/12 00:35 android13-5.10-lts d76d4cd0623a 98683f8f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/11 21:13 android13-5.10-lts d76d4cd0623a 98683f8f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/10 23:44 android13-5.10-lts d76d4cd0623a 5d7e17ca .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/10 09:31 android13-5.10-lts d76d4cd0623a 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/10 05:57 android13-5.10-lts d76d4cd0623a 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/10 04:47 android13-5.10-lts d76d4cd0623a 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/09 21:20 android13-5.10-lts d76d4cd0623a 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/09 21:02 android13-5.10-lts d76d4cd0623a 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/09 07:50 android13-5.10-lts d76d4cd0623a 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/09 01:40 android13-5.10-lts d76d4cd0623a 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/08 23:37 android13-5.10-lts d76d4cd0623a 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/08 18:52 android13-5.10-lts d76d4cd0623a 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/07 12:35 android13-5.10-lts d76d4cd0623a 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/06 23:32 android13-5.10-lts d76d4cd0623a 9fa58bba .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/06 23:30 android13-5.10-lts d76d4cd0623a 9fa58bba .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/06 23:21 android13-5.10-lts d76d4cd0623a 9fa58bba .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
2025/06/06 21:53 android13-5.10-lts d76d4cd0623a 9fa58bba .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in inet_twsk_purge
* Struck through repros no longer work on HEAD.