last executing test programs: 1.525164492s ago: executing program 0 (id=1): syz_mount_image$hfsplus(&(0x7f0000003000), &(0x7f0000000240)='./bus\x00', 0x208000, &(0x7f0000000940)=ANY=[@ANYBLOB="6e6c733d63703935302c6e6f626172726965722c666f7263652c756d61736b3d30303030303030303030303030303030303030313030302c00d0128005000000000000005c6ef64269a533fc6b052f92ffcac08ca18519d5b3711b97ec291e41355fa65d9c0d15e7c10c63ab0bba736f92ab9d30478ae1452a017be98c2a0507febf295db17e98d0fffc0d349264ce2acdedc0a61ae132d4024d39e11de2dc8679fac7efcb6137aa2e361c5f6cb851e3a60ba05f834666694667f27f0d632cf9a85fe247e27251acbd739ff85088cb201010900132000000000000000000002593d600000000210dc6431450a41d40f157e3512b4b99c026e738de5993f365a0c450b77103ed4a4ce9645d5bda31f3c7059d42c252f8bf6429ca73047cf2160668940f50a78e03514b4a241ac903d9d349a649eb2abefc56cd1ad4da51bca4e370cad9401e0899f5ba09f9b83acf4056b9ba4341a99065ebdb2646298351fb5b7ae6dbf1698f4eb5cd65fab44cdf71"], 0xfd, 0x6a5, &(0x7f0000000f00)="$eJzs3UtsHHcdB/DvrDdrO6DUaZO2IKRGjYigEYmdpSQIEAEhlEOFInHphYOVOI2VTVo5LnIrRFyeV4499FCEwqEn1ANSEYeKckZCQhy45B6Ju08smtnZ9Tp+xJvEXRs+H2l2/jP/129+npl9ydoA/7cuvZpDqyly6fQrK+X2vbvtzr277Zv9cpLJJI2k2VuluJUUnyQX01vyuXJnPVyx3Twv3//ovVPvftDubTXrpWrf2KnfJlu2XK2XnEgyUa8fw4bxrjz2eMUg7jJhJ/uJg3HrbrI6SvfdX7fAvlX0njc3mUkOJ5mqXwekvjs0Pt3onryR7nIAAABwQD21lrWs5Mi44wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICDpP79/6JeGv3yiRT93/9vVftaVfPWuON9XB+POwAAAAAAAAAAeAJeWMtaVnKkv90tqu/8X6w2jlWPn8mbuZ2FLOVMVjKf5SxnKXNJZqr6d6rH1sr88vLS3HY9u93une5E1fPcoGeGep7bFFqxc+Tdycc+eAAAAAAAAAA4YHb4svxnubT+/T8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOwHRTLRW1XLsX55Jo1mkqkkrbLdavLnfvkg+3jcAQAAAMCn4Km1rGUlR4r/9La7RfWe/9nqff9U3sytLGcxy+lkIVerzwJ67/obf19td+7dbd8sl83jfuffI4VRjZjeZw9bzzxbtThet19N8v38MKdzIpezlMX8OPNZzkJO5HtVaT5FZqqx/vWtpI5zU7yT5cPFDaFcflisz1eRTOdaFqvYzuTK4GOQRr/N0Gx/bCUbMtTIO2V2im/XHpqdXtavDm39ZrB3P5ipDurQICOzde7LbBy9t13uK73zZHL0mZr1nsbgM6hjO800cs57DtfrMte/Gs75C7uNeK8M57yM6lwag7Pv2Z1znnz5H3+5fL1z68b1a7dP75/TaFvdbvfO9rUPnn3tQSam8tzuM7G6TSY+3Lg5sVWbqREPaI+06mz0Yly/WyaXhu+W3W6y6W75YtX3SBbzg7yeq1nI+cxmLhcym6/nXNobzrDjO+e1utYao11rJ79UF6aT/Lpe7w+tQ8nRobwO3+nKfB/dsGc9S0/vIksj3pGan68L5Rw/H3rGGb8HMzE3lIlnds7Eb8szMrc7t24sXZ9/Y5fznarX5WX7y43Ph797Esfz6Mrr8Onyj1VtbTw7yrpntqybq+qODeoam+qOD+oedqW26tdwm0fq1T23ZV27qns+/6yf9h54lZPX0xm8CgFgv+hu3nX4pcOt6fvTf5t+f/oX09enX5n67uSFyS+0cuivzT9N/KHx+8Y3i5fyfn6aI+MIGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/tfcfuvtG/OdzsLSPiykMVqv8nj2OLCpvZ9ijwqTSUbp1b3T7RbNJxvGh0keuXv/twL7e77YWchnd+jVHDrD13vti7/F4xe+8aM6GQ9p3BztMp+uB9w/Py4G7J2zyzffOHv7rbe/snhz/rWF1xZunbtw/sL59tfmvnr22mJnYbb3OO4ogb2w/uw/7kgAAAAAAAAAAACA3drLf1Qo6v/WGPcxAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfbpVdzaDVF5mbPzJbb9+62O+XSL6+3bCZpJCl+khSfJBfTWzIzNFyx3Twv3//ovVPvftBeH6vZb9/Yqd/urCYTq2XhRJKJev1Agy1M7jBeBuNdGR6v8SjhFYMjLBN2sp84GLf/BgAA///RGv9P") r0 = fsopen(&(0x7f0000000380)='gfs2meta\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000240)='source', &(0x7f0000000400)='c:::\x00\xfdM\xab\x89\xff\xda\xc7dw2\xa1\xb2\xabuQQ\x14\x97\xc9\xfae\xc7\xa5U\xe2\xbe\"\xb9t\xa0\x0e\xfa\xdb\xf1\xa5.\xd87\xc3p\xa5l\xf8vC\xe2\xe8 \xd5-\x14V<#\x186\xe1\xbd\xc0\xc3\xb5N(vj\xa7+<:\xc4\xe00\x01\xdd \x82\x83\xed\x0e\xc4\x1d\xac\xef7\b\xd3Z5\\A\'\x18\xa2\xc3\xab\xc7`\xc3\v\xf3L\x9d[Q\x9e\x11@=\xa1\x9b\xdc\xb1\xef\xc3k<\x97L\xa0\xab\xa6\x1c\x8b~\x00\x00\x00\x00\x00\x00i^N\xbd@\x01p\xb2\x88\xc3\xe2\x96T\xa3\xa5\xf2\x0f\xf2f\xb9$\xd2\x14 [ 57.483139][ T4277] JFS: metapage_get_blocks failed [ 57.487836][ T4284] loop2: p1 size 16777216 extends beyond EOD, truncated [ 57.506416][ T4274] hfsplus: request for non-existent node 33423360 in B*Tree [ 57.514174][ T4277] ERROR: (device loop4): release_metapage: write_one_page() failed [ 57.514174][ T4277] [ 57.521826][ T4274] hfsplus: request for non-existent node 33423360 in B*Tree [ 57.547310][ T4284] loop2: p3 start 3036741376 is beyond EOD, truncated [ 57.554890][ T4288] [ 57.554890][ T4288] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 57.554890][ T4288] [ 57.563910][ T4285] hfsplus: request for non-existent node 33423360 in B*Tree [ 57.594356][ T4285] hfsplus: request for non-existent node 33423360 in B*Tree [ 57.627191][ T4277] ERROR: (device loop4): remounting filesystem as read-only [ 57.652220][ T4281] hfsplus: request for non-existent node 33423360 in B*Tree [ 57.660347][ T4288] [ 57.660347][ T4288] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 57.660347][ T4288] [ 57.672370][ T4290] loop3: detected capacity change from 0 to 1764 [ 57.686375][ T4277] ERROR: (device loop4): diWrite: ixpxd invalid [ 57.686375][ T4277] [ 57.707972][ T4281] hfsplus: request for non-existent node 33423360 in B*Tree [ 57.713329][ T4271] loop1: detected capacity change from 0 to 32768 [ 57.722193][ T4277] ERROR: (device loop4): remounting filesystem as read-only [ 57.756315][ T4274] hfsplus: request for non-existent node 33423360 in B*Tree [ 57.805481][ T4277] ERROR: (device loop4): txCommit: [ 57.805481][ T4277] [ 57.826603][ T4274] hfsplus: request for non-existent node 33423360 in B*Tree [ 57.848712][ T4277] [ 57.848712][ T4277] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 57.848712][ T4277] [ 57.864296][ T4281] hfsplus: request for non-existent node 33423360 in B*Tree [ 57.877083][ T4288] ================================================================== [ 57.885313][ T4288] BUG: KASAN: slab-out-of-bounds in dtSearch+0x1906/0x1f60 [ 57.892522][ T4288] Read of size 4 at addr ffff888024e1bfe0 by task syz.4.7/4288 [ 57.900072][ T4288] [ 57.902409][ T4288] CPU: 1 PID: 4288 Comm: syz.4.7 Not tainted syzkaller #0 [ 57.909518][ T4288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 57.919593][ T4288] Call Trace: [ 57.922876][ T4288] [ 57.925813][ T4288] dump_stack_lvl+0x188/0x250 [ 57.930500][ T4288] ? show_regs_print_info+0x20/0x20 [ 57.933543][ T4281] hfsplus: request for non-existent node 33423360 in B*Tree [ 57.935702][ T4288] ? _printk+0xda/0x130 [ 57.947151][ T4288] ? load_image+0x410/0x410 [ 57.951663][ T4288] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 57.955685][ T4274] hfsplus: request for non-existent node 33423360 in B*Tree [ 57.957138][ T4288] print_address_description+0x60/0x2d0 [ 57.969962][ T4288] ? dtSearch+0x1906/0x1f60 [ 57.974485][ T4288] kasan_report+0xdf/0x130 [ 57.977900][ T4274] hfsplus: request for non-existent node 33423360 in B*Tree [ 57.978906][ T4288] ? dtSearch+0x1906/0x1f60 [ 57.978934][ T4288] dtSearch+0x1906/0x1f60 [ 57.995022][ T4288] jfs_lookup+0x1ad/0x420 [ 57.999371][ T4288] ? jfs_get_parent+0xa0/0xa0 [ 58.004074][ T4288] ? __lock_acquire+0x7d40/0x7d40 [ 58.009106][ T4288] ? __rwlock_init+0x140/0x140 [ 58.013890][ T4288] ? do_raw_spin_unlock+0x11d/0x230 [ 58.019100][ T4288] ? _raw_spin_unlock+0x24/0x40 [ 58.023960][ T4288] ? d_alloc+0x1e7/0x250 [ 58.028213][ T4288] lookup_one_qstr_excl+0x10e/0x240 [ 58.033429][ T4288] filename_create+0x242/0x450 [ 58.037252][ T4274] hfsplus: request for non-existent node 33423360 in B*Tree [ 58.038200][ T4288] ? kern_path_create+0x190/0x190 [ 58.038235][ T4288] do_mkdirat+0xa5/0x5c0 [ 58.054737][ T4288] ? vfs_mkdir+0x570/0x570 [ 58.057749][ T4274] hfsplus: request for non-existent node 33423360 in B*Tree [ 58.059162][ T4288] __x64_sys_mkdirat+0x85/0x90 [ 58.071187][ T4288] do_syscall_64+0x4c/0xa0 [ 58.075608][ T4288] ? clear_bhb_loop+0x30/0x80 [ 58.080291][ T4288] ? clear_bhb_loop+0x30/0x80 [ 58.084974][ T4288] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 58.090889][ T4288] RIP: 0033:0x7efce2d12007 [ 58.095318][ T4288] Code: 00 66 90 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 db f7 ff ff 66 2e 0f 1f 84 00 00 00 00 00 90 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 58.114928][ T4288] RSP: 002b:00007efce0f49e58 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 58.123355][ T4288] RAX: ffffffffffffffda RBX: 00007efce0f49ee0 RCX: 00007efce2d12007 [ 58.131346][ T4288] RDX: 00000000000001ff RSI: 0000200000000040 RDI: 00000000ffffff9c [ 58.139342][ T4288] RBP: 0000200000000140 R08: 00002000000000c0 R09: 0000000000000000 [ 58.147332][ T4288] R10: 0000200000000140 R11: 0000000000000246 R12: 0000200000000040 [ 58.155322][ T4288] R13: 00007efce0f49ea0 R14: 0000000000000000 R15: 0000000000000000 [ 58.163323][ T4288] [ 58.166381][ T4288] [ 58.168705][ T4288] Allocated by task 1: [ 58.172779][ T4288] __kasan_slab_alloc+0x92/0xc0 [ 58.177641][ T4288] slab_post_alloc_hook+0x4c/0x380 [ 58.178987][ T4292] loop2: detected capacity change from 0 to 40427 [ 58.182756][ T4288] kmem_cache_alloc+0x15d/0x280 [ 58.182776][ T4288] __kernfs_new_node+0xe3/0x6b0 [ 58.182794][ T4288] kernfs_new_node+0x148/0x250 [ 58.182810][ T4288] __kernfs_create_file+0x47/0x2e0 [ 58.182826][ T4288] sysfs_add_file_mode_ns+0x2d2/0x390 [ 58.182839][ T4288] sysfs_merge_group+0x182/0x320 [ 58.182854][ T4288] dpm_sysfs_add+0xce/0x270 [ 58.182868][ T4288] device_add+0x745/0x1050 [ 58.182883][ T4288] usb_hub_create_port_device+0x3e4/0xaa0 [ 58.182898][ T4288] hub_probe+0x2554/0x3630 [ 58.207845][ T4292] F2FS-fs (loop2): build fault injection attr: rate: 19, type: 0x1ffff [ 58.208809][ T4288] usb_probe_interface+0x5be/0xae0 [ 58.208833][ T4288] really_probe+0x276/0xc70 [ 58.208850][ T4288] __driver_probe_device+0x1f5/0x390 [ 58.222423][ T4292] ------------[ cut here ]------------ [ 58.223689][ T4288] driver_probe_device+0x4f/0x420 [ 58.228089][ T4292] WARNING: CPU: 0 PID: 4292 at kernel/locking/lockdep.c:6467 lockdep_unregister_key+0x4d7/0x520 [ 58.233779][ T4288] __device_attach_driver+0x2b0/0x500 [ 58.238182][ T4292] Modules linked in: [ 58.246385][ T4288] bus_for_each_drv+0x184/0x210 [ 58.251471][ T4292] [ 58.251478][ T4292] CPU: 0 PID: 4292 Comm: syz.2.11 Not tainted syzkaller #0 [ 58.255970][ T4288] __device_attach+0x2a7/0x480 [ 58.261226][ T4292] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 58.266659][ T4288] bus_probe_device+0xba/0x1d0 [ 58.271662][ T4292] RIP: 0010:lockdep_unregister_key+0x4d7/0x520 [ 58.282052][ T4288] device_add+0xbcf/0x1050 [ 58.287400][ T4292] Code: 80 00 00 00 75 39 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 79 7d 64 08 41 f7 c4 00 02 00 00 74 90 fb 84 db 75 8f eb a0 <0f> 0b e9 44 ff ff ff 0f 0b e9 b0 fe ff ff 0f 0b e9 fd fe ff ff e8 [ 58.291270][ T4288] usb_set_configuration+0x19d5/0x2030 [ 58.296094][ T4292] RSP: 0018:ffffc9000325f9c0 EFLAGS: 00010002 [ 58.298403][ T4288] usb_generic_driver_probe+0x89/0x150 [ 58.305566][ T4292] [ 58.305572][ T4292] RAX: 0000000000000000 RBX: ffff88805e6b5728 RCX: dffffc0000000000 [ 58.310305][ T4288] usb_probe_device+0x126/0x250 [ 58.320353][ T4292] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc9000325f940 [ 58.325095][ T4288] really_probe+0x276/0xc70 [ 58.331218][ T4292] RBP: ffffc9000325fa90 R08: 0000000000000003 R09: 0000000000000004 [ 58.335605][ T4288] __driver_probe_device+0x1f5/0x390 [ 58.355403][ T4292] R10: dffffc0000000000 R11: fffff5200064bf28 R12: 0000000000000a03 [ 58.360853][ T4288] driver_probe_device+0x4f/0x420 [ 58.366890][ T4292] R13: ffff88805e6b4000 R14: 0000000000000000 R15: 1ffff9200064bf3c [ 58.372333][ T4288] __device_attach_driver+0x2b0/0x500 [ 58.374636][ T4292] FS: 00007f72ad3676c0(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000 [ 58.382584][ T4288] bus_for_each_drv+0x184/0x210 [ 58.387409][ T4292] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 58.395357][ T4288] __device_attach+0x2a7/0x480 [ 58.399837][ T4292] CR2: 00007f918f4f2000 CR3: 00000000735f8000 CR4: 00000000003506f0 [ 58.407894][ T4288] bus_probe_device+0xba/0x1d0 [ 58.413155][ T4292] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 58.421106][ T4288] device_add+0xbcf/0x1050 [ 58.426102][ T4292] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 58.434053][ T4288] usb_new_device+0x9f6/0x15d0 [ 58.439396][ T4292] Call Trace: [ 58.439406][ T4292] [ 58.448298][ T4288] register_root_hub+0x258/0x550 [ 58.453125][ T4292] ? lockdep_reset_lock+0x300/0x300 [ 58.459682][ T4288] usb_add_hcd+0xbb9/0x1080 [ 58.464424][ T4292] ? kfree+0xef/0x2a0 [ 58.472371][ T4288] vhci_hcd_probe+0x140/0x370 [ 58.477105][ T4292] ? __phys_addr+0xb6/0x170 [ 58.485052][ T4288] platform_probe+0x137/0x1c0 [ 58.489444][ T4292] f2fs_fill_super+0x3ce4/0x7050 [ 58.497390][ T4288] really_probe+0x276/0xc70 [ 58.502134][ T4292] ? vsnprintf+0x1b22/0x1c20 [ 58.505385][ T4288] __driver_probe_device+0x1f5/0x390 [ 58.508305][ T4292] ? kill_f2fs_super+0x3d0/0x3d0 [ 58.513207][ T4288] driver_probe_device+0x4f/0x420 [ 58.518377][ T4292] ? up_write+0x1b6/0x410 [ 58.522855][ T4288] __device_attach_driver+0x2b0/0x500 [ 58.526818][ T4292] ? set_blocksize+0x1f1/0x360 [ 58.531478][ T4288] bus_for_each_drv+0x184/0x210 [ 58.535966][ T4292] ? sb_set_blocksize+0xa5/0xe0 [ 58.540622][ T4288] __device_attach+0x2a7/0x480 [ 58.545537][ T4292] mount_bdev+0x28a/0x3c0 [ 58.550023][ T4288] bus_probe_device+0xba/0x1d0 [ 58.554599][ T4292] ? kill_f2fs_super+0x3d0/0x3d0 [ 58.559856][ T4288] device_add+0xbcf/0x1050 [ 58.564770][ T4292] legacy_get_tree+0xe6/0x180 [ 58.569766][ T4288] platform_device_add+0x4bf/0x830 [ 58.574067][ T4292] ? trace_raw_output_f2fs_fiemap+0x220/0x220 [ 58.579411][ T4288] vhci_hcd_init+0x3c7/0x500 [ 58.584147][ T4292] vfs_get_tree+0x88/0x270 [ 58.588972][ T4288] do_one_initcall+0x272/0x730 [ 58.593794][ T4292] do_new_mount+0x247/0xa40 [ 58.598526][ T4288] do_initcall_level+0x13d/0x1f0 [ 58.602830][ T4292] __se_sys_mount+0x2e3/0x3d0 [ 58.607562][ T4288] do_initcalls+0x4b/0x90 [ 58.612474][ T4292] ? __x64_sys_mount+0xc0/0xc0 [ 58.616859][ T4288] kernel_init_freeable+0x3d5/0x560 [ 58.621508][ T4292] ? lockdep_hardirqs_on+0x94/0x140 [ 58.626589][ T4288] kernel_init+0x19/0x1b0 [ 58.632624][ T4292] ? __x64_sys_mount+0x1c/0xc0 [ 58.637186][ T4288] ret_from_fork+0x1f/0x30 [ 58.641572][ T4292] do_syscall_64+0x4c/0xa0 [ 58.646308][ T4288] [ 58.646314][ T4288] The buggy address belongs to the object at ffff888024e1be80 [ 58.646314][ T4288] which belongs to the cache kernfs_node_cache of size 168 [ 58.650786][ T4292] ? clear_bhb_loop+0x30/0x80 [ 58.655692][ T4288] The buggy address is located 184 bytes to the right of [ 58.655692][ T4288] 168-byte region [ffff888024e1be80, ffff888024e1bf28) [ 58.660337][ T4292] ? clear_bhb_loop+0x30/0x80 [ 58.664637][ T4288] The buggy address belongs to the page: [ 58.669369][ T4292] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 58.674552][ T4288] page:ffffea00009386c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x24e1b [ 58.679704][ T4292] RIP: 0033:0x7f72af11040a [ 58.684003][ T4288] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 58.688739][ T4292] Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 58.693130][ T4288] raw: 00fff00000000200 0000000000000000 dead000000000122 ffff888016dddb40 [ 58.697508][ T4292] RSP: 002b:00007f72ad366e58 EFLAGS: 00000246 [ 58.699820][ T4288] raw: 0000000000000000 0000000000110011 00000001ffffffff 0000000000000000 [ 58.714352][ T4292] ORIG_RAX: 00000000000000a5 [ 58.719000][ T4288] page dumped because: kasan: bad access detected [ 58.732761][ T4292] RAX: ffffffffffffffda RBX: 00007f72ad366ee0 RCX: 00007f72af11040a [ 58.737422][ T4288] page_owner tracks the page as allocated [ 58.743012][ T4292] RDX: 0000200000000000 RSI: 0000200000000040 RDI: 00007f72ad366ea0 [ 58.748874][ T4288] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 8003730651, free_ts 7933612775 [ 58.758992][ T4292] RBP: 0000200000000000 R08: 00007f72ad366ee0 R09: 0000000000000008 [ 58.763382][ T4288] get_page_from_freelist+0x24f6/0x2670 [ 58.770893][ T4292] R10: 0000000000000008 R11: 0000000000000246 R12: 0000200000000040 [ 58.790470][ T4288] __alloc_pages+0x1ee/0x480 [ 58.799030][ T4292] R13: 00007f72ad366ea0 R14: 0000000000005505 R15: 0000200000005980 [ 58.805066][ T4288] alloc_page_interleave+0x24/0x1e0 [ 58.813629][ T4292] [ 58.818270][ T4288] new_slab+0xc0/0x4b0 [ 58.824669][ T4292] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 58.832602][ T4288] ___slab_alloc+0x807/0xdd0 [ 58.838294][ T4292] CPU: 0 PID: 4292 Comm: syz.2.11 Not tainted syzkaller #0 [ 58.846241][ T4288] kmem_cache_alloc+0xf0/0x280 [ 58.861824][ T4292] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 58.869772][ T4288] __kernfs_new_node+0xe3/0x6b0 [ 58.875298][ T4292] Call Trace: [ 58.875308][ T4292] [ 58.883244][ T4288] kernfs_new_node+0x148/0x250 [ 58.887808][ T4292] dump_stack_lvl+0x188/0x250 [ 58.895757][ T4288] __kernfs_create_file+0x47/0x2e0 [ 58.900932][ T4292] ? show_regs_print_info+0x20/0x20 [ 58.903931][ T4288] sysfs_add_file_mode_ns+0x2d2/0x390 [ 58.907976][ T4292] ? load_image+0x410/0x410 [ 58.915231][ T4288] sysfs_merge_group+0x182/0x320 [ 58.919817][ T4292] panic+0x2f8/0x850 [ 58.926990][ T4288] dpm_sysfs_add+0xce/0x270 [ 58.931727][ T4292] ? bpf_jit_dump+0xd0/0xd0 [ 58.941753][ T4288] device_add+0x745/0x1050 [ 58.946580][ T4292] ? lockdep_unregister_key+0x4d7/0x520 [ 58.949834][ T4288] usb_hub_create_port_device+0x3e4/0xaa0 [ 58.952748][ T4292] __warn+0x248/0x2b0 [ 58.957483][ T4288] hub_probe+0x2554/0x3630 [ 58.962136][ T4292] ? lockdep_unregister_key+0x4d7/0x520 [ 58.967221][ T4288] usb_probe_interface+0x5be/0xae0 [ 58.972393][ T4292] report_bug+0x1b9/0x2e0 [ 58.977738][ T4288] page last free stack trace: [ 58.982214][ T4292] handle_bug+0x3a/0x70 [ 58.987141][ T4288] free_unref_page_prepare+0x637/0x6c0 [ 58.991008][ T4292] exc_invalid_op+0x16/0x40 [ 58.995483][ T4288] free_unref_page+0x8f/0x2a0 [ 58.999958][ T4292] asm_exc_invalid_op+0x16/0x20 [ 59.004345][ T4288] __vunmap+0x8e0/0xa80 [ 59.009863][ T4292] RIP: 0010:lockdep_unregister_key+0x4d7/0x520 [ 59.015551][ T4288] free_work+0x56/0x80 [ 59.019505][ T4292] Code: 80 00 00 00 75 39 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 79 7d 64 08 41 f7 c4 00 02 00 00 74 90 fb 84 db 75 8f eb a0 <0f> 0b e9 44 ff ff ff 0f 0b e9 b0 fe ff ff 0f 0b e9 fd fe ff ff e8 [ 59.023893][ T4288] process_one_work+0x867/0xff0 [ 59.029410][ T4292] RSP: 0018:ffffc9000325f9c0 EFLAGS: 00010002 [ 59.034498][ T4288] worker_thread+0xad7/0x12a0 [ 59.038802][ T4292] [ 59.038807][ T4292] RAX: 0000000000000000 RBX: ffff88805e6b5728 RCX: dffffc0000000000 [ 59.043452][ T4288] kthread+0x42e/0x520 [ 59.047577][ T4292] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc9000325f940 [ 59.053010][ T4288] ret_from_fork+0x1f/0x30 [ 59.057483][ T4292] RBP: ffffc9000325fa90 R08: 0000000000000003 R09: 0000000000000004 [ 59.062133][ T4288] [ 59.066953][ T4292] R10: dffffc0000000000 R11: fffff5200064bf28 R12: 0000000000000a03 [ 59.071081][ T4288] Memory state around the buggy address: [ 59.071092][ T4288] ffff888024e1be80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 59.077203][ T4292] R13: ffff88805e6b4000 R14: 0000000000000000 R15: 1ffff9200064bf3c [ 59.081245][ T4288] ffff888024e1bf00: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 59.100830][ T4292] ? lockdep_reset_lock+0x300/0x300 [ 59.105651][ T4288] >ffff888024e1bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 59.111686][ T4292] ? kfree+0xef/0x2a0 [ 59.116334][ T4288] ^ [ 59.118637][ T4292] ? __phys_addr+0xb6/0x170 [ 59.126591][ T4288] ffff888024e1c000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 59.130632][ T4292] f2fs_fill_super+0x3ce4/0x7050 [ 59.138579][ T4288] ffff888024e1c080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 59.142974][ T4292] ? vsnprintf+0x1b22/0x1c20 [ 59.150922][ T4288] ================================================================== [ 59.150930][ T4288] Disabling lock debugging due to kernel taint [ 59.153760][ T4292] ? kill_f2fs_super+0x3d0/0x3d0 [ 59.177614][ T4196] Bluetooth: hci1: command 0x0419 tx timeout [ 59.183327][ T4292] ? up_write+0x1b6/0x410 [ 59.183350][ T4292] ? set_blocksize+0x1f1/0x360 [ 59.183367][ T4292] ? sb_set_blocksize+0xa5/0xe0 [ 59.183383][ T4292] mount_bdev+0x28a/0x3c0 [ 59.183399][ T4292] ? kill_f2fs_super+0x3d0/0x3d0 [ 59.207341][ T4196] Bluetooth: hci2: command 0x0419 tx timeout [ 59.208663][ T4292] legacy_get_tree+0xe6/0x180 [ 59.218154][ T4196] Bluetooth: hci3: command 0x0419 tx timeout [ 59.220323][ T4292] ? trace_raw_output_f2fs_fiemap+0x220/0x220 [ 59.220345][ T4292] vfs_get_tree+0x88/0x270 [ 59.220363][ T4292] do_new_mount+0x247/0xa40 [ 59.228485][ T4196] Bluetooth: hci4: command 0x0419 tx timeout [ 59.233317][ T4292] __se_sys_mount+0x2e3/0x3d0 [ 59.233336][ T4292] ? __x64_sys_mount+0xc0/0xc0 [ 59.233352][ T4292] ? lockdep_hardirqs_on+0x94/0x140 [ 59.233370][ T4292] ? __x64_sys_mount+0x1c/0xc0 [ 59.233387][ T4292] do_syscall_64+0x4c/0xa0 [ 59.233403][ T4292] ? clear_bhb_loop+0x30/0x80 [ 59.242940][ T4196] Bluetooth: hci0: command 0x0419 tx timeout [ 59.246009][ T4292] ? clear_bhb_loop+0x30/0x80 [ 59.265086][ T4288] ERROR: (device loop4): dtSearch: stack overrun! [ 59.265086][ T4288] [ 59.265111][ T4288] btstack dump: [ 59.265115][ T4288] bn = 0, index = 0 [ 59.271063][ T4292] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 59.271084][ T4292] RIP: 0033:0x7f72af11040a [ 59.271099][ T4292] Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 59.271111][ T4292] RSP: 002b:00007f72ad366e58 EFLAGS: 00000246 [ 59.275489][ T4288] bn = 20, index = 0 [ 59.280160][ T4292] ORIG_RAX: 00000000000000a5 [ 59.280169][ T4292] RAX: ffffffffffffffda RBX: 00007f72ad366ee0 RCX: 00007f72af11040a [ 59.280180][ T4292] RDX: 0000200000000000 RSI: 0000200000000040 RDI: 00007f72ad366ea0 [ 59.280189][ T4292] RBP: 0000200000000000 R08: 00007f72ad366ee0 R09: 0000000000000008 [ 59.280199][ T4292] R10: 0000000000000008 R11: 0000000000000246 R12: 0000200000000040 [ 59.280208][ T4292] R13: 00007f72ad366ea0 R14: 0000000000005505 R15: 0000200000005980 [ 59.280224][ T4292] [ 59.280503][ T4292] Kernel Offset: disabled [ 59.478409][ T4292] Rebooting in 86400 seconds..