syzkaller login: [ 97.193260][ T9] cfg80211: failed to load regulatory.db Warning: Permanently added '[localhost]:33962' (ED25519) to the list of known hosts. 2026/06/25 08:46:35 parsed 1 programs 2026/06/25 08:46:35 serving rpc on tcp://36087 [ 105.895941][ T5291] cgroup: Unknown subsys name 'net' [ 105.976589][ T5291] cgroup: Unknown subsys name 'cpuset' [ 105.985195][ T5291] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 107.747155][ T5291] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 112.533110][ T5310] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 115.799137][ T5342] bridge0: port 1(bridge_slave_0) entered blocking state [ 115.803394][ T5342] bridge0: port 1(bridge_slave_0) entered disabled state [ 115.806793][ T5342] bridge_slave_0: entered allmulticast mode [ 115.813718][ T5342] bridge_slave_0: entered promiscuous mode [ 115.824413][ T5342] bridge0: port 2(bridge_slave_1) entered blocking state [ 115.828043][ T5342] bridge0: port 2(bridge_slave_1) entered disabled state [ 115.831688][ T5342] bridge_slave_1: entered allmulticast mode [ 115.835539][ T5342] bridge_slave_1: entered promiscuous mode [ 115.871871][ T5342] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 115.882870][ T5342] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 115.924810][ T5342] team0: Port device team_slave_0 added [ 115.929539][ T5342] team0: Port device team_slave_1 added [ 115.959195][ T5342] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 115.962489][ T5342] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 115.975263][ T5342] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 115.983993][ T5342] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 115.987269][ T5342] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 115.999612][ T5342] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 116.052851][ T5342] hsr_slave_0: entered promiscuous mode [ 116.056558][ T5342] hsr_slave_1: entered promiscuous mode [ 116.272086][ T5342] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 116.285910][ T5342] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 116.292361][ T5342] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 116.298953][ T5342] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 116.305265][ T5342] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 116.319952][ T5342] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 116.326748][ T5342] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 116.335889][ T5342] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 116.379714][ T5342] bridge0: port 2(bridge_slave_1) entered blocking state [ 116.383772][ T5342] bridge0: port 2(bridge_slave_1) entered forwarding state [ 116.387495][ T5342] bridge0: port 1(bridge_slave_0) entered blocking state [ 116.392315][ T5342] bridge0: port 1(bridge_slave_0) entered forwarding state [ 116.476170][ T5342] 8021q: adding VLAN 0 to HW filter on device bond0 [ 116.496804][ T1160] bridge0: port 1(bridge_slave_0) entered disabled state [ 116.502024][ T1160] bridge0: port 2(bridge_slave_1) entered disabled state [ 116.518701][ T5342] 8021q: adding VLAN 0 to HW filter on device team0 [ 116.533937][ T1160] bridge0: port 1(bridge_slave_0) entered blocking state [ 116.537438][ T1160] bridge0: port 1(bridge_slave_0) entered forwarding state [ 116.550581][ T1160] bridge0: port 2(bridge_slave_1) entered blocking state [ 116.553903][ T1160] bridge0: port 2(bridge_slave_1) entered forwarding state [ 117.012624][ T5342] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 117.073953][ T5342] veth0_vlan: entered promiscuous mode [ 117.086582][ T5342] veth1_vlan: entered promiscuous mode [ 117.127480][ T5342] veth0_macvtap: entered promiscuous mode [ 117.138635][ T5342] veth1_macvtap: entered promiscuous mode [ 117.166295][ T5342] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 117.182881][ T5342] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 117.206319][ T1160] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.224864][ T1160] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.247652][ T1160] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.271027][ T1160] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.493038][ T51] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 117.556468][ T51] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 117.614984][ T51] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 117.693404][ T51] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 118.076232][ T44] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 118.084281][ T44] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 118.088679][ T44] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 118.093839][ T44] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 118.097319][ T44] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 118.508474][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 118.528900][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 118.579780][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 118.587508][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.688107][ T51] bridge_slave_1: left allmulticast mode [ 119.707887][ T51] bridge_slave_1: left promiscuous mode [ 119.728313][ T51] bridge0: port 2(bridge_slave_1) entered disabled state [ 119.807805][ T51] bridge_slave_0: left allmulticast mode [ 119.826968][ T51] bridge_slave_0: left promiscuous mode [ 119.848646][ T51] bridge0: port 1(bridge_slave_0) entered disabled state [ 120.456930][ T51] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 120.466653][ T51] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 120.473229][ T51] bond0 (unregistering): Released all slaves [ 120.517150][ T4995] 8021q: adding VLAN 0 to HW filter on device eth2 [ 120.560462][ T51] hsr_slave_0: left promiscuous mode [ 120.563862][ T51] hsr_slave_1: left promiscuous mode [ 120.566897][ T51] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 120.569989][ T51] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 120.575539][ T51] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 120.579449][ T51] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 120.594753][ T51] veth1_macvtap: left promiscuous mode [ 120.598289][ T51] veth0_macvtap: left promiscuous mode [ 120.602755][ T51] veth1_vlan: left promiscuous mode [ 120.606448][ T51] veth0_vlan: left promiscuous mode [ 120.892602][ T51] team0 (unregistering): Port device team_slave_1 removed [ 120.904923][ T51] team0 (unregistering): Port device team_slave_0 removed [ 122.119061][ T4995] 8021q: adding VLAN 0 to HW filter on device eth3 [ 123.187264][ T4995] 8021q: adding VLAN 0 to HW filter on device eth4 [ 123.900003][ T4995] 8021q: adding VLAN 0 to HW filter on device eth5 2026/06/25 08:46:56 executed programs: 0 [ 124.355770][ T4649] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 124.365942][ T4649] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 124.372031][ T4649] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 124.375816][ T4649] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 124.380303][ T4649] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 124.958456][ T5450] bridge0: port 1(bridge_slave_0) entered blocking state [ 124.961853][ T5450] bridge0: port 1(bridge_slave_0) entered disabled state [ 124.965214][ T5450] bridge_slave_0: entered allmulticast mode [ 124.969649][ T5450] bridge_slave_0: entered promiscuous mode [ 124.976827][ T5450] bridge0: port 2(bridge_slave_1) entered blocking state [ 124.980376][ T5450] bridge0: port 2(bridge_slave_1) entered disabled state [ 124.983654][ T5450] bridge_slave_1: entered allmulticast mode [ 124.988132][ T5450] bridge_slave_1: entered promiscuous mode [ 125.017861][ T5450] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 125.025070][ T5450] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 125.057253][ T5450] team0: Port device team_slave_0 added [ 125.063918][ T5450] team0: Port device team_slave_1 added [ 125.087726][ T5450] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 125.091580][ T5450] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 125.103749][ T5450] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 125.109783][ T5450] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 125.113315][ T5450] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 125.125105][ T5450] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 125.167968][ T5450] hsr_slave_0: entered promiscuous mode [ 125.172071][ T5450] hsr_slave_1: entered promiscuous mode [ 126.051592][ T5450] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 126.086787][ T5450] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 126.100921][ T5450] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 126.109106][ T5450] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 126.121268][ T5450] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 126.128902][ T5450] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 126.138696][ T5450] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 126.156406][ T5450] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 126.346641][ T5450] 8021q: adding VLAN 0 to HW filter on device bond0 [ 126.413638][ T5450] 8021q: adding VLAN 0 to HW filter on device team0 [ 126.436886][ T1160] bridge0: port 1(bridge_slave_0) entered blocking state [ 126.440312][ T1160] bridge0: port 1(bridge_slave_0) entered forwarding state [ 126.465454][ T4649] Bluetooth: hci0: command tx timeout [ 126.476670][ T1160] bridge0: port 2(bridge_slave_1) entered blocking state [ 126.479686][ T1160] bridge0: port 2(bridge_slave_1) entered forwarding state [ 127.298539][ T5450] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 127.404810][ T5450] veth0_vlan: entered promiscuous mode [ 127.440667][ T5450] veth1_vlan: entered promiscuous mode [ 127.511855][ T5450] veth0_macvtap: entered promiscuous mode [ 127.526335][ T5450] veth1_macvtap: entered promiscuous mode [ 127.557402][ T5450] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 127.590964][ T5450] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 127.629281][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 127.640546][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 127.655621][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 127.675232][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 127.898092][ T88] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 127.905479][ T88] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 128.015207][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 128.024894][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 128.238439][ T5525] loop0: detected capacity change from 0 to 128 [ 128.265998][ T5525] ======================================================= [ 128.265998][ T5525] WARNING: The mand mount option has been deprecated and [ 128.265998][ T5525] and is ignored by this kernel. Remove the mand [ 128.265998][ T5525] option from the mount to silence this warning. [ 128.265998][ T5525] ======================================================= [ 128.395919][ T5525] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 128.420568][ T5525] hpfs: filesystem error: improperly stopped [ 128.428814][ T5525] hpfs: You really don't want any checks? You are crazy... [ 128.445208][ T5525] hpfs: hpfs_map_sector(): read error [ 128.453968][ T5525] hpfs: code page support is disabled [ 128.476299][ T5525] hpfs: hpfs_map_sector(): read error [ 128.490340][ T5525] hpfs: hpfs_map_sector(): read error [ 128.492895][ T5525] hpfs: hpfs_map_sector(): read error [ 128.495376][ T5525] hpfs: hpfs_map_sector(): read error [ 128.501494][ T5525] hpfs: hpfs_map_4sectors(): unaligned read [ 128.512977][ T5525] hpfs: hpfs_map_4sectors(): unaligned read [ 128.522248][ T5525] hpfs: filesystem error: unable to find root dir [ 128.541985][ T4649] Bluetooth: hci0: command tx timeout [ 128.605185][ T5528] loop0: detected capacity change from 0 to 128 [ 128.624631][ T5528] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 128.636915][ T5528] hpfs: filesystem error: improperly stopped [ 128.647084][ T5528] hpfs: You really don't want any checks? You are crazy... [ 128.654148][ T5528] hpfs: hpfs_map_sector(): read error [ 128.661787][ T5528] hpfs: code page support is disabled [ 128.671234][ T5528] ================================================================== [ 128.674778][ T5528] BUG: KASAN: use-after-free in strcmp+0x6b/0xc0 [ 128.677776][ T5528] Read of size 1 at addr ffff8880412238a6 by task syz.0.18/5528 [ 128.683411][ T5528] [ 128.684574][ T5528] CPU: 0 UID: 0 PID: 5528 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full) [ 128.684590][ T5528] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 128.684597][ T5528] Call Trace: [ 128.684605][ T5528] [ 128.684611][ T5528] dump_stack_lvl+0xe8/0x150 [ 128.684631][ T5528] print_address_description+0x55/0x1e0 [ 128.684645][ T5528] ? strcmp+0x6b/0xc0 [ 128.684660][ T5528] print_report+0x58/0x70 [ 128.684671][ T5528] kasan_report+0x117/0x150 [ 128.684690][ T5528] ? strcmp+0x6b/0xc0 [ 128.684707][ T5528] strcmp+0x6b/0xc0 [ 128.684722][ T5528] hpfs_get_ea+0x137/0xeb0 [ 128.684734][ T5528] ? fs_reclaim_acquire+0x7c/0x100 [ 128.684751][ T5528] ? __pfx_hpfs_get_ea+0x10/0x10 [ 128.684762][ T5528] ? bdev_getblk+0xbd/0x6e0 [ 128.684776][ T5528] ? bdev_getblk+0x58b/0x6e0 [ 128.684787][ T5528] ? __pfx_hpfs_prefetch_sectors+0x10/0x10 [ 128.684800][ T5528] ? __bread_gfp+0xc3/0x380 [ 128.684813][ T5528] ? hpfs_map_sector+0x149/0x370 [ 128.684823][ T5528] ? trace_kmem_cache_alloc+0x29/0xe0 [ 128.684836][ T5528] hpfs_read_inode+0x1a9/0x1060 [ 128.684854][ T5528] ? __pfx_hpfs_read_inode+0x10/0x10 [ 128.684865][ T5528] ? inode_set_ctime_to_ts+0x116/0x2e0 [ 128.684877][ T5528] ? __pfx_inode_set_ctime_to_ts+0x10/0x10 [ 128.684887][ T5528] ? do_raw_spin_unlock+0x4d/0x210 [ 128.684905][ T5528] ? hpfs_init_inode+0x216/0x350 [ 128.684918][ T5528] hpfs_fill_super+0x1275/0x1fa0 [ 128.684939][ T5528] ? __pfx_hpfs_fill_super+0x10/0x10 [ 128.684953][ T5528] ? __pfx_snprintf+0x10/0x10 [ 128.684964][ T5528] ? set_blocksize+0x1c9/0x440 [ 128.685028][ T5528] ? sb_set_blocksize+0x155/0x240 [ 128.685042][ T5528] ? setup_bdev_super+0x4c1/0x5b0 [ 128.685055][ T5528] get_tree_bdev_flags+0x430/0x4f0 [ 128.685067][ T5528] ? __pfx_hpfs_fill_super+0x10/0x10 [ 128.685089][ T5528] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 128.685103][ T5528] vfs_get_tree+0x92/0x2a0 [ 128.685114][ T5528] do_new_mount+0x319/0xdc0 [ 128.685131][ T5528] ? __pfx_do_new_mount+0x10/0x10 [ 128.685145][ T5528] ? ns_capable+0x89/0xe0 [ 128.685161][ T5528] ? path_mount+0x647/0x1040 [ 128.685175][ T5528] ? user_path_at+0xd4/0x160 [ 128.685193][ T5528] __se_sys_mount+0x31d/0x420 [ 128.685209][ T5528] ? __pfx___se_sys_mount+0x10/0x10 [ 128.685229][ T5528] ? __x64_sys_mount+0x20/0xc0 [ 128.685243][ T5528] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.685256][ T5528] do_syscall_64+0x174/0x580 [ 128.685270][ T5528] ? trace_irq_disable+0x3b/0x140 [ 128.685280][ T5528] ? clear_bhb_loop+0x40/0x90 [ 128.685293][ T5528] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.685305][ T5528] RIP: 0033:0x7ff513f9e0ca [ 128.685316][ T5528] Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 128.685326][ T5528] RSP: 002b:00007ffd98293e48 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 128.685340][ T5528] RAX: ffffffffffffffda RBX: 00007ffd98293ed0 RCX: 00007ff513f9e0ca [ 128.685348][ T5528] RDX: 0000200000009e80 RSI: 0000200000009ec0 RDI: 00007ffd98293e90 [ 128.685355][ T5528] RBP: 0000200000009e80 R08: 00007ffd98293ed0 R09: 0000000000000041 [ 128.685363][ T5528] R10: 0000000000000041 R11: 0000000000000246 R12: 0000200000009ec0 [ 128.685370][ T5528] R13: 00007ffd98293e90 R14: 0000000000009e05 R15: 0000200000009f00 [ 128.685382][ T5528] [ 128.685386][ T5528] [ 128.841445][ T5528] The buggy address belongs to the physical page: [ 128.844356][ T5528] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x1fff32431 pfn:0x41223 [ 128.848336][ T5528] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 128.851307][ T5528] raw: 04fff00000000000 dead000000000100 dead000000000122 0000000000000000 [ 128.854938][ T5528] raw: 00000001fff32431 0000000000000000 00000000ffffffff 0000000000000000 [ 128.859390][ T5528] page dumped because: kasan: bad access detected [ 128.862499][ T5528] page_owner tracks the page as freed [ 128.864732][ T5528] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO|__GFP_COMP), pid 5293, tgid 5286 (syz-execprog), ts 109597261462, free_ts 119669266532 [ 128.873624][ T5528] post_alloc_hook+0x1f9/0x250 [ 128.876092][ T5528] compaction_alloc+0x3133/0x3630 [ 128.878573][ T5528] migrate_pages_batch+0xb08/0x4e50 [ 128.880686][ T5528] migrate_pages+0x1b9f/0x2920 [ 128.882782][ T5528] compact_zone+0x310e/0x4a30 [ 128.884902][ T5528] kcompactd+0x99c/0x12c0 [ 128.886929][ T5528] kthread+0x388/0x470 [ 128.888880][ T5528] ret_from_fork+0x514/0xb70 [ 128.891118][ T5528] ret_from_fork_asm+0x1a/0x30 [ 128.893590][ T5528] page last free pid 29 tgid 29 stack trace: [ 128.896147][ T5528] __free_frozen_pages+0xc1e/0xd10 [ 128.898304][ T5528] __folio_put+0x4b3/0x590 [ 128.900129][ T5528] migrate_pages_batch+0x3be1/0x4e50 [ 128.902555][ T5528] migrate_pages+0x1b9f/0x2920 [ 128.904783][ T5528] compact_zone+0x310e/0x4a30 [ 128.906957][ T5528] kcompactd+0x99c/0x12c0 [ 128.908736][ T5528] kthread+0x388/0x470 [ 128.910435][ T5528] ret_from_fork+0x514/0xb70 [ 128.912417][ T5528] ret_from_fork_asm+0x1a/0x30 [ 128.914527][ T5528] [ 128.915567][ T5528] Memory state around the buggy address: [ 128.917995][ T5528] ffff888041223780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 128.921484][ T5528] ffff888041223800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 128.924918][ T5528] >ffff888041223880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 128.928320][ T5528] ^ [ 128.930545][ T5528] ffff888041223900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 128.933969][ T5528] ffff888041223980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 128.937416][ T5528] ================================================================== [ 128.985611][ T5528] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 128.988706][ T5528] CPU: 0 UID: 0 PID: 5528 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full) [ 128.992371][ T5528] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 128.997234][ T5528] Call Trace: [ 128.999334][ T5528] [ 129.001018][ T5528] vpanic+0x56c/0xa60 [ 129.003046][ T5528] ? __pfx_vpanic+0x10/0x10 [ 129.005073][ T5528] ? __pfx___schedule+0x10/0x10 [ 129.007311][ T5528] panic+0xc5/0xd0 [ 129.008990][ T5528] ? __pfx_panic+0x10/0x10 [ 129.011017][ T5528] ? preempt_schedule_thunk+0x16/0x40 [ 129.013551][ T5528] ? strcmp+0x6b/0xc0 [ 129.015717][ T5528] check_panic_on_warn+0x89/0xb0 [ 129.018463][ T5528] ? strcmp+0x6b/0xc0 [ 129.020637][ T5528] end_report+0x73/0x170 [ 129.022859][ T5528] ? strcmp+0x6b/0xc0 [ 129.024721][ T5528] kasan_report+0x128/0x150 [ 129.026855][ T5528] ? strcmp+0x6b/0xc0 [ 129.028678][ T5528] strcmp+0x6b/0xc0 [ 129.030409][ T5528] hpfs_get_ea+0x137/0xeb0 [ 129.032614][ T5528] ? fs_reclaim_acquire+0x7c/0x100 [ 129.035506][ T5528] ? __pfx_hpfs_get_ea+0x10/0x10 [ 129.037932][ T5528] ? bdev_getblk+0xbd/0x6e0 [ 129.039933][ T5528] ? bdev_getblk+0x58b/0x6e0 [ 129.041909][ T5528] ? __pfx_hpfs_prefetch_sectors+0x10/0x10 [ 129.044620][ T5528] ? __bread_gfp+0xc3/0x380 [ 129.046867][ T5528] ? hpfs_map_sector+0x149/0x370 [ 129.049483][ T5528] ? trace_kmem_cache_alloc+0x29/0xe0 [ 129.051963][ T5528] hpfs_read_inode+0x1a9/0x1060 [ 129.054246][ T5528] ? __pfx_hpfs_read_inode+0x10/0x10 [ 129.056734][ T5528] ? inode_set_ctime_to_ts+0x116/0x2e0 [ 129.060146][ T5528] ? __pfx_inode_set_ctime_to_ts+0x10/0x10 [ 129.063319][ T5528] ? do_raw_spin_unlock+0x4d/0x210 [ 129.065518][ T5528] ? hpfs_init_inode+0x216/0x350 [ 129.067869][ T5528] hpfs_fill_super+0x1275/0x1fa0 [ 129.070729][ T5528] ? __pfx_hpfs_fill_super+0x10/0x10 [ 129.074508][ T5528] ? __pfx_snprintf+0x10/0x10 [ 129.077097][ T5528] ? set_blocksize+0x1c9/0x440 [ 129.079318][ T5528] ? sb_set_blocksize+0x155/0x240 [ 129.081566][ T5528] ? setup_bdev_super+0x4c1/0x5b0 [ 129.083879][ T5528] get_tree_bdev_flags+0x430/0x4f0 [ 129.086220][ T5528] ? __pfx_hpfs_fill_super+0x10/0x10 [ 129.089091][ T5528] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 129.091932][ T5528] vfs_get_tree+0x92/0x2a0 [ 129.094117][ T5528] do_new_mount+0x319/0xdc0 [ 129.096131][ T5528] ? __pfx_do_new_mount+0x10/0x10 [ 129.098342][ T5528] ? ns_capable+0x89/0xe0 [ 129.100465][ T5528] ? path_mount+0x647/0x1040 [ 129.102705][ T5528] ? user_path_at+0xd4/0x160 [ 129.105079][ T5528] __se_sys_mount+0x31d/0x420 [ 129.107183][ T5528] ? __pfx___se_sys_mount+0x10/0x10 [ 129.109455][ T5528] ? __x64_sys_mount+0x20/0xc0 [ 129.111712][ T5528] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.114708][ T5528] do_syscall_64+0x174/0x580 [ 129.116980][ T5528] ? trace_irq_disable+0x3b/0x140 [ 129.119301][ T5528] ? clear_bhb_loop+0x40/0x90 [ 129.121436][ T5528] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.124158][ T5528] RIP: 0033:0x7ff513f9e0ca [ 129.126518][ T5528] Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 129.135056][ T5528] RSP: 002b:00007ffd98293e48 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 129.139067][ T5528] RAX: ffffffffffffffda RBX: 00007ffd98293ed0 RCX: 00007ff513f9e0ca [ 129.143347][ T5528] RDX: 0000200000009e80 RSI: 0000200000009ec0 RDI: 00007ffd98293e90 [ 129.146728][ T5528] RBP: 0000200000009e80 R08: 00007ffd98293ed0 R09: 0000000000000041 [ 129.150267][ T5528] R10: 0000000000000041 R11: 0000000000000246 R12: 0000200000009ec0 [ 129.154404][ T5528] R13: 00007ffd98293e90 R14: 0000000000009e05 R15: 0000200000009f00 [ 129.158250][ T5528] [ 129.160101][ T5528] Kernel Offset: disabled [ 129.162076][ T5528] Rebooting in 86400 seconds.. VM DIAGNOSIS: 08:47:01 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000065 RBX=0000000000000065 RCX=0000000000000000 RDX=00000000000003f8 RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90002f96fd0 R8 =ffff888034360237 R9 =1ffff1100686c046 R10=dffffc0000000000 R11=ffffffff854c63c0 R12=dffffc0000000000 R13=ffffffff9a80d200 R14=ffffffff9a80d240 R15=0000000000000000 RIP=ffffffff854c643c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 000055557c766500 ffffffff 00c00000 GS =0000 ffff88808c81e000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007fa275bef000 CR3=000000003f6cc000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=00000000c0c40000 Opmask01=0000000000000003 Opmask02=0000000000000003 Opmask03=0000000000000000 Opmask04=00000000ffffffff Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000558d1603f1f0 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000558d160596b8 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fa2755f1b20 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffff0000ff000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffffff00 ffffffffffff00ff ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffff0000ff000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fa275552c80 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 20676e6964616572 004b4f2034366f66 6e695f706f6f6c20 676e696461657200 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000000085b5 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 7361647c2a737369 63637c2a65686361 63627c2a6476787c 2a64767c2a72737c ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6e2e65726f632e74 656e2e6c74637379 73203034313d6873 657268745f676f64 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6e617020343d7372 6f6e696d5f796361 67656c5f6d756e5f 6964656d6f632e69 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 64656d6f63203233 3d78616d5f736462 6e2032333d706f6f 6c5f78616d203233 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3d6d756e2e646368 5f796d6d75642030 34313d736365735f 74756f656d69745f ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 7265747369676572 6e755f7665647465 6e2e65726f632e74 656e2e6c74637379 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000