Warning: Permanently added '10.128.0.227' (ED25519) to the list of known hosts. 2026/05/22 08:20:55 parsed 1 programs [ 62.598087][ T4201] cgroup: Unknown subsys name 'net' [ 62.709012][ T4201] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 64.106075][ T4201] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 66.714790][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.722773][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.738696][ T970] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 66.763272][ T970] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.771131][ T970] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.779474][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 67.529194][ T154] ODEBUG: Out of memory. ODEBUG disabled [ 67.942403][ T4282] chnl_net:caif_netlink_parms(): no params data found [ 67.986830][ T4282] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.994641][ T4282] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.002960][ T4282] device bridge_slave_0 entered promiscuous mode [ 68.011823][ T4282] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.019052][ T4282] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.026950][ T4282] device bridge_slave_1 entered promiscuous mode [ 68.046123][ T4282] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.056888][ T4282] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 68.077950][ T4282] team0: Port device team_slave_0 added [ 68.086039][ T4282] team0: Port device team_slave_1 added [ 68.102069][ T4282] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 68.109058][ T4282] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 68.134984][ T4282] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 68.147104][ T4282] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 68.154137][ T4282] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 68.180062][ T4282] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 68.208839][ T4282] device hsr_slave_0 entered promiscuous mode [ 68.215796][ T4282] device hsr_slave_1 entered promiscuous mode [ 68.336768][ T4282] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 68.346518][ T4282] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 68.356150][ T4282] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 68.365971][ T4282] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 68.402814][ T4282] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.410008][ T4282] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.417649][ T4282] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.424764][ T4282] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.480693][ T4282] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.495060][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 68.504725][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.512331][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.523925][ T4282] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.537693][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 68.546525][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.553633][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.565382][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 68.574202][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.581701][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.611122][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 68.620787][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 68.632603][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 68.646089][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 68.673528][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 68.684985][ T4282] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 68.783040][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 68.790524][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 68.815088][ T4282] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 68.831568][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 68.849693][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 68.858437][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 68.867253][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 68.876232][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 68.897960][ T4282] device veth0_vlan entered promiscuous mode [ 68.909056][ T4282] device veth1_vlan entered promiscuous mode [ 68.928415][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 68.937182][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 68.945725][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 68.954700][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 68.966414][ T4282] device veth0_macvtap entered promiscuous mode [ 68.989261][ T4282] device veth1_macvtap entered promiscuous mode [ 69.004523][ T4282] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 69.012074][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 69.020744][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 69.028915][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 69.038776][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 69.051924][ T4282] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 69.060971][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 69.070372][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 69.085251][ T4282] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.098659][ T4282] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.108036][ T4282] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.117624][ T4282] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.236229][ T4282] syz-executor (4282) used greatest stack depth: 19832 bytes left 2026/05/22 08:21:05 executed programs: 0 [ 70.079368][ T4306] chnl_net:caif_netlink_parms(): no params data found [ 70.140073][ T4306] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.148481][ T4306] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.166939][ T4306] device bridge_slave_0 entered promiscuous mode [ 70.179277][ T4306] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.187570][ T4306] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.196867][ T4306] device bridge_slave_1 entered promiscuous mode [ 70.222740][ T4306] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.239944][ T4306] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.268811][ T4306] team0: Port device team_slave_0 added [ 70.278866][ T4306] team0: Port device team_slave_1 added [ 70.302276][ T4306] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.309434][ T4306] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 70.338547][ T4306] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.355982][ T4306] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.362959][ T4306] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 70.390102][ T4306] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.432240][ T4306] device hsr_slave_0 entered promiscuous mode [ 70.439321][ T4306] device hsr_slave_1 entered promiscuous mode [ 70.448677][ T4306] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 70.456897][ T4306] Cannot create hsr debugfs directory [ 70.547531][ T4306] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 71.115727][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.122179][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 72.003616][ T23] Bluetooth: hci0: command 0x0409 tx timeout [ 73.348658][ T4306] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 74.037127][ T4306] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 74.073523][ T4278] Bluetooth: hci0: command 0x041b tx timeout [ 74.105193][ T4306] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 74.212413][ T4306] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 74.222678][ T4306] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 74.244707][ T4306] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 74.253660][ T4306] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 74.305729][ T4306] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.318221][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 74.327317][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 74.348696][ T4306] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.358920][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 74.367788][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 74.376412][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.383526][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.391458][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 74.402966][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 74.411912][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 74.420917][ T144] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.428026][ T144] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.452580][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 74.466014][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 74.485340][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 74.494541][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 74.502959][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 74.511886][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 74.520777][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 74.529329][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 74.537955][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 74.546456][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 74.555536][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 74.565899][ T4306] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 74.675305][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 74.682761][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 74.706535][ T4306] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.722057][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 74.732483][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 74.749332][ T154] device hsr_slave_0 left promiscuous mode [ 74.756062][ T154] device hsr_slave_1 left promiscuous mode [ 74.762620][ T154] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 74.770299][ T154] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 74.779296][ T154] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 74.787601][ T154] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 74.795926][ T154] device bridge_slave_1 left promiscuous mode [ 74.802720][ T154] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.816829][ T154] device bridge_slave_0 left promiscuous mode [ 74.823341][ T154] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.841056][ T154] device veth1_macvtap left promiscuous mode [ 74.847271][ T154] device veth0_macvtap left promiscuous mode [ 74.854013][ T154] device veth1_vlan left promiscuous mode [ 74.859875][ T154] device veth0_vlan left promiscuous mode [ 75.004228][ T154] team0 (unregistering): Port device team_slave_1 removed [ 75.016432][ T154] team0 (unregistering): Port device team_slave_0 removed [ 75.029787][ T154] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 75.043950][ T154] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 75.096085][ T154] bond0 (unregistering): Released all slaves [ 75.145587][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 75.154196][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 75.163717][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 75.171471][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 75.181200][ T4306] device veth0_vlan entered promiscuous mode [ 75.194878][ T4306] device veth1_vlan entered promiscuous mode [ 75.220977][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 75.229411][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 75.237722][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 75.246768][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 75.257513][ T4306] device veth0_macvtap entered promiscuous mode [ 75.266717][ T4306] device veth1_macvtap entered promiscuous mode [ 75.284372][ T4306] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.291857][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 75.302160][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 75.310492][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 75.319678][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 75.331246][ T4306] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.339276][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 75.348519][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 75.362494][ T4306] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.376400][ T4306] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.385401][ T4306] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.394376][ T4306] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.447225][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.455454][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.475389][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 75.494139][ T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.501989][ T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.510062][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 75.867673][ T4327] loop0: detected capacity change from 0 to 32768 [ 75.901269][ T4327] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 75.922006][ T4327] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 75.969070][ T4327] gfs2: fsid=syz:syz.0: journal 0 mapped with 5 extents in 0ms [ 75.987040][ T23] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 75.994379][ T23] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 76.028853][ T23] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 34ms [ 76.037894][ T23] gfs2: fsid=syz:syz.0: jid=0: Done [ 76.044850][ T4327] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 76.151594][ T4327] gfs2: fsid=syz:syz.0: found 1 quota changes [ 76.163472][ T4317] Bluetooth: hci0: command 0x040f tx timeout [ 76.186472][ T4306] gfs2: fsid=syz:syz.0: fatal: filesystem consistency error [ 76.186472][ T4306] inode = 11 2339 [ 76.186472][ T4306] function = gfs2_dinode_in, file = fs/gfs2/glops.c, line = 465 [ 76.214839][ T4306] gfs2: fsid=syz:syz.0: about to withdraw this file system [ 76.265747][ T4306] gfs2: fsid=syz:syz.0: warning: assertion "!qd->qd_change" failed at function = gfs2_quota_cleanup, file = fs/gfs2/quota.c, line = 1485 [ 76.293716][ T4306] CPU: 1 PID: 4306 Comm: syz-executor Not tainted syzkaller #0 [ 76.301441][ T4306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 76.311559][ T4306] Call Trace: [ 76.314863][ T4306] [ 76.317819][ T4306] dump_stack_lvl+0x188/0x250 [ 76.322552][ T4306] ? show_regs_print_info+0x20/0x20 [ 76.327780][ T4306] ? load_image+0x400/0x400 [ 76.332317][ T4306] ? do_raw_spin_unlock+0x11d/0x230 [ 76.337550][ T4306] gfs2_assert_warn_i+0x18f/0x2c0 [ 76.342704][ T4306] gfs2_quota_cleanup+0x4b4/0x6a0 [ 76.347760][ T4306] gfs2_make_fs_ro+0x440/0x620 [ 76.352556][ T4306] ? __might_sleep+0xf0/0xf0 [ 76.357174][ T4306] ? gfs2_dinode_out+0xb00/0xb00 [ 76.362142][ T4306] ? _raw_spin_unlock+0x24/0x40 [ 76.367027][ T4306] ? gfs2_glock_nq+0xcb0/0x1550 [ 76.371927][ T4306] gfs2_withdraw+0x610/0x1490 [ 76.376638][ T4306] ? gfs2_lm+0x240/0x240 [ 76.380901][ T4306] ? __schedule+0x11f7/0x43c0 [ 76.385602][ T4306] ? gfs2_freeze_lock+0x52/0xc0 [ 76.390484][ T4306] ? gfs2_consist_inode_i+0xc0/0xe0 [ 76.395724][ T4306] gfs2_inode_refresh+0xb64/0xff0 [ 76.400775][ T4306] ? do_promote+0x71a/0xab0 [ 76.405305][ T4306] ? gfs2_inode_metasync+0xf0/0xf0 [ 76.410434][ T4306] ? __lock_acquire+0x7d10/0x7d10 [ 76.415492][ T4306] inode_go_lock+0x127/0x470 [ 76.420120][ T4306] do_promote+0x741/0xab0 [ 76.424495][ T4306] finish_xmote+0x4df/0xb00 [ 76.429037][ T4306] do_xmote+0x7b6/0x1120 [ 76.433311][ T4306] gfs2_glock_nq+0xc7a/0x1550 [ 76.438028][ T4306] do_sync+0x4ab/0xc40 [ 76.442140][ T4306] ? slot_put+0x1e0/0x1e0 [ 76.446504][ T4306] ? __lock_acquire+0x7d10/0x7d10 [ 76.451575][ T4306] ? do_raw_spin_lock+0x128/0x2f0 [ 76.456642][ T4306] ? do_sync+0x4a3/0xc40 [ 76.460916][ T4306] ? do_raw_spin_unlock+0x11d/0x230 [ 76.466143][ T4306] gfs2_quota_sync+0x32c/0x700 [ 76.470946][ T4306] gfs2_sync_fs+0x48/0xb0 [ 76.475305][ T4306] sync_filesystem+0xe6/0x220 [ 76.480019][ T4306] generic_shutdown_super+0x6b/0x300 [ 76.485335][ T4306] kill_block_super+0x7c/0xe0 [ 76.490038][ T4306] deactivate_locked_super+0x93/0xf0 [ 76.495348][ T4306] cleanup_mnt+0x42d/0x4e0 [ 76.499790][ T4306] ? lockdep_hardirqs_on+0x94/0x140 [ 76.505024][ T4306] task_work_run+0x125/0x1a0 [ 76.509670][ T4306] exit_to_user_mode_loop+0x10f/0x130 [ 76.515079][ T4306] exit_to_user_mode_prepare+0xee/0x180 [ 76.520651][ T4306] syscall_exit_to_user_mode+0x16/0x40 [ 76.526135][ T4306] do_syscall_64+0x58/0xa0 [ 76.530568][ T4306] ? clear_bhb_loop+0x30/0x80 [ 76.535262][ T4306] ? clear_bhb_loop+0x30/0x80 [ 76.540010][ T4306] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 76.545940][ T4306] RIP: 0033:0x7efd05357097 [ 76.550411][ T4306] Code: a2 c7 05 5c 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 76.570045][ T4306] RSP: 002b:00007fff9e957b38 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 76.578494][ T4306] RAX: 0000000000000000 RBX: 00007efd053eb1ca RCX: 00007efd05357097 [ 76.586488][ T4306] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff9e957bf0 [ 76.594474][ T4306] RBP: 00007fff9e957bf0 R08: 00007fff9e958bf0 R09: 00000000ffffffff [ 76.602470][ T4306] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff9e958c80 [ 76.610465][ T4306] R13: 00007efd053eb1ca R14: 00000000000126fb R15: 00007fff9e958cc0 [ 76.618474][ T4306] [ 76.674330][ T4306] gfs2: fsid=syz:syz.0: Journal recovery skipped for jid 0 until next mount. [ 76.693129][ T4306] gfs2: fsid=syz:syz.0: Glock dequeues delayed: 0 [ 76.714305][ T4306] gfs2: fsid=syz:syz.0: File system withdrawn [ 76.720426][ T4306] CPU: 0 PID: 4306 Comm: syz-executor Not tainted syzkaller #0 [ 76.728000][ T4306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 76.738081][ T4306] Call Trace: [ 76.741382][ T4306] [ 76.744335][ T4306] dump_stack_lvl+0x188/0x250 [ 76.749039][ T4306] ? kobject_uevent_env+0x371/0x890 [ 76.754268][ T4306] ? show_regs_print_info+0x20/0x20 [ 76.759492][ T4306] ? load_image+0x400/0x400 [ 76.764029][ T4306] ? kobject_uevent_env+0x371/0x890 [ 76.769254][ T4306] ? lockref_put_or_lock+0x6e/0xb0 [ 76.774395][ T4306] gfs2_withdraw+0x1149/0x1490 [ 76.779202][ T4306] ? gfs2_lm+0x240/0x240 [ 76.783473][ T4306] ? __schedule+0x11f7/0x43c0 [ 76.788186][ T4306] ? gfs2_consist_inode_i+0xc0/0xe0 [ 76.793413][ T4306] gfs2_inode_refresh+0xb64/0xff0 [ 76.798465][ T4306] ? do_promote+0x71a/0xab0 [ 76.803007][ T4306] ? gfs2_inode_metasync+0xf0/0xf0 [ 76.808142][ T4306] ? __lock_acquire+0x7d10/0x7d10 [ 76.813199][ T4306] inode_go_lock+0x127/0x470 [ 76.817832][ T4306] do_promote+0x741/0xab0 [ 76.822200][ T4306] finish_xmote+0x4df/0xb00 [ 76.826737][ T4306] do_xmote+0x7b6/0x1120 [ 76.831021][ T4306] gfs2_glock_nq+0xc7a/0x1550 [ 76.835736][ T4306] do_sync+0x4ab/0xc40 [ 76.839839][ T4306] ? slot_put+0x1e0/0x1e0 [ 76.844203][ T4306] ? __lock_acquire+0x7d10/0x7d10 [ 76.849262][ T4306] ? do_raw_spin_lock+0x128/0x2f0 [ 76.854311][ T4306] ? do_sync+0x4a3/0xc40 [ 76.858589][ T4306] ? do_raw_spin_unlock+0x11d/0x230 [ 76.863836][ T4306] gfs2_quota_sync+0x32c/0x700 [ 76.868657][ T4306] gfs2_sync_fs+0x48/0xb0 [ 76.873021][ T4306] sync_filesystem+0xe6/0x220 [ 76.877729][ T4306] generic_shutdown_super+0x6b/0x300 [ 76.883048][ T4306] kill_block_super+0x7c/0xe0 [ 76.887755][ T4306] deactivate_locked_super+0x93/0xf0 [ 76.893070][ T4306] cleanup_mnt+0x42d/0x4e0 [ 76.897516][ T4306] ? lockdep_hardirqs_on+0x94/0x140 [ 76.902747][ T4306] task_work_run+0x125/0x1a0 [ 76.907364][ T4306] exit_to_user_mode_loop+0x10f/0x130 [ 76.912760][ T4306] exit_to_user_mode_prepare+0xee/0x180 [ 76.918336][ T4306] syscall_exit_to_user_mode+0x16/0x40 [ 76.923827][ T4306] do_syscall_64+0x58/0xa0 [ 76.928281][ T4306] ? clear_bhb_loop+0x30/0x80 [ 76.932983][ T4306] ? clear_bhb_loop+0x30/0x80 [ 76.937689][ T4306] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 76.943607][ T4306] RIP: 0033:0x7efd05357097 [ 76.948048][ T4306] Code: a2 c7 05 5c 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 76.967672][ T4306] RSP: 002b:00007fff9e957b38 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 76.976117][ T4306] RAX: 0000000000000000 RBX: 00007efd053eb1ca RCX: 00007efd05357097 [ 76.984114][ T4306] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff9e957bf0 [ 76.992109][ T4306] RBP: 00007fff9e957bf0 R08: 00007fff9e958bf0 R09: 00000000ffffffff [ 77.000109][ T4306] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff9e958c80 [ 77.008195][ T4306] R13: 00007efd053eb1ca R14: 00000000000126fb R15: 00007fff9e958cc0 [ 77.016221][ T4306] [ 77.025681][ T4306] ================================================================== [ 77.034025][ T4306] BUG: KASAN: use-after-free in qd_unlock+0x30/0x2d0 [ 77.040731][ T4306] Read of size 8 at addr ffff888073e76090 by task syz-executor/4306 [ 77.048733][ T4306] [ 77.051080][ T4306] CPU: 0 PID: 4306 Comm: syz-executor Not tainted syzkaller #0 [ 77.058645][ T4306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 77.068724][ T4306] Call Trace: [ 77.072026][ T4306] [ 77.074980][ T4306] dump_stack_lvl+0x188/0x250 [ 77.079687][ T4306] ? show_regs_print_info+0x20/0x20 [ 77.084911][ T4306] ? _printk+0xda/0x130 [ 77.089095][ T4306] ? qd_unlock+0x30/0x2d0 [ 77.093453][ T4306] ? load_image+0x400/0x400 [ 77.098062][ T4306] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 77.103560][ T4306] print_address_description+0x60/0x2d0 [ 77.109138][ T4306] ? qd_unlock+0x30/0x2d0 [ 77.113497][ T4306] kasan_report+0xdf/0x130 [ 77.117952][ T4306] ? qd_unlock+0x30/0x2d0 [ 77.122324][ T4306] kasan_check_range+0x235/0x290 [ 77.127294][ T4306] qd_unlock+0x30/0x2d0 [ 77.131488][ T4306] gfs2_quota_sync+0x5cf/0x700 [ 77.136297][ T4306] gfs2_sync_fs+0x48/0xb0 [ 77.140655][ T4306] sync_filesystem+0xe6/0x220 [ 77.145359][ T4306] generic_shutdown_super+0x6b/0x300 [ 77.150673][ T4306] kill_block_super+0x7c/0xe0 [ 77.155374][ T4306] deactivate_locked_super+0x93/0xf0 [ 77.160686][ T4306] cleanup_mnt+0x42d/0x4e0 [ 77.165130][ T4306] ? lockdep_hardirqs_on+0x94/0x140 [ 77.170362][ T4306] task_work_run+0x125/0x1a0 [ 77.175003][ T4306] exit_to_user_mode_loop+0x10f/0x130 [ 77.180396][ T4306] exit_to_user_mode_prepare+0xee/0x180 [ 77.185967][ T4306] syscall_exit_to_user_mode+0x16/0x40 [ 77.191457][ T4306] do_syscall_64+0x58/0xa0 [ 77.195892][ T4306] ? clear_bhb_loop+0x30/0x80 [ 77.200594][ T4306] ? clear_bhb_loop+0x30/0x80 [ 77.205311][ T4306] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 77.211232][ T4306] RIP: 0033:0x7efd05357097 [ 77.215670][ T4306] Code: a2 c7 05 5c 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 77.235293][ T4306] RSP: 002b:00007fff9e957b38 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 77.243739][ T4306] RAX: 0000000000000000 RBX: 00007efd053eb1ca RCX: 00007efd05357097 [ 77.251732][ T4306] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff9e957bf0 [ 77.259726][ T4306] RBP: 00007fff9e957bf0 R08: 00007fff9e958bf0 R09: 00000000ffffffff [ 77.267726][ T4306] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff9e958c80 [ 77.275844][ T4306] R13: 00007efd053eb1ca R14: 00000000000126fb R15: 00007fff9e958cc0 [ 77.283861][ T4306] [ 77.286901][ T4306] [ 77.289235][ T4306] Allocated by task 4327: [ 77.293574][ T4306] __kasan_slab_alloc+0x9c/0xd0 [ 77.298447][ T4306] slab_post_alloc_hook+0x4c/0x380 [ 77.303581][ T4306] kmem_cache_alloc+0x100/0x290 [ 77.308461][ T4306] qd_alloc+0x50/0x260 [ 77.312553][ T4306] gfs2_quota_init+0x74e/0xea0 [ 77.317358][ T4306] gfs2_make_fs_rw+0x414/0x580 [ 77.322142][ T4306] gfs2_fill_super+0x1837/0x1f00 [ 77.327113][ T4306] get_tree_bdev+0x3f1/0x610 [ 77.331724][ T4306] gfs2_get_tree+0x4d/0x1e0 [ 77.336246][ T4306] vfs_get_tree+0x88/0x270 [ 77.340679][ T4306] do_new_mount+0x24a/0xa40 [ 77.345197][ T4306] __se_sys_mount+0x2e3/0x3d0 [ 77.349887][ T4306] do_syscall_64+0x4c/0xa0 [ 77.354320][ T4306] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 77.360232][ T4306] [ 77.362565][ T4306] Freed by task 4306: [ 77.366549][ T4306] kasan_set_track+0x4b/0x70 [ 77.371163][ T4306] kasan_set_free_info+0x1f/0x40 [ 77.376125][ T4306] ____kasan_slab_free+0xd5/0x110 [ 77.381169][ T4306] slab_free_freelist_hook+0xea/0x170 [ 77.386561][ T4306] kmem_cache_free+0x8f/0x210 [ 77.391258][ T4306] rcu_core+0x9d2/0x1670 [ 77.395516][ T4306] handle_softirqs+0x339/0x830 [ 77.400304][ T4306] __irq_exit_rcu+0x13b/0x230 [ 77.405007][ T4306] irq_exit_rcu+0x5/0x20 [ 77.409278][ T4306] sysvec_apic_timer_interrupt+0xa0/0xc0 [ 77.414967][ T4306] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 77.420979][ T4306] [ 77.423318][ T4306] Last potentially related work creation: [ 77.429051][ T4306] kasan_save_stack+0x35/0x60 [ 77.433756][ T4306] kasan_record_aux_stack+0xb8/0x100 [ 77.439074][ T4306] call_rcu+0x189/0x950 [ 77.443249][ T4306] gfs2_quota_cleanup+0x43c/0x6a0 [ 77.448309][ T4306] gfs2_make_fs_ro+0x440/0x620 [ 77.453091][ T4306] gfs2_withdraw+0x610/0x1490 [ 77.457805][ T4306] gfs2_inode_refresh+0xb64/0xff0 [ 77.462848][ T4306] inode_go_lock+0x127/0x470 [ 77.467459][ T4306] do_promote+0x741/0xab0 [ 77.471809][ T4306] finish_xmote+0x4df/0xb00 [ 77.476336][ T4306] do_xmote+0x7b6/0x1120 [ 77.480607][ T4306] gfs2_glock_nq+0xc7a/0x1550 [ 77.485306][ T4306] do_sync+0x4ab/0xc40 [ 77.489402][ T4306] gfs2_quota_sync+0x32c/0x700 [ 77.494188][ T4306] gfs2_sync_fs+0x48/0xb0 [ 77.498534][ T4306] sync_filesystem+0xe6/0x220 [ 77.503233][ T4306] generic_shutdown_super+0x6b/0x300 [ 77.508545][ T4306] kill_block_super+0x7c/0xe0 [ 77.513251][ T4306] deactivate_locked_super+0x93/0xf0 [ 77.518557][ T4306] cleanup_mnt+0x42d/0x4e0 [ 77.523000][ T4306] task_work_run+0x125/0x1a0 [ 77.527612][ T4306] exit_to_user_mode_loop+0x10f/0x130 [ 77.533001][ T4306] exit_to_user_mode_prepare+0xee/0x180 [ 77.538576][ T4306] syscall_exit_to_user_mode+0x16/0x40 [ 77.544071][ T4306] do_syscall_64+0x58/0xa0 [ 77.548520][ T4306] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 77.554437][ T4306] [ 77.556776][ T4306] The buggy address belongs to the object at ffff888073e76000 [ 77.556776][ T4306] which belongs to the cache gfs2_quotad of size 272 [ 77.570851][ T4306] The buggy address is located 144 bytes inside of [ 77.570851][ T4306] 272-byte region [ffff888073e76000, ffff888073e76110) [ 77.584150][ T4306] The buggy address belongs to the page: [ 77.589808][ T4306] page:ffffea0001cf9d80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x73e76 [ 77.599981][ T4306] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 77.607649][ T4306] raw: 00fff00000000200 0000000000000000 dead000000000122 ffff888147020140 [ 77.616263][ T4306] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 [ 77.624984][ T4306] page dumped because: kasan: bad access detected [ 77.631445][ T4306] page_owner tracks the page as allocated [ 77.637180][ T4306] page last allocated via order 0, migratetype Reclaimable, gfp_mask 0x112c50(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 4327, ts 76137887552, free_ts 75329168328 [ 77.656230][ T4306] get_page_from_freelist+0x1bbd/0x1ca0 [ 77.661815][ T4306] __alloc_pages+0x1ee/0x480 [ 77.666453][ T4306] new_slab+0xc0/0x4b0 [ 77.670561][ T4306] ___slab_alloc+0x80a/0xdd0 [ 77.675181][ T4306] kmem_cache_alloc+0x195/0x290 [ 77.680060][ T4306] qd_alloc+0x50/0x260 [ 77.684160][ T4306] gfs2_quota_init+0x74e/0xea0 [ 77.688953][ T4306] gfs2_make_fs_rw+0x414/0x580 [ 77.693737][ T4306] gfs2_fill_super+0x1837/0x1f00 [ 77.698702][ T4306] get_tree_bdev+0x3f1/0x610 [ 77.703322][ T4306] gfs2_get_tree+0x4d/0x1e0 [ 77.707853][ T4306] vfs_get_tree+0x88/0x270 [ 77.712304][ T4306] do_new_mount+0x24a/0xa40 [ 77.716838][ T4306] __se_sys_mount+0x2e3/0x3d0 [ 77.721567][ T4306] do_syscall_64+0x4c/0xa0 [ 77.726019][ T4306] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 77.731948][ T4306] page last free stack trace: [ 77.736641][ T4306] free_unref_page_prepare+0x637/0x6c0 [ 77.742135][ T4306] free_unref_page+0x8f/0x2a0 [ 77.746835][ T4306] __unfreeze_partials+0x1a5/0x200 [ 77.751975][ T4306] put_cpu_partial+0x12d/0x190 [ 77.756768][ T4306] qlist_free_all+0x35/0x90 [ 77.761302][ T4306] kasan_quarantine_reduce+0x150/0x160 [ 77.766785][ T4306] __kasan_slab_alloc+0x2f/0xd0 [ 77.771653][ T4306] slab_post_alloc_hook+0x4c/0x380 [ 77.776781][ T4306] kmem_cache_alloc_node+0x12d/0x2d0 [ 77.782091][ T4306] __alloc_skb+0xf4/0x750 [ 77.786502][ T4306] alloc_skb_with_frags+0xa7/0x730 [ 77.791708][ T4306] sock_alloc_send_pskb+0x87f/0x9a0 [ 77.796944][ T4306] unix_dgram_sendmsg+0x5fc/0x18a0 [ 77.802097][ T4306] __sys_sendto+0x46d/0x620 [ 77.806630][ T4306] __x64_sys_sendto+0xda/0xf0 [ 77.811334][ T4306] do_syscall_64+0x4c/0xa0 [ 77.815785][ T4306] [ 77.818135][ T4306] Memory state around the buggy address: [ 77.823784][ T4306] ffff888073e75f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.831858][ T4306] ffff888073e76000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 77.839945][ T4306] >ffff888073e76080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 77.848031][ T4306] ^ [ 77.852641][ T4306] ffff888073e76100: fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.860722][ T4306] ffff888073e76180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.868819][ T4306] ================================================================== [ 77.876913][ T4306] Disabling lock debugging due to kernel taint [ 77.903098][ T4306] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 77.910352][ T4306] CPU: 0 PID: 4306 Comm: syz-executor Tainted: G B syzkaller #0 [ 77.919318][ T4306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 77.929403][ T4306] Call Trace: [ 77.932705][ T4306] [ 77.935659][ T4306] dump_stack_lvl+0x188/0x250 [ 77.940363][ T4306] ? show_regs_print_info+0x20/0x20 [ 77.945597][ T4306] ? load_image+0x400/0x400 [ 77.950137][ T4306] panic+0x2e5/0x810 [ 77.954059][ T4306] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 77.960242][ T4306] ? bpf_jit_dump+0xd0/0xd0 [ 77.964774][ T4306] ? _raw_spin_unlock_irqrestore+0x10d/0x120 [ 77.970783][ T4306] ? _raw_spin_unlock+0x40/0x40 [ 77.975656][ T4306] ? qd_unlock+0x30/0x2d0 [ 77.980010][ T4306] check_panic_on_warn+0x80/0xa0 [ 77.984969][ T4306] ? qd_unlock+0x30/0x2d0 [ 77.989326][ T4306] end_report+0x6d/0xf0 [ 77.993507][ T4306] kasan_report+0x102/0x130 [ 77.998040][ T4306] ? qd_unlock+0x30/0x2d0 [ 78.002395]