Warning: Permanently added '10.128.1.82' (ED25519) to the list of known hosts. 2025/08/25 07:27:06 parsed 1 programs [ 58.414189][ T4269] cgroup: Unknown subsys name 'net' [ 58.586316][ T4269] cgroup: Unknown subsys name 'rlimit' [ 59.783955][ T4269] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 62.079226][ T4313] chnl_net:caif_netlink_parms(): no params data found [ 62.128572][ T4313] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.136231][ T4313] bridge0: port 1(bridge_slave_0) entered disabled state [ 62.144563][ T4313] device bridge_slave_0 entered promiscuous mode [ 62.162308][ T4313] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.169390][ T4313] bridge0: port 2(bridge_slave_1) entered disabled state [ 62.177272][ T4313] device bridge_slave_1 entered promiscuous mode [ 62.196307][ T4313] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 62.217264][ T4313] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 62.238118][ T4313] team0: Port device team_slave_0 added [ 62.246018][ T4313] team0: Port device team_slave_1 added [ 62.267885][ T4313] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 62.274865][ T4313] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 62.300741][ T4313] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 62.313104][ T4313] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 62.320165][ T4313] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 62.346062][ T4313] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 62.382477][ T4313] device hsr_slave_0 entered promiscuous mode [ 62.389260][ T4313] device hsr_slave_1 entered promiscuous mode [ 62.483553][ T4313] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 62.492825][ T4313] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 62.501967][ T4313] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 62.510403][ T4313] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 62.537863][ T4313] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.545065][ T4313] bridge0: port 2(bridge_slave_1) entered forwarding state [ 62.552718][ T4313] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.559766][ T4313] bridge0: port 1(bridge_slave_0) entered forwarding state [ 62.604475][ T4313] 8021q: adding VLAN 0 to HW filter on device bond0 [ 62.627820][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 62.637650][ T11] bridge0: port 1(bridge_slave_0) entered disabled state [ 62.646505][ T11] bridge0: port 2(bridge_slave_1) entered disabled state [ 62.658393][ T4313] 8021q: adding VLAN 0 to HW filter on device team0 [ 62.679210][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 62.687881][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.695003][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 62.711699][ T4325] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 62.720881][ T4325] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.727989][ T4325] bridge0: port 2(bridge_slave_1) entered forwarding state [ 62.740767][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 62.750156][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 62.766136][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 62.777902][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 62.789624][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 62.800589][ T4313] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 62.950398][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 62.958331][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 62.969471][ T4313] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 62.987287][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 63.004963][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 63.013767][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 63.023210][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 63.030891][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 63.042652][ T4313] device veth0_vlan entered promiscuous mode [ 63.052826][ T4313] device veth1_vlan entered promiscuous mode [ 63.069018][ T4325] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 63.077451][ T4325] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 63.086112][ T4325] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 63.094668][ T4325] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 63.104622][ T4313] device veth0_macvtap entered promiscuous mode [ 63.117252][ T4313] device veth1_macvtap entered promiscuous mode [ 63.130392][ T4313] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 63.137871][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 63.146771][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 63.154703][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 63.164398][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 63.175058][ T4313] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 63.184609][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 63.193243][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 63.203579][ T4313] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.213270][ T4313] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.222373][ T4313] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.231943][ T4313] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.563781][ T46] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 63.717518][ T4325] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 63.735486][ T4325] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 63.762090][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 63.777508][ T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 63.786124][ T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 63.795110][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 63.960332][ T4351] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 63.970332][ T4351] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 63.978824][ T4351] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 63.987038][ T4351] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 63.994697][ T4351] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 64.002092][ T4351] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 2025/08/25 07:27:14 executed programs: 0 [ 64.960248][ T4351] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 64.968542][ T4351] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 64.976028][ T4351] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 64.983925][ T4351] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 64.992131][ T4351] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 64.999305][ T4351] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 65.106096][ T4369] chnl_net:caif_netlink_parms(): no params data found [ 65.143795][ T4369] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.150889][ T4369] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.159060][ T4369] device bridge_slave_0 entered promiscuous mode [ 65.166851][ T4369] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.174087][ T4369] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.181798][ T4369] device bridge_slave_1 entered promiscuous mode [ 65.201384][ T4369] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.212498][ T4369] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.234910][ T4369] team0: Port device team_slave_0 added [ 65.242110][ T4369] team0: Port device team_slave_1 added [ 65.262448][ T4369] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 65.269387][ T4369] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.295474][ T4369] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 65.307971][ T4369] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 65.315102][ T4369] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.342547][ T4369] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 65.368826][ T4369] device hsr_slave_0 entered promiscuous mode [ 65.375743][ T4369] device hsr_slave_1 entered promiscuous mode [ 65.382396][ T4369] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 65.390175][ T4369] Cannot create hsr debugfs directory [ 65.920856][ T46] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 67.081703][ T4351] Bluetooth: hci0: command 0x0409 tx timeout [ 68.221291][ T46] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 68.290259][ T46] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 69.151982][ T4369] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 69.160521][ T4369] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 69.161982][ T4351] Bluetooth: hci0: command 0x041b tx timeout [ 69.179855][ T46] device hsr_slave_0 left promiscuous mode [ 69.186273][ T46] device hsr_slave_1 left promiscuous mode [ 69.192964][ T46] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 69.200459][ T46] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 69.208589][ T46] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 69.216134][ T46] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 69.223737][ T46] device bridge_slave_1 left promiscuous mode [ 69.230191][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.239803][ T46] device bridge_slave_0 left promiscuous mode [ 69.247430][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.264431][ T46] device veth1_macvtap left promiscuous mode [ 69.270536][ T46] device veth0_macvtap left promiscuous mode [ 69.276704][ T46] device veth1_vlan left promiscuous mode [ 69.282558][ T46] device veth0_vlan left promiscuous mode [ 69.523712][ T46] team0 (unregistering): Port device team_slave_1 removed [ 69.546479][ T46] team0 (unregistering): Port device team_slave_0 removed [ 69.568812][ T46] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 69.593766][ T46] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 69.793308][ T46] bond0 (unregistering): Released all slaves [ 69.847616][ T4369] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 69.856303][ T4369] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 69.919510][ T4369] 8021q: adding VLAN 0 to HW filter on device bond0 [ 69.930762][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 69.938736][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 69.949644][ T4369] 8021q: adding VLAN 0 to HW filter on device team0 [ 69.962525][ T40] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 69.975385][ T40] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 69.983970][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.991157][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.000413][ T40] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 70.010620][ T40] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 70.020269][ T40] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 70.028699][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.035787][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.054157][ T40] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 70.063022][ T40] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 70.071790][ T40] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 70.080331][ T40] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 70.089070][ T40] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 70.097910][ T40] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 70.106531][ T40] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 70.121837][ T4369] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 70.132328][ T4369] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 70.145389][ T40] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 70.153779][ T40] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 70.162590][ T40] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 70.170930][ T40] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 70.179439][ T40] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 70.370038][ T40] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 70.378846][ T40] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 70.395825][ T4369] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 70.420977][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 70.429846][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 70.448689][ T4369] device veth0_vlan entered promiscuous mode [ 70.455239][ T40] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 70.463816][ T40] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 70.472901][ T40] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 70.480552][ T40] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 70.492659][ T4369] device veth1_vlan entered promiscuous mode [ 70.507525][ T40] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 70.516532][ T40] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 70.525570][ T40] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 70.534136][ T40] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 70.544212][ T4369] device veth0_macvtap entered promiscuous mode [ 70.553647][ T4369] device veth1_macvtap entered promiscuous mode [ 70.567348][ T4369] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.574757][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 70.583895][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 70.591934][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 70.600270][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 70.611527][ T4369] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.620102][ T4369] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.629253][ T4369] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.638601][ T4369] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.647344][ T4369] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.657307][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 70.666366][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 70.720005][ T46] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.729910][ T46] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.750706][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready 2025/08/25 07:27:20 executed programs: 2 [ 70.766188][ T46] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.774181][ T46] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.782527][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 70.990629][ T4430] loop0: detected capacity change from 0 to 32768 [ 71.164785][ T1277] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.171355][ T1277] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.241425][ T4351] Bluetooth: hci0: command 0x040f tx timeout [ 71.317631][ T4431] loop0: detected capacity change from 0 to 32768 [ 71.833183][ T4432] loop0: detected capacity change from 0 to 32768 [ 72.086376][ T4433] loop0: detected capacity change from 0 to 32768 [ 72.105368][ T4433] ================================================================== [ 72.113462][ T4433] BUG: KASAN: slab-out-of-bounds in dtSearch+0x164c/0x2050 [ 72.120691][ T4433] Read of size 1 at addr ffff888060a02154 by task syz.0.20/4433 [ 72.128323][ T4433] [ 72.130669][ T4433] CPU: 0 PID: 4433 Comm: syz.0.20 Not tainted 6.1.148-syzkaller #0 [ 72.138566][ T4433] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 72.148637][ T4433] Call Trace: [ 72.151920][ T4433] [ 72.154856][ T4433] dump_stack_lvl+0x168/0x22e [ 72.159539][ T4433] ? __lock_acquire+0x7c50/0x7c50 [ 72.164570][ T4433] ? show_regs_print_info+0x12/0x12 [ 72.169772][ T4433] ? load_image+0x3b0/0x3b0 [ 72.174285][ T4433] ? __virt_addr_valid+0x465/0x540 [ 72.179407][ T4433] ? dtSearch+0x164c/0x2050 [ 72.183919][ T4433] print_report+0xa8/0x210 [ 72.188359][ T4433] kasan_report+0x10b/0x140 [ 72.192872][ T4433] ? dtSearch+0x164c/0x2050 [ 72.197386][ T4433] dtSearch+0x164c/0x2050 [ 72.201737][ T4433] jfs_lookup+0x152/0x380 [ 72.206080][ T4433] ? jfs_get_parent+0xa0/0xa0 [ 72.210771][ T4433] ? apparmor_path_rmdir+0x30/0x30 [ 72.215893][ T4433] ? make_kgid+0x640/0x640 [ 72.220315][ T4433] ? rwsem_write_trylock+0x12f/0x1b0 [ 72.225608][ T4433] ? generic_permission+0x230/0x510 [ 72.230818][ T4433] ? inode_permission+0xef/0x480 [ 72.235763][ T4433] ? bpf_lsm_inode_create+0x5/0x10 [ 72.240879][ T4433] ? security_inode_create+0xb3/0x100 [ 72.246254][ T4433] ? jfs_get_parent+0xa0/0xa0 [ 72.250935][ T4433] path_openat+0xfaf/0x2e70 [ 72.255437][ T4433] ? do_filp_open+0x3c0/0x3c0 [ 72.260108][ T4433] do_filp_open+0x1c1/0x3c0 [ 72.264599][ T4433] ? vfs_tmpfile+0x480/0x480 [ 72.269187][ T4433] ? _raw_spin_unlock+0x24/0x40 [ 72.274025][ T4433] ? alloc_fd+0x58f/0x630 [ 72.278347][ T4433] do_sys_openat2+0x142/0x490 [ 72.283011][ T4433] ? do_sys_open+0xe0/0xe0 [ 72.287419][ T4433] ? lockdep_hardirqs_on_prepare+0x3fc/0x760 [ 72.293386][ T4433] ? lock_chain_count+0x20/0x20 [ 72.298221][ T4433] __x64_sys_openat+0x135/0x160 [ 72.303057][ T4433] do_syscall_64+0x4c/0xa0 [ 72.307456][ T4433] ? clear_bhb_loop+0x60/0xb0 [ 72.312123][ T4433] ? clear_bhb_loop+0x60/0xb0 [ 72.316780][ T4433] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 72.322663][ T4433] RIP: 0033:0x7f1950f8ebe9 [ 72.327069][ T4433] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 72.346659][ T4433] RSP: 002b:00007fffe6a19908 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 72.355053][ T4433] RAX: ffffffffffffffda RBX: 00007f19511b5fa0 RCX: 00007f1950f8ebe9 [ 72.363006][ T4433] RDX: 0000000000183341 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 72.370957][ T4433] RBP: 00007f1951011e19 R08: 0000000000000000 R09: 0000000000000000 [ 72.378918][ T4433] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 72.386872][ T4433] R13: 00007f19511b5fa0 R14: 00007f19511b5fa0 R15: 0000000000000004 [ 72.394829][ T4433] [ 72.397829][ T4433] [ 72.400136][ T4433] The buggy address belongs to the object at ffff888060a01bc0 [ 72.400136][ T4433] which belongs to the cache jfs_ip of size 2240 [ 72.413832][ T4433] The buggy address is located 1428 bytes inside of [ 72.413832][ T4433] 2240-byte region [ffff888060a01bc0, ffff888060a02480) [ 72.427275][ T4433] [ 72.429585][ T4433] The buggy address belongs to the physical page: [ 72.435985][ T4433] page:ffffea0001828000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x60a00 [ 72.446119][ T4433] head:ffffea0001828000 order:3 compound_mapcount:0 compound_pincount:0 [ 72.454425][ T4433] memcg:ffff888078539501 [ 72.458654][ T4433] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 72.466630][ T4433] raw: 00fff00000010200 0000000000000000 dead000000000122 ffff8881472acc80 [ 72.475196][ T4433] raw: 0000000000000000 00000000800d000d 00000001ffffffff ffff888078539501 [ 72.483759][ T4433] page dumped because: kasan: bad access detected [ 72.490158][ T4433] page_owner tracks the page as allocated [ 72.495855][ T4433] page last allocated via order 3, migratetype Reclaimable, gfp_mask 0x1d2050(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 4433, tgid 4433 (syz.0.20), ts 72098813337, free_ts 61622820862 [ 72.519207][ T4433] post_alloc_hook+0x173/0x1a0 [ 72.523965][ T4433] get_page_from_freelist+0x1a26/0x1ac0 [ 72.529494][ T4433] __alloc_pages+0x1df/0x4e0 [ 72.534073][ T4433] alloc_slab_page+0x5d/0x160 [ 72.538732][ T4433] new_slab+0x87/0x2c0 [ 72.542781][ T4433] ___slab_alloc+0xbc6/0x1220 [ 72.547437][ T4433] kmem_cache_alloc_lru+0x1ae/0x2e0 [ 72.552614][ T4433] jfs_alloc_inode+0x24/0x60 [ 72.557187][ T4433] new_inode_pseudo+0x5f/0x1c0 [ 72.561935][ T4433] new_inode+0x25/0x1c0 [ 72.566083][ T4433] diReadSpecial+0x4e/0x700 [ 72.570578][ T4433] jfs_mount+0x29e/0x860 [ 72.574806][ T4433] jfs_fill_super+0x4de/0xac0 [ 72.579471][ T4433] mount_bdev+0x287/0x3c0 [ 72.583783][ T4433] legacy_get_tree+0xe6/0x180 [ 72.588445][ T4433] vfs_get_tree+0x88/0x270 [ 72.592887][ T4433] page last free stack trace: [ 72.597540][ T4433] free_unref_page_prepare+0x8b4/0x9a0 [ 72.602993][ T4433] free_unref_page+0x2e/0x3f0 [ 72.607659][ T4433] __vunmap+0x856/0xa00 [ 72.611795][ T4433] kcov_close+0x27/0x50 [ 72.615931][ T4433] __fput+0x22c/0x920 [ 72.619910][ T4433] task_work_run+0x1ca/0x250 [ 72.624516][ T4433] do_exit+0x93e/0x2400 [ 72.628657][ T4433] do_group_exit+0x217/0x2d0 [ 72.633231][ T4433] get_signal+0x1272/0x1350 [ 72.637724][ T4433] arch_do_signal_or_restart+0xb0/0x1230 [ 72.643342][ T4433] exit_to_user_mode_loop+0x70/0x110 [ 72.648614][ T4433] exit_to_user_mode_prepare+0xb1/0x140 [ 72.654149][ T4433] syscall_exit_to_user_mode+0x16/0x40 [ 72.659594][ T4433] do_syscall_64+0x58/0xa0 [ 72.663994][ T4433] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 72.669875][ T4433] [ 72.672184][ T4433] Memory state around the buggy address: [ 72.677791][ T4433] ffff888060a02000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 72.685831][ T4433] ffff888060a02080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 72.693884][ T4433] >ffff888060a02100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 72.701932][ T4433] ^ [ 72.708584][ T4433] ffff888060a02180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 72.716624][ T4433] ffff888060a02200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 72.724660][ T4433] ================================================================== [ 72.737264][ T4433] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 72.744476][ T4433] CPU: 1 PID: 4433 Comm: syz.0.20 Not tainted 6.1.148-syzkaller #0 [ 72.752361][ T4433] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 72.762402][ T4433] Call Trace: [ 72.765663][ T4433] [ 72.768577][ T4433] dump_stack_lvl+0x168/0x22e [ 72.773239][ T4433] ? memcpy+0x3c/0x60 [ 72.777206][ T4433] ? show_regs_print_info+0x12/0x12 [ 72.782387][ T4433] ? load_image+0x3b0/0x3b0 [ 72.786879][ T4433] panic+0x2c9/0x710 [ 72.790764][ T4433] ? bpf_jit_dump+0xd0/0xd0 [ 72.795251][ T4433] ? _raw_spin_unlock_irqrestore+0xf6/0x100 [ 72.801132][ T4433] ? _raw_spin_unlock+0x40/0x40 [ 72.805967][ T4433] ? print_memory_metadata+0x314/0x400 [ 72.811412][ T4433] check_panic_on_warn+0x80/0xa0 [ 72.816331][ T4433] ? dtSearch+0x164c/0x2050 [ 72.820817][ T4433] end_report+0x66/0x110 [ 72.825043][ T4433] kasan_report+0x118/0x140 [ 72.829529][ T4433] ? dtSearch+0x164c/0x2050 [ 72.834020][ T4433] dtSearch+0x164c/0x2050 [ 72.838343][ T4433] jfs_lookup+0x152/0x380 [ 72.842659][ T4433] ? jfs_get_parent+0xa0/0xa0 [ 72.847325][ T4433] ? apparmor_path_rmdir+0x30/0x30 [ 72.852425][ T4433] ? make_kgid+0x640/0x640 [ 72.856822][ T4433] ? rwsem_write_trylock+0x12f/0x1b0 [ 72.862092][ T4433] ? generic_permission+0x230/0x510 [ 72.867320][ T4433] ? inode_permission+0xef/0x480 [ 72.872250][ T4433] ? bpf_lsm_inode_create+0x5/0x10 [ 72.877347][ T4433] ? security_inode_create+0xb3/0x100 [ 72.882700][ T4433] ? jfs_get_parent+0xa0/0xa0 [ 72.887450][ T4433] path_openat+0xfaf/0x2e70 [ 72.891947][ T4433] ? do_filp_open+0x3c0/0x3c0 [ 72.896622][ T4433] do_filp_open+0x1c1/0x3c0 [ 72.901117][ T4433] ? vfs_tmpfile+0x480/0x480 [ 72.905706][ T4433] ? _raw_spin_unlock+0x24/0x40 [ 72.910569][ T4433] ? alloc_fd+0x58f/0x630 [ 72.914895][ T4433] do_sys_openat2+0x142/0x490 [ 72.919560][ T4433] ? do_sys_open+0xe0/0xe0 [ 72.923982][ T4433] ? lockdep_hardirqs_on_prepare+0x3fc/0x760 [ 72.929970][ T4433] ? lock_chain_count+0x20/0x20 [ 72.934821][ T4433] __x64_sys_openat+0x135/0x160 [ 72.939665][ T4433] do_syscall_64+0x4c/0xa0 [ 72.944072][ T4433] ? clear_bhb_loop+0x60/0xb0 [ 72.948731][ T4433] ? clear_bhb_loop+0x60/0xb0 [ 72.953391][ T4433] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 72.959273][ T4433] RIP: 0033:0x7f1950f8ebe9 [ 72.963670][ T4433] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 72.983261][ T4433] RSP: 002b:00007fffe6a19908 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 72.991659][ T4433] RAX: ffffffffffffffda RBX: 00007f19511b5fa0 RCX: 00007f1950f8ebe9 [ 72.999627][ T4433] RDX: 0000000000183341 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 73.007591][ T4433] RBP: 00007f1951011e19 R08: 0000000000000000 R09: 0000000000000000 [ 73.015552][ T4433] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 73.023516][ T4433] R13: 00007f19511b5fa0 R14: 00007f19511b5fa0 R15: 0000000000000004 [ 73.031478][ T4433] [ 73.034699][ T4433] Kernel Offset: disabled [ 73.039004][ T4433] Rebooting in 86400 seconds..