Warning: Permanently added '[localhost]:35536' (ED25519) to the list of known hosts. 2025/10/10 16:16:56 parsed 1 programs syzkaller login: [ 86.709919][ T55] cfg80211: failed to load regulatory.db [ 87.424919][ T5310] cgroup: Unknown subsys name 'net' [ 87.496168][ T5310] cgroup: Unknown subsys name 'cpuset' [ 87.501862][ T5310] cgroup: Unknown subsys name 'rlimit' [ 89.198167][ T5310] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 93.838196][ T47] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 93.842295][ T47] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 93.853526][ T47] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 93.857486][ T47] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 93.860744][ T47] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 95.107985][ T5333] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 95.196340][ T5331] syz-executor (5331) used greatest stack depth: 18440 bytes left [ 95.912860][ T4666] Bluetooth: hci0: command tx timeout [ 96.208301][ T5333] ODEBUG: Out of memory. ODEBUG disabled [ 103.628036][ T1041] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.631321][ T1041] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.712081][ T1050] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.736491][ T1050] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.876663][ T5378] chnl_net:caif_netlink_parms(): no params data found [ 107.072210][ T5378] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.087501][ T5378] bridge0: port 1(bridge_slave_0) entered disabled state [ 107.091402][ T5378] bridge_slave_0: entered allmulticast mode [ 107.115303][ T5378] bridge_slave_0: entered promiscuous mode [ 107.121090][ T5378] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.133009][ T5378] bridge0: port 2(bridge_slave_1) entered disabled state [ 107.136258][ T5378] bridge_slave_1: entered allmulticast mode [ 107.150830][ T5378] bridge_slave_1: entered promiscuous mode [ 107.216728][ T5378] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 107.234161][ T5378] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 107.295061][ T5378] team0: Port device team_slave_0 added [ 107.304138][ T5378] team0: Port device team_slave_1 added [ 107.373080][ T5378] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 107.376174][ T5378] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 107.396757][ T5378] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 107.415305][ T5378] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 107.429669][ T5378] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 107.451476][ T5378] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 107.559160][ T5378] hsr_slave_0: entered promiscuous mode [ 107.578170][ T5378] hsr_slave_1: entered promiscuous mode [ 107.897498][ T5378] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 107.915347][ T5378] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 107.927235][ T5378] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 107.944567][ T5378] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 108.093088][ T5378] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.124427][ T5378] 8021q: adding VLAN 0 to HW filter on device team0 [ 108.136742][ T1038] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.140001][ T1038] bridge0: port 1(bridge_slave_0) entered forwarding state [ 108.166221][ T1045] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.169463][ T1045] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.486147][ T5378] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.861639][ T5378] veth0_vlan: entered promiscuous mode [ 108.871995][ T5378] veth1_vlan: entered promiscuous mode [ 108.933937][ T5378] veth0_macvtap: entered promiscuous mode [ 108.939950][ T5378] veth1_macvtap: entered promiscuous mode [ 108.968338][ T5378] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 108.985595][ T5378] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.004846][ T1045] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.036468][ T1045] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.059055][ T1045] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.072986][ T1045] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 2025/10/10 16:17:21 executed programs: 0 [ 109.650953][ T47] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 109.657549][ T47] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 109.660565][ T47] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 109.664316][ T47] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 109.667724][ T47] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 109.704717][ T5335] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 109.708020][ T5335] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 109.711797][ T5335] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 109.715148][ T5335] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 109.718072][ T5335] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 109.721073][ T5335] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 109.724706][ T5335] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 109.727669][ T5335] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 109.730939][ T5335] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 109.734077][ T5335] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 109.828315][ T5446] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 109.842612][ T5446] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 109.852666][ T5446] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 109.855843][ T5335] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 109.859916][ T5446] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 109.863501][ T5446] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 109.866709][ T5335] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 109.870094][ T5446] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 109.926469][ T5446] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 109.935859][ T5446] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 110.060364][ T5448] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 110.073065][ T5448] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 110.082908][ T5448] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 110.086427][ T5448] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 110.089815][ T5448] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 111.026875][ T13] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.367839][ T13] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.459449][ T5439] chnl_net:caif_netlink_parms(): no params data found [ 111.664096][ T13] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.742686][ T5448] Bluetooth: hci0: command tx timeout [ 111.764817][ T13] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.825563][ T5448] Bluetooth: hci2: command tx timeout [ 111.828292][ T5448] Bluetooth: hci1: command tx timeout [ 111.933881][ T5439] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.937050][ T5439] bridge0: port 1(bridge_slave_0) entered disabled state [ 111.940083][ T5439] bridge_slave_0: entered allmulticast mode [ 111.954585][ T5439] bridge_slave_0: entered promiscuous mode [ 111.963816][ T5439] bridge0: port 2(bridge_slave_1) entered blocking state [ 111.966932][ T5439] bridge0: port 2(bridge_slave_1) entered disabled state [ 111.970095][ T5439] bridge_slave_1: entered allmulticast mode [ 111.983566][ T5446] Bluetooth: hci4: command tx timeout [ 111.985907][ T5446] Bluetooth: hci3: command tx timeout [ 111.990373][ T5439] bridge_slave_1: entered promiscuous mode [ 112.143457][ T5448] Bluetooth: hci5: command tx timeout [ 112.168830][ T5439] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 112.189362][ T5439] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 112.431175][ T5439] team0: Port device team_slave_0 added [ 112.490514][ T5439] team0: Port device team_slave_1 added [ 112.529211][ T5447] chnl_net:caif_netlink_parms(): no params data found [ 112.537722][ T13] bridge_slave_1: left allmulticast mode [ 112.540440][ T13] bridge_slave_1: left promiscuous mode [ 112.553865][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 112.559305][ T13] bridge_slave_0: left allmulticast mode [ 112.561921][ T13] bridge_slave_0: left promiscuous mode [ 112.573576][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 113.040175][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 113.046494][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 113.051055][ T13] bond0 (unregistering): Released all slaves [ 113.180164][ T5443] chnl_net:caif_netlink_parms(): no params data found [ 113.246645][ T13] hsr_slave_0: left promiscuous mode [ 113.253471][ T13] hsr_slave_1: left promiscuous mode [ 113.261414][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 113.275988][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 113.292781][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 113.295924][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 113.326149][ T13] veth1_macvtap: left promiscuous mode [ 113.328437][ T13] veth0_macvtap: left promiscuous mode [ 113.330873][ T13] veth1_vlan: left promiscuous mode [ 113.353109][ T13] veth0_vlan: left promiscuous mode [ 113.742249][ T13] team0 (unregistering): Port device team_slave_1 removed [ 113.763413][ T13] team0 (unregistering): Port device team_slave_0 removed [ 113.824821][ T5446] Bluetooth: hci0: command tx timeout [ 113.903694][ T5446] Bluetooth: hci1: command tx timeout [ 113.906120][ T5446] Bluetooth: hci2: command tx timeout [ 114.043962][ T5439] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 114.046615][ T5439] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 114.058348][ T5439] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 114.064593][ T5448] Bluetooth: hci3: command tx timeout [ 114.066684][ T5448] Bluetooth: hci4: command tx timeout [ 114.171889][ T5439] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 114.193733][ T5439] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 114.223358][ T5446] Bluetooth: hci5: command tx timeout [ 114.229966][ T5439] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 114.276884][ T5458] chnl_net:caif_netlink_parms(): no params data found [ 114.480866][ T5441] chnl_net:caif_netlink_parms(): no params data found [ 114.533875][ T5439] hsr_slave_0: entered promiscuous mode [ 114.551294][ T5439] hsr_slave_1: entered promiscuous mode [ 114.667888][ T5443] bridge0: port 1(bridge_slave_0) entered blocking state [ 114.670862][ T5443] bridge0: port 1(bridge_slave_0) entered disabled state [ 114.692856][ T5443] bridge_slave_0: entered allmulticast mode [ 114.713485][ T5443] bridge_slave_0: entered promiscuous mode [ 114.838346][ T5443] bridge0: port 2(bridge_slave_1) entered blocking state [ 114.841444][ T5443] bridge0: port 2(bridge_slave_1) entered disabled state [ 114.853361][ T5443] bridge_slave_1: entered allmulticast mode [ 114.867252][ T5443] bridge_slave_1: entered promiscuous mode [ 114.879845][ T5452] chnl_net:caif_netlink_parms(): no params data found [ 114.963454][ T5447] bridge0: port 1(bridge_slave_0) entered blocking state [ 114.966599][ T5447] bridge0: port 1(bridge_slave_0) entered disabled state [ 114.969780][ T5447] bridge_slave_0: entered allmulticast mode [ 114.994187][ T5447] bridge_slave_0: entered promiscuous mode [ 115.081338][ T5443] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 115.120786][ T5447] bridge0: port 2(bridge_slave_1) entered blocking state [ 115.135596][ T5447] bridge0: port 2(bridge_slave_1) entered disabled state [ 115.138662][ T5447] bridge_slave_1: entered allmulticast mode [ 115.147404][ T5447] bridge_slave_1: entered promiscuous mode [ 115.155987][ T5458] bridge0: port 1(bridge_slave_0) entered blocking state [ 115.159129][ T5458] bridge0: port 1(bridge_slave_0) entered disabled state [ 115.162325][ T5458] bridge_slave_0: entered allmulticast mode [ 115.167066][ T5458] bridge_slave_0: entered promiscuous mode [ 115.182245][ T5443] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 115.212498][ T5458] bridge0: port 2(bridge_slave_1) entered blocking state [ 115.216498][ T5458] bridge0: port 2(bridge_slave_1) entered disabled state [ 115.220092][ T5458] bridge_slave_1: entered allmulticast mode [ 115.224537][ T5458] bridge_slave_1: entered promiscuous mode [ 115.294583][ T5447] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 115.387098][ T5443] team0: Port device team_slave_0 added [ 115.401771][ T5447] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 115.434674][ T5458] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 115.446782][ T5443] team0: Port device team_slave_1 added [ 115.494645][ T5458] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 115.518793][ T5441] bridge0: port 1(bridge_slave_0) entered blocking state [ 115.521275][ T5441] bridge0: port 1(bridge_slave_0) entered disabled state [ 115.532833][ T5441] bridge_slave_0: entered allmulticast mode [ 115.536378][ T5441] bridge_slave_0: entered promiscuous mode [ 115.613816][ T5441] bridge0: port 2(bridge_slave_1) entered blocking state [ 115.617158][ T5441] bridge0: port 2(bridge_slave_1) entered disabled state [ 115.620967][ T5441] bridge_slave_1: entered allmulticast mode [ 115.653044][ T5441] bridge_slave_1: entered promiscuous mode [ 115.668573][ T5447] team0: Port device team_slave_0 added [ 115.671701][ T5452] bridge0: port 1(bridge_slave_0) entered blocking state [ 115.678981][ T5452] bridge0: port 1(bridge_slave_0) entered disabled state [ 115.681960][ T5452] bridge_slave_0: entered allmulticast mode [ 115.690556][ T5452] bridge_slave_0: entered promiscuous mode [ 115.704001][ T5443] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 115.707128][ T5443] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 115.718805][ T5443] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 115.733192][ T5447] team0: Port device team_slave_1 added [ 115.736550][ T5452] bridge0: port 2(bridge_slave_1) entered blocking state [ 115.739524][ T5452] bridge0: port 2(bridge_slave_1) entered disabled state [ 115.745270][ T5452] bridge_slave_1: entered allmulticast mode [ 115.748666][ T5452] bridge_slave_1: entered promiscuous mode [ 115.754385][ T5458] team0: Port device team_slave_0 added [ 115.761440][ T5443] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 115.768275][ T5443] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 115.780291][ T5443] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 115.803295][ T5458] team0: Port device team_slave_1 added [ 115.826913][ T5441] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 115.904213][ T5446] Bluetooth: hci0: command tx timeout [ 115.909490][ T5452] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 115.947725][ T5441] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 115.960889][ T5447] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 115.969199][ T5447] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 115.983850][ T5446] Bluetooth: hci2: command tx timeout [ 115.986100][ T5446] Bluetooth: hci1: command tx timeout [ 116.002717][ T5447] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 116.026153][ T5458] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 116.028890][ T5458] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 116.053289][ T5458] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 116.061300][ T5452] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 116.113859][ T5443] hsr_slave_0: entered promiscuous mode [ 116.124962][ T5443] hsr_slave_1: entered promiscuous mode [ 116.127919][ T5443] debugfs: 'hsr0' already exists in 'hsr' [ 116.130610][ T5443] Cannot create hsr debugfs directory [ 116.142833][ T5448] Bluetooth: hci4: command tx timeout [ 116.145363][ T5448] Bluetooth: hci3: command tx timeout [ 116.165436][ T5447] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 116.168397][ T5447] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 116.189059][ T5447] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 116.194991][ T5458] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 116.197840][ T5458] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 116.210582][ T5458] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 116.233786][ T5439] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 116.265093][ T5452] team0: Port device team_slave_0 added [ 116.295154][ T5439] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 116.303100][ T5446] Bluetooth: hci5: command tx timeout [ 116.306404][ T5441] team0: Port device team_slave_0 added [ 116.309601][ T5439] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 116.320136][ T5452] team0: Port device team_slave_1 added [ 116.399853][ T5441] team0: Port device team_slave_1 added [ 116.403548][ T5439] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 116.449013][ T5447] hsr_slave_0: entered promiscuous mode [ 116.452357][ T5447] hsr_slave_1: entered promiscuous mode [ 116.456304][ T5447] debugfs: 'hsr0' already exists in 'hsr' [ 116.458688][ T5447] Cannot create hsr debugfs directory [ 116.466612][ T5452] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 116.469624][ T5452] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 116.482235][ T5452] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 116.529186][ T5458] hsr_slave_0: entered promiscuous mode [ 116.532385][ T5458] hsr_slave_1: entered promiscuous mode [ 116.545423][ T5458] debugfs: 'hsr0' already exists in 'hsr' [ 116.547996][ T5458] Cannot create hsr debugfs directory [ 116.581243][ T5452] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 116.586217][ T5452] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 116.597685][ T5452] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 116.641135][ T5441] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 116.644999][ T5441] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 116.656186][ T5441] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 116.667733][ T5441] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 116.670822][ T5441] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 116.683469][ T5441] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 116.835147][ T5452] hsr_slave_0: entered promiscuous mode [ 116.838693][ T5452] hsr_slave_1: entered promiscuous mode [ 116.853578][ T5452] debugfs: 'hsr0' already exists in 'hsr' [ 116.856102][ T5452] Cannot create hsr debugfs directory [ 116.959159][ T5441] hsr_slave_0: entered promiscuous mode [ 116.963567][ T5441] hsr_slave_1: entered promiscuous mode [ 116.966556][ T5441] debugfs: 'hsr0' already exists in 'hsr' [ 116.968916][ T5441] Cannot create hsr debugfs directory [ 117.185338][ T5443] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 117.223053][ T5443] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 117.229960][ T5443] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 117.265369][ T5443] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 117.321221][ T5439] 8021q: adding VLAN 0 to HW filter on device bond0 [ 117.375662][ T5447] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 117.418119][ T5447] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 117.435970][ T5439] 8021q: adding VLAN 0 to HW filter on device team0 [ 117.447748][ T1041] bridge0: port 1(bridge_slave_0) entered blocking state [ 117.451020][ T1041] bridge0: port 1(bridge_slave_0) entered forwarding state [ 117.457133][ T5447] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 117.479659][ T1041] bridge0: port 2(bridge_slave_1) entered blocking state [ 117.482842][ T1041] bridge0: port 2(bridge_slave_1) entered forwarding state [ 117.486315][ T5447] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 117.598663][ T5458] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 117.678542][ T5458] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 117.768018][ T5458] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 117.795289][ T5458] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 117.850679][ T5443] 8021q: adding VLAN 0 to HW filter on device bond0 [ 117.983415][ T5446] Bluetooth: hci0: command tx timeout [ 118.065302][ T5446] Bluetooth: hci1: command tx timeout [ 118.067179][ T5446] Bluetooth: hci2: command tx timeout [ 118.099709][ T5443] 8021q: adding VLAN 0 to HW filter on device team0 [ 118.166774][ T1041] bridge0: port 1(bridge_slave_0) entered blocking state [ 118.169987][ T1041] bridge0: port 1(bridge_slave_0) entered forwarding state [ 118.223320][ T5448] Bluetooth: hci3: command tx timeout [ 118.225819][ T5448] Bluetooth: hci4: command tx timeout [ 118.283717][ T1050] bridge0: port 2(bridge_slave_1) entered blocking state [ 118.286898][ T1050] bridge0: port 2(bridge_slave_1) entered forwarding state [ 118.295635][ T5439] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 118.306087][ T5447] 8021q: adding VLAN 0 to HW filter on device bond0 [ 118.385734][ T5446] Bluetooth: hci5: command tx timeout [ 118.471819][ T5447] 8021q: adding VLAN 0 to HW filter on device team0 [ 118.500226][ T5458] 8021q: adding VLAN 0 to HW filter on device bond0 [ 118.588563][ T1045] bridge0: port 1(bridge_slave_0) entered blocking state [ 118.591796][ T1045] bridge0: port 1(bridge_slave_0) entered forwarding state [ 118.616614][ T1045] bridge0: port 2(bridge_slave_1) entered blocking state [ 118.619700][ T1045] bridge0: port 2(bridge_slave_1) entered forwarding state [ 118.799891][ T5439] veth0_vlan: entered promiscuous mode [ 118.806947][ T5452] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 118.842974][ T5452] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 118.868390][ T5458] 8021q: adding VLAN 0 to HW filter on device team0 [ 118.918355][ T5439] veth1_vlan: entered promiscuous mode [ 118.960923][ T5452] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 119.006578][ T5452] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 119.067758][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 119.070797][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 119.132393][ T5439] veth0_macvtap: entered promiscuous mode [ 119.249210][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 119.252360][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 119.296739][ T5439] veth1_macvtap: entered promiscuous mode [ 119.441314][ T5441] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 119.473830][ T5441] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 119.527261][ T5439] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 119.604357][ T5439] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 119.621068][ T5441] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 119.668390][ T5441] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 119.862819][ T1045] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.969561][ T5443] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 119.977068][ T1045] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.027638][ T5447] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 120.093804][ T1045] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.116758][ T5452] 8021q: adding VLAN 0 to HW filter on device bond0 [ 120.176594][ T1045] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.309117][ T5452] 8021q: adding VLAN 0 to HW filter on device team0 [ 120.481572][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 120.484812][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 120.522323][ T5447] veth0_vlan: entered promiscuous mode [ 120.527944][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 120.531224][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 120.556411][ T1038] bridge0: port 2(bridge_slave_1) entered blocking state [ 120.559393][ T1038] bridge0: port 2(bridge_slave_1) entered forwarding state [ 120.566950][ T5443] veth0_vlan: entered promiscuous mode [ 120.625452][ T5458] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 120.646128][ T5443] veth1_vlan: entered promiscuous mode [ 120.705114][ T5447] veth1_vlan: entered promiscuous mode [ 120.791224][ T1091] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 120.798303][ T1091] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 120.818412][ T5452] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 120.840973][ T5443] veth0_macvtap: entered promiscuous mode [ 120.859209][ T5441] 8021q: adding VLAN 0 to HW filter on device bond0 [ 120.917520][ T5443] veth1_macvtap: entered promiscuous mode [ 121.068398][ T5443] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 121.128566][ T5447] veth0_macvtap: entered promiscuous mode [ 121.195745][ T5441] 8021q: adding VLAN 0 to HW filter on device team0 [ 121.226788][ T5443] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 121.257766][ T5447] veth1_macvtap: entered promiscuous mode 2025/10/10 16:17:32 executed programs: 12 [ 121.310229][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 121.313498][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 121.391501][ T5447] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 121.498795][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.508309][ T1045] bridge0: port 2(bridge_slave_1) entered blocking state [ 121.511501][ T1045] bridge0: port 2(bridge_slave_1) entered forwarding state [ 121.569891][ T5447] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 121.641583][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.668132][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.672344][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.774476][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.778366][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.782137][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.872279][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.999741][ T5452] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 122.061601][ T5458] veth0_vlan: entered promiscuous mode [ 122.135320][ T1041] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 122.138643][ T1041] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 122.167030][ T5458] veth1_vlan: entered promiscuous mode [ 122.359945][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 122.368746][ T5458] veth0_macvtap: entered promiscuous mode [ 122.383463][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 122.426553][ T5458] veth1_macvtap: entered promiscuous mode [ 122.477563][ T5659] loop0: detected capacity change from 0 to 32768 [ 122.503811][ T1091] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 122.541853][ T1091] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 122.569091][ T5458] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 122.578268][ T5659] gfs2: fsid=.: Trying to join cluster "lock_nolock", "." [ 122.581660][ T5659] gfs2: fsid=.: Now mounting FS (format 1801)... [ 122.680383][ T5458] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 122.737156][ T1041] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 122.750510][ T1038] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.756072][ T5659] syz.0.17: attempt to access beyond end of device [ 122.756072][ T5659] loop0: rw=12288, sector=18446744073709551608, nr_sectors = 8 limit=32768 [ 122.789053][ T1041] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 122.835616][ T5659] gfs2: fsid=..s: fatal: filesystem consistency error - inode = 1 19, function = gfs2_jdesc_check, file = fs/gfs2/super.c, line = 119 [ 122.841202][ T5659] gfs2: fsid=..s: G: s:SH n:2/13 f:aqo t:SH d:EX/0 a:0 v:0 r:2 m:20 p:4 [ 122.859966][ T1038] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.891301][ T1038] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.904793][ T5659] gfs2: fsid=..s: H: s:SH f:eEcH e:0 p:5659 [syz.0.17] init_journal+0x17f8/0x2260 [ 122.908343][ T5659] gfs2: fsid=..s: I: n:1/19 t:8 f:0x00 d:0x00000200 s:8388608 p:0 [ 122.911737][ T5659] gfs2: fsid=..s: about to withdraw this file system [ 122.971553][ T5441] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 123.001579][ T5659] gfs2: fsid=..s: Journal recovery skipped for jid 0 until next mount. [ 123.024387][ T5659] gfs2: fsid=..s: Glock dequeues delayed: 0 [ 123.067005][ T5659] gfs2: fsid=..s: File system withdrawn [ 123.069380][ T5659] CPU: 0 UID: 0 PID: 5659 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 123.069396][ T5659] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 123.069403][ T5659] Call Trace: [ 123.069408][ T5659] [ 123.069414][ T5659] dump_stack_lvl+0x189/0x250 [ 123.069434][ T5659] ? __pfx_dump_stack_lvl+0x10/0x10 [ 123.069445][ T5659] ? __pfx__printk+0x10/0x10 [ 123.069458][ T5659] ? kobject_uevent_env+0x36b/0x8c0 [ 123.069525][ T5659] gfs2_withdraw+0xb30/0x1430 [ 123.069549][ T5659] ? __pfx_gfs2_withdraw+0x10/0x10 [ 123.069564][ T5659] ? __pfx_wake_up_bit+0x10/0x10 [ 123.069579][ T5659] ? __pfx_wake_bit_function+0x10/0x10 [ 123.069595][ T5659] ? gfs2_consist_inode_i+0xf5/0x110 [ 123.069610][ T5659] gfs2_jdesc_check+0x17d/0x2f0 [ 123.069628][ T5659] check_journal_clean+0x158/0x310 [ 123.069642][ T5659] ? __pfx_check_journal_clean+0x10/0x10 [ 123.069657][ T5659] ? init_journal+0x17f8/0x2260 [ 123.069675][ T5659] ? do_raw_spin_unlock+0x4d/0x240 [ 123.069692][ T5659] ? _raw_spin_unlock+0x28/0x50 [ 123.069703][ T5659] ? gfs2_jdesc_find+0xab/0xc0 [ 123.069718][ T5659] init_journal+0x17f8/0x2260 [ 123.069738][ T5659] ? init_inodes+0xdb/0x320 [ 123.069753][ T5659] ? __pfx_init_journal+0x10/0x10 [ 123.069765][ T5659] ? vsnprintf+0xe11/0xf00 [ 123.069788][ T5659] ? snprintf+0xda/0x120 [ 123.069805][ T5659] ? init_inodes+0xdb/0x320 [ 123.069817][ T5659] ? __pfx_snprintf+0x10/0x10 [ 123.069839][ T5659] ? gfs2_glock_nq_num+0x13d/0x170 [ 123.069854][ T5659] init_inodes+0xdb/0x320 [ 123.069868][ T5659] gfs2_fill_super+0x1923/0x20d0 [ 123.069914][ T5659] ? __pfx_gfs2_fill_super+0x10/0x10 [ 123.069929][ T5659] ? init_locking+0xb8/0x210 [ 123.069940][ T5659] ? sb_set_blocksize+0x104/0x180 [ 123.069955][ T5659] ? setup_bdev_super+0x4c1/0x5b0 [ 123.069972][ T5659] get_tree_bdev_flags+0x40b/0x4d0 [ 123.069986][ T5659] ? __pfx_gfs2_fill_super+0x10/0x10 [ 123.069998][ T5659] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 123.070010][ T5659] ? __pfx_vfs_parse_comma_sep+0x10/0x10 [ 123.070033][ T5659] gfs2_get_tree+0x51/0x1e0 [ 123.070048][ T5659] vfs_get_tree+0x8f/0x2b0 [ 123.070063][ T5659] do_new_mount+0x302/0xa10 [ 123.070076][ T5659] ? apparmor_capable+0x137/0x1b0 [ 123.070096][ T5659] ? __pfx_do_new_mount+0x10/0x10 [ 123.070110][ T5659] ? ns_capable+0x8a/0xf0 [ 123.070125][ T5659] ? kmem_cache_free+0x19b/0x690 [ 123.070147][ T5659] __se_sys_mount+0x313/0x410 [ 123.070166][ T5659] ? __pfx___se_sys_mount+0x10/0x10 [ 123.070183][ T5659] ? do_syscall_64+0xbe/0xfa0 [ 123.070195][ T5659] ? __x64_sys_mount+0x20/0xc0 [ 123.070211][ T5659] do_syscall_64+0xfa/0xfa0 [ 123.070222][ T5659] ? lockdep_hardirqs_on+0x9c/0x150 [ 123.070235][ T5659] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.070246][ T5659] ? clear_bhb_loop+0x60/0xb0 [ 123.070260][ T5659] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.070270][ T5659] RIP: 0033:0x7fb88379066a [ 123.070281][ T5659] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 123.070290][ T5659] RSP: 002b:00007fb884686e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 123.070303][ T5659] RAX: ffffffffffffffda RBX: 00007fb884686ef0 RCX: 00007fb88379066a [ 123.070311][ T5659] RDX: 0000200000000000 RSI: 0000200000000100 RDI: 00007fb884686eb0 [ 123.070318][ T5659] RBP: 0000200000000000 R08: 00007fb884686ef0 R09: 0000000000208c1b [ 123.070325][ T5659] R10: 0000000000208c1b R11: 0000000000000246 R12: 0000200000000100 [ 123.070332][ T5659] R13: 00007fb884686eb0 R14: 0000000000012754 R15: 00002000000128c0 [ 123.070352][ T5659] [ 123.070357][ T5659] gfs2: fsid=..s: Error checking journal for spectator mount. [ 123.276540][ T1038] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.562183][ T5452] veth0_vlan: entered promiscuous mode [ 123.637250][ T5452] veth1_vlan: entered promiscuous mode [ 123.683707][ T5441] veth0_vlan: entered promiscuous mode [ 123.764953][ T5441] veth1_vlan: entered promiscuous mode [ 123.817074][ T5452] veth0_macvtap: entered promiscuous mode [ 123.852172][ T1041] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 123.856625][ T1041] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 123.877269][ T5452] veth1_macvtap: entered promiscuous mode [ 123.896958][ T5441] veth0_macvtap: entered promiscuous mode [ 123.901707][ T5441] veth1_macvtap: entered promiscuous mode [ 124.096639][ T5452] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 124.104115][ T1050] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 124.107448][ T1050] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 124.142139][ T5441] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 124.178082][ T5452] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 124.220008][ T5441] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 124.284189][ T1091] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 124.302008][ T1091] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 124.325628][ T1091] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 124.329331][ T1091] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 124.423223][ T1091] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 124.514556][ T1091] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 124.585431][ T1091] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 124.685122][ T1091] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 124.867880][ T1050] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 124.871304][ T1050] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 125.117966][ T1050] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 125.133836][ T1050] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 125.199185][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 125.217799][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 125.280354][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 125.300311][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 126.215795][ T5697] loop0: detected capacity change from 0 to 32768 [ 126.322207][ T5697] gfs2: fsid=.: Trying to join cluster "lock_nolock", "." [ 126.355150][ T5697] gfs2: fsid=.: Now mounting FS (format 1801)... [ 126.475740][ T5697] syz.0.23: attempt to access beyond end of device [ 126.475740][ T5697] loop0: rw=12288, sector=18446744073709551608, nr_sectors = 8 limit=32768 [ 126.482274][ T5697] gfs2: fsid=..s: fatal: filesystem consistency error - inode = 1 19, function = gfs2_jdesc_check, file = fs/gfs2/super.c, line = 119 [ 126.606199][ T5697] gfs2: fsid=..s: G: s:SH n:2/13 f:aqo t:SH d:EX/0 a:0 v:0 r:2 m:20 p:4 [ 126.609778][ T5697] gfs2: fsid=..s: H: s:SH f:eEcH e:0 p:5697 [syz.0.23] init_journal+0x17f8/0x2260 [ 126.707171][ T5697] gfs2: fsid=..s: I: n:1/19 t:8 f:0x00 d:0x00000200 s:8388608 p:0 [ 126.710889][ T5697] gfs2: fsid=..s: about to withdraw this file system 2025/10/10 16:17:38 executed programs: 21 [ 126.753315][ T5697] gfs2: fsid=..s: Journal recovery skipped for jid 0 until next mount. [ 126.764941][ T5697] gfs2: fsid=..s: Glock dequeues delayed: 0 [ 126.778001][ T5697] gfs2: fsid=..s: File system withdrawn [ 126.780330][ T5697] CPU: 0 UID: 0 PID: 5697 Comm: syz.0.23 Not tainted syzkaller #0 PREEMPT(full) [ 126.780340][ T5697] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 126.780345][ T5697] Call Trace: [ 126.780349][ T5697] [ 126.780353][ T5697] dump_stack_lvl+0x189/0x250 [ 126.780366][ T5697] ? __pfx_dump_stack_lvl+0x10/0x10 [ 126.780373][ T5697] ? __pfx__printk+0x10/0x10 [ 126.780381][ T5697] ? kobject_uevent_env+0x36b/0x8c0 [ 126.780435][ T5697] gfs2_withdraw+0xb30/0x1430 [ 126.780453][ T5697] ? __pfx_gfs2_withdraw+0x10/0x10 [ 126.780464][ T5697] ? __pfx_wake_up_bit+0x10/0x10 [ 126.780479][ T5697] ? _raw_spin_unlock+0x3f/0x50 [ 126.780492][ T5697] ? gfs2_consist_inode_i+0xf5/0x110 [ 126.780500][ T5697] gfs2_jdesc_check+0x17d/0x2f0 [ 126.780511][ T5697] check_journal_clean+0x158/0x310 [ 126.780520][ T5697] ? __pfx_check_journal_clean+0x10/0x10 [ 126.780528][ T5697] ? init_journal+0x17f8/0x2260 [ 126.780538][ T5697] ? do_raw_spin_unlock+0x4d/0x240 [ 126.780548][ T5697] ? _raw_spin_unlock+0x28/0x50 [ 126.780559][ T5697] ? gfs2_jdesc_find+0xab/0xc0 [ 126.780567][ T5697] init_journal+0x17f8/0x2260 [ 126.780579][ T5697] ? init_inodes+0xdb/0x320 [ 126.780588][ T5697] ? __pfx_init_journal+0x10/0x10 [ 126.780595][ T5697] ? vsnprintf+0xe11/0xf00 [ 126.780608][ T5697] ? snprintf+0xda/0x120 [ 126.780617][ T5697] ? init_inodes+0xdb/0x320 [ 126.780624][ T5697] ? __pfx_snprintf+0x10/0x10 [ 126.780634][ T5697] ? gfs2_glock_nq_num+0x13d/0x170 [ 126.780644][ T5697] init_inodes+0xdb/0x320 [ 126.780652][ T5697] gfs2_fill_super+0x1923/0x20d0 [ 126.780665][ T5697] ? __pfx_gfs2_fill_super+0x10/0x10 [ 126.780673][ T5697] ? init_locking+0xb8/0x210 [ 126.780679][ T5697] ? sb_set_blocksize+0x104/0x180 [ 126.780688][ T5697] ? setup_bdev_super+0x4c1/0x5b0 [ 126.780698][ T5697] get_tree_bdev_flags+0x40b/0x4d0 [ 126.780706][ T5697] ? __pfx_gfs2_fill_super+0x10/0x10 [ 126.780713][ T5697] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 126.780719][ T5697] ? __pfx_vfs_parse_comma_sep+0x10/0x10 [ 126.780733][ T5697] gfs2_get_tree+0x51/0x1e0 [ 126.780741][ T5697] vfs_get_tree+0x8f/0x2b0 [ 126.780753][ T5697] do_new_mount+0x302/0xa10 [ 126.780764][ T5697] ? apparmor_capable+0x137/0x1b0 [ 126.780781][ T5697] ? __pfx_do_new_mount+0x10/0x10 [ 126.780793][ T5697] ? ns_capable+0x8a/0xf0 [ 126.780805][ T5697] ? kmem_cache_free+0x19b/0x690 [ 126.780817][ T5697] __se_sys_mount+0x313/0x410 [ 126.780828][ T5697] ? __pfx___se_sys_mount+0x10/0x10 [ 126.780838][ T5697] ? do_syscall_64+0xbe/0xfa0 [ 126.780845][ T5697] ? __x64_sys_mount+0x20/0xc0 [ 126.780854][ T5697] do_syscall_64+0xfa/0xfa0 [ 126.780861][ T5697] ? lockdep_hardirqs_on+0x9c/0x150 [ 126.780869][ T5697] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.780875][ T5697] ? clear_bhb_loop+0x60/0xb0 [ 126.780882][ T5697] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.780888][ T5697] RIP: 0033:0x7fb88379066a [ 126.780896][ T5697] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 126.780902][ T5697] RSP: 002b:00007fb884686e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 126.780910][ T5697] RAX: ffffffffffffffda RBX: 00007fb884686ef0 RCX: 00007fb88379066a [ 126.780915][ T5697] RDX: 0000200000000000 RSI: 0000200000000100 RDI: 00007fb884686eb0 [ 126.780919][ T5697] RBP: 0000200000000000 R08: 00007fb884686ef0 R09: 0000000000208c1b [ 126.780923][ T5697] R10: 0000000000208c1b R11: 0000000000000246 R12: 0000200000000100 [ 126.780927][ T5697] R13: 00007fb884686eb0 R14: 0000000000012754 R15: 00002000000128c0 [ 126.780939][ T5697] [ 126.780942][ T5697] gfs2: fsid=..s: Error checking journal for spectator mount. [ 130.880645][ T5713] loop0: detected capacity change from 0 to 32768 [ 130.959817][ T5713] gfs2: fsid=.: Trying to join cluster "lock_nolock", "." [ 130.997143][ T5713] gfs2: fsid=.: Now mounting FS (format 1801)... [ 131.037684][ T5713] syz.0.28: attempt to access beyond end of device [ 131.037684][ T5713] loop0: rw=12288, sector=18446744073709551608, nr_sectors = 8 limit=32768 [ 131.125179][ T5713] gfs2: fsid=..s: fatal: filesystem consistency error - inode = 1 19, function = gfs2_jdesc_check, file = fs/gfs2/super.c, line = 119 [ 131.192763][ T5713] gfs2: fsid=..s: G: s:SH n:2/13 f:aqo t:SH d:EX/0 a:0 v:0 r:2 m:20 p:4 [ 131.196334][ T5713] gfs2: fsid=..s: H: s:SH f:eEcH e:0 p:5713 [syz.0.28] init_journal+0x17f8/0x2260 [ 131.199789][ T5713] gfs2: fsid=..s: I: n:1/19 t:8 f:0x00 d:0x00000200 s:8388608 p:0 [ 131.202497][ T5713] gfs2: fsid=..s: about to withdraw this file system [ 131.315761][ T5713] gfs2: fsid=..s: Journal recovery skipped for jid 0 until next mount. [ 131.319251][ T5713] gfs2: fsid=..s: Glock dequeues delayed: 0 [ 131.369095][ T5713] gfs2: fsid=..s: File system withdrawn [ 131.371368][ T5713] CPU: 0 UID: 0 PID: 5713 Comm: syz.0.28 Not tainted syzkaller #0 PREEMPT(full) [ 131.371379][ T5713] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 131.371383][ T5713] Call Trace: [ 131.371386][ T5713] [ 131.371389][ T5713] dump_stack_lvl+0x189/0x250 [ 131.371402][ T5713] ? __pfx_dump_stack_lvl+0x10/0x10 [ 131.371409][ T5713] ? __pfx__printk+0x10/0x10 [ 131.371417][ T5713] ? kobject_uevent_env+0x36b/0x8c0 [ 131.371439][ T5713] gfs2_withdraw+0xb30/0x1430 [ 131.371453][ T5713] ? __pfx_gfs2_withdraw+0x10/0x10 [ 131.371461][ T5713] ? __pfx_wake_up_bit+0x10/0x10 [ 131.371471][ T5713] ? _raw_spin_unlock+0x3f/0x50 [ 131.371480][ T5713] ? gfs2_consist_inode_i+0xf5/0x110 [ 131.371493][ T5713] gfs2_jdesc_check+0x17d/0x2f0 [ 131.371504][ T5713] check_journal_clean+0x158/0x310 [ 131.371513][ T5713] ? __pfx_check_journal_clean+0x10/0x10 [ 131.371521][ T5713] ? init_journal+0x17f8/0x2260 [ 131.371531][ T5713] ? do_raw_spin_unlock+0x4d/0x240 [ 131.371541][ T5713] ? _raw_spin_unlock+0x28/0x50 [ 131.371547][ T5713] ? gfs2_jdesc_find+0xab/0xc0 [ 131.371556][ T5713] init_journal+0x17f8/0x2260 [ 131.371568][ T5713] ? init_inodes+0xdb/0x320 [ 131.371576][ T5713] ? __pfx_init_journal+0x10/0x10 [ 131.371583][ T5713] ? vsnprintf+0xe11/0xf00 [ 131.371596][ T5713] ? snprintf+0xda/0x120 [ 131.371606][ T5713] ? init_inodes+0xdb/0x320 [ 131.371613][ T5713] ? __pfx_snprintf+0x10/0x10 [ 131.371622][ T5713] ? gfs2_glock_nq_num+0x13d/0x170 [ 131.371632][ T5713] init_inodes+0xdb/0x320 [ 131.371642][ T5713] gfs2_fill_super+0x1923/0x20d0 [ 131.371661][ T5713] ? __pfx_gfs2_fill_super+0x10/0x10 [ 131.371673][ T5713] ? init_locking+0xb8/0x210 [ 131.371682][ T5713] ? sb_set_blocksize+0x104/0x180 [ 131.371694][ T5713] ? setup_bdev_super+0x4c1/0x5b0 [ 131.371705][ T5713] get_tree_bdev_flags+0x40b/0x4d0 [ 131.371713][ T5713] ? __pfx_gfs2_fill_super+0x10/0x10 [ 131.371720][ T5713] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 131.371726][ T5713] ? __pfx_vfs_parse_comma_sep+0x10/0x10 [ 131.371742][ T5713] gfs2_get_tree+0x51/0x1e0 [ 131.371750][ T5713] vfs_get_tree+0x8f/0x2b0 [ 131.371759][ T5713] do_new_mount+0x302/0xa10 [ 131.371768][ T5713] ? apparmor_capable+0x137/0x1b0 [ 131.371780][ T5713] ? __pfx_do_new_mount+0x10/0x10 [ 131.371788][ T5713] ? ns_capable+0x8a/0xf0 [ 131.371796][ T5713] ? kmem_cache_free+0x19b/0x690 [ 131.371808][ T5713] __se_sys_mount+0x313/0x410 [ 131.371819][ T5713] ? __pfx___se_sys_mount+0x10/0x10 [ 131.371829][ T5713] ? do_syscall_64+0xbe/0xfa0 [ 131.371836][ T5713] ? __x64_sys_mount+0x20/0xc0 [ 131.371845][ T5713] do_syscall_64+0xfa/0xfa0 [ 131.371852][ T5713] ? lockdep_hardirqs_on+0x9c/0x150 [ 131.371860][ T5713] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 131.371866][ T5713] ? clear_bhb_loop+0x60/0xb0 [ 131.371874][ T5713] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 131.371880][ T5713] RIP: 0033:0x7fb88379066a [ 131.371888][ T5713] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 131.371894][ T5713] RSP: 002b:00007fb884686e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 131.371902][ T5713] RAX: ffffffffffffffda RBX: 00007fb884686ef0 RCX: 00007fb88379066a [ 131.371907][ T5713] RDX: 0000200000000000 RSI: 0000200000000100 RDI: 00007fb884686eb0 [ 131.371911][ T5713] RBP: 0000200000000000 R08: 00007fb884686ef0 R09: 0000000000208c1b [ 131.371915][ T5713] R10: 0000000000208c1b R11: 0000000000000246 R12: 0000200000000100 [ 131.371919][ T5713] R13: 00007fb884686eb0 R14: 0000000000012754 R15: 00002000000128c0 [ 131.371931][ T5713] [ 131.371934][ T5713] gfs2: fsid=..s: Error checking journal for spectator mount. 2025/10/10 16:17:43 executed programs: 29 [ 134.802161][ T5733] loop0: detected capacity change from 0 to 32768 [ 134.846462][ T5733] gfs2: fsid=.: Trying to join cluster "lock_nolock", "." [ 134.879321][ T5733] gfs2: fsid=.: Now mounting FS (format 1801)... [ 134.924327][ T5733] syz.0.37: attempt to access beyond end of device [ 134.924327][ T5733] loop0: rw=12288, sector=18446744073709551608, nr_sectors = 8 limit=32768 [ 134.995053][ T5733] gfs2: fsid=..s: fatal: filesystem consistency error - inode = 1 19, function = gfs2_jdesc_check, file = fs/gfs2/super.c, line = 119 [ 135.000844][ T5733] gfs2: fsid=..s: G: s:SH n:2/13 f:aqo t:SH d:EX/0 a:0 v:0 r:2 m:20 p:4 [ 135.093472][ T5733] gfs2: fsid=..s: H: s:SH f:eEcH e:0 p:5733 [syz.0.37] init_journal+0x17f8/0x2260 [ 135.097161][ T5733] gfs2: fsid=..s: I: n:1/19 t:8 f:0x00 d:0x00000200 s:8388608 p:0 [ 135.099729][ T5733] gfs2: fsid=..s: about to withdraw this file system [ 135.101912][ T5733] gfs2: fsid=..s: Journal recovery skipped for jid 0 until next mount. [ 135.158434][ T5733] gfs2: fsid=..s: Glock dequeues delayed: 0 [ 135.193283][ T5733] gfs2: fsid=..s: File system withdrawn [ 135.195608][ T5733] CPU: 0 UID: 0 PID: 5733 Comm: syz.0.37 Not tainted syzkaller #0 PREEMPT(full) [ 135.195622][ T5733] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 135.195629][ T5733] Call Trace: [ 135.195634][ T5733] [ 135.195638][ T5733] dump_stack_lvl+0x189/0x250 [ 135.195656][ T5733] ? __pfx_dump_stack_lvl+0x10/0x10 [ 135.195668][ T5733] ? __pfx__printk+0x10/0x10 [ 135.195679][ T5733] ? kobject_uevent_env+0x36b/0x8c0 [ 135.195711][ T5733] gfs2_withdraw+0xb30/0x1430 [ 135.195732][ T5733] ? __pfx_gfs2_withdraw+0x10/0x10 [ 135.195745][ T5733] ? __pfx_wake_up_bit+0x10/0x10 [ 135.195761][ T5733] ? _raw_spin_unlock+0x3f/0x50 [ 135.195774][ T5733] ? gfs2_consist_inode_i+0xf5/0x110 [ 135.195787][ T5733] gfs2_jdesc_check+0x17d/0x2f0 [ 135.195809][ T5733] check_journal_clean+0x158/0x310 [ 135.195821][ T5733] ? __pfx_check_journal_clean+0x10/0x10 [ 135.195834][ T5733] ? init_journal+0x17f8/0x2260 [ 135.195850][ T5733] ? do_raw_spin_unlock+0x4d/0x240 [ 135.195866][ T5733] ? _raw_spin_unlock+0x28/0x50 [ 135.195875][ T5733] ? gfs2_jdesc_find+0xab/0xc0 [ 135.195888][ T5733] init_journal+0x17f8/0x2260 [ 135.195904][ T5733] ? init_inodes+0xdb/0x320 [ 135.195917][ T5733] ? __pfx_init_journal+0x10/0x10 [ 135.195927][ T5733] ? vsnprintf+0xe11/0xf00 [ 135.195948][ T5733] ? snprintf+0xda/0x120 [ 135.195963][ T5733] ? init_inodes+0xdb/0x320 [ 135.195974][ T5733] ? __pfx_snprintf+0x10/0x10 [ 135.195987][ T5733] ? gfs2_glock_nq_num+0x13d/0x170 [ 135.196003][ T5733] init_inodes+0xdb/0x320 [ 135.196016][ T5733] gfs2_fill_super+0x1923/0x20d0 [ 135.196038][ T5733] ? __pfx_gfs2_fill_super+0x10/0x10 [ 135.196050][ T5733] ? init_locking+0xb8/0x210 [ 135.196058][ T5733] ? sb_set_blocksize+0x104/0x180 [ 135.196067][ T5733] ? setup_bdev_super+0x4c1/0x5b0 [ 135.196078][ T5733] get_tree_bdev_flags+0x40b/0x4d0 [ 135.196089][ T5733] ? __pfx_gfs2_fill_super+0x10/0x10 [ 135.196100][ T5733] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 135.196110][ T5733] ? __pfx_vfs_parse_comma_sep+0x10/0x10 [ 135.196130][ T5733] gfs2_get_tree+0x51/0x1e0 [ 135.196142][ T5733] vfs_get_tree+0x8f/0x2b0 [ 135.196156][ T5733] do_new_mount+0x302/0xa10 [ 135.196168][ T5733] ? apparmor_capable+0x137/0x1b0 [ 135.196184][ T5733] ? __pfx_do_new_mount+0x10/0x10 [ 135.196215][ T5733] ? ns_capable+0x8a/0xf0 [ 135.196230][ T5733] ? kmem_cache_free+0x19b/0x690 [ 135.196249][ T5733] __se_sys_mount+0x313/0x410 [ 135.196267][ T5733] ? __pfx___se_sys_mount+0x10/0x10 [ 135.196283][ T5733] ? do_syscall_64+0xbe/0xfa0 [ 135.196293][ T5733] ? __x64_sys_mount+0x20/0xc0 [ 135.196307][ T5733] do_syscall_64+0xfa/0xfa0 [ 135.196318][ T5733] ? lockdep_hardirqs_on+0x9c/0x150 [ 135.196329][ T5733] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.196338][ T5733] ? clear_bhb_loop+0x60/0xb0 [ 135.196350][ T5733] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.196359][ T5733] RIP: 0033:0x7fb88379066a [ 135.196372][ T5733] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 135.196380][ T5733] RSP: 002b:00007fb884686e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 135.196393][ T5733] RAX: ffffffffffffffda RBX: 00007fb884686ef0 RCX: 00007fb88379066a [ 135.196400][ T5733] RDX: 0000200000000000 RSI: 0000200000000100 RDI: 00007fb884686eb0 [ 135.196406][ T5733] RBP: 0000200000000000 R08: 00007fb884686ef0 R09: 0000000000208c1b [ 135.196412][ T5733] R10: 0000000000208c1b R11: 0000000000000246 R12: 0000200000000100 [ 135.196418][ T5733] R13: 00007fb884686eb0 R14: 0000000000012754 R15: 00002000000128c0 [ 135.196436][ T5733] [ 135.372673][ T5733] gfs2: fsid=..s: Error checking journal for spectator mount. [ 136.849638][ T30] ================================================================== [ 136.852619][ T30] BUG: KASAN: slab-use-after-free in move_to_new_folio+0x145/0x490 [ 136.855765][ T30] Read of size 8 at addr ffff888050c393a0 by task kcompactd1/30 [ 136.859887][ T30] [ 136.860887][ T30] CPU: 0 UID: 0 PID: 30 Comm: kcompactd1 Not tainted syzkaller #0 PREEMPT(full) [ 136.860897][ T30] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 136.860901][ T30] Call Trace: [ 136.860906][ T30] [ 136.860910][ T30] dump_stack_lvl+0x189/0x250 [ 136.860921][ T30] ? rcu_is_watching+0x15/0xb0 [ 136.860929][ T30] ? __kasan_check_byte+0x12/0x40 [ 136.860939][ T30] ? __pfx_dump_stack_lvl+0x10/0x10 [ 136.860945][ T30] ? rcu_is_watching+0x15/0xb0 [ 136.860951][ T30] ? lock_release+0x4b/0x3e0 [ 136.860958][ T30] ? __virt_addr_valid+0x1c8/0x5c0 [ 136.860968][ T30] ? __virt_addr_valid+0x4a5/0x5c0 [ 136.860980][ T30] print_report+0xca/0x240 [ 136.860992][ T30] ? move_to_new_folio+0x145/0x490 [ 136.861001][ T30] kasan_report+0x118/0x150 [ 136.861014][ T30] ? move_to_new_folio+0x145/0x490 [ 136.861024][ T30] kasan_check_range+0x2b0/0x2c0 [ 136.861038][ T30] move_to_new_folio+0x145/0x490 [ 136.861049][ T30] migrate_pages_batch+0x1d5f/0x35e0 [ 136.861067][ T30] ? __pfx_compaction_free+0x10/0x10 [ 136.861076][ T30] ? __pfx_migrate_pages_batch+0x10/0x10 [ 136.861085][ T30] ? __lock_acquire+0xab9/0xd20 [ 136.861091][ T30] ? css_rstat_updated+0x23a/0x4f0 [ 136.861104][ T30] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 136.861117][ T30] ? __pfx_compaction_free+0x10/0x10 [ 136.861129][ T30] migrate_pages+0x1bcc/0x2930 [ 136.861146][ T30] ? __pfx_compaction_free+0x10/0x10 [ 136.861157][ T30] ? __pfx_compaction_alloc+0x10/0x10 [ 136.861167][ T30] ? __pfx___might_resched+0x10/0x10 [ 136.861178][ T30] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 136.861231][ T30] ? __pfx_migrate_pages+0x10/0x10 [ 136.861244][ T30] ? rcu_is_watching+0x15/0xb0 [ 136.861251][ T30] ? isolate_migratepages_block+0x394f/0x4160 [ 136.861262][ T30] compact_zone+0x23e1/0x4ab0 [ 136.861270][ T30] ? lockdep_hardirqs_on+0x9c/0x150 [ 136.861285][ T30] ? __pfx_compact_zone+0x10/0x10 [ 136.861293][ T30] ? rcu_is_watching+0x15/0xb0 [ 136.861301][ T30] kcompactd+0x97d/0x1290 [ 136.861310][ T30] ? __pfx_kcompactd+0x10/0x10 [ 136.861321][ T30] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 136.861327][ T30] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 136.861333][ T30] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 136.861341][ T30] ? __pfx_autoremove_wake_function+0x10/0x10 [ 136.861350][ T30] ? __kthread_parkme+0x7b/0x200 [ 136.861358][ T30] ? __kthread_parkme+0x1a1/0x200 [ 136.861370][ T30] kthread+0x711/0x8a0 [ 136.861382][ T30] ? __pfx_kcompactd+0x10/0x10 [ 136.861392][ T30] ? __pfx_kthread+0x10/0x10 [ 136.861403][ T30] ? _raw_spin_unlock_irq+0x23/0x50 [ 136.861412][ T30] ? lockdep_hardirqs_on+0x9c/0x150 [ 136.861421][ T30] ? __pfx_kthread+0x10/0x10 [ 136.861434][ T30] ret_from_fork+0x4bc/0x870 [ 136.861467][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 136.861477][ T30] ? __pfx_kthread+0x10/0x10 [ 136.861490][ T30] ret_from_fork_asm+0x1a/0x30 [ 136.861505][ T30] [ 136.861509][ T30] [ 136.983378][ T30] Allocated by task 5713: [ 136.985067][ T30] kasan_save_track+0x3e/0x80 [ 136.987177][ T30] __kasan_slab_alloc+0x6c/0x80 [ 136.989357][ T30] kmem_cache_alloc_noprof+0x367/0x6e0 [ 136.991739][ T30] gfs2_glock_get+0x263/0xec0 [ 136.993438][ T30] gfs2_inode_lookup+0x215/0xb10 [ 136.995566][ T30] gfs2_dir_search+0x168/0x220 [ 136.997721][ T30] gfs2_lookupi+0x3d9/0x5a0 [ 136.999784][ T30] init_journal+0x54a/0x2260 [ 137.001882][ T30] init_inodes+0xdb/0x320 [ 137.003762][ T30] gfs2_fill_super+0x1923/0x20d0 [ 137.005729][ T30] get_tree_bdev_flags+0x40b/0x4d0 [ 137.007985][ T30] gfs2_get_tree+0x51/0x1e0 [ 137.009944][ T30] vfs_get_tree+0x8f/0x2b0 [ 137.011666][ T30] do_new_mount+0x302/0xa10 [ 137.013690][ T30] __se_sys_mount+0x313/0x410 [ 137.015800][ T30] do_syscall_64+0xfa/0xfa0 [ 137.017592][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 137.020158][ T30] [ 137.021190][ T30] Freed by task 15: [ 137.022808][ T30] kasan_save_track+0x3e/0x80 [ 137.024842][ T30] __kasan_save_free_info+0x46/0x50 [ 137.027031][ T30] __kasan_slab_free+0x5c/0x80 [ 137.028896][ T30] kmem_cache_free+0x19b/0x690 [ 137.030808][ T30] rcu_core+0xca8/0x1770 [ 137.032583][ T30] handle_softirqs+0x283/0x870 [ 137.034401][ T30] run_ksoftirqd+0x9b/0x100 [ 137.036143][ T30] smpboot_thread_fn+0x53f/0xa60 [ 137.038178][ T30] kthread+0x711/0x8a0 [ 137.039837][ T30] ret_from_fork+0x4bc/0x870 [ 137.041926][ T30] ret_from_fork_asm+0x1a/0x30 [ 137.043985][ T30] [ 137.044987][ T30] Last potentially related work creation: [ 137.047412][ T30] kasan_save_stack+0x3e/0x60 [ 137.049420][ T30] kasan_record_aux_stack+0xbd/0xd0 [ 137.051391][ T30] call_rcu+0x157/0x9c0 [ 137.053004][ T30] __gfs2_glock_free+0xb44/0xc90 [ 137.054995][ T30] gfs2_glock_free+0x3c/0xa0 [ 137.056806][ T30] process_scheduled_works+0xae1/0x17b0 [ 137.058861][ T30] worker_thread+0x8a0/0xda0 [ 137.060578][ T30] kthread+0x711/0x8a0 [ 137.062261][ T30] ret_from_fork+0x4bc/0x870 [ 137.064155][ T30] ret_from_fork_asm+0x1a/0x30 [ 137.066075][ T30] [ 137.067107][ T30] Second to last potentially related work creation: [ 137.069392][ T30] kasan_save_stack+0x3e/0x60 [ 137.071075][ T30] kasan_record_aux_stack+0xbd/0xd0 [ 137.072918][ T30] insert_work+0x3d/0x330 [ 137.074501][ T30] __queue_work+0xcd2/0xfb0 [ 137.076312][ T30] queue_delayed_work_on+0x18b/0x280 [ 137.078518][ T30] do_xmote+0xa0d/0x1060 [ 137.080315][ T30] glock_work_func+0x2a8/0x580 [ 137.082382][ T30] process_scheduled_works+0xae1/0x17b0 [ 137.084600][ T30] worker_thread+0x8a0/0xda0 [ 137.086504][ T30] kthread+0x711/0x8a0 [ 137.088290][ T30] ret_from_fork+0x4bc/0x870 [ 137.090060][ T30] ret_from_fork_asm+0x1a/0x30 [ 137.091881][ T30] [ 137.092808][ T30] The buggy address belongs to the object at ffff888050c38fd8 [ 137.092808][ T30] which belongs to the cache gfs2_glock(aspace) of size 1224 [ 137.098435][ T30] The buggy address is located 968 bytes inside of [ 137.098435][ T30] freed 1224-byte region [ffff888050c38fd8, ffff888050c394a0) [ 137.103951][ T30] [ 137.104986][ T30] The buggy address belongs to the physical page: [ 137.107390][ T30] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x50c38 [ 137.110778][ T30] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 137.114192][ T30] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 137.117422][ T30] page_type: f5(slab) [ 137.119076][ T30] raw: 04fff00000000040 ffff888032b11780 dead000000000122 0000000000000000 [ 137.122445][ T30] raw: 0000000000000000 00000000800c000c 00000000f5000000 0000000000000000 [ 137.125859][ T30] head: 04fff00000000040 ffff888032b11780 dead000000000122 0000000000000000 [ 137.128845][ T30] head: 0000000000000000 00000000800c000c 00000000f5000000 0000000000000000 [ 137.131905][ T30] head: 04fff00000000002 ffffea0001430e01 00000000ffffffff 00000000ffffffff [ 137.135599][ T30] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 137.139407][ T30] page dumped because: kasan: bad access detected [ 137.142242][ T30] page_owner tracks the page as allocated [ 137.144691][ T30] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5659, tgid 5657 (syz.0.17), ts 122704993495, free_ts 106109051890 [ 137.153264][ T30] post_alloc_hook+0x240/0x2a0 [ 137.155142][ T30] get_page_from_freelist+0x2365/0x2440 [ 137.157292][ T30] __alloc_frozen_pages_noprof+0x181/0x370 [ 137.159830][ T30] alloc_pages_mpol+0x232/0x4a0 [ 137.161846][ T30] allocate_slab+0x96/0x3a0 [ 137.163653][ T30] ___slab_alloc+0xe94/0x18a0 [ 137.165632][ T30] __slab_alloc+0x65/0x100 [ 137.167583][ T30] kmem_cache_alloc_noprof+0x3f9/0x6e0 [ 137.169770][ T30] gfs2_glock_get+0x263/0xec0 [ 137.171631][ T30] gfs2_inode_lookup+0x215/0xb10 [ 137.173888][ T30] init_sb+0xa30/0x12c0 [ 137.175523][ T30] gfs2_fill_super+0x15ef/0x20d0 [ 137.177477][ T30] get_tree_bdev_flags+0x40b/0x4d0 [ 137.179627][ T30] gfs2_get_tree+0x51/0x1e0 [ 137.181636][ T30] vfs_get_tree+0x8f/0x2b0 [ 137.183551][ T30] do_new_mount+0x302/0xa10 [ 137.185446][ T30] page last free pid 5371 tgid 5371 stack trace: [ 137.188078][ T30] __free_frozen_pages+0xbc4/0xd30 [ 137.190161][ T30] vfree+0x25a/0x400 [ 137.191705][ T30] kcov_close+0x28/0x50 [ 137.193472][ T30] __fput+0x449/0xa70 [ 137.195215][ T30] task_work_run+0x1d4/0x260 [ 137.197227][ T30] do_exit+0x6b5/0x2300 [ 137.198972][ T30] do_group_exit+0x21c/0x2d0 [ 137.201155][ T30] get_signal+0x1285/0x1340 [ 137.203251][ T30] arch_do_signal_or_restart+0xa0/0x790 [ 137.205729][ T30] exit_to_user_mode_loop+0x72/0x130 [ 137.207966][ T30] do_syscall_64+0x2bd/0xfa0 [ 137.210046][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 137.212570][ T30] [ 137.213672][ T30] Memory state around the buggy address: [ 137.216069][ T30] ffff888050c39280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 137.219395][ T30] ffff888050c39300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 137.222730][ T30] >ffff888050c39380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 137.226076][ T30] ^ [ 137.228198][ T30] ffff888050c39400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 137.231574][ T30] ffff888050c39480: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc [ 137.234770][ T30] ================================================================== 2025/10/10 16:17:49 executed programs: 42 [ 137.954003][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 137.957140][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 138.392252][ T30] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 138.396008][ T30] CPU: 0 UID: 0 PID: 30 Comm: kcompactd1 Not tainted syzkaller #0 PREEMPT(full) [ 138.400095][ T30] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 138.405310][ T30] Call Trace: [ 138.407136][ T30] [ 138.408745][ T30] dump_stack_lvl+0x99/0x250 [ 138.410981][ T30] ? __asan_memcpy+0x40/0x70 [ 138.413052][ T30] ? __pfx_dump_stack_lvl+0x10/0x10 [ 138.415455][ T30] ? __pfx__printk+0x10/0x10 [ 138.417461][ T30] vpanic+0x237/0x6d0 [ 138.419238][ T30] ? __pfx_vpanic+0x10/0x10 [ 138.421199][ T30] ? preempt_schedule+0xae/0xc0 [ 138.423389][ T30] ? __pfx_preempt_schedule+0x10/0x10 [ 138.425718][ T30] panic+0xb9/0xc0 [ 138.427358][ T30] ? __pfx_panic+0x10/0x10 [ 138.429251][ T30] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 138.431740][ T30] ? move_to_new_folio+0x145/0x490 [ 138.434015][ T30] check_panic_on_warn+0x89/0xb0 [ 138.436102][ T30] ? move_to_new_folio+0x145/0x490 [ 138.438380][ T30] end_report+0x78/0x160 [ 138.440254][ T30] kasan_report+0x129/0x150 [ 138.442308][ T30] ? move_to_new_folio+0x145/0x490 [ 138.444565][ T30] kasan_check_range+0x2b0/0x2c0 [ 138.446690][ T30] move_to_new_folio+0x145/0x490 [ 138.448838][ T30] migrate_pages_batch+0x1d5f/0x35e0 [ 138.451124][ T30] ? __pfx_compaction_free+0x10/0x10 [ 138.453182][ T30] ? __pfx_migrate_pages_batch+0x10/0x10 [ 138.455546][ T30] ? __lock_acquire+0xab9/0xd20 [ 138.457658][ T30] ? css_rstat_updated+0x23a/0x4f0 [ 138.459830][ T30] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 138.462004][ T30] ? __pfx_compaction_free+0x10/0x10 [ 138.464203][ T30] migrate_pages+0x1bcc/0x2930 [ 138.466191][ T30] ? __pfx_compaction_free+0x10/0x10 [ 138.468439][ T30] ? __pfx_compaction_alloc+0x10/0x10 [ 138.470809][ T30] ? __pfx___might_resched+0x10/0x10 [ 138.473068][ T30] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 138.475747][ T30] ? __pfx_migrate_pages+0x10/0x10 [ 138.477912][ T30] ? rcu_is_watching+0x15/0xb0 [ 138.480065][ T30] ? isolate_migratepages_block+0x394f/0x4160 [ 138.482628][ T30] compact_zone+0x23e1/0x4ab0 [ 138.484546][ T30] ? lockdep_hardirqs_on+0x9c/0x150 [ 138.486766][ T30] ? __pfx_compact_zone+0x10/0x10 [ 138.488886][ T30] ? rcu_is_watching+0x15/0xb0 [ 138.491480][ T30] kcompactd+0x97d/0x1290 [ 138.493357][ T30] ? __pfx_kcompactd+0x10/0x10 [ 138.495384][ T30] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 138.497904][ T30] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 138.500567][ T30] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 138.503240][ T30] ? __pfx_autoremove_wake_function+0x10/0x10 [ 138.505831][ T30] ? __kthread_parkme+0x7b/0x200 [ 138.508046][ T30] ? __kthread_parkme+0x1a1/0x200 [ 138.510031][ T30] kthread+0x711/0x8a0 [ 138.511783][ T30] ? __pfx_kcompactd+0x10/0x10 [ 138.513845][ T30] ? __pfx_kthread+0x10/0x10 [ 138.515663][ T30] ? _raw_spin_unlock_irq+0x23/0x50 [ 138.518089][ T30] ? lockdep_hardirqs_on+0x9c/0x150 [ 138.520277][ T30] ? __pfx_kthread+0x10/0x10 [ 138.522132][ T30] ret_from_fork+0x4bc/0x870 [ 138.524017][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 138.526117][ T30] ? __pfx_kthread+0x10/0x10 [ 138.528163][ T30] ret_from_fork_asm+0x1a/0x30 [ 138.530217][ T30] [ 138.531896][ T30] Kernel Offset: disabled [ 138.533897][ T30] Rebooting in 86400 seconds.. VM DIAGNOSIS: 16:17:48 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000061 RBX=0000000000000061 RCX=0000000000000000 RDX=00000000000003f8 RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90000516a70 R8 =ffff888033ba8237 R9 =1ffff11006775046 R10=dffffc0000000000 R11=ffffffff851cdae0 R12=dffffc0000000000 R13=ffffffff99a1090a R14=ffffffff99d243e0 R15=0000000000000000 RIP=ffffffff851cdb5c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88808d304000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007fc0f1fe4000 CR3=00000000512b3000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000001000000 Opmask01=0000000001000001 Opmask02=00000000ffffffef Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffc591a7550 0000003000000018 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 00000000ffffffff ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 00000000ffffffff ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f9797612fbe ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f9797612fcb ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f9797612fc5 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f9797612fd9 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f979761305f ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f979761313d ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000050 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 0000000000000000 0000000000000000 0000000000000050 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000