Warning: Permanently added '[localhost]:55737' (ED25519) to the list of known hosts. 2025/11/08 02:38:03 parsed 1 programs syzkaller login: [ 84.669049][ T5310] cgroup: Unknown subsys name 'net' [ 84.742173][ T5310] cgroup: Unknown subsys name 'cpuset' [ 84.747144][ T5310] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 86.504404][ T5310] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 90.265596][ T5324] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 90.890611][ T5342] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 90.894721][ T5342] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 90.898720][ T5342] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 90.902495][ T5342] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 90.905844][ T5342] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 91.710244][ T5356] chnl_net:caif_netlink_parms(): no params data found [ 91.779494][ T5356] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.783179][ T5356] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.786509][ T5356] bridge_slave_0: entered allmulticast mode [ 91.790838][ T5356] bridge_slave_0: entered promiscuous mode [ 91.796314][ T5356] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.799595][ T5356] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.805090][ T5356] bridge_slave_1: entered allmulticast mode [ 91.809906][ T5356] bridge_slave_1: entered promiscuous mode [ 91.837381][ T5356] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.843749][ T5356] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.869012][ T5356] team0: Port device team_slave_0 added [ 91.873518][ T5356] team0: Port device team_slave_1 added [ 91.890347][ T55] cfg80211: failed to load regulatory.db [ 91.906188][ T5356] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.909441][ T5356] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.921859][ T5356] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.929103][ T5356] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.932163][ T5356] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.944090][ T5356] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.978564][ T5356] hsr_slave_0: entered promiscuous mode [ 91.981491][ T5356] hsr_slave_1: entered promiscuous mode [ 92.120144][ T5356] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 92.130959][ T5356] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 92.136917][ T5356] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 92.147359][ T5356] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 92.173831][ T5356] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.177058][ T5356] bridge0: port 2(bridge_slave_1) entered forwarding state [ 92.180918][ T5356] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.184080][ T5356] bridge0: port 1(bridge_slave_0) entered forwarding state [ 92.245997][ T5356] 8021q: adding VLAN 0 to HW filter on device bond0 [ 92.261274][ T1038] bridge0: port 1(bridge_slave_0) entered disabled state [ 92.265224][ T1038] bridge0: port 2(bridge_slave_1) entered disabled state [ 92.277030][ T5356] 8021q: adding VLAN 0 to HW filter on device team0 [ 92.287202][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.290430][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 92.301802][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.304833][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 92.477607][ T5356] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.513882][ T5356] veth0_vlan: entered promiscuous mode [ 92.522930][ T5356] veth1_vlan: entered promiscuous mode [ 92.550239][ T5356] veth0_macvtap: entered promiscuous mode [ 92.555815][ T5356] veth1_macvtap: entered promiscuous mode [ 92.575406][ T5356] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.585518][ T5356] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.597530][ T1038] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.610122][ T1038] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.613927][ T1038] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.626066][ T1038] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.780289][ T1038] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 92.819061][ T1038] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 92.852991][ T1038] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 92.907470][ T1038] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 92.937089][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.949865][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.974550][ T31] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.979398][ T31] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.490371][ T1038] bridge_slave_1: left allmulticast mode [ 95.493010][ T1038] bridge_slave_1: left promiscuous mode [ 95.496192][ T1038] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.520086][ T1038] bridge_slave_0: left allmulticast mode [ 95.522382][ T1038] bridge_slave_0: left promiscuous mode [ 95.524824][ T1038] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.864648][ T1038] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 95.870738][ T1038] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 95.875407][ T1038] bond0 (unregistering): Released all slaves [ 96.009384][ T1038] hsr_slave_0: left promiscuous mode [ 96.019163][ T1038] hsr_slave_1: left promiscuous mode [ 96.021536][ T1038] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 96.024804][ T1038] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 96.038632][ T1038] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 96.041506][ T1038] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 96.063679][ T1038] veth1_macvtap: left promiscuous mode [ 96.066278][ T1038] veth0_macvtap: left promiscuous mode [ 96.078337][ T1038] veth1_vlan: left promiscuous mode [ 96.080370][ T1038] veth0_vlan: left promiscuous mode [ 96.454073][ T1038] team0 (unregistering): Port device team_slave_1 removed [ 96.471258][ T1038] team0 (unregistering): Port device team_slave_0 removed 2025/11/08 02:38:19 executed programs: 0 [ 98.018785][ T4666] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 98.022545][ T4666] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 98.025843][ T4666] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 98.034254][ T4666] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 98.037400][ T4666] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 98.641894][ T5435] chnl_net:caif_netlink_parms(): no params data found [ 98.854227][ T5435] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.858001][ T5435] bridge0: port 1(bridge_slave_0) entered disabled state [ 98.860904][ T5435] bridge_slave_0: entered allmulticast mode [ 98.878292][ T5435] bridge_slave_0: entered promiscuous mode [ 98.886652][ T5435] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.899679][ T5435] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.902856][ T5435] bridge_slave_1: entered allmulticast mode [ 98.909650][ T5435] bridge_slave_1: entered promiscuous mode [ 98.961114][ T5435] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 98.966893][ T5435] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 99.029443][ T5435] team0: Port device team_slave_0 added [ 99.033999][ T5435] team0: Port device team_slave_1 added [ 99.074910][ T5435] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 99.088630][ T5435] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.109093][ T5435] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 99.118654][ T5435] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 99.121636][ T5435] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.133825][ T5435] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 99.203326][ T5435] hsr_slave_0: entered promiscuous mode [ 99.206504][ T5435] hsr_slave_1: entered promiscuous mode [ 99.714875][ T5435] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 99.734593][ T5435] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 99.751136][ T5435] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 99.761444][ T5435] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 99.923058][ T5435] 8021q: adding VLAN 0 to HW filter on device bond0 [ 99.961217][ T5435] 8021q: adding VLAN 0 to HW filter on device team0 [ 99.983455][ T1041] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.986600][ T1041] bridge0: port 1(bridge_slave_0) entered forwarding state [ 99.999418][ T1038] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.002540][ T1038] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.050208][ T5342] Bluetooth: hci0: command tx timeout [ 100.348618][ T5435] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.411197][ T5435] veth0_vlan: entered promiscuous mode [ 100.430113][ T5435] veth1_vlan: entered promiscuous mode [ 100.466768][ T5435] veth0_macvtap: entered promiscuous mode [ 100.491944][ T5435] veth1_macvtap: entered promiscuous mode [ 100.517552][ T5435] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 100.541856][ T5435] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 100.574008][ T1038] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.578419][ T1038] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.581917][ T1038] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.585570][ T1038] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.701683][ T1038] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.705243][ T1038] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.756495][ T31] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.759813][ T31] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.877028][ T5493] loop0: detected capacity change from 0 to 1024 [ 100.913842][ T5493] ======================================================= [ 100.913842][ T5493] WARNING: The mand mount option has been deprecated and [ 100.913842][ T5493] and is ignored by this kernel. Remove the mand [ 100.913842][ T5493] option from the mount to silence this warning. [ 100.913842][ T5493] ======================================================= [ 100.978226][ T5493] EXT4-fs: Ignoring removed oldalloc option [ 100.980311][ T5493] EXT4-fs: Ignoring removed orlov option [ 101.006295][ T5493] EXT4-fs (loop0): stripe (2) is not aligned with cluster size (16), stripe is disabled [ 101.045530][ T5493] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 101.117457][ T173] ================================================================== [ 101.120959][ T173] BUG: KASAN: use-after-free in ext4_find_extent+0xae6/0xcc0 [ 101.124066][ T173] Read of size 4 at addr ffff888047564400 by task kworker/u4:4/173 [ 101.128146][ T173] [ 101.128971][ T173] CPU: 0 UID: 0 PID: 173 Comm: kworker/u4:4 Not tainted syzkaller #0 PREEMPT(full) [ 101.128986][ T173] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 101.128994][ T173] Workqueue: writeback wb_workfn (flush-7:0) [ 101.129011][ T173] Call Trace: [ 101.129016][ T173] [ 101.129020][ T173] dump_stack_lvl+0x189/0x250 [ 101.129032][ T173] ? __virt_addr_valid+0x1c8/0x5c0 [ 101.129046][ T173] ? rcu_is_watching+0x15/0xb0 [ 101.129058][ T173] ? __pfx_dump_stack_lvl+0x10/0x10 [ 101.129071][ T173] ? rcu_is_watching+0x15/0xb0 [ 101.129082][ T173] ? lock_release+0x4b/0x3e0 [ 101.129093][ T173] ? _raw_spin_lock_irqsave+0xb3/0xf0 [ 101.129151][ T173] ? __virt_addr_valid+0x1c8/0x5c0 [ 101.129164][ T173] ? __virt_addr_valid+0x4a5/0x5c0 [ 101.129177][ T173] print_report+0xca/0x240 [ 101.129190][ T173] ? ext4_find_extent+0xae6/0xcc0 [ 101.129200][ T173] kasan_report+0x118/0x150 [ 101.129216][ T173] ? ext4_find_extent+0xae6/0xcc0 [ 101.129224][ T173] ext4_find_extent+0xae6/0xcc0 [ 101.129232][ T173] ext4_ext_map_blocks+0x288/0x6ac0 [ 101.129242][ T173] ? __lock_acquire+0xab9/0xd20 [ 101.129250][ T173] ? __pfx_ext4_ext_map_blocks+0x10/0x10 [ 101.129259][ T173] ? ext4_es_lookup_extent+0x622/0xa70 [ 101.129269][ T173] ext4_map_blocks+0x860/0x1740 [ 101.129280][ T173] ? __pfx_ext4_map_blocks+0x10/0x10 [ 101.129292][ T173] ? rcu_is_watching+0x15/0xb0 [ 101.129303][ T173] ? trace_kmem_cache_alloc+0x1f/0xc0 [ 101.129314][ T173] ? kmem_cache_alloc_noprof+0x3b8/0x6e0 [ 101.129328][ T173] ? ext4_inode_journal_mode+0x18c/0x480 [ 101.129344][ T173] ext4_do_writepages+0x1f88/0x4610 [ 101.129368][ T173] ? lockdep_unlock+0x89/0x120 [ 101.129384][ T173] ? __pfx_ext4_do_writepages+0x10/0x10 [ 101.129403][ T173] ? __lock_acquire+0xab9/0xd20 [ 101.129415][ T173] ? rcu_read_lock_any_held+0xb3/0x120 [ 101.129431][ T173] ext4_writepages+0x205/0x350 [ 101.129441][ T173] ? lockdep_unlock+0x89/0x120 [ 101.129456][ T173] ? __pfx_ext4_writepages+0x10/0x10 [ 101.129470][ T173] ? __pfx_ext4_writepages+0x10/0x10 [ 101.129481][ T173] do_writepages+0x32e/0x550 [ 101.129495][ T173] ? reacquire_held_locks+0x127/0x1d0 [ 101.129603][ T173] ? writeback_sb_inodes+0x384/0x1010 [ 101.129647][ T173] __writeback_single_inode+0x145/0xff0 [ 101.129661][ T173] ? do_raw_spin_unlock+0x4d/0x240 [ 101.129779][ T173] writeback_sb_inodes+0x6c7/0x1010 [ 101.129801][ T173] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 101.129821][ T173] ? rcu_is_watching+0x15/0xb0 [ 101.129834][ T173] wb_writeback+0x43b/0xaf0 [ 101.129854][ T173] ? queue_io+0x3d1/0x590 [ 101.129866][ T173] ? __pfx_wb_writeback+0x10/0x10 [ 101.129880][ T173] ? _raw_spin_unlock_irq+0x23/0x50 [ 101.129894][ T173] wb_workfn+0x409/0xef0 [ 101.129907][ T173] ? __pfx_wb_workfn+0x10/0x10 [ 101.129917][ T173] ? __lock_acquire+0xab9/0xd20 [ 101.129930][ T173] ? process_scheduled_works+0x9ef/0x17b0 [ 101.129943][ T173] ? _raw_spin_unlock_irq+0x23/0x50 [ 101.129954][ T173] ? process_scheduled_works+0x9ef/0x17b0 [ 101.129989][ T173] ? process_scheduled_works+0x9ef/0x17b0 [ 101.130001][ T173] process_scheduled_works+0xae1/0x17b0 [ 101.130019][ T173] ? __pfx_process_scheduled_works+0x10/0x10 [ 101.130033][ T173] worker_thread+0x8a0/0xda0 [ 101.130045][ T173] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 101.130060][ T173] ? __kthread_parkme+0x7b/0x200 [ 101.130075][ T173] kthread+0x711/0x8a0 [ 101.130089][ T173] ? __pfx_worker_thread+0x10/0x10 [ 101.130100][ T173] ? __pfx_kthread+0x10/0x10 [ 101.130114][ T173] ? _raw_spin_unlock_irq+0x23/0x50 [ 101.130126][ T173] ? lockdep_hardirqs_on+0x9c/0x150 [ 101.130139][ T173] ? __pfx_kthread+0x10/0x10 [ 101.130152][ T173] ret_from_fork+0x4bc/0x870 [ 101.130165][ T173] ? __pfx_ret_from_fork+0x10/0x10 [ 101.130178][ T173] ? __pfx_kthread+0x10/0x10 [ 101.130191][ T173] ret_from_fork_asm+0x1a/0x30 [ 101.130205][ T173] [ 101.130209][ T173] [ 101.281325][ T173] The buggy address belongs to the physical page: [ 101.284067][ T173] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2d7b pfn:0x47564 [ 101.287830][ T173] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 101.290910][ T173] raw: 04fff00000000000 dead000000000100 dead000000000122 0000000000000000 [ 101.294384][ T173] raw: 0000000000002d7b 0000000000000000 00000000ffffffff 0000000000000000 [ 101.297983][ T173] page dumped because: kasan: bad access detected [ 101.300585][ T173] page_owner tracks the page as freed [ 101.302789][ T173] page last allocated via order 0, migratetype Movable, gfp_mask 0x141cca(GFP_HIGHUSER_MOVABLE|__GFP_WRITE|__GFP_COMP), pid 5213, tgid 5213 (sftp-server), ts 76191818106, free_ts 93211358167 [ 101.310268][ T173] post_alloc_hook+0x240/0x2a0 [ 101.312274][ T173] get_page_from_freelist+0x2365/0x2440 [ 101.314625][ T173] __alloc_frozen_pages_noprof+0x181/0x370 [ 101.317586][ T173] alloc_pages_mpol+0x232/0x4a0 [ 101.319660][ T173] alloc_pages_noprof+0xa9/0x190 [ 101.321717][ T173] folio_alloc_noprof+0x1e/0x30 [ 101.323735][ T173] filemap_alloc_folio_noprof+0xdf/0x470 [ 101.326064][ T173] __filemap_get_folio+0x3f2/0xaf0 [ 101.328196][ T173] ext4_da_write_begin+0x641/0xda0 [ 101.330356][ T173] generic_perform_write+0x2c5/0x900 [ 101.332500][ T173] ext4_buffered_write_iter+0xce/0x3a0 [ 101.334755][ T173] ext4_file_write_iter+0x298/0x1bc0 [ 101.336926][ T173] vfs_write+0x5c9/0xb30 [ 101.338714][ T173] ksys_write+0x145/0x250 [ 101.340414][ T173] do_syscall_64+0xfa/0xfa0 [ 101.342226][ T173] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.344642][ T173] page last free pid 79 tgid 79 stack trace: [ 101.347254][ T173] free_unref_folios+0xdb3/0x14f0 [ 101.349418][ T173] shrink_folio_list+0x295e/0x4c70 [ 101.351482][ T173] evict_folios+0x471e/0x57c0 [ 101.353554][ T173] try_to_shrink_lruvec+0x8a3/0xb50 [ 101.355587][ T173] shrink_one+0x21b/0x7c0 [ 101.357319][ T173] shrink_node+0x315d/0x3780 [ 101.359198][ T173] kswapd+0x147c/0x2800 [ 101.360950][ T173] kthread+0x711/0x8a0 [ 101.362697][ T173] ret_from_fork+0x4bc/0x870 [ 101.364626][ T173] ret_from_fork_asm+0x1a/0x30 [ 101.366670][ T173] [ 101.367591][ T173] Memory state around the buggy address: [ 101.370130][ T173] ffff888047564300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 101.373813][ T173] ffff888047564380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 101.377121][ T173] >ffff888047564400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 101.380441][ T173] ^ [ 101.382210][ T173] ffff888047564480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 101.385491][ T173] ffff888047564500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 101.389283][ T173] ================================================================== [ 101.529408][ T173] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 101.532396][ T173] CPU: 0 UID: 0 PID: 173 Comm: kworker/u4:4 Not tainted syzkaller #0 PREEMPT(full) [ 101.536134][ T173] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 101.540597][ T173] Workqueue: writeback wb_workfn (flush-7:0) [ 101.543050][ T173] Call Trace: [ 101.544468][ T173] [ 101.545664][ T173] dump_stack_lvl+0x99/0x250 [ 101.547623][ T173] ? __asan_memcpy+0x40/0x70 [ 101.549738][ T173] ? __pfx_dump_stack_lvl+0x10/0x10 [ 101.551976][ T173] ? __pfx__printk+0x10/0x10 [ 101.554181][ T173] vpanic+0x237/0x6d0 [ 101.555972][ T173] ? __pfx_vpanic+0x10/0x10 [ 101.558004][ T173] ? preempt_schedule+0xae/0xc0 [ 101.560170][ T173] ? __pfx_preempt_schedule+0x10/0x10 [ 101.562586][ T173] panic+0xb9/0xc0 [ 101.564284][ T173] ? __pfx_panic+0x10/0x10 [ 101.566341][ T173] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 101.568846][ T173] ? is_module_address+0x17/0xf0 [ 101.570980][ T173] ? ext4_find_extent+0xae6/0xcc0 [ 101.573191][ T173] check_panic_on_warn+0x89/0xb0 [ 101.575451][ T173] ? ext4_find_extent+0xae6/0xcc0 [ 101.577708][ T173] end_report+0x78/0x160 [ 101.579497][ T173] kasan_report+0x129/0x150 [ 101.581416][ T173] ? ext4_find_extent+0xae6/0xcc0 [ 101.583493][ T173] ext4_find_extent+0xae6/0xcc0 [ 101.585642][ T173] ext4_ext_map_blocks+0x288/0x6ac0 [ 101.587902][ T173] ? __lock_acquire+0xab9/0xd20 [ 101.590144][ T173] ? __pfx_ext4_ext_map_blocks+0x10/0x10 [ 101.592673][ T173] ? ext4_es_lookup_extent+0x622/0xa70 [ 101.595006][ T173] ext4_map_blocks+0x860/0x1740 [ 101.597039][ T173] ? __pfx_ext4_map_blocks+0x10/0x10 [ 101.599359][ T173] ? rcu_is_watching+0x15/0xb0 [ 101.601399][ T173] ? trace_kmem_cache_alloc+0x1f/0xc0 [ 101.603851][ T173] ? kmem_cache_alloc_noprof+0x3b8/0x6e0 [ 101.606280][ T173] ? ext4_inode_journal_mode+0x18c/0x480 [ 101.608769][ T173] ext4_do_writepages+0x1f88/0x4610 [ 101.610909][ T173] ? lockdep_unlock+0x89/0x120 [ 101.612841][ T173] ? __pfx_ext4_do_writepages+0x10/0x10 [ 101.615020][ T173] ? __lock_acquire+0xab9/0xd20 [ 101.616963][ T173] ? rcu_read_lock_any_held+0xb3/0x120 [ 101.619039][ T173] ext4_writepages+0x205/0x350 [ 101.620936][ T173] ? lockdep_unlock+0x89/0x120 [ 101.622865][ T173] ? __pfx_ext4_writepages+0x10/0x10 [ 101.625091][ T173] ? __pfx_ext4_writepages+0x10/0x10 [ 101.627506][ T173] do_writepages+0x32e/0x550 [ 101.629602][ T173] ? reacquire_held_locks+0x127/0x1d0 [ 101.631977][ T173] ? writeback_sb_inodes+0x384/0x1010 [ 101.634235][ T173] __writeback_single_inode+0x145/0xff0 [ 101.636645][ T173] ? do_raw_spin_unlock+0x4d/0x240 [ 101.638872][ T173] writeback_sb_inodes+0x6c7/0x1010 [ 101.640827][ T173] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 101.643157][ T173] ? rcu_is_watching+0x15/0xb0 [ 101.645165][ T173] wb_writeback+0x43b/0xaf0 [ 101.647202][ T173] ? queue_io+0x3d1/0x590 [ 101.649140][ T173] ? __pfx_wb_writeback+0x10/0x10 [ 101.651393][ T173] ? _raw_spin_unlock_irq+0x23/0x50 [ 101.653687][ T173] wb_workfn+0x409/0xef0 [ 101.655670][ T173] ? __pfx_wb_workfn+0x10/0x10 [ 101.657924][ T173] ? __lock_acquire+0xab9/0xd20 [ 101.660040][ T173] ? process_scheduled_works+0x9ef/0x17b0 [ 101.662153][ T173] ? _raw_spin_unlock_irq+0x23/0x50 [ 101.663908][ T173] ? process_scheduled_works+0x9ef/0x17b0 [ 101.666063][ T173] ? process_scheduled_works+0x9ef/0x17b0 [ 101.668401][ T173] process_scheduled_works+0xae1/0x17b0 [ 101.670699][ T173] ? __pfx_process_scheduled_works+0x10/0x10 [ 101.673066][ T173] worker_thread+0x8a0/0xda0 [ 101.675048][ T173] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 101.677866][ T173] ? __kthread_parkme+0x7b/0x200 [ 101.679981][ T173] kthread+0x711/0x8a0 [ 101.681578][ T173] ? __pfx_worker_thread+0x10/0x10 [ 101.683719][ T173] ? __pfx_kthread+0x10/0x10 [ 101.685789][ T173] ? _raw_spin_unlock_irq+0x23/0x50 [ 101.688145][ T173] ? lockdep_hardirqs_on+0x9c/0x150 [ 101.690299][ T173] ? __pfx_kthread+0x10/0x10 [ 101.692298][ T173] ret_from_fork+0x4bc/0x870 [ 101.694305][ T173] ? __pfx_ret_from_fork+0x10/0x10 [ 101.696606][ T173] ? __pfx_kthread+0x10/0x10 [ 101.698829][ T173] ret_from_fork_asm+0x1a/0x30 [ 101.701082][ T173] [ 101.702910][ T173] Kernel Offset: disabled [ 101.704905][ T173] Rebooting in 86400 seconds.. VM DIAGNOSIS: 02:38:22 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000066 RBX=0000000000000066 RCX=0000000000000000 RDX=00000000000003f8 RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc900019ce090 R8 =ffff888033a10237 R9 =1ffff11006742046 R10=dffffc0000000000 R11=ffffffff85166410 R12=dffffc0000000000 R13=ffffffff997e491e R14=ffffffff99af8320 R15=0000000000000000 RIP=ffffffff8516648c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88808d730000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007fff87578f08 CR3=0000000058d67000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001fa0 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 c123405ec123405e c123405ec123405e ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 2814731a2814731a 2814731a2814731a ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 a1f5360ba1f5360b a1f5360ba1f5360b ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 c1f70eedc1f70eed c1f70eedc1f70eed ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 705781b04403388e 975a493bcaabbf63 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 1b3967f1dbb47a05 ae539b603d6e613e ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 df53388e4232192a 66b7b3e7415e6af1 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 30a474f6a0a2e055 280f06c0e61c66eb ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 46cd68dc7cc57754 881f769aed8bb484 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 08dc0792e75e1ac0 58adf06bdecc64b5 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 4e59cfb5587d1719 992acda4977f2025 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ded668b8f3a932f5 9aa43f5c74838792 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 5b3e87525b3e8752 5b3e87525b3e8752 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 cd37b59bcd37b59b cd37b59bcd37b59b ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 43e4dd9243e4dd92 43e4dd9243e4dd92 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000