Warning: Permanently added '10.128.1.155' (ED25519) to the list of known hosts. 2025/12/09 22:10:21 parsed 1 programs [ 88.753038][ T5771] cgroup: Unknown subsys name 'net' [ 88.917823][ T5771] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 90.664299][ T5771] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 92.218012][ T1207] cfg80211: failed to load regulatory.db [ 94.028032][ T5802] chnl_net:caif_netlink_parms(): no params data found [ 94.128917][ T5802] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.136744][ T5802] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.147521][ T5802] bridge_slave_0: entered allmulticast mode [ 94.155343][ T5802] bridge_slave_0: entered promiscuous mode [ 94.175538][ T5802] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.182770][ T5802] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.190135][ T5802] bridge_slave_1: entered allmulticast mode [ 94.197140][ T5802] bridge_slave_1: entered promiscuous mode [ 94.229100][ T5802] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 94.244528][ T5802] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 94.285731][ T5802] team0: Port device team_slave_0 added [ 94.294569][ T5802] team0: Port device team_slave_1 added [ 94.321747][ T5802] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 94.329676][ T5802] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 94.355928][ T5802] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 94.378708][ T5802] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 94.385716][ T5802] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 94.411854][ T5802] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 94.468621][ T5802] hsr_slave_0: entered promiscuous mode [ 94.475327][ T5802] hsr_slave_1: entered promiscuous mode [ 94.656262][ T5802] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 94.669245][ T5802] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 94.680369][ T5802] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 94.690591][ T5802] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 94.732356][ T5802] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.739788][ T5802] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.747802][ T5802] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.755385][ T5802] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.837255][ T5802] 8021q: adding VLAN 0 to HW filter on device bond0 [ 94.860004][ T3462] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.868874][ T3462] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.889139][ T5802] 8021q: adding VLAN 0 to HW filter on device team0 [ 94.903517][ T987] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.910730][ T987] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.925258][ T3462] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.932472][ T3462] bridge0: port 2(bridge_slave_1) entered forwarding state [ 95.135893][ T5802] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 95.185219][ T5802] veth0_vlan: entered promiscuous mode [ 95.197861][ T5802] veth1_vlan: entered promiscuous mode [ 95.230787][ T5802] veth0_macvtap: entered promiscuous mode [ 95.240917][ T5802] veth1_macvtap: entered promiscuous mode [ 95.261032][ T5802] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.277030][ T5802] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.291089][ T5802] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.300712][ T5802] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.309877][ T5802] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.318792][ T5802] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.509838][ T3462] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 96.006989][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 96.017220][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 96.025860][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 96.034704][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 96.044282][ T51] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 96.052466][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 97.690303][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.707102][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.754549][ T78] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.762929][ T78] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.317292][ T3462] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2025/12/09 22:10:33 executed programs: 0 [ 98.456908][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 98.465253][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 98.474604][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 98.483694][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 98.494387][ T51] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 98.501907][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 98.675529][ T5880] chnl_net:caif_netlink_parms(): no params data found [ 98.750917][ T5880] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.758088][ T5880] bridge0: port 1(bridge_slave_0) entered disabled state [ 98.765813][ T5880] bridge_slave_0: entered allmulticast mode [ 98.773324][ T5880] bridge_slave_0: entered promiscuous mode [ 98.782177][ T5880] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.789756][ T5880] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.797155][ T5880] bridge_slave_1: entered allmulticast mode [ 98.805720][ T5880] bridge_slave_1: entered promiscuous mode [ 98.839422][ T5880] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 98.851336][ T5880] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 98.887046][ T5880] team0: Port device team_slave_0 added [ 98.897186][ T5880] team0: Port device team_slave_1 added [ 98.928268][ T5880] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 98.935371][ T5880] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 98.962038][ T5880] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 98.974444][ T5880] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 98.982892][ T5880] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 99.009252][ T5880] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 99.054517][ T5880] hsr_slave_0: entered promiscuous mode [ 99.061767][ T5880] hsr_slave_1: entered promiscuous mode [ 99.068021][ T5880] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 99.076089][ T5880] Cannot create hsr debugfs directory [ 100.360296][ T3462] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.414871][ T3462] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.600797][ T5083] Bluetooth: hci0: command tx timeout [ 101.329466][ T3462] hsr_slave_0: left promiscuous mode [ 101.336030][ T3462] hsr_slave_1: left promiscuous mode [ 101.343014][ T3462] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 101.350880][ T3462] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 101.360771][ T3462] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 101.368232][ T3462] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 101.376432][ T3462] bridge_slave_1: left allmulticast mode [ 101.382552][ T3462] bridge_slave_1: left promiscuous mode [ 101.389536][ T3462] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.402990][ T3462] bridge_slave_0: left allmulticast mode [ 101.410501][ T3462] bridge_slave_0: left promiscuous mode [ 101.416442][ T3462] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.448190][ T3462] veth1_macvtap: left promiscuous mode [ 101.455975][ T3462] veth0_macvtap: left promiscuous mode [ 101.462192][ T3462] veth1_vlan: left promiscuous mode [ 101.467816][ T3462] veth0_vlan: left promiscuous mode [ 101.945509][ T3462] team0 (unregistering): Port device team_slave_1 removed [ 101.985229][ T3462] team0 (unregistering): Port device team_slave_0 removed [ 102.026392][ T3462] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 102.066430][ T3462] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 102.580982][ T3462] bond0 (unregistering): Released all slaves [ 102.678515][ T5083] Bluetooth: hci0: command tx timeout [ 102.693289][ T5880] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 102.708067][ T5880] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 102.725512][ T5880] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 102.737563][ T5880] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 102.856957][ T5880] 8021q: adding VLAN 0 to HW filter on device bond0 [ 102.882993][ T5880] 8021q: adding VLAN 0 to HW filter on device team0 [ 102.895412][ T987] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.902630][ T987] bridge0: port 1(bridge_slave_0) entered forwarding state [ 102.920306][ T78] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.927692][ T78] bridge0: port 2(bridge_slave_1) entered forwarding state [ 103.221660][ T5880] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 103.301458][ T5880] veth0_vlan: entered promiscuous mode [ 103.316991][ T5880] veth1_vlan: entered promiscuous mode [ 103.373493][ T5880] veth0_macvtap: entered promiscuous mode [ 103.390380][ T5880] veth1_macvtap: entered promiscuous mode [ 103.415192][ T5880] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 103.430457][ T5880] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 103.443603][ T5880] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.453798][ T5880] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.462804][ T5880] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.472416][ T5880] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.541521][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.554124][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.627568][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.635566][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2025/12/09 22:10:39 executed programs: 2 [ 103.743472][ T5925] syz.0.17[5925]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 103.830252][ T5925] loop0: detected capacity change from 0 to 8192 [ 103.850196][ T5925] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 103.863946][ T5925] REISERFS (device loop0): found reiserfs format "3.5" with non-standard journal [ 103.878033][ T5925] REISERFS (device loop0): using ordered data mode [ 103.889113][ T5925] reiserfs: using flush barriers [ 103.898676][ T5925] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 103.919679][ T5925] REISERFS (device loop0): checking transaction log (loop0) [ 103.947423][ T5925] REISERFS (device loop0): Using rupasov hash to sort names [ 103.957678][ T5925] REISERFS (device loop0): using 3.5.x disk format [ 103.966655][ T5925] REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP [ 103.992218][ T5925] REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP [ 104.007552][ T5925] REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP [ 104.020702][ T5925] REISERFS warning (device loop0): vs-13060 reiserfs_update_sd_size: stat data of object [1 2 0x0 UNKNOWN] (nlink == 1) not found (pos 2) [ 104.037722][ T5925] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. [ 104.052706][ T5925] REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP [ 104.067003][ T5925] REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP [ 104.082423][ T5925] REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP [ 104.095388][ T5925] REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP [ 104.117163][ T5925] REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP [ 104.133533][ T5925] REISERFS warning (device loop0): vs-13060 reiserfs_update_sd_size: stat data of object [1 2 0x0 UNKNOWN] (nlink == 1) not found (pos 2) [ 104.149101][ T5925] ================================================================== [ 104.157220][ T5925] BUG: KASAN: use-after-free in reiserfs_release_objectid+0x575/0x820 [ 104.165401][ T5925] Read of size 8188 at addr ffff88805e084050 by task syz.0.17/5925 [ 104.173300][ T5925] [ 104.175634][ T5925] CPU: 1 PID: 5925 Comm: syz.0.17 Not tainted syzkaller #0 [ 104.182839][ T5925] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 104.192912][ T5925] Call Trace: [ 104.196198][ T5925] [ 104.199159][ T5925] dump_stack_lvl+0x16c/0x230 [ 104.203899][ T5925] ? read_lock_is_recursive+0x20/0x20 [ 104.209325][ T5925] ? show_regs_print_info+0x20/0x20 [ 104.214565][ T5925] ? load_image+0x3b0/0x3b0 [ 104.219115][ T5925] ? _raw_spin_lock_irqsave+0xb4/0xf0 [ 104.224502][ T5925] ? __virt_addr_valid+0x18c/0x540 [ 104.229632][ T5925] ? __virt_addr_valid+0x469/0x540 [ 104.234772][ T5925] print_report+0xac/0x220 [ 104.239203][ T5925] ? reiserfs_release_objectid+0x575/0x820 [ 104.245024][ T5925] kasan_report+0x117/0x150 [ 104.249545][ T5925] ? reiserfs_release_objectid+0x575/0x820 [ 104.255374][ T5925] kasan_check_range+0x288/0x290 [ 104.260337][ T5925] ? reiserfs_release_objectid+0x575/0x820 [ 104.266192][ T5925] __asan_memmove+0x29/0x70 [ 104.270714][ T5925] reiserfs_release_objectid+0x575/0x820 [ 104.276365][ T5925] remove_save_link+0x2ba/0x3c0 [ 104.281249][ T5925] ? reiserfs_write_lock_nested+0x60/0xd0 [ 104.286999][ T5925] ? add_save_link+0x5c0/0x5c0 [ 104.291881][ T5925] ? __rwlock_init+0x150/0x150 [ 104.296675][ T5925] ? journal_end+0x1ff/0x2b0 [ 104.301295][ T5925] reiserfs_evict_inode+0x395/0x490 [ 104.306510][ T5925] ? entry_points_to_object+0x260/0x260 [ 104.312068][ T5925] ? do_raw_spin_lock+0x121/0x2c0 [ 104.317113][ T5925] ? do_raw_spin_unlock+0x121/0x230 [ 104.322331][ T5925] ? entry_points_to_object+0x260/0x260 [ 104.327891][ T5925] evict+0x486/0x870 [ 104.331813][ T5925] ? __lock_acquire+0x7c80/0x7c80 [ 104.336870][ T5925] ? proc_nr_inodes+0x230/0x230 [ 104.341758][ T5925] ? do_raw_spin_unlock+0x121/0x230 [ 104.347005][ T5925] ? _raw_spin_unlock+0x28/0x40 [ 104.351880][ T5925] ? iput+0x70a/0x920 [ 104.355888][ T5925] __dentry_kill+0x431/0x650 [ 104.360502][ T5925] dentry_kill+0xb8/0x290 [ 104.364849][ T5925] ? dput+0x3b/0x1e0 [ 104.368762][ T5925] dput+0xfe/0x1e0 [ 104.372504][ T5925] __fput+0x5e5/0x970 [ 104.376520][ T5925] task_work_run+0x1ce/0x250 [ 104.381130][ T5925] ? task_work_cancel+0x240/0x240 [ 104.386181][ T5925] ? exit_to_user_mode_loop+0x3b/0x110 [ 104.391657][ T5925] exit_to_user_mode_loop+0xe6/0x110 [ 104.396961][ T5925] exit_to_user_mode_prepare+0xf6/0x180 [ 104.402527][ T5925] syscall_exit_to_user_mode+0x1a/0x50 [ 104.408025][ T5925] do_syscall_64+0x61/0xb0 [ 104.412469][ T5925] ? clear_bhb_loop+0x40/0x90 [ 104.417211][ T5925] ? clear_bhb_loop+0x40/0x90 [ 104.421917][ T5925] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 104.427829][ T5925] RIP: 0033:0x7fdc3058f749 [ 104.432269][ T5925] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 104.451893][ T5925] RSP: 002b:00007ffe0edae178 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 104.460347][ T5925] RAX: 0000000000000000 RBX: 0000000000019509 RCX: 00007fdc3058f749 [ 104.468341][ T5925] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 104.476417][ T5925] RBP: 0000000000000000 R08: 0000000000000001 R09: 000000040edae46f [ 104.484401][ T5925] R10: 0000001b33720000 R11: 0000000000000246 R12: 00007fdc307e5fac [ 104.492382][ T5925] R13: 00007fdc307e5fa0 R14: ffffffffffffffff R15: 0000000000000004 [ 104.500372][ T5925] [ 104.503397][ T5925] [ 104.505725][ T5925] The buggy address belongs to the physical page: [ 104.512148][ T5925] page:ffffea0001782100 refcount:2 mapcount:0 mapping:ffff88801fdf41f8 index:0x10 pfn:0x5e084 [ 104.522415][ T5925] memcg:ffff888030094000 [ 104.526665][ T5925] aops:def_blk_aops ino:700000 [ 104.531466][ T5925] flags: 0xfff5800002822c(referenced|uptodate|lru|workingset|private|mappedtodisk|node=0|zone=1|lastcpupid=0x7ff) [ 104.543895][ T5925] page_type: 0xffffffff() [ 104.548238][ T5925] raw: 00fff5800002822c ffffea00018e2788 ffffea00018e2088 ffff88801fdf41f8 [ 104.556930][ T5925] raw: 0000000000000010 ffff8880742d32b8 00000002ffffffff ffff888030094000 [ 104.565521][ T5925] page dumped because: kasan: bad access detected [ 104.571952][ T5925] page_owner tracks the page as allocated [ 104.577673][ T5925] page last allocated via order 0, migratetype Movable, gfp_mask 0x148c48(GFP_NOFS|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL|__GFP_MOVABLE), pid 5925, tgid 5925 (syz.0.17), ts 103849530282, free_ts 103828914267 [ 104.598024][ T5925] post_alloc_hook+0x1cd/0x210 [ 104.602821][ T5925] get_page_from_freelist+0x195c/0x19f0 [ 104.608586][ T5925] __alloc_pages+0x1e3/0x460 [ 104.613214][ T5925] folio_alloc+0x1e/0x30 [ 104.617475][ T5925] filemap_alloc_folio+0xdf/0x470 [ 104.622532][ T5925] __filemap_get_folio+0x3ee/0xbc0 [ 104.627654][ T5925] __getblk_gfp+0x223/0x660 [ 104.632172][ T5925] __bread_gfp+0x2a/0x330 [ 104.636520][ T5925] read_super_block+0x91/0x7c0 [ 104.641302][ T5925] reiserfs_fill_super+0x7a2/0x2340 [ 104.646600][ T5925] mount_bdev+0x22b/0x2d0 [ 104.651035][ T5925] legacy_get_tree+0xea/0x180 [ 104.655734][ T5925] vfs_get_tree+0x8c/0x280 [ 104.660166][ T5925] do_new_mount+0x24b/0xa40 [ 104.664857][ T5925] __se_sys_mount+0x2da/0x3c0 [ 104.669569][ T5925] do_syscall_64+0x55/0xb0 [ 104.673992][ T5925] page last free stack trace: [ 104.678672][ T5925] free_unref_page_prepare+0x7ce/0x8e0 [ 104.684149][ T5925] free_unref_page_list+0xbe/0x860 [ 104.689274][ T5925] release_pages+0x1fa0/0x2220 [ 104.694072][ T5925] tlb_flush_mmu+0x368/0x4f0 [ 104.698679][ T5925] tlb_finish_mmu+0xc3/0x1d0 [ 104.703286][ T5925] unmap_region+0x2ed/0x340 [ 104.707805][ T5925] do_vmi_align_munmap+0xffe/0x1660 [ 104.713026][ T5925] do_vmi_munmap+0x252/0x2d0 [ 104.717648][ T5925] __vm_munmap+0x193/0x3c0 [ 104.722083][ T5925] __x64_sys_munmap+0x60/0x70 [ 104.726776][ T5925] do_syscall_64+0x55/0xb0 [ 104.731201][ T5925] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 104.737104][ T5925] [ 104.739445][ T5925] Memory state around the buggy address: [ 104.745130][ T5925] ffff88805e084f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 104.753203][ T5925] ffff88805e084f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 104.761295][ T5925] >ffff88805e085000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 104.769366][ T5925] ^ [ 104.773472][ T5925] ffff88805e085080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 104.781645][ T5925] ffff88805e085100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 104.789710][ T5925] ================================================================== [ 104.812326][ T5083] Bluetooth: hci0: command tx timeout [ 104.829116][ T5925] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 104.836543][ T5925] CPU: 1 PID: 5925 Comm: syz.0.17 Not tainted syzkaller #0 [ 104.843867][ T5925] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 104.854297][ T5925] Call Trace: [ 104.857683][ T5925] [ 104.860653][ T5925] dump_stack_lvl+0x16c/0x230 [ 104.865356][ T5925] ? show_regs_print_info+0x20/0x20 [ 104.870577][ T5925] ? load_image+0x3b0/0x3b0 [ 104.875104][ T5925] panic+0x2c0/0x710 [ 104.879027][ T5925] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 104.885198][ T5925] ? bpf_jit_dump+0xd0/0xd0 [ 104.889726][ T5925] ? _raw_spin_unlock_irqrestore+0xfa/0x110 [ 104.895655][ T5925] ? _raw_spin_unlock+0x40/0x40 [ 104.900783][ T5925] ? reiserfs_release_objectid+0x575/0x820 [ 104.906614][ T5925] check_panic_on_warn+0x84/0xa0 [ 104.911571][ T5925] ? reiserfs_release_objectid+0x575/0x820 [ 104.917405][ T5925] end_report+0x6f/0x140 [ 104.921660][ T5925] kasan_report+0x128/0x150 [ 104.926356][ T5925] ? reiserfs_release_objectid+0x575/0x820 [ 104.932708][ T5925] kasan_check_range+0x288/0x290 [ 104.937752][ T5925] ? reiserfs_release_objectid+0x575/0x820 [ 104.943722][ T5925] __asan_memmove+0x29/0x70 [ 104.948242][ T5925] reiserfs_release_objectid+0x575/0x820 [ 104.953906][ T5925] remove_save_link+0x2ba/0x3c0 [ 104.958780][ T5925] ? reiserfs_write_lock_nested+0x60/0xd0 [ 104.964529][ T5925] ? add_save_link+0x5c0/0x5c0 [ 104.969403][ T5925] ? __rwlock_init+0x150/0x150 [ 104.974190][ T5925] ? journal_end+0x1ff/0x2b0 [ 104.978801][ T5925] reiserfs_evict_inode+0x395/0x490 [ 104.984018][ T5925] ? entry_points_to_object+0x260/0x260 [ 104.989582][ T5925] ? do_raw_spin_lock+0x121/0x2c0 [ 104.994630][ T5925] ? do_raw_spin_unlock+0x121/0x230 [ 104.999850][ T5925] ? entry_points_to_object+0x260/0x260 [ 105.005431][ T5925] evict+0x486/0x870 [ 105.009431][ T5925] ? __lock_acquire+0x7c80/0x7c80 [ 105.014478][ T5925] ? proc_nr_inodes+0x230/0x230 [ 105.019346][ T5925] ? do_raw_spin_unlock+0x121/0x230 [ 105.024562][ T5925] ? _raw_spin_unlock+0x28/0x40 [ 105.029522][ T5925] ? iput+0x70a/0x920 [ 105.033567][ T5925] __dentry_kill+0x431/0x650 [ 105.038208][ T5925] dentry_kill+0xb8/0x290 [ 105.042647][ T5925] ? dput+0x3b/0x1e0 [ 105.046569][ T5925] dput+0xfe/0x1e0 [ 105.050311][ T5925] __fput+0x5e5/0x970 [ 105.054329][ T5925] task_work_run+0x1ce/0x250 [ 105.058945][ T5925] ? task_work_cancel+0x240/0x240 [ 105.064040][ T5925] ? exit_to_user_mode_loop+0x3b/0x110 [ 105.069614][ T5925] exit_to_user_mode_loop+0xe6/0x110 [ 105.074944][ T5925] exit_to_user_mode_prepare+0xf6/0x180 [ 105.080525][ T5925] syscall_exit_to_user_mode+0x1a/0x50 [ 105.086015][ T5925] do_syscall_64+0x61/0xb0 [ 105.090543][ T5925] ? clear_bhb_loop+0x40/0x90 [ 105.095246][ T5925] ? clear_bhb_loop+0x40/0x90 [ 105.099945][ T5925] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 105.105861][ T5925] RIP: 0033:0x7fdc3058f749 [ 105.110310][ T5925] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 105.130042][ T5925] RSP: 002b:00007ffe0edae178 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 105.138477][ T5925] RAX: 0000000000000000 RBX: 0000000000019509 RCX: 00007fdc3058f749 [ 105.146641][ T5925] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 105.154654][ T5925] RBP: 0000000000000000 R08: 0000000000000001 R09: 000000040edae46f [ 105.162650][ T5925] R10: 0000001b33720000 R11: 0000000000000246 R12: 00007fdc307e5fac [ 105.170637][ T5925] R13: 00007fdc307e5fa0 R14: ffffffffffffffff R15: 0000000000000004 [ 105.178634][ T5925] [ 105.182019][ T5925] Kernel Offset: disabled [ 105.186352][ T5925] Rebooting in 86400 seconds..