Warning: Permanently added '10.128.1.215' (ED25519) to the list of known hosts. 2025/08/23 01:11:27 parsed 1 programs [ 73.923338][ T5785] cgroup: Unknown subsys name 'net' [ 74.059992][ T5785] cgroup: Unknown subsys name 'rlimit' [ 75.491719][ T5785] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 77.731491][ T3455] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.739849][ T3455] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.765616][ T1121] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.774001][ T1121] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.239294][ T5835] chnl_net:caif_netlink_parms(): no params data found [ 79.318910][ T5835] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.326478][ T5835] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.334765][ T5835] bridge_slave_0: entered allmulticast mode [ 79.341532][ T5835] bridge_slave_0: entered promiscuous mode [ 79.351167][ T5835] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.359414][ T5835] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.366968][ T5835] bridge_slave_1: entered allmulticast mode [ 79.374880][ T5835] bridge_slave_1: entered promiscuous mode [ 79.409025][ T5835] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.421704][ T5835] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.458484][ T5835] team0: Port device team_slave_0 added [ 79.467885][ T5835] team0: Port device team_slave_1 added [ 79.501340][ T5835] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.509125][ T5835] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.535959][ T5835] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.549651][ T5835] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.556692][ T5835] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.583024][ T5835] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.626801][ T5835] hsr_slave_0: entered promiscuous mode [ 79.633674][ T5835] hsr_slave_1: entered promiscuous mode [ 79.785902][ T5835] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 79.796913][ T5835] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 79.811632][ T5835] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 79.822348][ T5835] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 79.849702][ T5835] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.856949][ T5835] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.865075][ T5835] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.872533][ T5835] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.934703][ T5835] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.965790][ T590] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.974489][ T590] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.987874][ T5835] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.999972][ T1121] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.007189][ T1121] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.028908][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.036104][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.222929][ T5835] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.271818][ T5835] veth0_vlan: entered promiscuous mode [ 80.283753][ T5835] veth1_vlan: entered promiscuous mode [ 80.319825][ T5835] veth0_macvtap: entered promiscuous mode [ 80.328480][ T5835] veth1_macvtap: entered promiscuous mode [ 80.347316][ T5835] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.369399][ T5835] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.384788][ T5835] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.394195][ T5835] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.402915][ T5835] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.411704][ T5835] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.610066][ T5860] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 80.620705][ T5860] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 80.629489][ T5860] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 80.639231][ T5860] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 80.647898][ T5860] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 80.656557][ T5860] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 80.702490][ T60] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 81.645757][ T8] cfg80211: failed to load regulatory.db 2025/08/23 01:11:37 executed programs: 0 [ 82.371724][ T5860] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 82.379830][ T5860] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 82.389196][ T5860] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 82.397913][ T5860] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 82.406407][ T5860] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 82.414120][ T5860] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 82.541276][ T5898] chnl_net:caif_netlink_parms(): no params data found [ 82.596044][ T5898] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.603989][ T5898] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.611311][ T5898] bridge_slave_0: entered allmulticast mode [ 82.618304][ T5898] bridge_slave_0: entered promiscuous mode [ 82.626261][ T5898] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.633593][ T5898] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.640887][ T5898] bridge_slave_1: entered allmulticast mode [ 82.647872][ T5898] bridge_slave_1: entered promiscuous mode [ 82.672198][ T5898] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.686397][ T5898] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.713122][ T5898] team0: Port device team_slave_0 added [ 82.720880][ T5898] team0: Port device team_slave_1 added [ 82.745852][ T5898] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.752933][ T5898] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.779146][ T5898] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.790860][ T5898] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.797902][ T5898] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.824059][ T5898] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.857817][ T5898] hsr_slave_0: entered promiscuous mode [ 82.865131][ T5898] hsr_slave_1: entered promiscuous mode [ 82.871246][ T5898] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 82.879131][ T5898] Cannot create hsr debugfs directory [ 83.192818][ T60] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 84.444299][ T5860] Bluetooth: hci0: command tx timeout [ 85.432169][ T60] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.505860][ T60] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.381915][ T60] hsr_slave_0: left promiscuous mode [ 86.391028][ T60] hsr_slave_1: left promiscuous mode [ 86.401354][ T60] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 86.409254][ T60] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 86.418108][ T60] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 86.426271][ T60] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 86.434931][ T60] bridge_slave_1: left allmulticast mode [ 86.440707][ T60] bridge_slave_1: left promiscuous mode [ 86.451148][ T60] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.462440][ T60] bridge_slave_0: left allmulticast mode [ 86.469103][ T60] bridge_slave_0: left promiscuous mode [ 86.475191][ T60] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.493443][ T60] veth1_macvtap: left promiscuous mode [ 86.499202][ T60] veth0_macvtap: left promiscuous mode [ 86.505306][ T60] veth1_vlan: left promiscuous mode [ 86.510701][ T60] veth0_vlan: left promiscuous mode [ 86.523714][ T5860] Bluetooth: hci0: command tx timeout [ 86.846807][ T60] team0 (unregistering): Port device team_slave_1 removed [ 86.877676][ T60] team0 (unregistering): Port device team_slave_0 removed [ 86.906095][ T60] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 86.938255][ T60] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 87.210312][ T60] bond0 (unregistering): Released all slaves [ 87.302751][ T5898] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 87.314762][ T5898] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 87.328449][ T5898] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 87.341907][ T5898] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 87.441985][ T5898] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.460657][ T5898] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.490478][ T42] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.497705][ T42] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.507169][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.514386][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.700452][ T5898] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.740949][ T5898] veth0_vlan: entered promiscuous mode [ 87.761480][ T5898] veth1_vlan: entered promiscuous mode [ 87.811507][ T5898] veth0_macvtap: entered promiscuous mode [ 87.829756][ T5898] veth1_macvtap: entered promiscuous mode [ 87.858071][ T5898] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.880469][ T5898] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.909311][ T5898] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.918833][ T5898] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.928988][ T5898] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.938052][ T5898] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.042352][ T3455] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.051462][ T3455] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 2025/08/23 01:11:42 executed programs: 2 [ 88.086717][ T590] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.094971][ T590] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.144971][ T5945] syz.0.17[5945]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 88.427713][ T5945] loop0: detected capacity change from 0 to 32768 [ 88.467041][ T5945] [ 88.467041][ T5945] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 88.467041][ T5945] [ 88.487534][ T28] audit: type=1800 audit(1755911503.276:2): pid=5945 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.17" name="file1" dev="loop0" ino=4 res=0 errno=0 [ 88.510004][ T5945] [ 88.510004][ T5945] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 88.510004][ T5945] [ 88.535510][ T5945] [ 88.535510][ T5945] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 88.535510][ T5945] [ 88.565605][ T113] [ 88.565605][ T113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 88.565605][ T113] [ 88.581695][ T590] [ 88.581695][ T590] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 88.581695][ T590] [ 88.593555][ T590] [ 88.593555][ T590] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 88.593555][ T590] [ 88.604743][ T5860] Bluetooth: hci0: command tx timeout [ 88.609129][ T112] [ 88.609129][ T112] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 88.609129][ T112] [ 88.631291][ T5898] [ 88.631291][ T5898] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 88.631291][ T5898] [ 88.644779][ T5898] [ 88.644779][ T5898] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 88.644779][ T5898] [ 89.050188][ T5946] loop0: detected capacity change from 0 to 32768 [ 89.077540][ T5946] [ 89.077540][ T5946] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 89.077540][ T5946] [ 89.108380][ T5946] [ 89.108380][ T5946] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 89.108380][ T5946] [ 89.119721][ T28] audit: type=1800 audit(1755911503.896:3): pid=5946 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.18" name="file1" dev="loop0" ino=4 res=0 errno=0 [ 89.123286][ T5946] [ 89.123286][ T5946] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 89.123286][ T5946] [ 89.188378][ T112] [ 89.188378][ T112] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 89.188378][ T112] [ 89.202374][ T11] [ 89.202374][ T11] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 89.202374][ T11] [ 89.213569][ T11] [ 89.213569][ T11] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 89.213569][ T11] [ 89.226877][ T5898] [ 89.226877][ T5898] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 89.226877][ T5898] [ 89.241366][ T112] [ 89.241366][ T112] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 89.241366][ T112] [ 89.254936][ T5898] [ 89.254936][ T5898] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 89.254936][ T5898] [ 89.555820][ T5947] loop0: detected capacity change from 0 to 32768 [ 89.570724][ T5947] [ 89.570724][ T5947] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 89.570724][ T5947] [ 89.584815][ T28] audit: type=1800 audit(1755911504.376:4): pid=5947 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.19" name="file1" dev="loop0" ino=4 res=0 errno=0 [ 89.607047][ T5947] [ 89.607047][ T5947] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 89.607047][ T5947] [ 89.617793][ T5947] [ 89.617793][ T5947] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 89.617793][ T5947] [ 89.630629][ T113] [ 89.630629][ T113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 89.630629][ T113] [ 89.645087][ T60] [ 89.645087][ T60] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 89.645087][ T60] [ 89.655814][ T60] [ 89.655814][ T60] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 89.655814][ T60] [ 89.667317][ T5898] [ 89.667317][ T5898] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 89.667317][ T5898] [ 89.678554][ T112] [ 89.678554][ T112] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 89.678554][ T112] [ 89.690526][ T5898] [ 89.690526][ T5898] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 89.690526][ T5898] [ 89.983042][ T5948] loop0: detected capacity change from 0 to 32768 [ 90.021759][ T5948] [ 90.021759][ T5948] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 90.021759][ T5948] [ 90.048047][ T28] audit: type=1800 audit(1755911504.836:5): pid=5948 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.20" name="file1" dev="loop0" ino=4 res=0 errno=0 [ 90.073884][ T5948] [ 90.073884][ T5948] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 90.073884][ T5948] [ 90.092340][ T5948] [ 90.092340][ T5948] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 90.092340][ T5948] [ 90.104410][ T113] [ 90.104410][ T113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 90.104410][ T113] [ 90.121796][ T60] [ 90.121796][ T60] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 90.121796][ T60] [ 90.143320][ T60] [ 90.143320][ T60] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 90.143320][ T60] [ 90.162191][ T112] [ 90.162191][ T112] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 90.162191][ T112] [ 90.183991][ T5898] [ 90.183991][ T5898] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 90.183991][ T5898] [ 90.198272][ T5898] [ 90.198272][ T5898] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 90.198272][ T5898] [ 90.576123][ T5949] loop0: detected capacity change from 0 to 32768 [ 90.598212][ T5949] [ 90.598212][ T5949] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 90.598212][ T5949] [ 90.611758][ T28] audit: type=1800 audit(1755911505.406:6): pid=5949 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.21" name="file1" dev="loop0" ino=4 res=0 errno=0 [ 90.612167][ T5949] [ 90.612167][ T5949] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 90.612167][ T5949] [ 90.643755][ T5949] [ 90.643755][ T5949] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 90.643755][ T5949] [ 90.665741][ T113] [ 90.665741][ T113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 90.665741][ T113] [ 90.682916][ T1121] [ 90.682916][ T1121] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 90.682916][ T1121] [ 90.683395][ T5860] Bluetooth: hci0: command tx timeout [ 90.702029][ T1121] [ 90.702029][ T1121] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 90.702029][ T1121] [ 90.713458][ T5898] [ 90.713458][ T5898] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 90.713458][ T5898] [ 90.725534][ T113] [ 90.725534][ T113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 90.725534][ T113] [ 90.736818][ T5898] [ 90.736818][ T5898] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 90.736818][ T5898] [ 90.992515][ T5950] loop0: detected capacity change from 0 to 32768 [ 91.018608][ T5950] [ 91.018608][ T5950] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 91.018608][ T5950] [ 91.032275][ T28] audit: type=1800 audit(1755911505.826:7): pid=5950 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.22" name="file1" dev="loop0" ino=4 res=0 errno=0 [ 91.034317][ T5950] [ 91.034317][ T5950] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 91.034317][ T5950] [ 91.063761][ T5950] [ 91.063761][ T5950] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 91.063761][ T5950] [ 91.085092][ T112] [ 91.085092][ T112] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 91.085092][ T112] [ 91.102362][ T590] [ 91.102362][ T590] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 91.102362][ T590] [ 91.116992][ T590] [ 91.116992][ T590] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 91.116992][ T590] [ 91.129116][ T5898] [ 91.129116][ T5898] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 91.129116][ T5898] [ 91.142097][ T5898] [ 91.142097][ T5898] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 91.142097][ T5898] [ 91.165813][ T113] ================================================================== [ 91.174027][ T113] BUG: KASAN: slab-use-after-free in __mutex_lock+0x6cb/0xcc0 [ 91.181620][ T113] Read of size 8 at addr ffff88807e9d2908 by task jfsCommit/113 [ 91.189285][ T113] [ 91.191624][ T113] CPU: 1 PID: 113 Comm: jfsCommit Not tainted 6.6.102-syzkaller #0 [ 91.199536][ T113] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 91.209787][ T113] Call Trace: [ 91.213084][ T113] [ 91.216045][ T113] dump_stack_lvl+0x16c/0x230 [ 91.220923][ T113] ? __lock_acquire+0x7c80/0x7c80 [ 91.225970][ T113] ? show_regs_print_info+0x20/0x20 [ 91.231182][ T113] ? load_image+0x3b0/0x3b0 [ 91.235893][ T113] ? __virt_addr_valid+0x469/0x540 [ 91.244048][ T113] print_report+0xac/0x220 [ 91.248595][ T113] ? __mutex_lock+0x6cb/0xcc0 [ 91.253287][ T113] kasan_report+0x117/0x150 [ 91.257798][ T113] ? __mutex_lock+0x6cb/0xcc0 [ 91.262485][ T113] __mutex_lock+0x6cb/0xcc0 [ 91.267085][ T113] ? __mutex_lock+0x4e8/0xcc0 [ 91.271769][ T113] ? jfs_syncpt+0x25/0x90 [ 91.276104][ T113] ? mutex_lock_nested+0x20/0x20 [ 91.281051][ T113] ? __rwlock_init+0x150/0x150 [ 91.285828][ T113] jfs_syncpt+0x25/0x90 [ 91.290084][ T113] txEnd+0x2e5/0x520 [ 91.293995][ T113] jfs_lazycommit+0x5a6/0xa60 [ 91.298679][ T113] ? txFreelock+0x5a0/0x5a0 [ 91.303205][ T113] ? do_task_dead+0xd0/0xd0 [ 91.307796][ T113] ? __kthread_parkme+0x7a/0x1c0 [ 91.312754][ T113] kthread+0x2fa/0x390 [ 91.316827][ T113] ? txFreelock+0x5a0/0x5a0 [ 91.321539][ T113] ? kthread_blkcg+0xd0/0xd0 [ 91.326296][ T113] ret_from_fork+0x48/0x80 [ 91.330717][ T113] ? kthread_blkcg+0xd0/0xd0 [ 91.335397][ T113] ret_from_fork_asm+0x11/0x20 [ 91.340184][ T113] [ 91.343215][ T113] [ 91.345545][ T113] Allocated by task 5950: [ 91.349868][ T113] kasan_set_track+0x4e/0x70 [ 91.354551][ T113] __kasan_kmalloc+0x8f/0xa0 [ 91.359201][ T113] lmLogOpen+0x2df/0xfb0 [ 91.363549][ T113] jfs_mount_rw+0xea/0x670 [ 91.368075][ T113] jfs_fill_super+0x592/0xac0 [ 91.372857][ T113] mount_bdev+0x22b/0x2d0 [ 91.377191][ T113] legacy_get_tree+0xea/0x180 [ 91.381872][ T113] vfs_get_tree+0x8c/0x280 [ 91.386292][ T113] do_new_mount+0x24b/0xa40 [ 91.390966][ T113] __se_sys_mount+0x2da/0x3c0 [ 91.395740][ T113] do_syscall_64+0x55/0xb0 [ 91.400159][ T113] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 91.406151][ T113] [ 91.408475][ T113] Freed by task 5898: [ 91.412539][ T113] kasan_set_track+0x4e/0x70 [ 91.417224][ T113] kasan_save_free_info+0x2e/0x50 [ 91.422277][ T113] ____kasan_slab_free+0x126/0x1e0 [ 91.427485][ T113] slab_free_freelist_hook+0x130/0x1b0 [ 91.432951][ T113] __kmem_cache_free+0xba/0x1f0 [ 91.437982][ T113] lmLogClose+0x297/0x520 [ 91.442340][ T113] jfs_umount+0x2ef/0x3c0 [ 91.446765][ T113] jfs_put_super+0x8c/0x190 [ 91.451354][ T113] generic_shutdown_super+0x134/0x2b0 [ 91.456751][ T113] kill_block_super+0x44/0x90 [ 91.461436][ T113] deactivate_locked_super+0x97/0x100 [ 91.466905][ T113] cleanup_mnt+0x429/0x4c0 [ 91.471318][ T113] task_work_run+0x1ce/0x250 [ 91.476002][ T113] exit_to_user_mode_loop+0xe6/0x110 [ 91.481399][ T113] exit_to_user_mode_prepare+0xb1/0x140 [ 91.486955][ T113] syscall_exit_to_user_mode+0x1a/0x50 [ 91.492513][ T113] do_syscall_64+0x61/0xb0 [ 91.496932][ T113] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 91.502930][ T113] [ 91.505344][ T113] The buggy address belongs to the object at ffff88807e9d2800 [ 91.505344][ T113] which belongs to the cache kmalloc-1k of size 1024 [ 91.519404][ T113] The buggy address is located 264 bytes inside of [ 91.519404][ T113] freed 1024-byte region [ffff88807e9d2800, ffff88807e9d2c00) [ 91.533373][ T113] [ 91.535743][ T113] The buggy address belongs to the physical page: [ 91.542324][ T113] page:ffffea0001fa7400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7e9d0 [ 91.552733][ T113] head:ffffea0001fa7400 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 91.561663][ T113] anon flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 91.570077][ T113] page_type: 0xffffffff() [ 91.574496][ T113] raw: 00fff00000000840 ffff888017841dc0 0000000000000000 dead000000000001 [ 91.583089][ T113] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 91.591667][ T113] page dumped because: kasan: bad access detected [ 91.598086][ T113] page_owner tracks the page as allocated [ 91.603883][ T113] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 20324978414, free_ts 20070415113 [ 91.624558][ T113] post_alloc_hook+0x1cd/0x210 [ 91.629431][ T113] get_page_from_freelist+0x195c/0x19f0 [ 91.634996][ T113] __alloc_pages+0x1e3/0x460 [ 91.639686][ T113] alloc_page_interleave+0x24/0x1e0 [ 91.644915][ T113] alloc_slab_page+0x5d/0x170 [ 91.649599][ T113] new_slab+0x87/0x2e0 [ 91.653674][ T113] ___slab_alloc+0xc6d/0x12f0 [ 91.658467][ T113] __kmem_cache_alloc_node+0x1a2/0x260 [ 91.664399][ T113] __kmalloc+0xa4/0x240 [ 91.668575][ T113] mpi_powm+0x1173/0x2340 [ 91.672992][ T113] rsa_enc+0x291/0x3d0 [ 91.677065][ T113] pkcs1pad_verify+0x424/0x600 [ 91.681919][ T113] crypto_sig_verify+0x18f/0x1f0 [ 91.687043][ T113] public_key_verify_signature+0x5d6/0x810 [ 91.692859][ T113] x509_check_for_self_signed+0x322/0x430 [ 91.698669][ T113] x509_cert_parse+0x5a8/0x7b0 [ 91.703443][ T113] page last free stack trace: [ 91.708110][ T113] free_unref_page_prepare+0x7ce/0x8e0 [ 91.713575][ T113] free_unref_page+0x32/0x2e0 [ 91.718259][ T113] free_contig_range+0xa1/0x160 [ 91.723121][ T113] destroy_args+0x87/0x770 [ 91.727562][ T113] debug_vm_pgtable+0x3cc/0x410 [ 91.732505][ T113] do_one_initcall+0x1fd/0x750 [ 91.737276][ T113] do_initcall_level+0x137/0x1f0 [ 91.742225][ T113] do_initcalls+0x69/0xd0 [ 91.746651][ T113] kernel_init_freeable+0x3d2/0x570 [ 91.751862][ T113] kernel_init+0x1d/0x1c0 [ 91.756193][ T113] ret_from_fork+0x48/0x80 [ 91.760622][ T113] ret_from_fork_asm+0x11/0x20 [ 91.765416][ T113] [ 91.767743][ T113] Memory state around the buggy address: [ 91.773384][ T113] ffff88807e9d2800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 91.781561][ T113] ffff88807e9d2880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 91.789624][ T113] >ffff88807e9d2900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 91.797689][ T113] ^ [ 91.802334][ T113] ffff88807e9d2980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 91.810498][ T113] ffff88807e9d2a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 91.818645][ T113] ================================================================== [ 91.827544][ T113] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 91.834795][ T113] CPU: 1 PID: 113 Comm: jfsCommit Not tainted 6.6.102-syzkaller #0 [ 91.842904][ T113] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 91.853425][ T113] Call Trace: [ 91.856761][ T113] [ 91.859726][ T113] dump_stack_lvl+0x16c/0x230 [ 91.864447][ T113] ? show_regs_print_info+0x20/0x20 [ 91.869676][ T113] ? load_image+0x3b0/0x3b0 [ 91.874218][ T113] panic+0x2c0/0x710 [ 91.878150][ T113] ? bpf_jit_dump+0xd0/0xd0 [ 91.882689][ T113] ? _raw_spin_unlock_irqrestore+0xa9/0x110 [ 91.889075][ T113] ? _raw_spin_unlock_irqrestore+0xae/0x110 [ 91.895095][ T113] ? _raw_spin_unlock+0x40/0x40 [ 91.899976][ T113] ? print_memory_metadata+0x314/0x400 [ 91.905460][ T113] ? __mutex_lock+0x6cb/0xcc0 [ 91.910164][ T113] check_panic_on_warn+0x84/0xa0 [ 91.915140][ T113] ? __mutex_lock+0x6cb/0xcc0 [ 91.919867][ T113] end_report+0x6f/0x140 [ 91.924231][ T113] kasan_report+0x128/0x150 [ 91.928771][ T113] ? __mutex_lock+0x6cb/0xcc0 [ 91.933503][ T113] __mutex_lock+0x6cb/0xcc0 [ 91.938048][ T113] ? __mutex_lock+0x4e8/0xcc0 [ 91.942756][ T113] ? jfs_syncpt+0x25/0x90 [ 91.947465][ T113] ? mutex_lock_nested+0x20/0x20 [ 91.952695][ T113] ? __rwlock_init+0x150/0x150 [ 91.957568][ T113] jfs_syncpt+0x25/0x90 [ 91.961734][ T113] txEnd+0x2e5/0x520 [ 91.965639][ T113] jfs_lazycommit+0x5a6/0xa60 [ 91.970323][ T113] ? txFreelock+0x5a0/0x5a0 [ 91.974842][ T113] ? do_task_dead+0xd0/0xd0 [ 91.979349][ T113] ? __kthread_parkme+0x7a/0x1c0 [ 91.984303][ T113] kthread+0x2fa/0x390 [ 91.988369][ T113] ? txFreelock+0x5a0/0x5a0 [ 91.992883][ T113] ? kthread_blkcg+0xd0/0xd0 [ 91.997563][ T113] ret_from_fork+0x48/0x80 [ 92.001984][ T113] ? kthread_blkcg+0xd0/0xd0 [ 92.006579][ T113] ret_from_fork_asm+0x11/0x20 [ 92.011525][ T113] [ 92.014849][ T113] Kernel Offset: disabled [ 92.019205][ T113] Rebooting in 86400 seconds..