Warning: Permanently added '[localhost]:24444' (ED25519) to the list of known hosts.
2025/10/26 16:55:42 parsed 1 programs
syzkaller login: [ 83.525289][ T5313] cgroup: Unknown subsys name 'net'
[ 83.615740][ T5313] cgroup: Unknown subsys name 'cpuset'
[ 83.620962][ T5313] cgroup: Unknown subsys name 'rlimit'
[ 85.168253][ T5313] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 88.949890][ T5327] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 89.135598][ T5335] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 89.139359][ T5335] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 89.143340][ T5335] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 89.149819][ T5335] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 89.156101][ T5335] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 89.537825][ T1098] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 89.541075][ T1098] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 89.573940][ T1092] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 89.577304][ T1092] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 91.761021][ T5367] chnl_net:caif_netlink_parms(): no params data found
[ 91.826897][ T5367] bridge0: port 1(bridge_slave_0) entered blocking state
[ 91.830577][ T5367] bridge0: port 1(bridge_slave_0) entered disabled state
[ 91.833907][ T5367] bridge_slave_0: entered allmulticast mode
[ 91.837818][ T5367] bridge_slave_0: entered promiscuous mode
[ 91.843525][ T5367] bridge0: port 2(bridge_slave_1) entered blocking state
[ 91.846606][ T5367] bridge0: port 2(bridge_slave_1) entered disabled state
[ 91.849742][ T5367] bridge_slave_1: entered allmulticast mode
[ 91.853902][ T5367] bridge_slave_1: entered promiscuous mode
[ 91.877963][ T5367] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 91.884630][ T5367] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 91.907373][ T5367] team0: Port device team_slave_0 added
[ 91.911823][ T5367] team0: Port device team_slave_1 added
[ 91.925993][ T55] cfg80211: failed to load regulatory.db
[ 91.944245][ T5367] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 91.947280][ T5367] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 91.958579][ T5367] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 91.965966][ T5367] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 91.968785][ T5367] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 91.979423][ T5367] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 92.011794][ T5367] hsr_slave_0: entered promiscuous mode
[ 92.015154][ T5367] hsr_slave_1: entered promiscuous mode
[ 92.151921][ T5367] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 92.163085][ T5367] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 92.169381][ T5367] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 92.181098][ T5367] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 92.207547][ T5367] bridge0: port 2(bridge_slave_1) entered blocking state
[ 92.210690][ T5367] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 92.214521][ T5367] bridge0: port 1(bridge_slave_0) entered blocking state
[ 92.217644][ T5367] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 92.270714][ T5367] 8021q: adding VLAN 0 to HW filter on device bond0
[ 92.286937][ T1092] bridge0: port 1(bridge_slave_0) entered disabled state
[ 92.291026][ T1092] bridge0: port 2(bridge_slave_1) entered disabled state
[ 92.304238][ T5367] 8021q: adding VLAN 0 to HW filter on device team0
[ 92.315258][ T1092] bridge0: port 1(bridge_slave_0) entered blocking state
[ 92.318733][ T1092] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 92.328884][ T1092] bridge0: port 2(bridge_slave_1) entered blocking state
[ 92.332029][ T1092] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 92.506620][ T5367] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 92.547164][ T5367] veth0_vlan: entered promiscuous mode
[ 92.557932][ T5367] veth1_vlan: entered promiscuous mode
[ 92.586309][ T5367] veth0_macvtap: entered promiscuous mode
[ 92.593803][ T5367] veth1_macvtap: entered promiscuous mode
[ 92.611005][ T5367] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 92.623599][ T5367] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 92.634430][ T1098] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 92.645573][ T1098] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 92.648933][ T1098] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 92.664081][ T1098] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 92.794001][ T1098] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 92.844167][ T1098] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 92.883302][ T1098] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 92.930333][ T1098] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2025/10/26 16:55:55 executed programs: 0
[ 94.075525][ T4671] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 94.078960][ T4671] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 94.081817][ T4671] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 94.088514][ T4671] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 94.091848][ T4671] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 94.254568][ T5421] chnl_net:caif_netlink_parms(): no params data found
[ 94.327923][ T5421] bridge0: port 1(bridge_slave_0) entered blocking state
[ 94.331190][ T5421] bridge0: port 1(bridge_slave_0) entered disabled state
[ 94.335722][ T5421] bridge_slave_0: entered allmulticast mode
[ 94.339295][ T5421] bridge_slave_0: entered promiscuous mode
[ 94.344236][ T5421] bridge0: port 2(bridge_slave_1) entered blocking state
[ 94.347350][ T5421] bridge0: port 2(bridge_slave_1) entered disabled state
[ 94.350962][ T5421] bridge_slave_1: entered allmulticast mode
[ 94.355537][ T5421] bridge_slave_1: entered promiscuous mode
[ 94.378528][ T5421] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 94.385171][ T5421] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 94.409349][ T5421] team0: Port device team_slave_0 added
[ 94.414357][ T5421] team0: Port device team_slave_1 added
[ 94.434822][ T5421] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 94.437713][ T5421] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 94.448855][ T5421] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 94.455102][ T5421] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 94.457897][ T5421] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 94.469314][ T5421] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 94.502970][ T5421] hsr_slave_0: entered promiscuous mode
[ 94.506677][ T5421] hsr_slave_1: entered promiscuous mode
[ 94.509495][ T5421] debugfs: 'hsr0' already exists in 'hsr'
[ 94.511982][ T5421] Cannot create hsr debugfs directory
[ 95.328370][ T1098] bridge_slave_1: left allmulticast mode
[ 95.330963][ T1098] bridge_slave_1: left promiscuous mode
[ 95.335684][ T1098] bridge0: port 2(bridge_slave_1) entered disabled state
[ 95.348224][ T1098] bridge_slave_0: left allmulticast mode
[ 95.350605][ T1098] bridge_slave_0: left promiscuous mode
[ 95.360901][ T1098] bridge0: port 1(bridge_slave_0) entered disabled state
[ 95.738351][ T1098] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 95.746629][ T1098] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 95.751319][ T1098] bond0 (unregistering): Released all slaves
[ 95.836388][ T1098] hsr_slave_0: left promiscuous mode
[ 95.839488][ T1098] hsr_slave_1: left promiscuous mode
[ 95.844700][ T1098] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 95.848020][ T1098] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 95.851949][ T1098] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 95.859866][ T1098] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 95.871057][ T1098] veth1_macvtap: left promiscuous mode
[ 95.874842][ T1098] veth0_macvtap: left promiscuous mode
[ 95.877366][ T1098] veth1_vlan: left promiscuous mode
[ 95.879781][ T1098] veth0_vlan: left promiscuous mode
[ 96.163406][ T5335] Bluetooth: hci0: command tx timeout
[ 96.168794][ T1098] team0 (unregistering): Port device team_slave_1 removed
[ 96.187644][ T1098] team0 (unregistering): Port device team_slave_0 removed
[ 96.666287][ T5421] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 96.678330][ T5421] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 96.696061][ T5421] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 96.717299][ T5421] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 97.337967][ T5421] 8021q: adding VLAN 0 to HW filter on device bond0
[ 97.403077][ T5421] 8021q: adding VLAN 0 to HW filter on device team0
[ 97.411247][ T1041] bridge0: port 1(bridge_slave_0) entered blocking state
[ 97.414525][ T1041] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 97.444415][ T1041] bridge0: port 2(bridge_slave_1) entered blocking state
[ 97.447354][ T1041] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 97.518421][ T5421] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 97.672801][ T5421] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 97.711346][ T5421] veth0_vlan: entered promiscuous mode
[ 97.720105][ T5421] veth1_vlan: entered promiscuous mode
[ 97.748381][ T5421] veth0_macvtap: entered promiscuous mode
[ 97.755223][ T5421] veth1_macvtap: entered promiscuous mode
[ 97.769515][ T5421] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 97.780307][ T5421] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 97.789989][ T1041] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 97.795523][ T1041] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 97.799279][ T1041] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 97.817969][ T1041] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 97.868622][ T1041] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 97.871846][ T1041] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 97.901620][ T1098] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 97.908257][ T1098] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 97.956518][ T5451] loop0: detected capacity change from 0 to 512
[ 97.968974][ T5451] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support!
[ 97.983238][ T5451] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 98.011074][ T5451] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2853: Unable to expand inode 15. Delete some EAs or run e2fsck.
[ 98.022817][ T5451] EXT4-fs (loop0): 1 truncate cleaned up
[ 98.026359][ T5451] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[ 98.045146][ T5451] ==================================================================
[ 98.048431][ T5451] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x8e9/0x1e20
[ 98.051671][ T5451] Read of size 18446744073709551572 at addr ffff888011bb1850 by task syz.0.17/5451
[ 98.056884][ T5451]
[ 98.057955][ T5451] CPU: 0 UID: 0 PID: 5451 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 98.057969][ T5451] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 98.057975][ T5451] Call Trace:
[ 98.057983][ T5451]
[ 98.057988][ T5451] dump_stack_lvl+0x189/0x250
[ 98.058005][ T5451] ? __kasan_check_byte+0x12/0x40
[ 98.058020][ T5451] ? __pfx_dump_stack_lvl+0x10/0x10
[ 98.058032][ T5451] ? lock_release+0x4b/0x3e0
[ 98.058043][ T5451] ? __virt_addr_valid+0x4a5/0x5c0
[ 98.058057][ T5451] print_report+0xca/0x240
[ 98.058069][ T5451] ? ext4_xattr_set_entry+0x8e9/0x1e20
[ 98.058082][ T5451] kasan_report+0x118/0x150
[ 98.058095][ T5451] ? ext4_xattr_set_entry+0x8e9/0x1e20
[ 98.058110][ T5451] ? ext4_xattr_set_entry+0x8e9/0x1e20
[ 98.058122][ T5451] kasan_check_range+0x2b0/0x2c0
[ 98.058134][ T5451] ? ext4_xattr_set_entry+0x8e9/0x1e20
[ 98.058146][ T5451] __asan_memmove+0x29/0x70
[ 98.058157][ T5451] ext4_xattr_set_entry+0x8e9/0x1e20
[ 98.058175][ T5451] ext4_xattr_block_set+0x872/0x2ac0
[ 98.058189][ T5451] ? fs_reclaim_acquire+0x7d/0x100
[ 98.058206][ T5451] ? __pfx_check_xattrs+0x10/0x10
[ 98.058221][ T5451] ? __pfx_ext4_xattr_block_set+0x10/0x10
[ 98.058234][ T5451] ? ext4_xattr_block_find+0x2d4/0x350
[ 98.058248][ T5451] ext4_expand_extra_isize_ea+0x12da/0x1ea0
[ 98.058270][ T5451] __ext4_expand_extra_isize+0x30d/0x400
[ 98.058281][ T5451] __ext4_mark_inode_dirty+0x46c/0x700
[ 98.058296][ T5451] __ext4_unlink+0x631/0xab0
[ 98.058310][ T5451] ? __pfx___ext4_unlink+0x10/0x10
[ 98.058323][ T5451] ? __pfx___dquot_initialize+0x10/0x10
[ 98.058334][ T5451] ? down_write+0x162/0x1f0
[ 98.058415][ T5451] ext4_unlink+0x216/0x5d0
[ 98.058426][ T5451] vfs_unlink+0x394/0x650
[ 98.058440][ T5451] do_unlinkat+0x345/0x560
[ 98.058452][ T5451] ? __pfx_do_unlinkat+0x10/0x10
[ 98.058463][ T5451] ? strncpy_from_user+0x150/0x290
[ 98.058476][ T5451] ? getname_flags+0x1e5/0x540
[ 98.058490][ T5451] __x64_sys_unlink+0x47/0x50
[ 98.058501][ T5451] do_syscall_64+0xfa/0xfa0
[ 98.058512][ T5451] ? lockdep_hardirqs_on+0x9c/0x150
[ 98.058522][ T5451] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 98.058532][ T5451] ? clear_bhb_loop+0x60/0xb0
[ 98.058544][ T5451] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 98.058554][ T5451] RIP: 0033:0x7f5a6918efc9
[ 98.058564][ T5451] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 98.058572][ T5451] RSP: 002b:00007ffeef04eb78 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
[ 98.058584][ T5451] RAX: ffffffffffffffda RBX: 00007f5a693e5fa0 RCX: 00007f5a6918efc9
[ 98.058590][ T5451] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000180
[ 98.058597][ T5451] RBP: 00007f5a69211f91 R08: 0000000000000000 R09: 0000000000000000
[ 98.058603][ T5451] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 98.058609][ T5451] R13: 00007f5a693e5fa0 R14: 00007f5a693e5fa0 R15: 0000000000000001
[ 98.058620][ T5451]
[ 98.058624][ T5451]
[ 98.185543][ T5451] Allocated by task 5451:
[ 98.187532][ T5451] kasan_save_track+0x3e/0x80
[ 98.189636][ T5451] __kasan_kmalloc+0x93/0xb0
[ 98.191710][ T5451] __kmalloc_node_track_caller_noprof+0x568/0x800
[ 98.194869][ T5451] kmemdup_noprof+0x2b/0x70
[ 98.197089][ T5451] ext4_xattr_block_set+0x781/0x2ac0
[ 98.199679][ T5451] ext4_expand_extra_isize_ea+0x12da/0x1ea0
[ 98.202528][ T5451] __ext4_expand_extra_isize+0x30d/0x400
[ 98.205148][ T5451] __ext4_mark_inode_dirty+0x46c/0x700
[ 98.207441][ T5451] __ext4_unlink+0x631/0xab0
[ 98.209354][ T5451] ext4_unlink+0x216/0x5d0
[ 98.211285][ T5451] vfs_unlink+0x394/0x650
[ 98.213139][ T5451] do_unlinkat+0x345/0x560
[ 98.215058][ T5451] __x64_sys_unlink+0x47/0x50
[ 98.217099][ T5451] do_syscall_64+0xfa/0xfa0
[ 98.219154][ T5451] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 98.221640][ T5451]
[ 98.222699][ T5451] The buggy address belongs to the object at ffff888011bb1800
[ 98.222699][ T5451] which belongs to the cache kmalloc-1k of size 1024
[ 98.228657][ T5451] The buggy address is located 80 bytes inside of
[ 98.228657][ T5451] 1024-byte region [ffff888011bb1800, ffff888011bb1c00)
[ 98.234257][ T5451]
[ 98.235336][ T5451] The buggy address belongs to the physical page:
[ 98.238108][ T5451] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11bb0
[ 98.241765][ T5451] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 98.245465][ T5451] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 98.248715][ T5451] page_type: f5(slab)
[ 98.250362][ T5451] raw: 00fff00000000040 ffff88801a041dc0 dead000000000122 0000000000000000
[ 98.253999][ T5451] raw: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000
[ 98.257866][ T5451] head: 00fff00000000040 ffff88801a041dc0 dead000000000122 0000000000000000
[ 98.261531][ T5451] head: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000
[ 98.265201][ T5451] head: 00fff00000000002 ffffea000046ec01 00000000ffffffff 00000000ffffffff
[ 98.268896][ T5451] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[ 98.272633][ T5451] page dumped because: kasan: bad access detected
[ 98.275381][ T5451] page_owner tracks the page as allocated
[ 98.278048][ T5451] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 5451, tgid 5451 (syz.0.17), ts 98031645820, free_ts 86490994198
[ 98.285993][ T5451] post_alloc_hook+0x240/0x2a0
[ 98.288008][ T5451] get_page_from_freelist+0x2365/0x2440
[ 98.290246][ T5451] __alloc_pages_slowpath+0x30b/0xcf0
[ 98.292433][ T5451] __alloc_frozen_pages_noprof+0x319/0x370
[ 98.294924][ T5451] allocate_slab+0x71/0x350
[ 98.296866][ T5451] ___slab_alloc+0xe94/0x18a0
[ 98.299038][ T5451] __slab_alloc+0x65/0x100
[ 98.301071][ T5451] __kmalloc_node_noprof+0x5cc/0x800
[ 98.303512][ T5451] alloc_slab_obj_exts+0x3e/0x100
[ 98.305779][ T5451] __memcg_slab_post_alloc_hook+0x31d/0x7d0
[ 98.308393][ T5451] __kmalloc_node_track_caller_noprof+0x5e6/0x800
[ 98.311210][ T5451] kstrdup+0x42/0x100
[ 98.312963][ T5451] alloc_vfsmnt+0xeb/0x430
[ 98.314906][ T5451] vfs_create_mount+0x69/0x320
[ 98.316894][ T5451] do_new_mount+0x390/0xa10
[ 98.318620][ T5451] __se_sys_mount+0x313/0x410
[ 98.320747][ T5451] page last free pid 5314 tgid 5307 stack trace:
[ 98.323459][ T5451] __free_frozen_pages+0xbc4/0xd30
[ 98.325672][ T5451] stack_depot_save_flags+0x436/0x860
[ 98.327966][ T5451] kasan_save_track+0x4f/0x80
[ 98.329978][ T5451] __kasan_slab_alloc+0x6c/0x80
[ 98.332153][ T5451] kmem_cache_alloc_node_noprof+0x433/0x710
[ 98.334706][ T5451] __alloc_skb+0x112/0x2d0
[ 98.336648][ T5451] skb_segment+0xf4d/0x3f90
[ 98.338429][ T5451] tcp_gso_segment+0x423/0x1a40
[ 98.340577][ T5451] inet_gso_segment+0x661/0x1530
[ 98.342818][ T5451] skb_mac_gso_segment+0x31f/0x640
[ 98.344999][ T5451] __skb_gso_segment+0x376/0x540
[ 98.347069][ T5451] validate_xmit_skb+0x8de/0x1270
[ 98.349102][ T5451] __dev_queue_xmit+0x1612/0x3b50
[ 98.351289][ T5451] ip_finish_output2+0xd03/0x1160
[ 98.353537][ T5451] ip_output+0x29f/0x450
[ 98.355434][ T5451] __ip_queue_xmit+0x118d/0x1c30
[ 98.357617][ T5451]
[ 98.358660][ T5451] Memory state around the buggy address:
[ 98.361070][ T5451] ffff888011bb1700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 98.364361][ T5451] ffff888011bb1780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 98.367849][ T5451] >ffff888011bb1800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 98.371332][ T5451] ^
[ 98.374162][ T5451] ffff888011bb1880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 98.377683][ T5451] ffff888011bb1900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 98.381075][ T5451] ==================================================================
[ 98.385893][ T5335] Bluetooth: hci0: command tx timeout
[ 98.407629][ T5451] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 98.410649][ T5451] CPU: 0 UID: 0 PID: 5451 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 98.414637][ T5451] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 98.419315][ T5451] Call Trace:
[ 98.420852][ T5451]
[ 98.422234][ T5451] dump_stack_lvl+0x99/0x250
[ 98.424292][ T5451] ? __asan_memcpy+0x40/0x70
[ 98.426313][ T5451] ? __pfx_dump_stack_lvl+0x10/0x10
[ 98.428515][ T5451] ? __pfx__printk+0x10/0x10
[ 98.430453][ T5451] vpanic+0x237/0x6d0
[ 98.432129][ T5451] ? __pfx_vpanic+0x10/0x10
[ 98.433991][ T5451] ? preempt_schedule+0xae/0xc0
[ 98.436082][ T5451] ? __pfx_preempt_schedule+0x10/0x10
[ 98.438443][ T5451] panic+0xb9/0xc0
[ 98.440122][ T5451] ? __pfx_panic+0x10/0x10
[ 98.442119][ T5451] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 98.444764][ T5451] ? ext4_xattr_set_entry+0x8e9/0x1e20
[ 98.447226][ T5451] check_panic_on_warn+0x89/0xb0
[ 98.449497][ T5451] ? ext4_xattr_set_entry+0x8e9/0x1e20
[ 98.451766][ T5451] end_report+0x78/0x160
[ 98.453625][ T5451] kasan_report+0x129/0x150
[ 98.455587][ T5451] ? ext4_xattr_set_entry+0x8e9/0x1e20
[ 98.457936][ T5451] ? ext4_xattr_set_entry+0x8e9/0x1e20
[ 98.460295][ T5451] kasan_check_range+0x2b0/0x2c0
[ 98.462388][ T5451] ? ext4_xattr_set_entry+0x8e9/0x1e20
[ 98.464682][ T5451] __asan_memmove+0x29/0x70
[ 98.466485][ T5451] ext4_xattr_set_entry+0x8e9/0x1e20
[ 98.468619][ T5451] ext4_xattr_block_set+0x872/0x2ac0
[ 98.470754][ T5451] ? fs_reclaim_acquire+0x7d/0x100
[ 98.472953][ T5451] ? __pfx_check_xattrs+0x10/0x10
[ 98.475133][ T5451] ? __pfx_ext4_xattr_block_set+0x10/0x10
[ 98.477654][ T5451] ? ext4_xattr_block_find+0x2d4/0x350
[ 98.480037][ T5451] ext4_expand_extra_isize_ea+0x12da/0x1ea0
[ 98.482543][ T5451] __ext4_expand_extra_isize+0x30d/0x400
[ 98.485014][ T5451] __ext4_mark_inode_dirty+0x46c/0x700
[ 98.487458][ T5451] __ext4_unlink+0x631/0xab0
[ 98.489557][ T5451] ? __pfx___ext4_unlink+0x10/0x10
[ 98.491807][ T5451] ? __pfx___dquot_initialize+0x10/0x10
[ 98.494241][ T5451] ? down_write+0x162/0x1f0
[ 98.496237][ T5451] ext4_unlink+0x216/0x5d0
[ 98.498169][ T5451] vfs_unlink+0x394/0x650
[ 98.500053][ T5451] do_unlinkat+0x345/0x560
[ 98.501950][ T5451] ? __pfx_do_unlinkat+0x10/0x10
[ 98.504138][ T5451] ? strncpy_from_user+0x150/0x290
[ 98.506302][ T5451] ? getname_flags+0x1e5/0x540
[ 98.508414][ T5451] __x64_sys_unlink+0x47/0x50
[ 98.510506][ T5451] do_syscall_64+0xfa/0xfa0
[ 98.512494][ T5451] ? lockdep_hardirqs_on+0x9c/0x150
[ 98.514795][ T5451] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 98.517537][ T5451] ? clear_bhb_loop+0x60/0xb0
[ 98.519670][ T5451] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 98.522273][ T5451] RIP: 0033:0x7f5a6918efc9
[ 98.524259][ T5451] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 98.532234][ T5451] RSP: 002b:00007ffeef04eb78 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
[ 98.535656][ T5451] RAX: ffffffffffffffda RBX: 00007f5a693e5fa0 RCX: 00007f5a6918efc9
[ 98.538990][ T5451] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000180
[ 98.542356][ T5451] RBP: 00007f5a69211f91 R08: 0000000000000000 R09: 0000000000000000
[ 98.545810][ T5451] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 98.549188][ T5451] R13: 00007f5a693e5fa0 R14: 00007f5a693e5fa0 R15: 0000000000000001
[ 98.552356][ T5451]
[ 98.553979][ T5451] Kernel Offset: disabled
[ 98.555852][ T5451] Rebooting in 86400 seconds..
VM DIAGNOSIS:
16:55:59 Registers:
info registers vcpu 0
CPU#0
RAX=0000000000000031 RBX=0000000000000031 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90002adeeb0
R8 =ffff888033940237 R9 =1ffff11006728046 R10=dffffc0000000000 R11=ffffffff851660a0
R12=dffffc0000000000 R13=ffffffff997e1905 R14=ffffffff99af5320 R15=0000000000000000
RIP=ffffffff8516611c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000555558f61500 ffffffff 00c00000
GS =0000 ffff88808d733000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=000020000000f000 CR3=0000000045eb2000 CR4=00352ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=0000000008000100 Opmask01=0000000000000000 Opmask02=00000000ffffffef Opmask03=0000000000000000
Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffeef04ee50 0000003000000018
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 00000000ffffffff
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 00000000ffffffff
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f5a69212fdb
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f5a69212fe8
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f5a69212fe2
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f5a69212ff6
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f5a6921307c
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f5a6921315a
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000