[ 91.985411][ T806] cfg80211: failed to load regulatory.db Warning: Permanently added '10.128.0.118' (ED25519) to the list of known hosts. 2026/02/11 09:50:09 parsed 1 programs [ 102.593194][ T5806] cgroup: Unknown subsys name 'net' [ 102.833777][ T5806] cgroup: Unknown subsys name 'cpuset' [ 102.888507][ T5806] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 104.822161][ T5806] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 110.210996][ T5836] chnl_net:caif_netlink_parms(): no params data found [ 110.341175][ T5836] bridge0: port 1(bridge_slave_0) entered blocking state [ 110.342266][ T5836] bridge0: port 1(bridge_slave_0) entered disabled state [ 110.342386][ T5836] bridge_slave_0: entered allmulticast mode [ 110.344335][ T5836] bridge_slave_0: entered promiscuous mode [ 110.352105][ T5836] bridge0: port 2(bridge_slave_1) entered blocking state [ 110.352384][ T5836] bridge0: port 2(bridge_slave_1) entered disabled state [ 110.352629][ T5836] bridge_slave_1: entered allmulticast mode [ 110.356774][ T5836] bridge_slave_1: entered promiscuous mode [ 110.425816][ T5836] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 110.433918][ T5836] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 110.550459][ T5836] team0: Port device team_slave_0 added [ 110.553306][ T5836] team0: Port device team_slave_1 added [ 110.620272][ T5836] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 110.620287][ T5836] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 110.620307][ T5836] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 110.672733][ T5836] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 110.672750][ T5836] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 110.672779][ T5836] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 110.762447][ T5836] hsr_slave_0: entered promiscuous mode [ 110.763560][ T5836] hsr_slave_1: entered promiscuous mode [ 111.235346][ T5836] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 111.266570][ T5836] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 111.283219][ T5836] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 111.323108][ T5836] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 111.464786][ T5836] 8021q: adding VLAN 0 to HW filter on device bond0 [ 111.491981][ T5836] 8021q: adding VLAN 0 to HW filter on device team0 [ 111.507536][ T1414] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.515026][ T1414] bridge0: port 1(bridge_slave_0) entered forwarding state [ 111.533933][ T1414] bridge0: port 2(bridge_slave_1) entered blocking state [ 111.534112][ T1414] bridge0: port 2(bridge_slave_1) entered forwarding state [ 111.769166][ T5836] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 111.821953][ T5836] veth0_vlan: entered promiscuous mode [ 111.831051][ T5836] veth1_vlan: entered promiscuous mode [ 111.870839][ T5836] veth0_macvtap: entered promiscuous mode [ 111.874890][ T5836] veth1_macvtap: entered promiscuous mode [ 111.900485][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.917285][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.939823][ T1151] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.942067][ T1151] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.942114][ T1151] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.942153][ T1151] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.339892][ T5111] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 112.344071][ T5111] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 112.344876][ T5111] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 112.346502][ T5111] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 112.347229][ T5111] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 112.751891][ T1414] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 113.034294][ T1414] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 113.310375][ T1414] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 114.263006][ T1414] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.233166][ T1414] bridge_slave_1: left allmulticast mode [ 115.233312][ T1414] bridge_slave_1: left promiscuous mode [ 115.234954][ T1414] bridge0: port 2(bridge_slave_1) entered disabled state [ 115.329081][ T1414] bridge_slave_0: left allmulticast mode [ 115.329104][ T1414] bridge_slave_0: left promiscuous mode [ 115.329284][ T1414] bridge0: port 1(bridge_slave_0) entered disabled state [ 116.708881][ T1414] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 116.768620][ T1414] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 116.790754][ T1414] bond0 (unregistering): Released all slaves [ 117.127978][ T1414] hsr_slave_0: left promiscuous mode [ 117.171281][ T1414] hsr_slave_1: left promiscuous mode [ 117.172499][ T1414] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 117.172580][ T1414] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 117.219931][ T1414] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 117.219961][ T1414] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 117.312543][ T1414] veth1_macvtap: left promiscuous mode [ 117.312769][ T1414] veth0_macvtap: left promiscuous mode [ 117.313058][ T1414] veth1_vlan: left promiscuous mode [ 117.313350][ T1414] veth0_vlan: left promiscuous mode [ 119.568647][ T1414] team0 (unregistering): Port device team_slave_1 removed [ 119.839128][ T1414] team0 (unregistering): Port device team_slave_0 removed [ 121.659055][ T3504] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.659078][ T3504] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.739407][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.739431][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2026/02/11 09:50:33 executed programs: 0 [ 122.915274][ T60] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 122.916815][ T60] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 122.917632][ T60] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 122.941019][ T60] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 122.941805][ T60] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 123.908589][ T5940] chnl_net:caif_netlink_parms(): no params data found [ 124.115401][ T5940] bridge0: port 1(bridge_slave_0) entered blocking state [ 124.115598][ T5940] bridge0: port 1(bridge_slave_0) entered disabled state [ 124.115770][ T5940] bridge_slave_0: entered allmulticast mode [ 124.139286][ T5940] bridge_slave_0: entered promiscuous mode [ 124.143517][ T5940] bridge0: port 2(bridge_slave_1) entered blocking state [ 124.143724][ T5940] bridge0: port 2(bridge_slave_1) entered disabled state [ 124.143892][ T5940] bridge_slave_1: entered allmulticast mode [ 124.146683][ T5940] bridge_slave_1: entered promiscuous mode [ 124.239874][ T5940] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 124.244346][ T5940] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 124.327053][ T5940] team0: Port device team_slave_0 added [ 124.340272][ T5940] team0: Port device team_slave_1 added [ 124.399096][ T5940] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 124.399114][ T5940] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 124.399140][ T5940] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 124.401706][ T5940] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 124.401729][ T5940] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 124.401756][ T5940] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 124.557505][ T5940] hsr_slave_0: entered promiscuous mode [ 124.565127][ T5940] hsr_slave_1: entered promiscuous mode [ 125.019854][ T60] Bluetooth: hci0: command tx timeout [ 127.097838][ T60] Bluetooth: hci0: command tx timeout [ 127.201809][ T5940] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 127.388324][ T5940] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 127.453229][ T5940] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 127.523183][ T5940] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 127.823474][ T5940] 8021q: adding VLAN 0 to HW filter on device bond0 [ 127.848784][ T5940] 8021q: adding VLAN 0 to HW filter on device team0 [ 127.857473][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 127.874432][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 127.892450][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 127.894248][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 128.265974][ T5940] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 128.331559][ T5940] veth0_vlan: entered promiscuous mode [ 128.352444][ T5940] veth1_vlan: entered promiscuous mode [ 128.407634][ T5940] veth0_macvtap: entered promiscuous mode [ 128.424927][ T5940] veth1_macvtap: entered promiscuous mode [ 128.454418][ T5940] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 128.480843][ T5940] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 128.503003][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.503254][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.503294][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.503330][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.786314][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 128.786335][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 128.855027][ T1414] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 128.855052][ T1414] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2026/02/11 09:50:39 executed programs: 2 [ 129.177893][ T60] Bluetooth: hci0: command tx timeout [ 129.394972][ T6058] loop0: detected capacity change from 0 to 32768 [ 129.406388][ T6058] ======================================================= [ 129.406388][ T6058] WARNING: The mand mount option has been deprecated and [ 129.406388][ T6058] and is ignored by this kernel. Remove the mand [ 129.406388][ T6058] option from the mount to silence this warning. [ 129.406388][ T6058] ======================================================= [ 129.559735][ T6058] JBD2: Ignoring recovery information on journal [ 129.682938][ T6058] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 129.751744][ T6058] overlayfs: upper fs does not support tmpfile. [ 129.766281][ T6058] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 129.767193][ T6058] [ 129.767203][ T6058] ====================================================== [ 129.767212][ T6058] WARNING: possible circular locking dependency detected [ 129.767231][ T6058] syzkaller #0 Not tainted [ 129.767243][ T6058] ------------------------------------------------------ [ 129.767251][ T6058] syz.0.17/6058 is trying to acquire lock: [ 129.767263][ T6058] ffff8880546dce80 (&ocfs2_sysfile_lock_key[LOCAL_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}, at: ocfs2_reserve_local_alloc_bits+0x11f/0x2610 [ 129.767330][ T6058] [ 129.767330][ T6058] but task is already holding lock: [ 129.767338][ T6058] ffff8880547d0858 (&oi->ip_xattr_sem){+.+.}-{4:4}, at: ocfs2_xattr_set+0x475/0x13e0 [ 129.767394][ T6058] [ 129.767394][ T6058] which lock already depends on the new lock. [ 129.767394][ T6058] [ 129.767402][ T6058] [ 129.767402][ T6058] the existing dependency chain (in reverse order) is: [ 129.767409][ T6058] [ 129.767409][ T6058] -> #3 (&oi->ip_xattr_sem){+.+.}-{4:4}: [ 129.767439][ T6058] down_write+0x3a/0x50 [ 129.767459][ T6058] ocfs2_xattr_set_handle+0x3e6/0x810 [ 129.767486][ T6058] ocfs2_init_security_set+0xbd/0xe0 [ 129.767514][ T6058] ocfs2_mknod+0x1481/0x2210 [ 129.767535][ T6058] ocfs2_mkdir+0x181/0x430 [ 129.767555][ T6058] vfs_mkdir+0x40b/0x630 [ 129.767575][ T6058] filename_mkdirat+0x289/0x520 [ 129.767595][ T6058] __se_sys_mkdirat+0x35/0x150 [ 129.767616][ T6058] do_syscall_64+0x14d/0xf80 [ 129.767635][ T6058] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.767655][ T6058] [ 129.767655][ T6058] -> #2 (&journal->j_trans_barrier){.+.+}-{4:4}: [ 129.767686][ T6058] down_read+0x97/0x200 [ 129.767716][ T6058] ocfs2_start_trans+0x3ac/0x700 [ 129.767739][ T6058] ocfs2_reserve_suballoc_bits+0x7bb/0x4790 [ 129.767761][ T6058] ocfs2_reserve_new_metadata_blocks+0x415/0x9a0 [ 129.767782][ T6058] ocfs2_mknod+0xea3/0x2210 [ 129.767800][ T6058] ocfs2_mkdir+0x181/0x430 [ 129.767817][ T6058] vfs_mkdir+0x40b/0x630 [ 129.767835][ T6058] filename_mkdirat+0x289/0x520 [ 129.767853][ T6058] __se_sys_mkdirat+0x35/0x150 [ 129.767927][ T6058] do_syscall_64+0x14d/0xf80 [ 129.767946][ T6058] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.767966][ T6058] [ 129.767966][ T6058] -> #1 (sb_internal#2){.+.+}-{0:0}: [ 129.768000][ T6058] ocfs2_start_trans+0x2ac/0x700 [ 129.768025][ T6058] ocfs2_mknod+0xf31/0x2210 [ 129.768045][ T6058] ocfs2_mkdir+0x181/0x430 [ 129.768064][ T6058] vfs_mkdir+0x40b/0x630 [ 129.768083][ T6058] filename_mkdirat+0x289/0x520 [ 129.768104][ T6058] __se_sys_mkdirat+0x35/0x150 [ 129.768124][ T6058] do_syscall_64+0x14d/0xf80 [ 129.768143][ T6058] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.768163][ T6058] [ 129.768163][ T6058] -> #0 (&ocfs2_sysfile_lock_key[LOCAL_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}: [ 129.768192][ T6058] __lock_acquire+0x15a5/0x2cf0 [ 129.768218][ T6058] lock_acquire+0x106/0x330 [ 129.768242][ T6058] down_write+0x3a/0x50 [ 129.768259][ T6058] ocfs2_reserve_local_alloc_bits+0x11f/0x2610 [ 129.768277][ T6058] ocfs2_reserve_clusters_with_limit+0x1b9/0xc20 [ 129.768301][ T6058] ocfs2_init_xattr_set_ctxt+0x375/0x710 [ 129.768326][ T6058] ocfs2_xattr_set+0xc42/0x13e0 [ 129.768349][ T6058] __vfs_setxattr+0x43c/0x480 [ 129.768374][ T6058] __vfs_setxattr_noperm+0x12d/0x660 [ 129.768400][ T6058] vfs_setxattr+0x163/0x370 [ 129.768425][ T6058] ovl_fill_super+0x4b50/0x5e60 [ 129.768452][ T6058] get_tree_nodev+0xbb/0x150 [ 129.768484][ T6058] vfs_get_tree+0x92/0x2a0 [ 129.768502][ T6058] do_new_mount+0x341/0xd30 [ 129.768527][ T6058] __se_sys_mount+0x31d/0x420 [ 129.768553][ T6058] do_syscall_64+0x14d/0xf80 [ 129.768572][ T6058] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.768591][ T6058] [ 129.768591][ T6058] other info that might help us debug this: [ 129.768591][ T6058] [ 129.768598][ T6058] Chain exists of: [ 129.768598][ T6058] &ocfs2_sysfile_lock_key[LOCAL_ALLOC_SYSTEM_INODE] --> &journal->j_trans_barrier --> &oi->ip_xattr_sem [ 129.768598][ T6058] [ 129.768636][ T6058] Possible unsafe locking scenario: [ 129.768636][ T6058] [ 129.768642][ T6058] CPU0 CPU1 [ 129.768650][ T6058] ---- ---- [ 129.768656][ T6058] lock(&oi->ip_xattr_sem); [ 129.768670][ T6058] lock(&journal->j_trans_barrier); [ 129.768685][ T6058] lock(&oi->ip_xattr_sem); [ 129.768699][ T6058] lock(&ocfs2_sysfile_lock_key[LOCAL_ALLOC_SYSTEM_INODE]); [ 129.768714][ T6058] [ 129.768714][ T6058] *** DEADLOCK *** [ 129.768714][ T6058] [ 129.768720][ T6058] 4 locks held by syz.0.17/6058: [ 129.768733][ T6058] #0: ffff888038ede0d0 (&type->s_umount_key#56/1){+.+.}-{4:4}, at: alloc_super+0x28c/0xac0 [ 129.768801][ T6058] #1: ffff888032e42480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 129.768854][ T6058] #2: ffff8880547d0b80 (&sb->s_type->i_mutex_key#26){++++}-{4:4}, at: vfs_setxattr+0x13e/0x370 [ 129.768924][ T6058] #3: ffff8880547d0858 (&oi->ip_xattr_sem){+.+.}-{4:4}, at: ocfs2_xattr_set+0x475/0x13e0 [ 129.768978][ T6058] [ 129.768978][ T6058] stack backtrace: [ 129.769008][ T6058] CPU: 1 UID: 0 PID: 6058 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 129.769033][ T6058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 129.769054][ T6058] Call Trace: [ 129.769066][ T6058] [ 129.769075][ T6058] dump_stack_lvl+0xe8/0x150 [ 129.769107][ T6058] print_circular_bug+0x2e1/0x300 [ 129.769127][ T6058] check_noncircular+0x12e/0x150 [ 129.769165][ T6058] __lock_acquire+0x15a5/0x2cf0 [ 129.769198][ T6058] ? ocfs2_get_system_file_inode+0x202/0x7e0 [ 129.769225][ T6058] ? __pfx_ocfs2_get_system_file_inode+0x10/0x10 [ 129.769249][ T6058] ? ocfs2_reserve_local_alloc_bits+0x11f/0x2610 [ 129.769271][ T6058] lock_acquire+0x106/0x330 [ 129.769299][ T6058] ? ocfs2_reserve_local_alloc_bits+0x11f/0x2610 [ 129.769328][ T6058] down_write+0x3a/0x50 [ 129.769349][ T6058] ? ocfs2_reserve_local_alloc_bits+0x11f/0x2610 [ 129.769371][ T6058] ocfs2_reserve_local_alloc_bits+0x11f/0x2610 [ 129.769395][ T6058] ? __lock_acquire+0x6b5/0x2cf0 [ 129.769426][ T6058] ? __lock_acquire+0x6b5/0x2cf0 [ 129.769459][ T6058] ? __pfx_ocfs2_reserve_local_alloc_bits+0x10/0x10 [ 129.769484][ T6058] ? do_raw_spin_lock+0x12b/0x2f0 [ 129.769514][ T6058] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 129.769535][ T6058] ? lockdep_hardirqs_on+0x7a/0x110 [ 129.769555][ T6058] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 129.769576][ T6058] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 129.769605][ T6058] ? reacquire_held_locks+0x104/0x190 [ 129.769638][ T6058] ? rt_spin_lock+0x1e0/0x400 [ 129.769666][ T6058] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 129.769696][ T6058] ? rt_spin_unlock+0x14f/0x200 [ 129.769725][ T6058] ? rt_spin_unlock+0x160/0x200 [ 129.769755][ T6058] ? ocfs2_alloc_should_use_local+0x13e/0x2e0 [ 129.769788][ T6058] ? ocfs2_reserve_clusters_with_limit+0x160/0xc20 [ 129.769817][ T6058] ocfs2_reserve_clusters_with_limit+0x1b9/0xc20 [ 129.769848][ T6058] ? __pfx_ocfs2_reserve_clusters_with_limit+0x10/0x10 [ 129.769888][ T6058] ? __pfx_ocfs2_calc_xattr_set_need+0x10/0x10 [ 129.769923][ T6058] ? do_raw_spin_lock+0x12b/0x2f0 [ 129.769950][ T6058] ocfs2_init_xattr_set_ctxt+0x375/0x710 [ 129.769979][ T6058] ? lockdep_hardirqs_on+0x7a/0x110 [ 129.770001][ T6058] ? __pfx_ocfs2_init_xattr_set_ctxt+0x10/0x10 [ 129.770034][ T6058] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 129.770060][ T6058] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 129.770081][ T6058] ? lockdep_hardirqs_on+0x7a/0x110 [ 129.770103][ T6058] ocfs2_xattr_set+0xc42/0x13e0 [ 129.770145][ T6058] ? __pfx_ocfs2_xattr_set+0x10/0x10 [ 129.770173][ T6058] ? desc_update_last_finalized+0x193/0x1f0 [ 129.770210][ T6058] ? lockdep_hardirqs_on+0x7a/0x110 [ 129.770234][ T6058] ? smk_tskacc+0x311/0x3a0 [ 129.770264][ T6058] ? posix_xattr_acl+0x93/0xc0 [ 129.770287][ T6058] ? evm_protect_xattr+0x4d4/0xac0 [ 129.770310][ T6058] ? __pfx_evm_protect_xattr+0x10/0x10 [ 129.770333][ T6058] ? __pfx_ocfs2_xattr_trusted_set+0x10/0x10 [ 129.770364][ T6058] __vfs_setxattr+0x43c/0x480 [ 129.770396][ T6058] __vfs_setxattr_noperm+0x12d/0x660 [ 129.770429][ T6058] vfs_setxattr+0x163/0x370 [ 129.770460][ T6058] ? __pfx_vfs_setxattr+0x10/0x10 [ 129.770486][ T6058] ? __dentry_kill+0x4b2/0x5e0 [ 129.770511][ T6058] ? finish_dput+0xad/0x480 [ 129.770538][ T6058] ? finish_dput+0x3da/0x480 [ 129.770564][ T6058] ovl_fill_super+0x4b50/0x5e60 [ 129.770593][ T6058] ? unwind_get_return_address+0x4d/0x90 [ 129.770632][ T6058] ? __pfx_stack_trace_save+0x10/0x10 [ 129.770661][ T6058] ? __pfx_ovl_fill_super+0x10/0x10 [ 129.770690][ T6058] ? __lock_acquire+0x6b5/0x2cf0 [ 129.770722][ T6058] ? __lock_acquire+0x6b5/0x2cf0 [ 129.770755][ T6058] ? __lock_acquire+0x6b5/0x2cf0 [ 129.770785][ T6058] ? do_raw_spin_lock+0x12b/0x2f0 [ 129.770815][ T6058] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 129.770836][ T6058] ? lockdep_hardirqs_on+0x7a/0x110 [ 129.770855][ T6058] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 129.770884][ T6058] ? rt_mutex_slowunlock+0x1cb/0x300 [ 129.770914][ T6058] ? __raw_spin_lock_init+0x45/0x100 [ 129.770944][ T6058] ? sget_fc+0x962/0xa40 [ 129.770975][ T6058] ? __pfx_set_anon_super_fc+0x10/0x10 [ 129.771007][ T6058] ? __pfx_ovl_fill_super+0x10/0x10 [ 129.771035][ T6058] get_tree_nodev+0xbb/0x150 [ 129.771068][ T6058] vfs_get_tree+0x92/0x2a0 [ 129.771091][ T6058] do_new_mount+0x341/0xd30 [ 129.771117][ T6058] ? safesetid_security_capable+0xa9/0x1a0 [ 129.771145][ T6058] ? __pfx_do_new_mount+0x10/0x10 [ 129.771171][ T6058] ? ns_capable+0x89/0xe0 [ 129.771198][ T6058] ? path_mount+0x690/0x10e0 [ 129.771227][ T6058] ? user_path_at+0xd4/0x160 [ 129.771260][ T6058] __se_sys_mount+0x31d/0x420 [ 129.771292][ T6058] ? __pfx___se_sys_mount+0x10/0x10 [ 129.771323][ T6058] ? __x64_sys_mount+0x20/0xc0 [ 129.771353][ T6058] do_syscall_64+0x14d/0xf80 [ 129.771373][ T6058] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.771394][ T6058] ? trace_irq_disable+0x37/0x100 [ 129.771424][ T6058] ? clear_bhb_loop+0x40/0x90 [ 129.771448][ T6058] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.771470][ T6058] RIP: 0033:0x7f7bc55abf79 [ 129.771497][ T6058] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 129.771515][ T6058] RSP: 002b:00007ffd91960c58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 129.771536][ T6058] RAX: ffffffffffffffda RBX: 00007f7bc5825fa0 RCX: 00007f7bc55abf79 [ 129.771553][ T6058] RDX: 0000200000000440 RSI: 0000200000000100 RDI: 0000000000000000 [ 129.771567][ T6058] RBP: 00007f7bc56427e0 R08: 0000200000000200 R09: 0000000000000000 [ 129.771582][ T6058] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000000 [ 129.771594][ T6058] R13: 00007f7bc5825fac R14: 00007f7bc5825fa0 R15: 00007f7bc5825fa0 [ 129.771619][ T6058] [ 129.787484][ T6058] ------------[ cut here ]------------ [ 129.787525][ T6058] UBSAN: array-index-out-of-bounds in fs/ocfs2/xattr.c:1985:3 [ 129.787571][ T6058] index 2 is out of range for type 'struct ocfs2_xattr_entry[] __counted_by(xh_count)' (aka 'struct ocfs2_xattr_entry[]') [ 129.787626][ T6058] CPU: 1 UID: 0 PID: 6058 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 129.787691][ T6058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 129.787714][ T6058] Call Trace: [ 129.787721][ T6058] [ 129.787729][ T6058] dump_stack_lvl+0xe8/0x150 [ 129.787762][ T6058] ubsan_epilogue+0xa/0x30 [ 129.787783][ T6058] __ubsan_handle_out_of_bounds+0xe8/0xf0 [ 129.787817][ T6058] ocfs2_xa_remove_entry+0x49e/0x670 [ 129.787842][ T6058] ocfs2_xa_set+0xdb2/0x2ec0 [ 129.787882][ T6058] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 129.787912][ T6058] ? try_to_take_rt_mutex+0x840/0xb00 [ 129.787941][ T6058] ? rcu_is_watching+0x15/0xb0 [ 129.787970][ T6058] ? __pfx_ocfs2_xa_set+0x10/0x10 [ 129.787999][ T6058] ? rtlock_slowlock_locked+0xfb/0x3c80 [ 129.788026][ T6058] ? do_raw_spin_lock+0x12b/0x2f0 [ 129.788049][ T6058] ? rcu_is_watching+0x15/0xb0 [ 129.788110][ T6058] ? unwind_next_frame+0xa5/0x23c0 [ 129.788149][ T6058] ? rcu_is_watching+0x15/0xb0 [ 129.788249][ T6058] ? unwind_next_frame+0xa5/0x23c0 [ 129.788352][ T6058] ? rcu_is_watching+0x15/0xb0 [ 129.788422][ T6058] ? unwind_next_frame+0xa5/0x23c0 [ 129.788479][ T6058] ? rcu_is_watching+0x15/0xb0 [ 129.788509][ T6058] ? is_bpf_text_address+0x26/0x2b0 [ 129.788528][ T6058] ? rcu_is_watching+0x15/0xb0 [ 129.788558][ T6058] ? rcu_is_watching+0x15/0xb0 [ 129.788637][ T6058] ? lock_release+0x4b/0x3a0 [ 129.788704][ T6058] ? lock_release+0x4b/0x3a0 [ 129.788783][ T6058] ? is_bpf_text_address+0x292/0x2b0 [ 129.788839][ T6058] ? rt_read_lock+0x277/0x4b0 [ 129.788923][ T6058] ? rcu_is_watching+0x15/0xb0 [ 129.789000][ T6058] ? lock_acquire+0x5f/0x330 [ 129.789076][ T6058] ocfs2_xattr_block_set+0x3e0/0x3350 [ 129.789171][ T6058] ? rcu_is_watching+0x15/0xb0 [ 129.789249][ T6058] ? lock_acquire+0x5f/0x330 [ 129.789335][ T6058] ? __pfx_ocfs2_xattr_block_set+0x10/0x10 [ 129.789413][ T6058] ? start_this_handle+0x2135/0x2290 [ 129.789523][ T6058] ? __pfx_start_this_handle+0x10/0x10 [ 129.789638][ T6058] ? jbd2__journal_start+0x145/0x5b0 [ 129.789727][ T6058] ? rcu_is_watching+0x15/0xb0 [ 129.789814][ T6058] __ocfs2_xattr_set_handle+0x262/0xf50 [ 129.789910][ T6058] ? __pfx___ocfs2_xattr_set_handle+0x10/0x10 [ 129.789981][ T6058] ? jbd2_journal_start+0x2a/0x40 [ 129.790056][ T6058] ? ocfs2_start_trans+0x4e2/0x700 [ 129.790138][ T6058] ? __pfx_ocfs2_start_trans+0x10/0x10 [ 129.790215][ T6058] ocfs2_xattr_set+0xf3f/0x13e0 [ 129.790315][ T6058] ? __pfx_ocfs2_xattr_set+0x10/0x10 [ 129.790394][ T6058] ? smk_tskacc+0x311/0x3a0 [ 129.790463][ T6058] ? smack_log+0xf5/0x3f0 [ 129.790527][ T6058] ? __pfx_smack_log+0x10/0x10 [ 129.790605][ T6058] ? smk_tskacc+0x311/0x3a0 [ 129.790682][ T6058] ? posix_xattr_acl+0x93/0xc0 [ 129.790740][ T6058] ? evm_protect_xattr+0x4d4/0xac0 [ 129.790797][ T6058] ? __pfx_evm_protect_xattr+0x10/0x10 [ 129.790853][ T6058] ? __pfx_ocfs2_xattr_trusted_set+0x10/0x10 [ 129.790932][ T6058] __vfs_removexattr+0x431/0x470 [ 129.791043][ T6058] __vfs_removexattr_locked+0xe2/0x280 [ 129.791133][ T6058] vfs_removexattr+0x7f/0x230 [ 129.791211][ T6058] ovl_fill_super+0x4c39/0x5e60 [ 129.791286][ T6058] ? unwind_get_return_address+0x4d/0x90 [ 129.791385][ T6058] ? __pfx_stack_trace_save+0x10/0x10 [ 129.791460][ T6058] ? __pfx_ovl_fill_super+0x10/0x10 [ 129.791535][ T6058] ? __lock_acquire+0x6b5/0x2cf0 [ 129.791612][ T6058] ? __lock_acquire+0x6b5/0x2cf0 [ 129.791691][ T6058] ? __lock_acquire+0x6b5/0x2cf0 [ 129.791767][ T6058] ? do_raw_spin_lock+0x12b/0x2f0 [ 129.791846][ T6058] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 129.791912][ T6058] ? lockdep_hardirqs_on+0x7a/0x110 [ 129.791959][ T6058] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 129.792014][ T6058] ? rt_mutex_slowunlock+0x1cb/0x300 [ 129.792090][ T6058] ? __raw_spin_lock_init+0x45/0x100 [ 129.792180][ T6058] ? sget_fc+0x962/0xa40 [ 129.792260][ T6058] ? __pfx_set_anon_super_fc+0x10/0x10 [ 129.792345][ T6058] ? __pfx_ovl_fill_super+0x10/0x10 [ 129.792421][ T6058] get_tree_nodev+0xbb/0x150 [ 129.792537][ T6058] vfs_get_tree+0x92/0x2a0 [ 129.792592][ T6058] do_new_mount+0x341/0xd30 [ 129.792657][ T6058] ? safesetid_security_capable+0xa9/0x1a0 [ 129.792746][ T6058] ? __pfx_do_new_mount+0x10/0x10 [ 129.792813][ T6058] ? ns_capable+0x89/0xe0 [ 129.792891][ T6058] ? path_mount+0x690/0x10e0 [ 129.792966][ T6058] ? user_path_at+0xd4/0x160 [ 129.793045][ T6058] __se_sys_mount+0x31d/0x420 [ 129.793126][ T6058] ? __pfx___se_sys_mount+0x10/0x10 [ 129.793205][ T6058] ? __x64_sys_mount+0x20/0xc0 [ 129.793281][ T6058] do_syscall_64+0x14d/0xf80 [ 129.793335][ T6058] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.793391][ T6058] ? trace_irq_disable+0x37/0x100 [ 129.793469][ T6058] ? clear_bhb_loop+0x40/0x90 [ 129.793534][ T6058] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.793589][ T6058] RIP: 0033:0x7f7bc55abf79 [ 129.793641][ T6058] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 129.793686][ T6058] RSP: 002b:00007ffd91960c58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 129.793741][ T6058] RAX: ffffffffffffffda RBX: 00007f7bc5825fa0 RCX: 00007f7bc55abf79 [ 129.793791][ T6058] RDX: 0000200000000440 RSI: 0000200000000100 RDI: 0000000000000000 [ 129.793840][ T6058] RBP: 00007f7bc56427e0 R08: 0000200000000200 R09: 0000000000000000 [ 129.793899][ T6058] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000000 [ 129.793934][ T6058] R13: 00007f7bc5825fac R14: 00007f7bc5825fa0 R15: 00007f7bc5825fa0 [ 129.793998][ T6058] [ 129.820430][ T6058] ---[ end trace ]--- [ 129.820476][ T6058] Kernel panic - not syncing: UBSAN: panic_on_warn set ... [ 129.820541][ T6058] CPU: 1 UID: 0 PID: 6058 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 129.820607][ T6058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 129.820641][ T6058] Call Trace: [ 129.820662][ T6058] [ 129.820685][ T6058] vpanic+0x1e0/0x670 [ 129.820783][ T6058] panic+0xc5/0xd0 [ 129.820869][ T6058] ? __pfx_panic+0x10/0x10 [ 129.820948][ T6058] ? __pfx__printk+0x10/0x10 [ 129.821016][ T6058] check_panic_on_warn+0x89/0xb0 [ 129.821079][ T6058] __ubsan_handle_out_of_bounds+0xe8/0xf0 [ 129.821161][ T6058] ocfs2_xa_remove_entry+0x49e/0x670 [ 129.821228][ T6058] ocfs2_xa_set+0xdb2/0x2ec0 [ 129.821330][ T6058] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 129.821439][ T6058] ? try_to_take_rt_mutex+0x840/0xb00 [ 129.821517][ T6058] ? rcu_is_watching+0x15/0xb0 [ 129.821604][ T6058] ? __pfx_ocfs2_xa_set+0x10/0x10 [ 129.821689][ T6058] ? rtlock_slowlock_locked+0xfb/0x3c80 [ 129.821758][ T6058] ? do_raw_spin_lock+0x12b/0x2f0 [ 129.821823][ T6058] ? rcu_is_watching+0x15/0xb0 [ 129.821920][ T6058] ? unwind_next_frame+0xa5/0x23c0 [ 129.821996][ T6058] ? rcu_is_watching+0x15/0xb0 [ 129.822072][ T6058] ? unwind_next_frame+0xa5/0x23c0 [ 129.822147][ T6058] ? rcu_is_watching+0x15/0xb0 [ 129.822224][ T6058] ? unwind_next_frame+0xa5/0x23c0 [ 129.822299][ T6058] ? rcu_is_watching+0x15/0xb0 [ 129.822382][ T6058] ? is_bpf_text_address+0x26/0x2b0 [ 129.822438][ T6058] ? rcu_is_watching+0x15/0xb0 [ 129.822524][ T6058] ? rcu_is_watching+0x15/0xb0 [ 129.822600][ T6058] ? lock_release+0x4b/0x3a0 [ 129.822681][ T6058] ? lock_release+0x4b/0x3a0 [ 129.822826][ T6058] ? is_bpf_text_address+0x292/0x2b0 [ 129.822893][ T6058] ? rt_read_lock+0x277/0x4b0 [ 129.822963][ T6058] ? rcu_is_watching+0x15/0xb0 [ 129.823041][ T6058] ? lock_acquire+0x5f/0x330 [ 129.823110][ T6058] ocfs2_xattr_block_set+0x3e0/0x3350 [ 129.823198][ T6058] ? rcu_is_watching+0x15/0xb0 [ 129.823274][ T6058] ? lock_acquire+0x5f/0x330 [ 129.823360][ T6058] ? __pfx_ocfs2_xattr_block_set+0x10/0x10 [ 129.823437][ T6058] ? start_this_handle+0x2135/0x2290 [ 129.823553][ T6058] ? __pfx_start_this_handle+0x10/0x10 [ 129.823643][ T6058] ? jbd2__journal_start+0x145/0x5b0 [ 129.823718][ T6058] ? rcu_is_watching+0x15/0xb0 [ 129.823797][ T6058] __ocfs2_xattr_set_handle+0x262/0xf50 [ 129.823884][ T6058] ? __pfx___ocfs2_xattr_set_handle+0x10/0x10 [ 129.823967][ T6058] ? jbd2_journal_start+0x2a/0x40 [ 129.824042][ T6058] ? ocfs2_start_trans+0x4e2/0x700 [ 129.824128][ T6058] ? __pfx_ocfs2_start_trans+0x10/0x10 [ 129.824227][ T6058] ocfs2_xattr_set+0xf3f/0x13e0 [ 129.824336][ T6058] ? __pfx_ocfs2_xattr_set+0x10/0x10 [ 129.824425][ T6058] ? smk_tskacc+0x311/0x3a0 [ 129.824491][ T6058] ? smack_log+0xf5/0x3f0 [ 129.824556][ T6058] ? __pfx_smack_log+0x10/0x10 [ 129.824629][ T6058] ? smk_tskacc+0x311/0x3a0 [ 129.824697][ T6058] ? posix_xattr_acl+0x93/0xc0 [ 129.824760][ T6058] ? evm_protect_xattr+0x4d4/0xac0 [ 129.824826][ T6058] ? __pfx_evm_protect_xattr+0x10/0x10 [ 129.824880][ T6058] ? __pfx_ocfs2_xattr_trusted_set+0x10/0x10 [ 129.824958][ T6058] __vfs_removexattr+0x431/0x470 [ 129.825045][ T6058] __vfs_removexattr_locked+0xe2/0x280 [ 129.825124][ T6058] vfs_removexattr+0x7f/0x230 [ 129.825205][ T6058] ovl_fill_super+0x4c39/0x5e60 [ 129.825274][ T6058] ? unwind_get_return_address+0x4d/0x90 [ 129.825380][ T6058] ? __pfx_stack_trace_save+0x10/0x10 [ 129.825466][ T6058] ? __pfx_ovl_fill_super+0x10/0x10 [ 129.825562][ T6058] ? __lock_acquire+0x6b5/0x2cf0 [ 129.825656][ T6058] ? __lock_acquire+0x6b5/0x2cf0 [ 129.825741][ T6058] ? __lock_acquire+0x6b5/0x2cf0 [ 129.825810][ T6058] ? do_raw_spin_lock+0x12b/0x2f0 [ 129.825904][ T6058] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 129.825958][ T6058] ? lockdep_hardirqs_on+0x7a/0x110 [ 129.826011][ T6058] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 129.826066][ T6058] ? rt_mutex_slowunlock+0x1cb/0x300 [ 129.826136][ T6058] ? __raw_spin_lock_init+0x45/0x100 [ 129.826214][ T6058] ? sget_fc+0x962/0xa40 [ 129.826298][ T6058] ? __pfx_set_anon_super_fc+0x10/0x10 [ 129.826376][ T6058] ? __pfx_ovl_fill_super+0x10/0x10 [ 129.826421][ T6058] get_tree_nodev+0xbb/0x150 [ 129.826455][ T6058] vfs_get_tree+0x92/0x2a0 [ 129.826476][ T6058] do_new_mount+0x341/0xd30 [ 129.826507][ T6058] ? safesetid_security_capable+0xa9/0x1a0 [ 129.826534][ T6058] ? __pfx_do_new_mount+0x10/0x10 [ 129.826554][ T6058] ? ns_capable+0x89/0xe0 [ 129.826572][ T6058] ? path_mount+0x690/0x10e0 [ 129.826593][ T6058] ? user_path_at+0xd4/0x160 [ 129.826617][ T6058] __se_sys_mount+0x31d/0x420 [ 129.826639][ T6058] ? __pfx___se_sys_mount+0x10/0x10 [ 129.826661][ T6058] ? __x64_sys_mount+0x20/0xc0 [ 129.826682][ T6058] do_syscall_64+0x14d/0xf80 [ 129.826696][ T6058] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.826711][ T6058] ? trace_irq_disable+0x37/0x100 [ 129.826734][ T6058] ? clear_bhb_loop+0x40/0x90 [ 129.826751][ T6058] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.826766][ T6058] RIP: 0033:0x7f7bc55abf79 [ 129.826780][ T6058] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 129.826793][ T6058] RSP: 002b:00007ffd91960c58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 129.826810][ T6058] RAX: ffffffffffffffda RBX: 00007f7bc5825fa0 RCX: 00007f7bc55abf79 [ 129.826822][ T6058] RDX: 0000200000000440 RSI: 0000200000000100 RDI: 0000000000000000 [ 129.826832][ T6058] RBP: 00007f7bc56427e0 R08: 0000200000000200 R09: 0000000000000000 [ 129.826842][ T6058] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000000 [ 129.826863][ T6058] R13: 00007f7bc5825fac R14: 00007f7bc5825fa0 R15: 00007f7bc5825fa0 [ 129.826881][ T6058] [ 129.827490][ T6058] Kernel Offset: disabled