Warning: Permanently added '10.128.1.182' (ED25519) to the list of known hosts. [ 87.038314][ T919] cfg80211: failed to load regulatory.db 2025/12/24 09:45:39 parsed 1 programs [ 92.159149][ T5808] cgroup: Unknown subsys name 'net' [ 92.415337][ T5808] cgroup: Unknown subsys name 'cpuset' [ 92.459840][ T5808] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 94.486352][ T5808] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 99.204378][ T5835] chnl_net:caif_netlink_parms(): no params data found [ 99.558814][ T5835] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.560300][ T5835] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.560518][ T5835] bridge_slave_0: entered allmulticast mode [ 99.562235][ T5835] bridge_slave_0: entered promiscuous mode [ 99.595064][ T5835] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.595201][ T5835] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.595329][ T5835] bridge_slave_1: entered allmulticast mode [ 99.596958][ T5835] bridge_slave_1: entered promiscuous mode [ 99.784460][ T5835] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.800413][ T5835] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.003327][ T5835] team0: Port device team_slave_0 added [ 100.006560][ T5835] team0: Port device team_slave_1 added [ 100.160688][ T5835] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.160703][ T5835] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.160718][ T5835] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 100.163444][ T5835] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 100.163460][ T5835] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.163483][ T5835] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 100.345009][ T5835] hsr_slave_0: entered promiscuous mode [ 100.346092][ T5835] hsr_slave_1: entered promiscuous mode [ 100.683385][ T5835] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 100.706191][ T5835] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 100.742269][ T5835] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 100.782783][ T5835] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 100.914671][ T5835] 8021q: adding VLAN 0 to HW filter on device bond0 [ 101.058708][ T5835] 8021q: adding VLAN 0 to HW filter on device team0 [ 101.066804][ T1322] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.067657][ T1322] bridge0: port 1(bridge_slave_0) entered forwarding state [ 101.105333][ T68] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.105479][ T68] bridge0: port 2(bridge_slave_1) entered forwarding state [ 101.360626][ T5835] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 101.420891][ T5835] veth0_vlan: entered promiscuous mode [ 101.431447][ T5835] veth1_vlan: entered promiscuous mode [ 101.466937][ T5835] veth0_macvtap: entered promiscuous mode [ 101.479614][ T5835] veth1_macvtap: entered promiscuous mode [ 101.500150][ T5835] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 101.521531][ T5835] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 101.539935][ T68] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.542538][ T68] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.542585][ T68] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.542621][ T68] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.371149][ T68] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 103.070584][ T68] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 103.990179][ T5122] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 103.994217][ T5122] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 104.003074][ T5122] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 104.004366][ T5122] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 104.005418][ T5122] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 104.090278][ T68] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 104.480431][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.480455][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.558628][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.558652][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.693970][ T68] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 105.088229][ T68] bridge_slave_1: left allmulticast mode [ 105.088446][ T68] bridge_slave_1: left promiscuous mode [ 105.090383][ T68] bridge0: port 2(bridge_slave_1) entered disabled state [ 105.170611][ T68] bridge_slave_0: left allmulticast mode [ 105.170645][ T68] bridge_slave_0: left promiscuous mode [ 105.170926][ T68] bridge0: port 1(bridge_slave_0) entered disabled state [ 106.888723][ T68] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 106.950645][ T68] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 106.990757][ T68] bond0 (unregistering): Released all slaves [ 107.309249][ T68] hsr_slave_0: left promiscuous mode [ 107.329626][ T68] hsr_slave_1: left promiscuous mode [ 107.331074][ T68] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 107.331156][ T68] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 107.381232][ T68] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 107.381265][ T68] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 107.504800][ T68] veth1_macvtap: left promiscuous mode [ 107.505226][ T68] veth0_macvtap: left promiscuous mode [ 107.505558][ T68] veth1_vlan: left promiscuous mode [ 107.505883][ T68] veth0_vlan: left promiscuous mode [ 109.788619][ T68] team0 (unregistering): Port device team_slave_1 removed [ 109.978644][ T68] team0 (unregistering): Port device team_slave_0 removed 2025/12/24 09:46:05 executed programs: 0 [ 115.275037][ T61] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 115.281390][ T61] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 115.282313][ T61] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 115.283547][ T61] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 115.284296][ T61] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 116.184650][ T5984] chnl_net:caif_netlink_parms(): no params data found [ 116.700056][ T5984] bridge0: port 1(bridge_slave_0) entered blocking state [ 116.700198][ T5984] bridge0: port 1(bridge_slave_0) entered disabled state [ 116.700331][ T5984] bridge_slave_0: entered allmulticast mode [ 116.701964][ T5984] bridge_slave_0: entered promiscuous mode [ 116.739357][ T5984] bridge0: port 2(bridge_slave_1) entered blocking state [ 116.739547][ T5984] bridge0: port 2(bridge_slave_1) entered disabled state [ 116.739693][ T5984] bridge_slave_1: entered allmulticast mode [ 116.741280][ T5984] bridge_slave_1: entered promiscuous mode [ 117.015033][ T5984] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 117.022185][ T5984] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 117.185054][ T5984] team0: Port device team_slave_0 added [ 117.190387][ T5984] team0: Port device team_slave_1 added [ 117.349862][ T61] Bluetooth: hci0: command tx timeout [ 117.373649][ T5984] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 117.373670][ T5984] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 117.373697][ T5984] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 117.376275][ T5984] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 117.376289][ T5984] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 117.376316][ T5984] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 117.664506][ T5984] hsr_slave_0: entered promiscuous mode [ 117.665367][ T5984] hsr_slave_1: entered promiscuous mode [ 119.429261][ T61] Bluetooth: hci0: command tx timeout [ 119.720523][ T5984] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 119.767011][ T5984] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 119.812415][ T5984] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 119.842740][ T5984] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 120.017482][ T5984] 8021q: adding VLAN 0 to HW filter on device bond0 [ 120.070844][ T5984] 8021q: adding VLAN 0 to HW filter on device team0 [ 120.082487][ T68] bridge0: port 1(bridge_slave_0) entered blocking state [ 120.082954][ T68] bridge0: port 1(bridge_slave_0) entered forwarding state [ 120.094633][ T68] bridge0: port 2(bridge_slave_1) entered blocking state [ 120.094832][ T68] bridge0: port 2(bridge_slave_1) entered forwarding state [ 120.437252][ T5984] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 120.524796][ T5984] veth0_vlan: entered promiscuous mode [ 120.554378][ T5984] veth1_vlan: entered promiscuous mode [ 120.621601][ T5984] veth0_macvtap: entered promiscuous mode [ 120.627343][ T5984] veth1_macvtap: entered promiscuous mode [ 120.663982][ T5984] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 120.681759][ T5984] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 120.713394][ T4450] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.713654][ T4450] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.713692][ T4450] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.713727][ T4450] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.959348][ T57] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 120.959386][ T57] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.058618][ T1407] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.058642][ T1407] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2025/12/24 09:46:11 executed programs: 2 [ 121.266213][ T6073] loop0: detected capacity change from 0 to 1024 [ 121.286387][ T6073] ======================================================= [ 121.286387][ T6073] WARNING: The mand mount option has been deprecated and [ 121.286387][ T6073] and is ignored by this kernel. Remove the mand [ 121.286387][ T6073] option from the mount to silence this warning. [ 121.286387][ T6073] ======================================================= [ 121.286490][ T6073] EXT4-fs: Ignoring removed orlov option [ 121.286516][ T6073] EXT4-fs: inline encryption not supported [ 121.441232][ T6073] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 121.508479][ T61] Bluetooth: hci0: command tx timeout [ 121.628876][ T5984] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 121.753002][ T6088] loop0: detected capacity change from 0 to 1024 [ 121.756212][ T6088] EXT4-fs: Ignoring removed orlov option [ 121.756245][ T6088] EXT4-fs: inline encryption not supported [ 121.796766][ T6088] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 121.971204][ T5984] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 122.147439][ T6097] loop0: detected capacity change from 0 to 1024 [ 122.169795][ T6097] EXT4-fs: Ignoring removed orlov option [ 122.169830][ T6097] EXT4-fs: inline encryption not supported [ 122.210178][ T6097] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 122.331808][ T5984] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 122.425875][ T6108] loop0: detected capacity change from 0 to 1024 [ 122.427209][ T6108] EXT4-fs: Ignoring removed orlov option [ 122.427240][ T6108] EXT4-fs: inline encryption not supported [ 122.467743][ T6108] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 122.571554][ T6108] ================================================================== [ 122.571572][ T6108] BUG: KASAN: use-after-free in ext4_find_extent+0xae6/0xcc0 [ 122.571607][ T6108] Read of size 4 at addr ffff888054ee7d6c by task syz.0.20/6108 [ 122.571623][ T6108] [ 122.571635][ T6108] CPU: 0 UID: 0 PID: 6108 Comm: syz.0.20 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 122.571658][ T6108] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 122.571670][ T6108] Call Trace: [ 122.571678][ T6108] [ 122.571686][ T6108] dump_stack_lvl+0xe8/0x150 [ 122.571715][ T6108] print_report+0xca/0x240 [ 122.571740][ T6108] ? ext4_find_extent+0xae6/0xcc0 [ 122.571765][ T6108] kasan_report+0x118/0x150 [ 122.571798][ T6108] ? ext4_find_extent+0xae6/0xcc0 [ 122.571828][ T6108] ext4_find_extent+0xae6/0xcc0 [ 122.571855][ T6108] ext4_ext_map_blocks+0x278/0x69c0 [ 122.571891][ T6108] ? __lock_acquire+0x6b6/0x2cf0 [ 122.571920][ T6108] ? __lock_acquire+0x6b6/0x2cf0 [ 122.571949][ T6108] ? __lock_acquire+0x6b6/0x2cf0 [ 122.571975][ T6108] ? __pfx_ext4_ext_map_blocks+0x10/0x10 [ 122.572006][ T6108] ? rt_read_lock+0x203/0x490 [ 122.572039][ T6108] ? ext4_map_blocks+0x4a4/0x16f0 [ 122.572062][ T6108] ext4_map_query_blocks+0x135/0x9f0 [ 122.572087][ T6108] ? __pfx_ext4_map_query_blocks+0x10/0x10 [ 122.572107][ T6108] ? down_read+0x181/0x1f0 [ 122.572128][ T6108] ? __pfx_down_read+0x10/0x10 [ 122.572149][ T6108] ? ext4_es_lookup_extent+0x6cd/0xb00 [ 122.572173][ T6108] ext4_map_blocks+0x4b8/0x16f0 [ 122.572200][ T6108] ? __pfx_ext4_map_blocks+0x10/0x10 [ 122.572222][ T6108] ? __lock_acquire+0x6b6/0x2cf0 [ 122.572251][ T6108] _ext4_get_block+0x1fa/0x4c0 [ 122.572269][ T6108] ? __pfx__ext4_get_block+0x10/0x10 [ 122.572293][ T6108] ? __ext4_journal_ensure_credits+0x30/0x450 [ 122.572323][ T6108] ext4_block_write_begin+0xb03/0x1940 [ 122.572353][ T6108] ? __pfx_ext4_get_block+0x10/0x10 [ 122.572374][ T6108] ? __pfx_ext4_block_write_begin+0x10/0x10 [ 122.572398][ T6108] ? folio_mapping+0x16f/0x1f0 [ 122.572425][ T6108] ext4_write_begin+0xb3a/0x1870 [ 122.572466][ T6108] ? __pfx_ext4_write_begin+0x10/0x10 [ 122.572505][ T6108] ? __ext4_mark_inode_dirty+0x4c8/0x6e0 [ 122.572535][ T6108] ext4_da_write_begin+0x352/0xd30 [ 122.572573][ T6108] ? __pfx_ext4_da_write_begin+0x10/0x10 [ 122.572605][ T6108] generic_perform_write+0x29d/0x8c0 [ 122.572642][ T6108] ? __pfx_generic_perform_write+0x10/0x10 [ 122.572673][ T6108] ? file_update_time_flags+0x44e/0x4f0 [ 122.572700][ T6108] ? ext4_write_checks+0x24d/0x2d0 [ 122.572724][ T6108] ext4_buffered_write_iter+0xd0/0x3a0 [ 122.572749][ T6108] ext4_file_write_iter+0x293/0x1be0 [ 122.572772][ T6108] ? try_to_wake_up+0x82b/0x12b0 [ 122.572802][ T6108] ? vfs_write+0x217/0xb40 [ 122.572829][ T6108] ? vfs_write+0x217/0xb40 [ 122.572854][ T6108] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 122.572884][ T6108] vfs_write+0x5d5/0xb40 [ 122.572914][ T6108] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 122.572935][ T6108] ? __pfx_vfs_write+0x10/0x10 [ 122.572968][ T6108] ? __fget_files+0x2a/0x420 [ 122.572993][ T6108] __x64_sys_pwrite64+0x196/0x220 [ 122.573024][ T6108] ? __pfx___x64_sys_pwrite64+0x10/0x10 [ 122.573058][ T6108] do_syscall_64+0xec/0xf80 [ 122.573077][ T6108] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.573097][ T6108] ? trace_irq_disable+0x37/0x100 [ 122.573119][ T6108] ? clear_bhb_loop+0x60/0xb0 [ 122.573141][ T6108] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.573162][ T6108] RIP: 0033:0x7f1b9f20f749 [ 122.573180][ T6108] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 122.573197][ T6108] RSP: 002b:00007f1b9e876038 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 [ 122.573220][ T6108] RAX: ffffffffffffffda RBX: 00007f1b9f465fa0 RCX: 00007f1b9f20f749 [ 122.573236][ T6108] RDX: 000000000000fdef RSI: 0000200000000140 RDI: 0000000000000004 [ 122.573249][ T6108] RBP: 00007f1b9f293f91 R08: 0000000000000000 R09: 0000000000000000 [ 122.573261][ T6108] R10: 0000000000000e7c R11: 0000000000000246 R12: 0000000000000000 [ 122.573274][ T6108] R13: 00007f1b9f466038 R14: 00007f1b9f465fa0 R15: 00007fff436979b8 [ 122.573296][ T6108] [ 122.573304][ T6108] [ 122.573309][ T6108] The buggy address belongs to the physical page: [ 122.573319][ T6108] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2c0 pfn:0x54ee7 [ 122.573338][ T6108] flags: 0x80000000000000(node=0|zone=1) [ 122.573361][ T6108] raw: 0080000000000000 dead000000000100 dead000000000122 0000000000000000 [ 122.573378][ T6108] raw: 00000000000002c0 0000000000000000 00000000ffffffff 0000000000000000 [ 122.573388][ T6108] page dumped because: kasan: bad access detected [ 122.573397][ T6108] page_owner tracks the page as freed [ 122.573404][ T6108] page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 5919, tgid 5919 (syz-executor), ts 107453677173, free_ts 112360916870 [ 122.573437][ T6108] post_alloc_hook+0x234/0x290 [ 122.573463][ T6108] get_page_from_freelist+0x28c0/0x2960 [ 122.573480][ T6108] __alloc_frozen_pages_noprof+0x181/0x370 [ 122.573506][ T6108] alloc_pages_mpol+0xd1/0x380 [ 122.573522][ T6108] vma_alloc_folio_noprof+0xe4/0x280 [ 122.573538][ T6108] folio_prealloc+0x30/0x180 [ 122.573567][ T6108] do_pte_missing+0x509/0x27a0 [ 122.573584][ T6108] handle_mm_fault+0xcc1/0x1330 [ 122.573608][ T6108] do_user_addr_fault+0xa7c/0x1380 [ 122.573630][ T6108] exc_page_fault+0x71/0xd0 [ 122.573645][ T6108] asm_exc_page_fault+0x26/0x30 [ 122.573662][ T6108] page last free pid 5920 tgid 5920 stack trace: [ 122.573673][ T6108] free_unref_folios+0xc28/0x1810 [ 122.573700][ T6108] folios_put_refs+0x569/0x670 [ 122.573716][ T6108] free_pages_and_swap_cache+0x277/0x520 [ 122.573738][ T6108] tlb_flush_mmu+0x3a0/0x680 [ 122.573753][ T6108] tlb_finish_mmu+0xc3/0x1d0 [ 122.573770][ T6108] exit_mmap+0x439/0xb10 [ 122.573796][ T6108] __mmput+0xcb/0x3d0 [ 122.573814][ T6108] exit_mm+0x169/0x230 [ 122.573838][ T6108] do_exit+0x627/0x22f0 [ 122.573863][ T6108] do_group_exit+0x21c/0x2d0 [ 122.573890][ T6108] get_signal+0x125d/0x1310 [ 122.573907][ T6108] arch_do_signal_or_restart+0x9a/0x7a0 [ 122.573937][ T6108] exit_to_user_mode_loop+0x87/0x4e0 [ 122.573962][ T6108] do_syscall_64+0x2b7/0xf80 [ 122.573978][ T6108] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.573995][ T6108] [ 122.574000][ T6108] Memory state around the buggy address: [ 122.574011][ T6108] ffff888054ee7c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 122.574026][ T6108] ffff888054ee7c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 122.574039][ T6108] >ffff888054ee7d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 122.574050][ T6108] ^ [ 122.574060][ T6108] ffff888054ee7d80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 122.574073][ T6108] ffff888054ee7e00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 122.574082][ T6108] ================================================================== [ 122.818621][ T6108] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 122.818643][ T6108] CPU: 1 UID: 0 PID: 6108 Comm: syz.0.20 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 122.818665][ T6108] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 122.818676][ T6108] Call Trace: [ 122.818683][ T6108] [ 122.818692][ T6108] vpanic+0x1e0/0x670 [ 122.818723][ T6108] panic+0xb9/0xc0 [ 122.818746][ T6108] ? __pfx_panic+0x10/0x10 [ 122.818771][ T6108] ? preempt_schedule_common+0x83/0xd0 [ 122.818802][ T6108] ? ext4_find_extent+0xae6/0xcc0 [ 122.818825][ T6108] check_panic_on_warn+0x89/0xb0 [ 122.818852][ T6108] ? ext4_find_extent+0xae6/0xcc0 [ 122.818874][ T6108] end_report+0x6f/0x140 [ 122.818900][ T6108] kasan_report+0x129/0x150 [ 122.818927][ T6108] ? ext4_find_extent+0xae6/0xcc0 [ 122.818953][ T6108] ext4_find_extent+0xae6/0xcc0 [ 122.818980][ T6108] ext4_ext_map_blocks+0x278/0x69c0 [ 122.819012][ T6108] ? __lock_acquire+0x6b6/0x2cf0 [ 122.819038][ T6108] ? __lock_acquire+0x6b6/0x2cf0 [ 122.819062][ T6108] ? __lock_acquire+0x6b6/0x2cf0 [ 122.819084][ T6108] ? __pfx_ext4_ext_map_blocks+0x10/0x10 [ 122.819110][ T6108] ? rt_read_lock+0x203/0x490 [ 122.819138][ T6108] ? ext4_map_blocks+0x4a4/0x16f0 [ 122.819158][ T6108] ext4_map_query_blocks+0x135/0x9f0 [ 122.819180][ T6108] ? __pfx_ext4_map_query_blocks+0x10/0x10 [ 122.819197][ T6108] ? down_read+0x181/0x1f0 [ 122.819215][ T6108] ? __pfx_down_read+0x10/0x10 [ 122.819233][ T6108] ? ext4_es_lookup_extent+0x6cd/0xb00 [ 122.819253][ T6108] ext4_map_blocks+0x4b8/0x16f0 [ 122.819277][ T6108] ? __pfx_ext4_map_blocks+0x10/0x10 [ 122.819304][ T6108] ? __lock_acquire+0x6b6/0x2cf0 [ 122.819333][ T6108] _ext4_get_block+0x1fa/0x4c0 [ 122.819351][ T6108] ? __pfx__ext4_get_block+0x10/0x10 [ 122.819371][ T6108] ? __ext4_journal_ensure_credits+0x30/0x450 [ 122.819396][ T6108] ext4_block_write_begin+0xb03/0x1940 [ 122.819422][ T6108] ? __pfx_ext4_get_block+0x10/0x10 [ 122.819440][ T6108] ? __pfx_ext4_block_write_begin+0x10/0x10 [ 122.819460][ T6108] ? folio_mapping+0x16f/0x1f0 [ 122.819483][ T6108] ext4_write_begin+0xb3a/0x1870 [ 122.819518][ T6108] ? __pfx_ext4_write_begin+0x10/0x10 [ 122.819543][ T6108] ? __ext4_mark_inode_dirty+0x4c8/0x6e0 [ 122.819564][ T6108] ext4_da_write_begin+0x352/0xd30 [ 122.819596][ T6108] ? __pfx_ext4_da_write_begin+0x10/0x10 [ 122.819632][ T6108] generic_perform_write+0x29d/0x8c0 [ 122.819664][ T6108] ? __pfx_generic_perform_write+0x10/0x10 [ 122.819700][ T6108] ? file_update_time_flags+0x44e/0x4f0 [ 122.819725][ T6108] ? ext4_write_checks+0x24d/0x2d0 [ 122.819745][ T6108] ext4_buffered_write_iter+0xd0/0x3a0 [ 122.819768][ T6108] ext4_file_write_iter+0x293/0x1be0 [ 122.819788][ T6108] ? try_to_wake_up+0x82b/0x12b0 [ 122.819816][ T6108] ? vfs_write+0x217/0xb40 [ 122.819840][ T6108] ? vfs_write+0x217/0xb40 [ 122.819863][ T6108] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 122.819888][ T6108] vfs_write+0x5d5/0xb40 [ 122.819914][ T6108] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 122.819933][ T6108] ? __pfx_vfs_write+0x10/0x10 [ 122.819961][ T6108] ? __fget_files+0x2a/0x420 [ 122.819983][ T6108] __x64_sys_pwrite64+0x196/0x220 [ 122.820013][ T6108] ? __pfx___x64_sys_pwrite64+0x10/0x10 [ 122.820045][ T6108] do_syscall_64+0xec/0xf80 [ 122.820064][ T6108] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.820083][ T6108] ? trace_irq_disable+0x37/0x100 [ 122.820102][ T6108] ? clear_bhb_loop+0x60/0xb0 [ 122.820122][ T6108] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.820142][ T6108] RIP: 0033:0x7f1b9f20f749 [ 122.820171][ T6108] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 122.820187][ T6108] RSP: 002b:00007f1b9e876038 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 [ 122.820210][ T6108] RAX: ffffffffffffffda RBX: 00007f1b9f465fa0 RCX: 00007f1b9f20f749 [ 122.820225][ T6108] RDX: 000000000000fdef RSI: 0000200000000140 RDI: 0000000000000004 [ 122.820238][ T6108] RBP: 00007f1b9f293f91 R08: 0000000000000000 R09: 0000000000000000 [ 122.820251][ T6108] R10: 0000000000000e7c R11: 0000000000000246 R12: 0000000000000000 [ 122.820264][ T6108] R13: 00007f1b9f466038 R14: 00007f1b9f465fa0 R15: 00007fff436979b8 [ 122.820302][ T6108] [ 122.820452][ T6108] Kernel Offset: disabled