KASAN: use-after-free Read in ring_buffer_consume

Status: premoderation: reported on 2026/09/24 02:43
Reported-by: syzbot+5ec6906607257d49d2a6@syzkaller.appspotmail.com
First crash: 16d, last: 16d

Sample crash report:
RBP: 00007f04ca31706b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f04ca508218 R14: 00007f04ca508180 R15: 00007ffc62da3018
 </TASK>
---[ end trace 999d4c298a68e971 ]---
==================================================================
BUG: KASAN: use-after-free in rb_buffer_peek+0x71a/0x7a0 kernel/trace/ring_buffer.c:4747
Read of size 4 at addr ffff88813e1a254d by task syz.2.762/3036

CPU: 0 PID: 3036 Comm: syz.2.762 Tainted: G        W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:427 [inline]
 kasan_report+0x10f/0x150 mm/kasan/report.c:444
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
 rb_buffer_peek+0x71a/0x7a0 kernel/trace/ring_buffer.c:4747
 ring_buffer_consume+0x1aa/0x370 kernel/trace/ring_buffer.c:5021
 trace_consume kernel/trace/trace.c:4007 [inline]
 tracing_read_pipe+0x599/0xab0 kernel/trace/trace.c:6845
 vfs_read+0x28c/0xc20 fs/read_write.c:483
 ksys_read+0x14a/0x260 fs/read_write.c:623
 __do_sys_read fs/read_write.c:633 [inline]
 __se_sys_read fs/read_write.c:631 [inline]
 __x64_sys_read+0x7b/0x90 fs/read_write.c:631
 x64_sys_call+0x96d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f04ca280159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f04c8c97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f04ca508180 RCX: 00007f04ca280159
RDX: 0000000000004000 RSI: 00002000000091c0 RDI: 0000000000000005
RBP: 00007f04ca31706b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f04ca508218 R14: 00007f04ca508180 R15: 00007ffc62da3018
 </TASK>

The buggy address belongs to the page:
page:ffffea0004f86880 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x100 pfn:0x13e1a2
flags: 0x4000000000000000(zone=1)
raw: 4000000000000000 ffffea0004f86908 ffffea0004f86808 0000000000000000
raw: 0000000000000100 0000000000000000 00000000ffffff7f 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Movable, gfp_mask 0x100cca(GFP_HIGHUSER_MOVABLE), pid 424, ts 33822140358, free_ts 290593464004
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x192/0x1b0 mm/page_alloc.c:2607
 prep_new_page+0x1c/0x110 mm/page_alloc.c:2613
 get_page_from_freelist+0x2c3a/0x2cd0 mm/page_alloc.c:4487
 __alloc_pages+0x1a2/0x460 mm/page_alloc.c:5824
 __alloc_pages_node include/linux/gfp.h:595 [inline]
 alloc_pages_node include/linux/gfp.h:609 [inline]
 alloc_pages include/linux/gfp.h:622 [inline]
 shmem_alloc_page mm/shmem.c:1587 [inline]
 shmem_alloc_and_acct_page+0x4a2/0x8d0 mm/shmem.c:1612
 shmem_getpage_gfp+0x127d/0x2250 mm/shmem.c:1908
 shmem_getpage mm/shmem.c:152 [inline]
 shmem_write_begin+0xce/0x1b0 mm/shmem.c:2476
 generic_perform_write+0x2b7/0x690 mm/filemap.c:3887
 __generic_file_write_iter+0x268/0x490 mm/filemap.c:4015
 generic_file_write_iter+0xa9/0x1d0 mm/filemap.c:4047
 __kernel_write+0x521/0x970 fs/read_write.c:539
 __dump_emit+0x255/0x380 fs/coredump.c:880
 dump_emit+0x36a/0x3d0 fs/coredump.c:917
 dump_user_range+0x86/0x1c0 fs/coredump.c:954
 elf_core_dump+0x2aa4/0x2ff0 fs/binfmt_elf.c:2285
 do_coredump+0x13c2/0x27d0 fs/coredump.c:831
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 free_pages_prepare mm/page_alloc.c:1474 [inline]
 free_pcp_prepare mm/page_alloc.c:1546 [inline]
 free_unref_page_prepare+0x5fa/0x600 mm/page_alloc.c:3536
 free_unref_page_list+0x138/0x9e0 mm/page_alloc.c:3673
 release_pages+0x1264/0x12c0 mm/swap.c:1015
 __pagevec_release+0x71/0xe0 mm/swap.c:1035
 pagevec_release include/linux/pagevec.h:81 [inline]
 shmem_undo_range+0x564/0x13b0 mm/shmem.c:965
 shmem_truncate_range mm/shmem.c:1064 [inline]
 shmem_evict_inode+0x1dc/0x970 mm/shmem.c:1146
 evict+0x4b6/0x8b0 fs/inode.c:650
 iput_final fs/inode.c:1779 [inline]
 iput+0x651/0x7e0 fs/inode.c:1805
 dentry_unlink_inode+0x338/0x3e0 fs/dcache.c:380
 __dentry_kill+0x45b/0x660 fs/dcache.c:586
 shrink_dentry_list+0x38e/0x500 fs/dcache.c:1181
 shrink_dcache_parent+0xa9/0x270 fs/dcache.c:-1
 do_one_tree+0x27/0xe0 fs/dcache.c:1662
 shrink_dcache_for_umount+0x6a/0x110 fs/dcache.c:1679
 generic_shutdown_super+0x66/0x330 fs/super.c:447
 kill_anon_super fs/super.c:1089 [inline]
 kill_litter_super+0x77/0xa0 fs/super.c:1098

Memory state around the buggy address:
 ffff88813e1a2400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88813e1a2480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88813e1a2500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                              ^
 ffff88813e1a2580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88813e1a2600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 arch_atomic_inc include/linux/instrumented.h:101 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 atomic_inc include/linux/atomic/atomic-instrumented.h:182 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Modules linked in:
CPU: 0 PID: 3036 Comm: syz.2.762 Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Code: 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 2d 33 3d 00 48 8b 1b 48 8d 7b 08 be 04 00 00 00 e8 1c 35 3d 00 f0 ff 43 08 <0f> 0b 4c 8b 64 24 38 4d 85 e4 74 3d 43 0f b6 44 3d 00 84 c0 0f 85
RSP: 0018:ffffc900011a7940 EFLAGS: 00010006
RAX: 1ffff11020031d01 RBX: ffff888100052600 RCX: ffffffff816c0a84
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff888100052608
RBP: ffffc900011a7aa8 R08: ffff88810005260b R09: 1ffff1102000a4c1
R10: dffffc0000000000 R11: ffffed102000a4c2 R12: 000000003de0053d
R13: 1ffff11020070553 R14: 1ffff11020070556 R15: dffffc0000000000
FS:  00007f04c8c976c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b33c23ffc CR3: 000000014c2e5000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 rb_advance_reader+0x2b/0x6b0 kernel/trace/ring_buffer.c:4669
 ring_buffer_consume+0x1e7/0x370 kernel/trace/ring_buffer.c:5024
 trace_consume kernel/trace/trace.c:4007 [inline]
 tracing_read_pipe+0x599/0xab0 kernel/trace/trace.c:6845
 vfs_read+0x28c/0xc20 fs/read_write.c:483
 ksys_read+0x14a/0x260 fs/read_write.c:623
 __do_sys_read fs/read_write.c:633 [inline]
 __se_sys_read fs/read_write.c:631 [inline]
 __x64_sys_read+0x7b/0x90 fs/read_write.c:631
 x64_sys_call+0x96d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f04ca280159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f04c8c97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f04ca508180 RCX: 00007f04ca280159
RDX: 0000000000004000 RSI: 00002000000091c0 RDI: 0000000000000005
RBP: 00007f04ca31706b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f04ca508218 R14: 00007f04ca508180 R15: 00007ffc62da3018
 </TASK>
---[ end trace 999d4c298a68e972 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 arch_atomic_inc include/linux/instrumented.h:101 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 atomic_inc include/linux/atomic/atomic-instrumented.h:182 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Modules linked in:
CPU: 0 PID: 3036 Comm: syz.2.762 Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Code: 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 2d 33 3d 00 48 8b 1b 48 8d 7b 08 be 04 00 00 00 e8 1c 35 3d 00 f0 ff 43 08 <0f> 0b 4c 8b 64 24 38 4d 85 e4 74 3d 43 0f b6 44 3d 00 84 c0 0f 85
RSP: 0018:ffffc900011a77e0 EFLAGS: 00010002
RAX: 1ffff11020031d01 RBX: ffff888100052600 RCX: ffffffff816c0a84
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff888100052608
RBP: ffffc900011a7958 R08: ffff88810005260b R09: 1ffff1102000a4c1
R10: dffffc0000000000 R11: ffffed102000a4c2 R12: 000000003de00541
R13: 1ffff11020070553 R14: 1ffff11020070556 R15: dffffc0000000000
FS:  00007f04c8c976c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f65ea60b840 CR3: 000000014c2e5000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 rb_buffer_peek+0x60/0x7a0 kernel/trace/ring_buffer.c:4741
 ring_buffer_peek+0x184/0x3b0 kernel/trace/ring_buffer.c:4941
 peek_next_entry kernel/trace/trace.c:3571 [inline]
 __find_next_entry+0x34d/0x6b0 kernel/trace/trace.c:3615
 trace_find_next_entry_inc kernel/trace/trace.c:3996 [inline]
 tracing_read_pipe+0x3b8/0xab0 kernel/trace/trace.c:6821
 vfs_read+0x28c/0xc20 fs/read_write.c:483
 ksys_read+0x14a/0x260 fs/read_write.c:623
 __do_sys_read fs/read_write.c:633 [inline]
 __se_sys_read fs/read_write.c:631 [inline]
 __x64_sys_read+0x7b/0x90 fs/read_write.c:631
 x64_sys_call+0x96d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f04ca280159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f04c8c97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f04ca508180 RCX: 00007f04ca280159
RDX: 0000000000004000 RSI: 00002000000091c0 RDI: 0000000000000005
RBP: 00007f04ca31706b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f04ca508218 R14: 00007f04ca508180 R15: 00007ffc62da3018
 </TASK>
---[ end trace 999d4c298a68e973 ]---
------------[ cut here ]------------
WARNING: CPU: 1 PID: 3036 at kernel/trace/ring_buffer.c:4528 arch_atomic_inc include/linux/instrumented.h:101 [inline]
WARNING: CPU: 1 PID: 3036 at kernel/trace/ring_buffer.c:4528 atomic_inc include/linux/atomic/atomic-instrumented.h:182 [inline]
WARNING: CPU: 1 PID: 3036 at kernel/trace/ring_buffer.c:4528 rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Modules linked in:
CPU: 1 PID: 3036 Comm: syz.2.762 Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Code: 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 2d 33 3d 00 48 8b 1b 48 8d 7b 08 be 04 00 00 00 e8 1c 35 3d 00 f0 ff 43 08 <0f> 0b 4c 8b 64 24 38 4d 85 e4 74 3d 43 0f b6 44 3d 00 84 c0 0f 85
RSP: 0018:ffffc900011a7920 EFLAGS: 00010006
RAX: 1ffff11020031d01 RBX: ffff888100052600 RCX: ffffffff816c0a84
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff888100052608
RBP: ffffc900011a7a98 R08: ffff88810005260b R09: 1ffff1102000a4c1
R10: dffffc0000000000 R11: ffffed102000a4c2 R12: 000000003de00541
R13: 1ffff11020070553 R14: 1ffff11020070556 R15: dffffc0000000000
FS:  00007f04c8c976c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b33c1dff8 CR3: 000000014c2e5000 CR4: 00000000003526a0
Call Trace:
 <TASK>
 rb_buffer_peek+0x60/0x7a0 kernel/trace/ring_buffer.c:4741
 ring_buffer_consume+0x1aa/0x370 kernel/trace/ring_buffer.c:5021
 trace_consume kernel/trace/trace.c:4007 [inline]
 tracing_read_pipe+0x599/0xab0 kernel/trace/trace.c:6845
 vfs_read+0x28c/0xc20 fs/read_write.c:483
 ksys_read+0x14a/0x260 fs/read_write.c:623
 __do_sys_read fs/read_write.c:633 [inline]
 __se_sys_read fs/read_write.c:631 [inline]
 __x64_sys_read+0x7b/0x90 fs/read_write.c:631
 x64_sys_call+0x96d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f04ca280159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f04c8c97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f04ca508180 RCX: 00007f04ca280159
RDX: 0000000000004000 RSI: 00002000000091c0 RDI: 0000000000000005
RBP: 00007f04ca31706b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f04ca508218 R14: 00007f04ca508180 R15: 00007ffc62da3018
 </TASK>
---[ end trace 999d4c298a68e974 ]---
------------[ cut here ]------------
WARNING: CPU: 1 PID: 3036 at kernel/trace/ring_buffer.c:4528 arch_atomic_inc include/linux/instrumented.h:101 [inline]
WARNING: CPU: 1 PID: 3036 at kernel/trace/ring_buffer.c:4528 atomic_inc include/linux/atomic/atomic-instrumented.h:182 [inline]
WARNING: CPU: 1 PID: 3036 at kernel/trace/ring_buffer.c:4528 rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Modules linked in:
CPU: 1 PID: 3036 Comm: syz.2.762 Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Code: 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 2d 33 3d 00 48 8b 1b 48 8d 7b 08 be 04 00 00 00 e8 1c 35 3d 00 f0 ff 43 08 <0f> 0b 4c 8b 64 24 38 4d 85 e4 74 3d 43 0f b6 44 3d 00 84 c0 0f 85
RSP: 0018:ffffc900011a7940 EFLAGS: 00010002
RAX: 1ffff11020031d01 RBX: ffff888100052600 RCX: ffffffff816c0a84
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff888100052608
RBP: ffffc900011a7aa8 R08: ffff88810005260b R09: 1ffff1102000a4c1
R10: dffffc0000000000 R11: ffffed102000a4c2 R12: 000000003de00541
R13: 1ffff11020070553 R14: 1ffff11020070556 R15: dffffc0000000000
FS:  00007f04c8c976c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b33c1dff8 CR3: 000000014c2e5000 CR4: 00000000003526a0
Call Trace:
 <TASK>
 rb_advance_reader+0x2b/0x6b0 kernel/trace/ring_buffer.c:4669
 ring_buffer_consume+0x1e7/0x370 kernel/trace/ring_buffer.c:5024
 trace_consume kernel/trace/trace.c:4007 [inline]
 tracing_read_pipe+0x599/0xab0 kernel/trace/trace.c:6845
 vfs_read+0x28c/0xc20 fs/read_write.c:483
 ksys_read+0x14a/0x260 fs/read_write.c:623
 __do_sys_read fs/read_write.c:633 [inline]
 __se_sys_read fs/read_write.c:631 [inline]
 __x64_sys_read+0x7b/0x90 fs/read_write.c:631
 x64_sys_call+0x96d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f04ca280159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f04c8c97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f04ca508180 RCX: 00007f04ca280159
RDX: 0000000000004000 RSI: 00002000000091c0 RDI: 0000000000000005
RBP: 00007f04ca31706b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f04ca508218 R14: 00007f04ca508180 R15: 00007ffc62da3018
 </TASK>
---[ end trace 999d4c298a68e975 ]---
------------[ cut here ]------------
WARNING: CPU: 1 PID: 3036 at kernel/trace/ring_buffer.c:4528 arch_atomic_inc include/linux/instrumented.h:101 [inline]
WARNING: CPU: 1 PID: 3036 at kernel/trace/ring_buffer.c:4528 atomic_inc include/linux/atomic/atomic-instrumented.h:182 [inline]
WARNING: CPU: 1 PID: 3036 at kernel/trace/ring_buffer.c:4528 rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Modules linked in:
CPU: 1 PID: 3036 Comm: syz.2.762 Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Code: 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 2d 33 3d 00 48 8b 1b 48 8d 7b 08 be 04 00 00 00 e8 1c 35 3d 00 f0 ff 43 08 <0f> 0b 4c 8b 64 24 38 4d 85 e4 74 3d 43 0f b6 44 3d 00 84 c0 0f 85
RSP: 0018:ffffc900011a77e0 EFLAGS: 00010002
RAX: 1ffff11020031d01 RBX: ffff888100052600 RCX: ffffffff816c0a84
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff888100052608
RBP: ffffc900011a7958 R08: ffff88810005260b R09: 1ffff1102000a4c1
R10: dffffc0000000000 R11: ffffed102000a4c2 R12: 000000003de00545
R13: 1ffff11020070553 R14: 1ffff11020070556 R15: dffffc0000000000
FS:  00007f04c8c976c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b33c1dff8 CR3: 000000014c2e5000 CR4: 00000000003526a0
Call Trace:
 <TASK>
 rb_buffer_peek+0x60/0x7a0 kernel/trace/ring_buffer.c:4741
 ring_buffer_peek+0x184/0x3b0 kernel/trace/ring_buffer.c:4941
 peek_next_entry kernel/trace/trace.c:3571 [inline]
 __find_next_entry+0x34d/0x6b0 kernel/trace/trace.c:3615
 trace_find_next_entry_inc kernel/trace/trace.c:3996 [inline]
 tracing_read_pipe+0x3b8/0xab0 kernel/trace/trace.c:6821
 vfs_read+0x28c/0xc20 fs/read_write.c:483
 ksys_read+0x14a/0x260 fs/read_write.c:623
 __do_sys_read fs/read_write.c:633 [inline]
 __se_sys_read fs/read_write.c:631 [inline]
 __x64_sys_read+0x7b/0x90 fs/read_write.c:631
 x64_sys_call+0x96d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f04ca280159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f04c8c97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f04ca508180 RCX: 00007f04ca280159
RDX: 0000000000004000 RSI: 00002000000091c0 RDI: 0000000000000005
RBP: 00007f04ca31706b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f04ca508218 R14: 00007f04ca508180 R15: 00007ffc62da3018
 </TASK>
---[ end trace 999d4c298a68e976 ]---
------------[ cut here ]------------
WARNING: CPU: 1 PID: 3036 at kernel/trace/ring_buffer.c:4528 arch_atomic_inc include/linux/instrumented.h:101 [inline]
WARNING: CPU: 1 PID: 3036 at kernel/trace/ring_buffer.c:4528 atomic_inc include/linux/atomic/atomic-instrumented.h:182 [inline]
WARNING: CPU: 1 PID: 3036 at kernel/trace/ring_buffer.c:4528 rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Modules linked in:
CPU: 1 PID: 3036 Comm: syz.2.762 Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Code: 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 2d 33 3d 00 48 8b 1b 48 8d 7b 08 be 04 00 00 00 e8 1c 35 3d 00 f0 ff 43 08 <0f> 0b 4c 8b 64 24 38 4d 85 e4 74 3d 43 0f b6 44 3d 00 84 c0 0f 85
RSP: 0018:ffffc900011a7920 EFLAGS: 00010006
RAX: 1ffff11020031d01 RBX: ffff888100052600 RCX: ffffffff816c0a84
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff888100052608
RBP: ffffc900011a7a98 R08: ffff88810005260b R09: 1ffff1102000a4c1
R10: dffffc0000000000 R11: ffffed102000a4c2 R12: 000000003de00545
R13: 1ffff11020070553 R14: 1ffff11020070556 R15: dffffc0000000000
FS:  00007f04c8c976c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b33c1dff8 CR3: 000000014c2e5000 CR4: 00000000003526a0
Call Trace:
 <TASK>
 rb_buffer_peek+0x60/0x7a0 kernel/trace/ring_buffer.c:4741
 ring_buffer_consume+0x1aa/0x370 kernel/trace/ring_buffer.c:5021
 trace_consume kernel/trace/trace.c:4007 [inline]
 tracing_read_pipe+0x599/0xab0 kernel/trace/trace.c:6845
 vfs_read+0x28c/0xc20 fs/read_write.c:483
 ksys_read+0x14a/0x260 fs/read_write.c:623
 __do_sys_read fs/read_write.c:633 [inline]
 __se_sys_read fs/read_write.c:631 [inline]
 __x64_sys_read+0x7b/0x90 fs/read_write.c:631
 x64_sys_call+0x96d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f04ca280159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f04c8c97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f04ca508180 RCX: 00007f04ca280159
RDX: 0000000000004000 RSI: 00002000000091c0 RDI: 0000000000000005
RBP: 00007f04ca31706b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f04ca508218 R14: 00007f04ca508180 R15: 00007ffc62da3018
 </TASK>
---[ end trace 999d4c298a68e977 ]---
------------[ cut here ]------------
WARNING: CPU: 1 PID: 3036 at kernel/trace/ring_buffer.c:4528 arch_atomic_inc include/linux/instrumented.h:101 [inline]
WARNING: CPU: 1 PID: 3036 at kernel/trace/ring_buffer.c:4528 atomic_inc include/linux/atomic/atomic-instrumented.h:182 [inline]
WARNING: CPU: 1 PID: 3036 at kernel/trace/ring_buffer.c:4528 rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Modules linked in:
CPU: 1 PID: 3036 Comm: syz.2.762 Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Code: 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 2d 33 3d 00 48 8b 1b 48 8d 7b 08 be 04 00 00 00 e8 1c 35 3d 00 f0 ff 43 08 <0f> 0b 4c 8b 64 24 38 4d 85 e4 74 3d 43 0f b6 44 3d 00 84 c0 0f 85
RSP: 0018:ffffc900011a7940 EFLAGS: 00010006
RAX: 1ffff11020031d01 RBX: ffff888100052600 RCX: ffffffff816c0a84
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff888100052608
RBP: ffffc900011a7aa8 R08: ffff88810005260b R09: 1ffff1102000a4c1
R10: dffffc0000000000 R11: ffffed102000a4c2 R12: 000000003de00545
R13: 1ffff11020070553 R14: 1ffff11020070556 R15: dffffc0000000000
FS:  00007f04c8c976c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b33c1dff8 CR3: 000000014c2e5000 CR4: 00000000003526a0
Call Trace:
 <TASK>
 rb_advance_reader+0x2b/0x6b0 kernel/trace/ring_buffer.c:4669
 ring_buffer_consume+0x1e7/0x370 kernel/trace/ring_buffer.c:5024
 trace_consume kernel/trace/trace.c:4007 [inline]
 tracing_read_pipe+0x599/0xab0 kernel/trace/trace.c:6845
 vfs_read+0x28c/0xc20 fs/read_write.c:483
 ksys_read+0x14a/0x260 fs/read_write.c:623
 __do_sys_read fs/read_write.c:633 [inline]
 __se_sys_read fs/read_write.c:631 [inline]
 __x64_sys_read+0x7b/0x90 fs/read_write.c:631
 x64_sys_call+0x96d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f04ca280159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f04c8c97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f04ca508180 RCX: 00007f04ca280159
RDX: 0000000000004000 RSI: 00002000000091c0 RDI: 0000000000000005
RBP: 00007f04ca31706b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f04ca508218 R14: 00007f04ca508180 R15: 00007ffc62da3018
 </TASK>
---[ end trace 999d4c298a68e978 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 arch_atomic_inc include/linux/instrumented.h:101 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 atomic_inc include/linux/atomic/atomic-instrumented.h:182 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Modules linked in:
CPU: 0 PID: 3036 Comm: syz.2.762 Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Code: 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 2d 33 3d 00 48 8b 1b 48 8d 7b 08 be 04 00 00 00 e8 1c 35 3d 00 f0 ff 43 08 <0f> 0b 4c 8b 64 24 38 4d 85 e4 74 3d 43 0f b6 44 3d 00 84 c0 0f 85
RSP: 0018:ffffc900011a77e0 EFLAGS: 00010002
RAX: 1ffff11020031d01 RBX: ffff888100052600 RCX: ffffffff816c0a84
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff888100052608
RBP: ffffc900011a7958 R08: ffff88810005260b R09: 1ffff1102000a4c1
R10: dffffc0000000000 R11: ffffed102000a4c2 R12: 000000003de00549
R13: 1ffff11020070553 R14: 1ffff11020070556 R15: dffffc0000000000
FS:  00007f04c8c976c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f61d4000020 CR3: 000000014c2e5000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 rb_buffer_peek+0x60/0x7a0 kernel/trace/ring_buffer.c:4741
 ring_buffer_peek+0x184/0x3b0 kernel/trace/ring_buffer.c:4941
 peek_next_entry kernel/trace/trace.c:3571 [inline]
 __find_next_entry+0x34d/0x6b0 kernel/trace/trace.c:3615
 trace_find_next_entry_inc kernel/trace/trace.c:3996 [inline]
 tracing_read_pipe+0x3b8/0xab0 kernel/trace/trace.c:6821
 vfs_read+0x28c/0xc20 fs/read_write.c:483
 ksys_read+0x14a/0x260 fs/read_write.c:623
 __do_sys_read fs/read_write.c:633 [inline]
 __se_sys_read fs/read_write.c:631 [inline]
 __x64_sys_read+0x7b/0x90 fs/read_write.c:631
 x64_sys_call+0x96d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f04ca280159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f04c8c97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f04ca508180 RCX: 00007f04ca280159
RDX: 0000000000004000 RSI: 00002000000091c0 RDI: 0000000000000005
RBP: 00007f04ca31706b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f04ca508218 R14: 00007f04ca508180 R15: 00007ffc62da3018
 </TASK>
---[ end trace 999d4c298a68e979 ]---
------------[ cut here ]------------
WARNING: CPU: 1 PID: 3036 at kernel/trace/ring_buffer.c:4528 arch_atomic_inc include/linux/instrumented.h:101 [inline]
WARNING: CPU: 1 PID: 3036 at kernel/trace/ring_buffer.c:4528 atomic_inc include/linux/atomic/atomic-instrumented.h:182 [inline]
WARNING: CPU: 1 PID: 3036 at kernel/trace/ring_buffer.c:4528 rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Modules linked in:
CPU: 1 PID: 3036 Comm: syz.2.762 Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Code: 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 2d 33 3d 00 48 8b 1b 48 8d 7b 08 be 04 00 00 00 e8 1c 35 3d 00 f0 ff 43 08 <0f> 0b 4c 8b 64 24 38 4d 85 e4 74 3d 43 0f b6 44 3d 00 84 c0 0f 85
RSP: 0018:ffffc900011a7920 EFLAGS: 00010002
RAX: 1ffff11020031d01 RBX: ffff888100052600 RCX: ffffffff816c0a84
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff888100052608
RBP: ffffc900011a7a98 R08: ffff88810005260b R09: 1ffff1102000a4c1
R10: dffffc0000000000 R11: ffffed102000a4c2 R12: 000000003de00549
R13: 1ffff11020070553 R14: 1ffff11020070556 R15: dffffc0000000000
FS:  00007f04c8c976c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b32f1aff8 CR3: 000000014c2e5000 CR4: 00000000003506a0
Call Trace:
 <TASK>
 rb_buffer_peek+0x60/0x7a0 kernel/trace/ring_buffer.c:4741
 ring_buffer_consume+0x1aa/0x370 kernel/trace/ring_buffer.c:5021
 trace_consume kernel/trace/trace.c:4007 [inline]
 tracing_read_pipe+0x599/0xab0 kernel/trace/trace.c:6845
 vfs_read+0x28c/0xc20 fs/read_write.c:483
 ksys_read+0x14a/0x260 fs/read_write.c:623
 __do_sys_read fs/read_write.c:633 [inline]
 __se_sys_read fs/read_write.c:631 [inline]
 __x64_sys_read+0x7b/0x90 fs/read_write.c:631
 x64_sys_call+0x96d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f04ca280159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f04c8c97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f04ca508180 RCX: 00007f04ca280159
RDX: 0000000000004000 RSI: 00002000000091c0 RDI: 0000000000000005
RBP: 00007f04ca31706b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f04ca508218 R14: 00007f04ca508180 R15: 00007ffc62da3018
 </TASK>
---[ end trace 999d4c298a68e97a ]---
------------[ cut here ]------------
WARNING: CPU: 1 PID: 3036 at kernel/trace/ring_buffer.c:4528 arch_atomic_inc include/linux/instrumented.h:101 [inline]
WARNING: CPU: 1 PID: 3036 at kernel/trace/ring_buffer.c:4528 atomic_inc include/linux/atomic/atomic-instrumented.h:182 [inline]
WARNING: CPU: 1 PID: 3036 at kernel/trace/ring_buffer.c:4528 rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Modules linked in:
CPU: 1 PID: 3036 Comm: syz.2.762 Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Code: 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 2d 33 3d 00 48 8b 1b 48 8d 7b 08 be 04 00 00 00 e8 1c 35 3d 00 f0 ff 43 08 <0f> 0b 4c 8b 64 24 38 4d 85 e4 74 3d 43 0f b6 44 3d 00 84 c0 0f 85
RSP: 0018:ffffc900011a7940 EFLAGS: 00010006
RAX: 1ffff11020031d01 RBX: ffff888100052600 RCX: ffffffff816c0a84
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff888100052608
RBP: ffffc900011a7aa8 R08: ffff88810005260b R09: 1ffff1102000a4c1
R10: dffffc0000000000 R11: ffffed102000a4c2 R12: 000000003de00549
R13: 1ffff11020070553 R14: 1ffff11020070556 R15: dffffc0000000000
FS:  00007f04c8c976c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b32f1aff8 CR3: 000000014c2e5000 CR4: 00000000003506a0
Call Trace:
 <TASK>
 rb_advance_reader+0x2b/0x6b0 kernel/trace/ring_buffer.c:4669
 ring_buffer_consume+0x1e7/0x370 kernel/trace/ring_buffer.c:5024
 trace_consume kernel/trace/trace.c:4007 [inline]
 tracing_read_pipe+0x599/0xab0 kernel/trace/trace.c:6845
 vfs_read+0x28c/0xc20 fs/read_write.c:483
 ksys_read+0x14a/0x260 fs/read_write.c:623
 __do_sys_read fs/read_write.c:633 [inline]
 __se_sys_read fs/read_write.c:631 [inline]
 __x64_sys_read+0x7b/0x90 fs/read_write.c:631
 x64_sys_call+0x96d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f04ca280159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f04c8c97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f04ca508180 RCX: 00007f04ca280159
RDX: 0000000000004000 RSI: 00002000000091c0 RDI: 0000000000000005
RBP: 00007f04ca31706b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f04ca508218 R14: 00007f04ca508180 R15: 00007ffc62da3018
 </TASK>
---[ end trace 999d4c298a68e97b ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 arch_atomic_inc include/linux/instrumented.h:101 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 atomic_inc include/linux/atomic/atomic-instrumented.h:182 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Modules linked in:
CPU: 0 PID: 3036 Comm: syz.2.762 Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Code: 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 2d 33 3d 00 48 8b 1b 48 8d 7b 08 be 04 00 00 00 e8 1c 35 3d 00 f0 ff 43 08 <0f> 0b 4c 8b 64 24 38 4d 85 e4 74 3d 43 0f b6 44 3d 00 84 c0 0f 85
RSP: 0018:ffffc900011a77e0 EFLAGS: 00010002
RAX: 1ffff11020031d01 RBX: ffff888100052600 RCX: ffffffff816c0a84
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff888100052608
RBP: ffffc900011a7958 R08: ffff88810005260b R09: 1ffff1102000a4c1
R10: dffffc0000000000 R11: ffffed102000a4c2 R12: 000000003de0054d
R13: 1ffff11020070553 R14: 1ffff11020070556 R15: dffffc0000000000
FS:  00007f04c8c976c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b32f19ff8 CR3: 000000014c2e5000 CR4: 00000000003506b0
Call Trace:
 <TASK>
 rb_buffer_peek+0x60/0x7a0 kernel/trace/ring_buffer.c:4741
 ring_buffer_peek+0x184/0x3b0 kernel/trace/ring_buffer.c:4941
 peek_next_entry kernel/trace/trace.c:3571 [inline]
 __find_next_entry+0x34d/0x6b0 kernel/trace/trace.c:3615
 trace_find_next_entry_inc kernel/trace/trace.c:3996 [inline]
 tracing_read_pipe+0x3b8/0xab0 kernel/trace/trace.c:6821
 vfs_read+0x28c/0xc20 fs/read_write.c:483
 ksys_read+0x14a/0x260 fs/read_write.c:623
 __do_sys_read fs/read_write.c:633 [inline]
 __se_sys_read fs/read_write.c:631 [inline]
 __x64_sys_read+0x7b/0x90 fs/read_write.c:631
 x64_sys_call+0x96d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f04ca280159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f04c8c97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f04ca508180 RCX: 00007f04ca280159
RDX: 0000000000004000 RSI: 00002000000091c0 RDI: 0000000000000005
RBP: 00007f04ca31706b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f04ca508218 R14: 00007f04ca508180 R15: 00007ffc62da3018
 </TASK>
---[ end trace 999d4c298a68e97c ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 arch_atomic_inc include/linux/instrumented.h:101 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 atomic_inc include/linux/atomic/atomic-instrumented.h:182 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Modules linked in:
CPU: 0 PID: 3036 Comm: syz.2.762 Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Code: 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 2d 33 3d 00 48 8b 1b 48 8d 7b 08 be 04 00 00 00 e8 1c 35 3d 00 f0 ff 43 08 <0f> 0b 4c 8b 64 24 38 4d 85 e4 74 3d 43 0f b6 44 3d 00 84 c0 0f 85
RSP: 0018:ffffc900011a7920 EFLAGS: 00010006
RAX: 1ffff11020031d01 RBX: ffff888100052600 RCX: ffffffff816c0a84
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff888100052608
RBP: ffffc900011a7a98 R08: ffff88810005260b R09: 1ffff1102000a4c1
R10: dffffc0000000000 R11: ffffed102000a4c2 R12: 000000003de0054d
R13: 1ffff11020070553 R14: 1ffff11020070556 R15: dffffc0000000000
FS:  00007f04c8c976c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b32f19ff8 CR3: 000000014c2e5000 CR4: 00000000003506b0
Call Trace:
 <TASK>
 rb_buffer_peek+0x60/0x7a0 kernel/trace/ring_buffer.c:4741
 ring_buffer_consume+0x1aa/0x370 kernel/trace/ring_buffer.c:5021
 trace_consume kernel/trace/trace.c:4007 [inline]
 tracing_read_pipe+0x599/0xab0 kernel/trace/trace.c:6845
 vfs_read+0x28c/0xc20 fs/read_write.c:483
 ksys_read+0x14a/0x260 fs/read_write.c:623
 __do_sys_read fs/read_write.c:633 [inline]
 __se_sys_read fs/read_write.c:631 [inline]
 __x64_sys_read+0x7b/0x90 fs/read_write.c:631
 x64_sys_call+0x96d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f04ca280159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f04c8c97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f04ca508180 RCX: 00007f04ca280159
RDX: 0000000000004000 RSI: 00002000000091c0 RDI: 0000000000000005
RBP: 00007f04ca31706b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f04ca508218 R14: 00007f04ca508180 R15: 00007ffc62da3018
 </TASK>
---[ end trace 999d4c298a68e97d ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 arch_atomic_inc include/linux/instrumented.h:101 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 atomic_inc include/linux/atomic/atomic-instrumented.h:182 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Modules linked in:
CPU: 0 PID: 3036 Comm: syz.2.762 Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Code: 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 2d 33 3d 00 48 8b 1b 48 8d 7b 08 be 04 00 00 00 e8 1c 35 3d 00 f0 ff 43 08 <0f> 0b 4c 8b 64 24 38 4d 85 e4 74 3d 43 0f b6 44 3d 00 84 c0 0f 85
RSP: 0018:ffffc900011a7940 EFLAGS: 00010006
RAX: 1ffff11020031d01 RBX: ffff888100052600 RCX: ffffffff816c0a84
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff888100052608
RBP: ffffc900011a7aa8 R08: ffff88810005260b R09: 1ffff1102000a4c1
R10: dffffc0000000000 R11: ffffed102000a4c2 R12: 000000003de0054d
R13: 1ffff11020070553 R14: 1ffff11020070556 R15: dffffc0000000000
FS:  00007f04c8c976c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b32f19ff8 CR3: 000000014c2e5000 CR4: 00000000003506b0
Call Trace:
 <TASK>
 rb_advance_reader+0x2b/0x6b0 kernel/trace/ring_buffer.c:4669
 ring_buffer_consume+0x1e7/0x370 kernel/trace/ring_buffer.c:5024
 trace_consume kernel/trace/trace.c:4007 [inline]
 tracing_read_pipe+0x599/0xab0 kernel/trace/trace.c:6845
 vfs_read+0x28c/0xc20 fs/read_write.c:483
 ksys_read+0x14a/0x260 fs/read_write.c:623
 __do_sys_read fs/read_write.c:633 [inline]
 __se_sys_read fs/read_write.c:631 [inline]
 __x64_sys_read+0x7b/0x90 fs/read_write.c:631
 x64_sys_call+0x96d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f04ca280159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f04c8c97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f04ca508180 RCX: 00007f04ca280159
RDX: 0000000000004000 RSI: 00002000000091c0 RDI: 0000000000000005
RBP: 00007f04ca31706b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f04ca508218 R14: 00007f04ca508180 R15: 00007ffc62da3018
 </TASK>
---[ end trace 999d4c298a68e97e ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 arch_atomic_inc include/linux/instrumented.h:101 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 atomic_inc include/linux/atomic/atomic-instrumented.h:182 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Modules linked in:
CPU: 0 PID: 3036 Comm: syz.2.762 Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Code: 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 2d 33 3d 00 48 8b 1b 48 8d 7b 08 be 04 00 00 00 e8 1c 35 3d 00 f0 ff 43 08 <0f> 0b 4c 8b 64 24 38 4d 85 e4 74 3d 43 0f b6 44 3d 00 84 c0 0f 85
RSP: 0018:ffffc900011a77e0 EFLAGS: 00010002
RAX: 1ffff11020031d01 RBX: ffff888100052600 RCX: ffffffff816c0a84
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff888100052608
RBP: ffffc900011a7958 R08: ffff88810005260b R09: 1ffff1102000a4c1
R10: dffffc0000000000 R11: ffffed102000a4c2 R12: 000000003de00551
R13: 1ffff11020070553 R14: 1ffff11020070556 R15: dffffc0000000000
FS:  00007f04c8c976c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b32f19ff8 CR3: 000000014c2e5000 CR4: 00000000003506b0
Call Trace:
 <TASK>
 rb_buffer_peek+0x60/0x7a0 kernel/trace/ring_buffer.c:4741
 ring_buffer_peek+0x184/0x3b0 kernel/trace/ring_buffer.c:4941
 peek_next_entry kernel/trace/trace.c:3571 [inline]
 __find_next_entry+0x34d/0x6b0 kernel/trace/trace.c:3615
 trace_find_next_entry_inc kernel/trace/trace.c:3996 [inline]
 tracing_read_pipe+0x3b8/0xab0 kernel/trace/trace.c:6821
 vfs_read+0x28c/0xc20 fs/read_write.c:483
 ksys_read+0x14a/0x260 fs/read_write.c:623
 __do_sys_read fs/read_write.c:633 [inline]
 __se_sys_read fs/read_write.c:631 [inline]
 __x64_sys_read+0x7b/0x90 fs/read_write.c:631
 x64_sys_call+0x96d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f04ca280159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f04c8c97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f04ca508180 RCX: 00007f04ca280159
RDX: 0000000000004000 RSI: 00002000000091c0 RDI: 0000000000000005
RBP: 00007f04ca31706b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f04ca508218 R14: 00007f04ca508180 R15: 00007ffc62da3018
 </TASK>
---[ end trace 999d4c298a68e97f ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 arch_atomic_inc include/linux/instrumented.h:101 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 atomic_inc include/linux/atomic/atomic-instrumented.h:182 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Modules linked in:
CPU: 0 PID: 3036 Comm: syz.2.762 Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Code: 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 2d 33 3d 00 48 8b 1b 48 8d 7b 08 be 04 00 00 00 e8 1c 35 3d 00 f0 ff 43 08 <0f> 0b 4c 8b 64 24 38 4d 85 e4 74 3d 43 0f b6 44 3d 00 84 c0 0f 85
RSP: 0018:ffffc900011a7920 EFLAGS: 00010016
RAX: 1ffff11020031d01 RBX: ffff888100052600 RCX: ffffffff816c0a84
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff888100052608
RBP: ffffc900011a7a98 R08: ffff88810005260b R09: 1ffff1102000a4c1
R10: dffffc0000000000 R11: ffffed102000a4c2 R12: 000000003de00551
R13: 1ffff11020070553 R14: 1ffff11020070556 R15: dffffc0000000000
FS:  00007f04c8c976c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb1fb267000 CR3: 000000014c2e5000 CR4: 00000000003506b0
Call Trace:
 <TASK>
 rb_buffer_peek+0x60/0x7a0 kernel/trace/ring_buffer.c:4741
 ring_buffer_consume+0x1aa/0x370 kernel/trace/ring_buffer.c:5021
 trace_consume kernel/trace/trace.c:4007 [inline]
 tracing_read_pipe+0x599/0xab0 kernel/trace/trace.c:6845
 vfs_read+0x28c/0xc20 fs/read_write.c:483
 ksys_read+0x14a/0x260 fs/read_write.c:623
 __do_sys_read fs/read_write.c:633 [inline]
 __se_sys_read fs/read_write.c:631 [inline]
 __x64_sys_read+0x7b/0x90 fs/read_write.c:631
 x64_sys_call+0x96d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f04ca280159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f04c8c97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f04ca508180 RCX: 00007f04ca280159
RDX: 0000000000004000 RSI: 00002000000091c0 RDI: 0000000000000005
RBP: 00007f04ca31706b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f04ca508218 R14: 00007f04ca508180 R15: 00007ffc62da3018
 </TASK>
---[ end trace 999d4c298a68e980 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 arch_atomic_inc include/linux/instrumented.h:101 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 atomic_inc include/linux/atomic/atomic-instrumented.h:182 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Modules linked in:
CPU: 0 PID: 3036 Comm: syz.2.762 Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Code: 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 2d 33 3d 00 48 8b 1b 48 8d 7b 08 be 04 00 00 00 e8 1c 35 3d 00 f0 ff 43 08 <0f> 0b 4c 8b 64 24 38 4d 85 e4 74 3d 43 0f b6 44 3d 00 84 c0 0f 85
RSP: 0018:ffffc900011a7940 EFLAGS: 00010002
RAX: 1ffff11020031d01 RBX: ffff888100052600 RCX: ffffffff816c0a84
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff888100052608
RBP: ffffc900011a7aa8 R08: ffff88810005260b R09: 1ffff1102000a4c1
R10: dffffc0000000000 R11: ffffed102000a4c2 R12: 000000003de00551
R13: 1ffff11020070553 R14: 1ffff11020070556 R15: dffffc0000000000
FS:  00007f04c8c976c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb1fb267000 CR3: 000000014c2e5000 CR4: 00000000003506b0
Call Trace:
 <TASK>
 rb_advance_reader+0x2b/0x6b0 kernel/trace/ring_buffer.c:4669
 ring_buffer_consume+0x1e7/0x370 kernel/trace/ring_buffer.c:5024
 trace_consume kernel/trace/trace.c:4007 [inline]
 tracing_read_pipe+0x599/0xab0 kernel/trace/trace.c:6845
 vfs_read+0x28c/0xc20 fs/read_write.c:483
 ksys_read+0x14a/0x260 fs/read_write.c:623
 __do_sys_read fs/read_write.c:633 [inline]
 __se_sys_read fs/read_write.c:631 [inline]
 __x64_sys_read+0x7b/0x90 fs/read_write.c:631
 x64_sys_call+0x96d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f04ca280159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f04c8c97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f04ca508180 RCX: 00007f04ca280159
RDX: 0000000000004000 RSI: 00002000000091c0 RDI: 0000000000000005
RBP: 00007f04ca31706b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f04ca508218 R14: 00007f04ca508180 R15: 00007ffc62da3018
 </TASK>
---[ end trace 999d4c298a68e981 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 arch_atomic_inc include/linux/instrumented.h:101 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 atomic_inc include/linux/atomic/atomic-instrumented.h:182 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Modules linked in:
CPU: 0 PID: 3036 Comm: syz.2.762 Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Code: 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 2d 33 3d 00 48 8b 1b 48 8d 7b 08 be 04 00 00 00 e8 1c 35 3d 00 f0 ff 43 08 <0f> 0b 4c 8b 64 24 38 4d 85 e4 74 3d 43 0f b6 44 3d 00 84 c0 0f 85
RSP: 0018:ffffc900011a77e0 EFLAGS: 00010002
RAX: 1ffff11020031d01 RBX: ffff888100052600 RCX: ffffffff816c0a84
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff888100052608
RBP: ffffc900011a7958 R08: ffff88810005260b R09: 1ffff1102000a4c1
R10: dffffc0000000000 R11: ffffed102000a4c2 R12: 000000003de00555
R13: 1ffff11020070553 R14: 1ffff11020070556 R15: dffffc0000000000
FS:  00007f04c8c976c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb1fb267000 CR3: 000000014c2e5000 CR4: 00000000003506b0
Call Trace:
 <TASK>
 rb_buffer_peek+0x60/0x7a0 kernel/trace/ring_buffer.c:4741
 ring_buffer_peek+0x184/0x3b0 kernel/trace/ring_buffer.c:4941
 peek_next_entry kernel/trace/trace.c:3571 [inline]
 __find_next_entry+0x34d/0x6b0 kernel/trace/trace.c:3615
 trace_find_next_entry_inc kernel/trace/trace.c:3996 [inline]
 tracing_read_pipe+0x3b8/0xab0 kernel/trace/trace.c:6821
 vfs_read+0x28c/0xc20 fs/read_write.c:483
 ksys_read+0x14a/0x260 fs/read_write.c:623
 __do_sys_read fs/read_write.c:633 [inline]
 __se_sys_read fs/read_write.c:631 [inline]
 __x64_sys_read+0x7b/0x90 fs/read_write.c:631
 x64_sys_call+0x96d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f04ca280159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f04c8c97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f04ca508180 RCX: 00007f04ca280159
RDX: 0000000000004000 RSI: 00002000000091c0 RDI: 0000000000000005
RBP: 00007f04ca31706b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f04ca508218 R14: 00007f04ca508180 R15: 00007ffc62da3018
 </TASK>
---[ end trace 999d4c298a68e982 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 arch_atomic_inc include/linux/instrumented.h:101 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 atomic_inc include/linux/atomic/atomic-instrumented.h:182 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Modules linked in:
CPU: 0 PID: 3036 Comm: syz.2.762 Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Code: 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 2d 33 3d 00 48 8b 1b 48 8d 7b 08 be 04 00 00 00 e8 1c 35 3d 00 f0 ff 43 08 <0f> 0b 4c 8b 64 24 38 4d 85 e4 74 3d 43 0f b6 44 3d 00 84 c0 0f 85
RSP: 0018:ffffc900011a7920 EFLAGS: 00010006
RAX: 1ffff11020031d01 RBX: ffff888100052600 RCX: ffffffff816c0a84
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff888100052608
RBP: ffffc900011a7a98 R08: ffff88810005260b R09: 1ffff1102000a4c1
R10: dffffc0000000000 R11: ffffed102000a4c2 R12: 000000003de00555
R13: 1ffff11020070553 R14: 1ffff11020070556 R15: dffffc0000000000
FS:  00007f04c8c976c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb1fb267000 CR3: 000000014c2e5000 CR4: 00000000003506b0
Call Trace:
 <TASK>
 rb_buffer_peek+0x60/0x7a0 kernel/trace/ring_buffer.c:4741
 ring_buffer_consume+0x1aa/0x370 kernel/trace/ring_buffer.c:5021
 trace_consume kernel/trace/trace.c:4007 [inline]
 tracing_read_pipe+0x599/0xab0 kernel/trace/trace.c:6845
 vfs_read+0x28c/0xc20 fs/read_write.c:483
 ksys_read+0x14a/0x260 fs/read_write.c:623
 __do_sys_read fs/read_write.c:633 [inline]
 __se_sys_read fs/read_write.c:631 [inline]
 __x64_sys_read+0x7b/0x90 fs/read_write.c:631
 x64_sys_call+0x96d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f04ca280159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f04c8c97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f04ca508180 RCX: 00007f04ca280159
RDX: 0000000000004000 RSI: 00002000000091c0 RDI: 0000000000000005
RBP: 00007f04ca31706b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f04ca508218 R14: 00007f04ca508180 R15: 00007ffc62da3018
 </TASK>
---[ end trace 999d4c298a68e983 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 arch_atomic_inc include/linux/instrumented.h:101 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 atomic_inc include/linux/atomic/atomic-instrumented.h:182 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Modules linked in:
CPU: 0 PID: 3036 Comm: syz.2.762 Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Code: 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 2d 33 3d 00 48 8b 1b 48 8d 7b 08 be 04 00 00 00 e8 1c 35 3d 00 f0 ff 43 08 <0f> 0b 4c 8b 64 24 38 4d 85 e4 74 3d 43 0f b6 44 3d 00 84 c0 0f 85
RSP: 0018:ffffc900011a7940 EFLAGS: 00010002
RAX: 1ffff11020031d01 RBX: ffff888100052600 RCX: ffffffff816c0a84
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff888100052608
RBP: ffffc900011a7aa8 R08: ffff88810005260b R09: 1ffff1102000a4c1
R10: dffffc0000000000 R11: ffffed102000a4c2 R12: 000000003de00555
R13: 1ffff11020070553 R14: 1ffff11020070556 R15: dffffc0000000000
FS:  00007f04c8c976c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb1fb267000 CR3: 000000014c2e5000 CR4: 00000000003506b0
Call Trace:
 <TASK>
 rb_advance_reader+0x2b/0x6b0 kernel/trace/ring_buffer.c:4669
 ring_buffer_consume+0x1e7/0x370 kernel/trace/ring_buffer.c:5024
 trace_consume kernel/trace/trace.c:4007 [inline]
 tracing_read_pipe+0x599/0xab0 kernel/trace/trace.c:6845
 vfs_read+0x28c/0xc20 fs/read_write.c:483
 ksys_read+0x14a/0x260 fs/read_write.c:623
 __do_sys_read fs/read_write.c:633 [inline]
 __se_sys_read fs/read_write.c:631 [inline]
 __x64_sys_read+0x7b/0x90 fs/read_write.c:631
 x64_sys_call+0x96d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f04ca280159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f04c8c97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f04ca508180 RCX: 00007f04ca280159
RDX: 0000000000004000 RSI: 00002000000091c0 RDI: 0000000000000005
RBP: 00007f04ca31706b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f04ca508218 R14: 00007f04ca508180 R15: 00007ffc62da3018
 </TASK>
---[ end trace 999d4c298a68e984 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 arch_atomic_inc include/linux/instrumented.h:101 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 atomic_inc include/linux/atomic/atomic-instrumented.h:182 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Modules linked in:
CPU: 0 PID: 3036 Comm: syz.2.762 Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Code: 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 2d 33 3d 00 48 8b 1b 48 8d 7b 08 be 04 00 00 00 e8 1c 35 3d 00 f0 ff 43 08 <0f> 0b 4c 8b 64 24 38 4d 85 e4 74 3d 43 0f b6 44 3d 00 84 c0 0f 85
RSP: 0018:ffffc900011a77e0 EFLAGS: 00010006
RAX: 1ffff11020031d01 RBX: ffff888100052600 RCX: ffffffff816c0a84
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff888100052608
RBP: ffffc900011a7958 R08: ffff88810005260b R09: 1ffff1102000a4c1
R10: dffffc0000000000 R11: ffffed102000a4c2 R12: 000000003de00559
R13: 1ffff11020070553 R14: 1ffff11020070556 R15: dffffc0000000000
FS:  00007f04c8c976c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb1fb267000 CR3: 000000014c2e5000 CR4: 00000000003506b0
Call Trace:
 <TASK>
 rb_buffer_peek+0x60/0x7a0 kernel/trace/ring_buffer.c:4741
 ring_buffer_peek+0x184/0x3b0 kernel/trace/ring_buffer.c:4941
 peek_next_entry kernel/trace/trace.c:3571 [inline]
 __find_next_entry+0x34d/0x6b0 kernel/trace/trace.c:3615
 trace_find_next_entry_inc kernel/trace/trace.c:3996 [inline]
 tracing_read_pipe+0x3b8/0xab0 kernel/trace/trace.c:6821
 vfs_read+0x28c/0xc20 fs/read_write.c:483
 ksys_read+0x14a/0x260 fs/read_write.c:623
 __do_sys_read fs/read_write.c:633 [inline]
 __se_sys_read fs/read_write.c:631 [inline]
 __x64_sys_read+0x7b/0x90 fs/read_write.c:631
 x64_sys_call+0x96d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f04ca280159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f04c8c97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f04ca508180 RCX: 00007f04ca280159
RDX: 0000000000004000 RSI: 00002000000091c0 RDI: 0000000000000005
RBP: 00007f04ca31706b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f04ca508218 R14: 00007f04ca508180 R15: 00007ffc62da3018
 </TASK>
---[ end trace 999d4c298a68e985 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 arch_atomic_inc include/linux/instrumented.h:101 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 atomic_inc include/linux/atomic/atomic-instrumented.h:182 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Modules linked in:
CPU: 0 PID: 3036 Comm: syz.2.762 Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Code: 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 2d 33 3d 00 48 8b 1b 48 8d 7b 08 be 04 00 00 00 e8 1c 35 3d 00 f0 ff 43 08 <0f> 0b 4c 8b 64 24 38 4d 85 e4 74 3d 43 0f b6 44 3d 00 84 c0 0f 85
RSP: 0018:ffffc900011a7920 EFLAGS: 00010006
RAX: 1ffff11020031d01 RBX: ffff888100052600 RCX: ffffffff816c0a84
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff888100052608
RBP: ffffc900011a7a98 R08: ffff88810005260b R09: 1ffff1102000a4c1
R10: dffffc0000000000 R11: ffffed102000a4c2 R12: 000000003de00559
R13: 1ffff11020070553 R14: 1ffff11020070556 R15: dffffc0000000000
FS:  00007f04c8c976c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb1fb267000 CR3: 000000014c2e5000 CR4: 00000000003506b0
Call Trace:
 <TASK>
 rb_buffer_peek+0x60/0x7a0 kernel/trace/ring_buffer.c:4741
 ring_buffer_consume+0x1aa/0x370 kernel/trace/ring_buffer.c:5021
 trace_consume kernel/trace/trace.c:4007 [inline]
 tracing_read_pipe+0x599/0xab0 kernel/trace/trace.c:6845
 vfs_read+0x28c/0xc20 fs/read_write.c:483
 ksys_read+0x14a/0x260 fs/read_write.c:623
 __do_sys_read fs/read_write.c:633 [inline]
 __se_sys_read fs/read_write.c:631 [inline]
 __x64_sys_read+0x7b/0x90 fs/read_write.c:631
 x64_sys_call+0x96d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f04ca280159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f04c8c97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f04ca508180 RCX: 00007f04ca280159
RDX: 0000000000004000 RSI: 00002000000091c0 RDI: 0000000000000005
RBP: 00007f04ca31706b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f04ca508218 R14: 00007f04ca508180 R15: 00007ffc62da3018
 </TASK>
---[ end trace 999d4c298a68e986 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 arch_atomic_inc include/linux/instrumented.h:101 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 atomic_inc include/linux/atomic/atomic-instrumented.h:182 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Modules linked in:
CPU: 0 PID: 3036 Comm: syz.2.762 Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Code: 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 2d 33 3d 00 48 8b 1b 48 8d 7b 08 be 04 00 00 00 e8 1c 35 3d 00 f0 ff 43 08 <0f> 0b 4c 8b 64 24 38 4d 85 e4 74 3d 43 0f b6 44 3d 00 84 c0 0f 85
RSP: 0018:ffffc900011a7940 EFLAGS: 00010002
RAX: 1ffff11020031d01 RBX: ffff888100052600 RCX: ffffffff816c0a84
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff888100052608
RBP: ffffc900011a7aa8 R08: ffff88810005260b R09: 1ffff1102000a4c1
R10: dffffc0000000000 R11: ffffed102000a4c2 R12: 000000003de00559
R13: 1ffff11020070553 R14: 1ffff11020070556 R15: dffffc0000000000
FS:  00007f04c8c976c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb1fb267000 CR3: 000000014c2e5000 CR4: 00000000003506b0
Call Trace:
 <TASK>
 rb_advance_reader+0x2b/0x6b0 kernel/trace/ring_buffer.c:4669
 ring_buffer_consume+0x1e7/0x370 kernel/trace/ring_buffer.c:5024
 trace_consume kernel/trace/trace.c:4007 [inline]
 tracing_read_pipe+0x599/0xab0 kernel/trace/trace.c:6845
 vfs_read+0x28c/0xc20 fs/read_write.c:483
 ksys_read+0x14a/0x260 fs/read_write.c:623
 __do_sys_read fs/read_write.c:633 [inline]
 __se_sys_read fs/read_write.c:631 [inline]
 __x64_sys_read+0x7b/0x90 fs/read_write.c:631
 x64_sys_call+0x96d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f04ca280159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f04c8c97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f04ca508180 RCX: 00007f04ca280159
RDX: 0000000000004000 RSI: 00002000000091c0 RDI: 0000000000000005
RBP: 00007f04ca31706b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f04ca508218 R14: 00007f04ca508180 R15: 00007ffc62da3018
 </TASK>
---[ end trace 999d4c298a68e987 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 arch_atomic_inc include/linux/instrumented.h:101 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 atomic_inc include/linux/atomic/atomic-instrumented.h:182 [inline]
WARNING: CPU: 0 PID: 3036 at kernel/trace/ring_buffer.c:4528 rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Modules linked in:
CPU: 0 PID: 3036 Comm: syz.2.762 Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:rb_get_reader_page+0xa68/0xc00 kernel/trace/ring_buffer.c:4527
Code: 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 2d 33 3d 00 48 8b 1b 48 8d 7b 08 be 04 00 00 00 e8 1c 35 3d 00 f0 ff 43 08 <0f> 0b 4c 8b 64 24 38 4d 85 e4 74 3d 43 0f b6 44 3d 00 84 c0 0f 85
RSP: 0018:ffffc900011a77e0 EFLAGS: 00010002
RAX: 1ffff11020031d01 RBX: ffff888100052600 RCX: ffffffff816c0a84
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff888100052608
RBP: ffffc900011a7958 R08: ffff88810005260b R09: 1ffff1102000a4c1
R10: dffffc0000000000 R11: ffffed102000a4c2 R12: 000000003de0055d
R13: 1ffff11020070553 R14: 1ffff11020070556 R15: dffffc0000000000
FS:  00007f04c8c976c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb1fb267000 CR3: 000000014c2e5000 CR4: 00000000003506b0
Call Trace:
 <TASK>
 rb_buffer_peek+0x60/0x7a0 kernel/trace/ring_buffer.c:4741
 ring_buffer_peek+0x184/0x3b0 kernel/trace/ring_buffer.c:4941
 peek_next_entry kernel/trace/trace.c:3571 [inline]
 __find_next_entry+0x34d/0x6b0 kernel/trace/trace.c:3615
 trace_find_next_entry_inc kernel/trace/trace.c:3996 [inline]
 tracing_read_pipe+0x3b8/0xab0 kernel/trace/trace.c:6821
 vfs_read+0x28c/0xc20 fs/read_write.c:483
 ksys_read+0x14a/0x260 fs/read_write.c:623
 __do_sys_read fs/read_write.c:633 [inline]
 __se_sys_read fs/read_write.c:631 [inline]
 __x64_sys_read+0x7b/0x90 fs/read_write.c:631
 x64_sys_call+0x96d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f04ca280159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f04c8c97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f04ca508180 RCX: 00007f04ca280159
RDX: 0000000000004000 RSI: 00002000000091c0 RDI: 0000000000000005
RBP: 00007f04ca31706b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f04ca508218 R14: 00007f04ca508180 R15: 00007ffc62da3018
 </TASK>
---[ end trace 999d4c298a68e988 ]---

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/24 02:42 android13-5.15-lts 5bfe2b8c1439 0281b448 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-15 KASAN: use-after-free Read in ring_buffer_consume
* Struck through repros no longer work on HEAD.