Warning: Permanently added '[localhost]:36840' (ED25519) to the list of known hosts.
2025/08/05 15:18:35 ignoring optional flag "sandboxArg"="0"
2025/08/05 15:18:37 parsed 1 programs
syzkaller login: [ 89.924041][ T5348] cgroup: Unknown subsys name 'net'
[ 89.994719][ T5348] cgroup: Unknown subsys name 'cpuset'
[ 90.001683][ T5348] cgroup: Unknown subsys name 'rlimit'
[ 91.732161][ T5348] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 92.151736][ T10] cfg80211: failed to load regulatory.db
[ 95.764182][ T5364] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 96.745140][ T5379] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 96.752898][ T5379] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 96.757482][ T5379] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 96.770777][ T45] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 96.775325][ T45] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 97.177756][ T1083] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 97.191436][ T1083] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 97.218340][ T1083] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 97.223025][ T1083] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 98.982357][ T5417] chnl_net:caif_netlink_parms(): no params data found
[ 99.055611][ T5417] bridge0: port 1(bridge_slave_0) entered blocking state
[ 99.061099][ T5417] bridge0: port 1(bridge_slave_0) entered disabled state
[ 99.064329][ T5417] bridge_slave_0: entered allmulticast mode
[ 99.068321][ T5417] bridge_slave_0: entered promiscuous mode
[ 99.074999][ T5417] bridge0: port 2(bridge_slave_1) entered blocking state
[ 99.078180][ T5417] bridge0: port 2(bridge_slave_1) entered disabled state
[ 99.081934][ T5417] bridge_slave_1: entered allmulticast mode
[ 99.085746][ T5417] bridge_slave_1: entered promiscuous mode
[ 99.114520][ T5417] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 99.121807][ T5417] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 99.148651][ T5417] team0: Port device team_slave_0 added
[ 99.155033][ T5417] team0: Port device team_slave_1 added
[ 99.181135][ T5417] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 99.184315][ T5417] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 99.196134][ T5417] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 99.206141][ T5417] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 99.209159][ T5417] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 99.221335][ T5417] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 99.264967][ T5417] hsr_slave_0: entered promiscuous mode
[ 99.268372][ T5417] hsr_slave_1: entered promiscuous mode
[ 99.446686][ T5417] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 99.457239][ T5417] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 99.464874][ T5417] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 99.473276][ T5417] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 99.565740][ T5417] 8021q: adding VLAN 0 to HW filter on device bond0
[ 99.587610][ T5417] 8021q: adding VLAN 0 to HW filter on device team0
[ 99.597176][ T1041] bridge0: port 1(bridge_slave_0) entered blocking state
[ 99.600505][ T1041] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 99.616827][ T1041] bridge0: port 2(bridge_slave_1) entered blocking state
[ 99.619958][ T1041] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 99.847459][ T5417] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 99.887161][ T5417] veth0_vlan: entered promiscuous mode
[ 99.897725][ T5417] veth1_vlan: entered promiscuous mode
[ 99.924692][ T5417] veth0_macvtap: entered promiscuous mode
[ 99.929821][ T5417] veth1_macvtap: entered promiscuous mode
[ 99.948786][ T5417] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 99.959759][ T5417] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 99.975041][ T1041] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 99.983744][ T1041] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 99.987349][ T1041] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 100.006709][ T1041] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 100.153997][ T1094] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 100.209169][ T1094] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 100.266987][ T1094] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 100.326496][ T1094] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2025/08/05 15:18:51 executed programs: 0
[ 101.658088][ T4704] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 101.663208][ T4704] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 101.667113][ T4704] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 101.682892][ T4704] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 101.687427][ T4704] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 101.993131][ T5457] chnl_net:caif_netlink_parms(): no params data found
[ 102.147150][ T5457] bridge0: port 1(bridge_slave_0) entered blocking state
[ 102.164094][ T5457] bridge0: port 1(bridge_slave_0) entered disabled state
[ 102.167423][ T5457] bridge_slave_0: entered allmulticast mode
[ 102.182806][ T5457] bridge_slave_0: entered promiscuous mode
[ 102.192907][ T5457] bridge0: port 2(bridge_slave_1) entered blocking state
[ 102.196437][ T5457] bridge0: port 2(bridge_slave_1) entered disabled state
[ 102.199860][ T5457] bridge_slave_1: entered allmulticast mode
[ 102.222230][ T5457] bridge_slave_1: entered promiscuous mode
[ 102.287467][ T5457] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 102.302930][ T5457] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 102.336195][ T5457] team0: Port device team_slave_0 added
[ 102.340980][ T5457] team0: Port device team_slave_1 added
[ 102.364617][ T5457] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 102.367910][ T5457] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 102.379623][ T5457] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 102.387131][ T5457] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 102.392181][ T5457] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 102.404161][ T5457] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 102.439347][ T5457] hsr_slave_0: entered promiscuous mode
[ 102.442971][ T5457] hsr_slave_1: entered promiscuous mode
[ 102.446635][ T5457] debugfs: 'hsr0' already exists in 'hsr'
[ 102.449601][ T5457] Cannot create hsr debugfs directory
[ 102.659869][ T1094] bridge_slave_1: left allmulticast mode
[ 102.665873][ T1094] bridge_slave_1: left promiscuous mode
[ 102.669251][ T1094] bridge0: port 2(bridge_slave_1) entered disabled state
[ 102.692955][ T1094] bridge_slave_0: left allmulticast mode
[ 102.696134][ T1094] bridge_slave_0: left promiscuous mode
[ 102.699722][ T1094] bridge0: port 1(bridge_slave_0) entered disabled state
[ 103.149036][ T1094] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 103.162623][ T1094] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 103.167246][ T1094] bond0 (unregistering): Released all slaves
[ 103.289536][ T1094] hsr_slave_0: left promiscuous mode
[ 103.298631][ T1094] hsr_slave_1: left promiscuous mode
[ 103.302979][ T1094] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 103.306416][ T1094] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 103.314163][ T1094] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 103.318033][ T1094] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 103.329950][ T1094] veth1_macvtap: left promiscuous mode
[ 103.334654][ T1094] veth0_macvtap: left promiscuous mode
[ 103.338703][ T1094] veth1_vlan: left promiscuous mode
[ 103.341771][ T1094] veth0_vlan: left promiscuous mode
[ 103.686720][ T1094] team0 (unregistering): Port device team_slave_1 removed
[ 103.711497][ T4704] Bluetooth: hci0: command tx timeout
[ 103.715027][ T1094] team0 (unregistering): Port device team_slave_0 removed
[ 104.310070][ T5457] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 104.576787][ T5457] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 104.602380][ T5457] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 104.633111][ T5457] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 104.856649][ T5457] 8021q: adding VLAN 0 to HW filter on device bond0
[ 104.875254][ T5457] 8021q: adding VLAN 0 to HW filter on device team0
[ 104.886548][ T1094] bridge0: port 1(bridge_slave_0) entered blocking state
[ 104.889970][ T1094] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 104.903831][ T1094] bridge0: port 2(bridge_slave_1) entered blocking state
[ 104.907446][ T1094] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 105.097652][ T5457] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 105.134888][ T5457] veth0_vlan: entered promiscuous mode
[ 105.151716][ T5457] veth1_vlan: entered promiscuous mode
[ 105.178311][ T5457] veth0_macvtap: entered promiscuous mode
[ 105.185664][ T5457] veth1_macvtap: entered promiscuous mode
[ 105.200056][ T5457] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 105.218636][ T5457] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 105.228595][ T1040] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 105.244474][ T1040] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 105.248906][ T1040] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 105.263772][ T1040] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 105.323291][ T1083] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 105.326572][ T1083] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 105.361242][ T1094] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 105.364686][ T1094] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 105.423649][ T5487] loop0: detected capacity change from 0 to 512
[ 105.439867][ T5487] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support!
[ 105.460737][ T5487] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 105.482039][ T5487] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2848: Unable to expand inode 15. Delete some EAs or run e2fsck.
[ 105.494998][ T5487] EXT4-fs (loop0): 1 truncate cleaned up
[ 105.498897][ T5487] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[ 105.521377][ T5487] ==================================================================
[ 105.524866][ T5487] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x8e9/0x1e20
[ 105.528356][ T5487] Read of size 18446744073709551572 at addr ffff888011654850 by task syz.0.17/5487
[ 105.533981][ T5487]
[ 105.535267][ T5487] CPU: 0 UID: 0 PID: 5487 Comm: syz.0.17 Not tainted 6.16.0-syzkaller-11699-g7e161a991ea7 #0 PREEMPT(full)
[ 105.535286][ T5487] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 105.535292][ T5487] Call Trace:
[ 105.535300][ T5487]
[ 105.535306][ T5487] dump_stack_lvl+0x189/0x250
[ 105.535327][ T5487] ? __kasan_check_byte+0x12/0x40
[ 105.535342][ T5487] ? __pfx_dump_stack_lvl+0x10/0x10
[ 105.535354][ T5487] ? lock_release+0x4b/0x3e0
[ 105.535369][ T5487] ? __virt_addr_valid+0x4a5/0x5c0
[ 105.535384][ T5487] print_report+0xca/0x240
[ 105.535396][ T5487] ? ext4_xattr_set_entry+0x8e9/0x1e20
[ 105.535409][ T5487] kasan_report+0x118/0x150
[ 105.535421][ T5487] ? ext4_xattr_set_entry+0x8e9/0x1e20
[ 105.535434][ T5487] ? ext4_xattr_set_entry+0x8e9/0x1e20
[ 105.535447][ T5487] kasan_check_range+0x2b0/0x2c0
[ 105.535459][ T5487] ? ext4_xattr_set_entry+0x8e9/0x1e20
[ 105.535471][ T5487] __asan_memmove+0x29/0x70
[ 105.535481][ T5487] ext4_xattr_set_entry+0x8e9/0x1e20
[ 105.535499][ T5487] ext4_xattr_block_set+0x872/0x2ac0
[ 105.535511][ T5487] ? fs_reclaim_acquire+0x7d/0x100
[ 105.535529][ T5487] ? __pfx_check_xattrs+0x10/0x10
[ 105.535543][ T5487] ? __pfx_ext4_xattr_block_set+0x10/0x10
[ 105.535564][ T5487] ? ext4_xattr_block_find+0x2d4/0x350
[ 105.535578][ T5487] ext4_expand_extra_isize_ea+0x12d5/0x1ea0
[ 105.535594][ T5487] __ext4_expand_extra_isize+0x30d/0x400
[ 105.535605][ T5487] __ext4_mark_inode_dirty+0x46c/0x700
[ 105.535614][ T5487] __ext4_unlink+0x631/0xab0
[ 105.535623][ T5487] ? __pfx___ext4_unlink+0x10/0x10
[ 105.535630][ T5487] ? __pfx___dquot_initialize+0x10/0x10
[ 105.535641][ T5487] ? down_write+0x162/0x1f0
[ 105.535698][ T5487] ext4_unlink+0x216/0x5d0
[ 105.535706][ T5487] vfs_unlink+0x394/0x650
[ 105.535716][ T5487] do_unlinkat+0x345/0x560
[ 105.535727][ T5487] ? __pfx_do_unlinkat+0x10/0x10
[ 105.535739][ T5487] ? getname_flags+0x1e5/0x540
[ 105.535753][ T5487] __x64_sys_unlink+0x47/0x50
[ 105.535764][ T5487] do_syscall_64+0xfa/0x3b0
[ 105.535774][ T5487] ? lockdep_hardirqs_on+0x9c/0x150
[ 105.535782][ T5487] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 105.535788][ T5487] ? clear_bhb_loop+0x60/0xb0
[ 105.535796][ T5487] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 105.535804][ T5487] RIP: 0033:0x7ff21d18eb69
[ 105.535813][ T5487] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 105.535820][ T5487] RSP: 002b:00007fff90869208 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
[ 105.535829][ T5487] RAX: ffffffffffffffda RBX: 00007ff21d3b5fa0 RCX: 00007ff21d18eb69
[ 105.535834][ T5487] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000180
[ 105.535839][ T5487] RBP: 00007ff21d211df1 R08: 0000000000000000 R09: 0000000000000000
[ 105.535849][ T5487] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 105.535853][ T5487] R13: 00007ff21d3b5fa0 R14: 00007ff21d3b5fa0 R15: 0000000000000001
[ 105.535861][ T5487]
[ 105.535864][ T5487]
[ 105.667476][ T5487] Allocated by task 5487:
[ 105.669470][ T5487] kasan_save_track+0x3e/0x80
[ 105.671635][ T5487] __kasan_kmalloc+0x93/0xb0
[ 105.673754][ T5487] __kmalloc_node_track_caller_noprof+0x271/0x4e0
[ 105.676402][ T5487] kmemdup_noprof+0x2b/0x70
[ 105.678523][ T5487] ext4_xattr_block_set+0x781/0x2ac0
[ 105.680960][ T5487] ext4_expand_extra_isize_ea+0x12d5/0x1ea0
[ 105.684056][ T5487] __ext4_expand_extra_isize+0x30d/0x400
[ 105.686816][ T5487] __ext4_mark_inode_dirty+0x46c/0x700
[ 105.689441][ T5487] __ext4_unlink+0x631/0xab0
[ 105.691780][ T5487] ext4_unlink+0x216/0x5d0
[ 105.693779][ T5487] vfs_unlink+0x394/0x650
[ 105.695751][ T5487] do_unlinkat+0x345/0x560
[ 105.697879][ T5487] __x64_sys_unlink+0x47/0x50
[ 105.700607][ T5487] do_syscall_64+0xfa/0x3b0
[ 105.703200][ T5487] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 105.706042][ T5487]
[ 105.707083][ T5487] The buggy address belongs to the object at ffff888011654800
[ 105.707083][ T5487] which belongs to the cache kmalloc-1k of size 1024
[ 105.712936][ T5487] The buggy address is located 80 bytes inside of
[ 105.712936][ T5487] 1024-byte region [ffff888011654800, ffff888011654c00)
[ 105.718918][ T5487]
[ 105.720040][ T5487] The buggy address belongs to the physical page:
[ 105.722806][ T5487] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11654
[ 105.726788][ T5487] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 105.730719][ T5487] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 105.734392][ T5487] page_type: f5(slab)
[ 105.736296][ T5487] raw: 00fff00000000040 ffff88801a441dc0 dead000000000122 0000000000000000
[ 105.740298][ T5487] raw: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000
[ 105.743620][ T5487] head: 00fff00000000040 ffff88801a441dc0 dead000000000122 0000000000000000
[ 105.747195][ T5487] head: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000
[ 105.750695][ T5487] head: 00fff00000000002 ffffea0000459501 00000000ffffffff 00000000ffffffff
[ 105.754606][ T5487] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[ 105.758932][ T5487] page dumped because: kasan: bad access detected
[ 105.761986][ T5487] page_owner tracks the page as allocated
[ 105.764071][ T5487] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 5487, tgid 5487 (syz.0.17), ts 105506190584, free_ts 96025851807
[ 105.772100][ T5487] post_alloc_hook+0x240/0x2a0
[ 105.774051][ T5487] get_page_from_freelist+0x21e4/0x22c0
[ 105.776172][ T5487] __alloc_pages_slowpath+0x2fe/0xce0
[ 105.778413][ T5487] __alloc_frozen_pages_noprof+0x319/0x370
[ 105.781056][ T5487] allocate_slab+0x65/0x370
[ 105.783141][ T5487] ___slab_alloc+0xbeb/0x1410
[ 105.785278][ T5487] __kmalloc_node_noprof+0x2fd/0x4e0
[ 105.787703][ T5487] alloc_slab_obj_exts+0x39/0xa0
[ 105.790107][ T5487] __memcg_slab_post_alloc_hook+0x31e/0x7f0
[ 105.793044][ T5487] __kmalloc_node_track_caller_noprof+0x335/0x4e0
[ 105.795906][ T5487] kstrdup+0x42/0x100
[ 105.797684][ T5487] alloc_vfsmnt+0xeb/0x430
[ 105.799733][ T5487] vfs_create_mount+0x6c/0x3d0
[ 105.802193][ T5487] do_new_mount+0x3ec/0x9e0
[ 105.804931][ T5487] __se_sys_mount+0x317/0x410
[ 105.807098][ T5487] do_syscall_64+0xfa/0x3b0
[ 105.808758][ T5487] page last free pid 1094 tgid 1094 stack trace:
[ 105.811363][ T5487] __free_frozen_pages+0xbc4/0xd30
[ 105.813820][ T5487] free_large_kmalloc+0x13a/0x1f0
[ 105.816203][ T5487] ops_undo_list+0x856/0x990
[ 105.818324][ T5487] cleanup_net+0x4c5/0x800
[ 105.820171][ T5487] process_scheduled_works+0xade/0x17b0
[ 105.822417][ T5487] worker_thread+0x8a0/0xda0
[ 105.824474][ T5487] kthread+0x711/0x8a0
[ 105.826355][ T5487] ret_from_fork+0x3f9/0x770
[ 105.828564][ T5487] ret_from_fork_asm+0x1a/0x30
[ 105.830884][ T5487]
[ 105.831988][ T5487] Memory state around the buggy address:
[ 105.834215][ T5487] ffff888011654700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 105.837812][ T5487] ffff888011654780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 105.841136][ T5487] >ffff888011654800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 105.844178][ T5487] ^
[ 105.847447][ T5487] ffff888011654880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 105.850998][ T5487] ffff888011654900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 105.854439][ T5487] ==================================================================
[ 105.859259][ T4704] Bluetooth: hci0: command tx timeout
[ 105.876319][ T5487] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 105.879656][ T5487] CPU: 0 UID: 0 PID: 5487 Comm: syz.0.17 Not tainted 6.16.0-syzkaller-11699-g7e161a991ea7 #0 PREEMPT(full)
[ 105.884296][ T5487] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 105.888667][ T5487] Call Trace:
[ 105.890006][ T5487]
[ 105.891035][ T5487] dump_stack_lvl+0x99/0x250
[ 105.892694][ T5487] ? __asan_memcpy+0x40/0x70
[ 105.894445][ T5487] ? __pfx_dump_stack_lvl+0x10/0x10
[ 105.896580][ T5487] ? __pfx__printk+0x10/0x10
[ 105.898832][ T5487] vpanic+0x281/0x750
[ 105.900662][ T5487] ? preempt_schedule+0xae/0xc0
[ 105.902842][ T5487] ? __pfx_vpanic+0x10/0x10
[ 105.904760][ T5487] ? preempt_schedule_common+0x83/0xd0
[ 105.907103][ T5487] ? preempt_schedule+0xae/0xc0
[ 105.909274][ T5487] ? __pfx_preempt_schedule+0x10/0x10
[ 105.911498][ T5487] panic+0xb9/0xc0
[ 105.913238][ T5487] ? __pfx_panic+0x10/0x10
[ 105.915275][ T5487] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 105.918099][ T5487] ? ext4_xattr_set_entry+0x8e9/0x1e20
[ 105.920992][ T5487] check_panic_on_warn+0x89/0xb0
[ 105.923252][ T5487] ? ext4_xattr_set_entry+0x8e9/0x1e20
[ 105.925581][ T5487] end_report+0x78/0x160
[ 105.927480][ T5487] kasan_report+0x129/0x150
[ 105.929674][ T5487] ? ext4_xattr_set_entry+0x8e9/0x1e20
[ 105.932368][ T5487] ? ext4_xattr_set_entry+0x8e9/0x1e20
[ 105.935407][ T5487] kasan_check_range+0x2b0/0x2c0
[ 105.938507][ T5487] ? ext4_xattr_set_entry+0x8e9/0x1e20
[ 105.941685][ T5487] __asan_memmove+0x29/0x70
[ 105.944441][ T5487] ext4_xattr_set_entry+0x8e9/0x1e20
[ 105.947520][ T5487] ext4_xattr_block_set+0x872/0x2ac0
[ 105.950624][ T5487] ? fs_reclaim_acquire+0x7d/0x100
[ 105.953768][ T5487] ? __pfx_check_xattrs+0x10/0x10
[ 105.956474][ T5487] ? __pfx_ext4_xattr_block_set+0x10/0x10
[ 105.960240][ T5487] ? ext4_xattr_block_find+0x2d4/0x350
[ 105.963514][ T5487] ext4_expand_extra_isize_ea+0x12d5/0x1ea0
[ 105.966828][ T5487] __ext4_expand_extra_isize+0x30d/0x400
[ 105.969870][ T5487] __ext4_mark_inode_dirty+0x46c/0x700
[ 105.972493][ T5487] __ext4_unlink+0x631/0xab0
[ 105.974894][ T5487] ? __pfx___ext4_unlink+0x10/0x10
[ 105.977324][ T5487] ? __pfx___dquot_initialize+0x10/0x10
[ 105.980005][ T5487] ? down_write+0x162/0x1f0
[ 105.982124][ T5487] ext4_unlink+0x216/0x5d0
[ 105.984154][ T5487] vfs_unlink+0x394/0x650
[ 105.985920][ T5487] do_unlinkat+0x345/0x560
[ 105.987717][ T5487] ? __pfx_do_unlinkat+0x10/0x10
[ 105.989423][ T5487] ? getname_flags+0x1e5/0x540
[ 105.991177][ T5487] __x64_sys_unlink+0x47/0x50
[ 105.993025][ T5487] do_syscall_64+0xfa/0x3b0
[ 105.994760][ T5487] ? lockdep_hardirqs_on+0x9c/0x150
[ 105.996749][ T5487] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 105.999127][ T5487] ? clear_bhb_loop+0x60/0xb0
[ 106.000893][ T5487] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 106.003219][ T5487] RIP: 0033:0x7ff21d18eb69
[ 106.004922][ T5487] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 106.013544][ T5487] RSP: 002b:00007fff90869208 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
[ 106.017361][ T5487] RAX: ffffffffffffffda RBX: 00007ff21d3b5fa0 RCX: 00007ff21d18eb69
[ 106.020860][ T5487] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000180
[ 106.024448][ T5487] RBP: 00007ff21d211df1 R08: 0000000000000000 R09: 0000000000000000
[ 106.027944][ T5487] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 106.031215][ T5487] R13: 00007ff21d3b5fa0 R14: 00007ff21d3b5fa0 R15: 0000000000000001
[ 106.034399][ T5487]
[ 106.036085][ T5487] Kernel Offset: disabled
[ 106.037927][ T5487] Rebooting in 86400 seconds..
VM DIAGNOSIS:
15:18:55 Registers:
info registers vcpu 0
CPU#0
RAX=1ffffffff33be360 RBX=00000000000003fd RCX=0000000000000000 RDX=00000000000003fd
RSI=0000000000000000 RDI=0000000000000020 RBP=ffffffff99df1b70 RSP=ffffc90002b1ee70
R8 =ffff888031f58237 R9 =1ffff110063eb046 R10=dffffc0000000000 R11=ffffffff854fea10
R12=dffffc0000000000 R13=0000000000000000 R14=ffffffff99df18e0 R15=0000000000000000
RIP=ffffffff854fea87 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000555588832500 ffffffff 00c00000
GS =0000 ffff88808d219000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=000020000000f000 CR3=0000000035da5000 CR4=00352ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=0000000080040001 Opmask01=0000000000000fff Opmask02=00000000ffffffef Opmask03=0000000000000000
Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fff908694e0 0000003000000018
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fff90869666
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fff90869666 00007fff9086966c
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ff21d212e0a
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ff21d212e17
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ff21d212e11
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ff21d212e25
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ff21d212eab
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ff21d212f89
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2525252525252525 2525252525252525 2525252525252525 2525252525252525
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0063696e61703d73 726f727265006f72 2d746e756f6d6572 3d73726f72726500
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00464c4b44551856 574a575740004a57 08514b504a484057 1856574a57574000
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000