./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2420413870

<...>
Warning: Permanently added '10.128.0.167' (ED25519) to the list of known hosts.
execve("./syz-executor2420413870", ["./syz-executor2420413870"], 0x7ffd06525110 /* 10 vars */) = 0
brk(NULL)                               = 0x55557c17e000
brk(0x55557c17ed00)                     = 0x55557c17ed00
arch_prctl(ARCH_SET_FS, 0x55557c17e380) = 0
set_tid_address(0x55557c17e650)         = 5091
set_robust_list(0x55557c17e660, 24)     = 0
rseq(0x55557c17eca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor2420413870", 4096) = 28
getrandom("\x1a\xf6\xb2\xf1\x7e\xa7\xde\xf9", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x55557c17ed00
brk(0x55557c19fd00)                     = 0x55557c19fd00
brk(0x55557c1a0000)                     = 0x55557c1a0000
mprotect(0x7febba06f000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
unshare(CLONE_NEWPID)                   = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55557c17e650) = 5092
./strace-static-x86_64: Process 5092 attached
[pid  5092] set_robust_list(0x55557c17e660, 24) = 0
[pid  5092] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy)
[pid  5092] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5092] setsid()                    = 1
[pid  5092] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0
[pid  5092] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid  5092] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid  5092] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0
[pid  5092] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid  5092] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid  5092] unshare(CLONE_NEWNS)        = 0
[pid  5092] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
[pid  5092] unshare(CLONE_NEWIPC)       = 0
[pid  5092] unshare(CLONE_NEWCGROUP)    = 0
[pid  5092] unshare(CLONE_NEWUTS)       = 0
[pid  5092] unshare(CLONE_SYSVSEM)      = 0
[pid  5092] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3
[pid  5092] write(3, "16777216", 8)     = 8
[pid  5092] close(3)                    = 0
[pid  5092] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3
[pid  5092] write(3, "536870912", 9)    = 9
[pid  5092] close(3)                    = 0
[pid  5092] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3
[pid  5092] write(3, "1024", 4)         = 4
[pid  5092] close(3)                    = 0
[pid  5092] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3
[pid  5092] write(3, "8192", 4)         = 4
[pid  5092] close(3)                    = 0
[pid  5092] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3
[pid  5092] write(3, "1024", 4)         = 4
[pid  5092] close(3)                    = 0
[pid  5092] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3
[pid  5092] write(3, "1024", 4)         = 4
[pid  5092] close(3)                    = 0
[pid  5092] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3
[pid  5092] write(3, "1024 1048576 500 1024", 21) = 21
[pid  5092] close(3)                    = 0
[pid  5092] getpid()                    = 1
[pid  5092] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  5092] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  5092] unshare(CLONE_NEWNET)       = 0
[pid  5092] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3
[pid  5092] write(3, "0 65535", 7)      = 7
[pid  5092] close(3)                    = 0
[pid  5092] mkdir("/dev/binderfs", 0777) = 0
[pid  5092] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0
[pid  5092] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5092] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5095 attached
, child_tidptr=0x55557c17e650) = 2
[pid  5095] set_robust_list(0x55557c17e660, 24) = 0
[pid  5095] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5095] setpgid(0, 0)               = 0
[pid  5095] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5095] write(3, "1000", 4)         = 4
[pid  5095] close(3)                    = 0
[pid  5095] openat(AT_FDCWD, "/dev/vhost-vsock", O_RDWR) = 3
[pid  5095] ioctl(3, VHOST_SET_OWNER, 0) = 0
[pid  5095] close(3)                    = 0
[pid  5095] close(4)                    = -1 EBADF (Bad file descriptor)
[pid  5095] close(5)                    = -1 EBADF (Bad file descriptor)
[pid  5095] close(6)                    = -1 EBADF (Bad file descriptor)
[pid  5095] close(7)                    = -1 EBADF (Bad file descriptor)
[   55.798426][ T5096] ==================================================================
[   55.806502][ T5096] BUG: KASAN: slab-use-after-free in __mutex_unlock_slowpath+0xef/0x750
[   55.814834][ T5096] Read of size 8 at addr ffff88802a913480 by task vhost-5095/5096
[   55.822625][ T5096] 
[   55.824939][ T5096] CPU: 1 PID: 5096 Comm: vhost-5095 Not tainted 6.9.0-rc6-next-20240501-syzkaller #0
[   55.834389][ T5096] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
[   55.844436][ T5096] Call Trace:
[   55.847708][ T5096]  <TASK>
[   55.850629][ T5096]  dump_stack_lvl+0x241/0x360
[   55.855395][ T5096]  ? __pfx_dump_stack_lvl+0x10/0x10
[   55.860587][ T5096]  ? __pfx__printk+0x10/0x10
[   55.865167][ T5096]  ? _printk+0xd5/0x120
[   55.869315][ T5096]  ? __virt_addr_valid+0x183/0x520
[   55.874420][ T5096]  ? __virt_addr_valid+0x183/0x520
[   55.879525][ T5096]  print_report+0x169/0x550
[   55.884018][ T5096]  ? __virt_addr_valid+0x183/0x520
[   55.889119][ T5096]  ? __virt_addr_valid+0x183/0x520
[   55.894219][ T5096]  ? __virt_addr_valid+0x44e/0x520
[   55.899319][ T5096]  ? __phys_addr+0xba/0x170
[   55.903816][ T5096]  ? __mutex_unlock_slowpath+0xef/0x750
[   55.909353][ T5096]  kasan_report+0x143/0x180
[   55.913847][ T5096]  ? __mutex_unlock_slowpath+0xef/0x750
[   55.919380][ T5096]  kasan_check_range+0x282/0x290
[   55.924310][ T5096]  ? vhost_task_fn+0x3bc/0x3f0
[   55.929060][ T5096]  __mutex_unlock_slowpath+0xef/0x750
[   55.934418][ T5096]  ? preempt_schedule_thunk+0x1a/0x30
[   55.939777][ T5096]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[   55.945749][ T5096]  ? _raw_spin_unlock_irqrestore+0x130/0x140
[   55.951719][ T5096]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   55.958123][ T5096]  ? complete+0xb4/0x1c0
[   55.962354][ T5096]  vhost_task_fn+0x3bc/0x3f0
[   55.966938][ T5096]  ? __pfx_vhost_task_fn+0x10/0x10
[   55.972121][ T5096]  ? __pfx_vhost_task_fn+0x10/0x10
[   55.977221][ T5096]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   55.983186][ T5096]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[   55.989500][ T5096]  ? __pfx_vhost_task_fn+0x10/0x10
[   55.994601][ T5096]  ? __pfx_vhost_task_fn+0x10/0x10
[   55.999700][ T5096]  ? _raw_spin_unlock_irq+0x23/0x50
[   56.004892][ T5096]  ? lockdep_hardirqs_on+0x99/0x150
[   56.010078][ T5096]  ? __pfx_vhost_task_fn+0x10/0x10
[   56.015177][ T5096]  ret_from_fork+0x4b/0x80
[   56.019582][ T5096]  ? __pfx_vhost_task_fn+0x10/0x10
[   56.024680][ T5096]  ret_from_fork_asm+0x1a/0x30
[   56.029436][ T5096]  </TASK>
[   56.032438][ T5096] 
[   56.034743][ T5096] Allocated by task 5095:
[   56.039065][ T5096]  kasan_save_track+0x3f/0x80
[   56.043737][ T5096]  __kasan_kmalloc+0x98/0xb0
[   56.048318][ T5096]  kmalloc_trace_noprof+0x19c/0x2b0
[   56.053512][ T5096]  vhost_task_create+0x149/0x300
[   56.058444][ T5096]  vhost_worker_create+0x17b/0x3f0
[   56.063556][ T5096]  vhost_dev_set_owner+0x563/0x940
[   56.068654][ T5096]  vhost_dev_ioctl+0xda/0xda0
[   56.073318][ T5096]  vhost_vsock_dev_ioctl+0x2bb/0xfa0
[   56.078596][ T5096]  __se_sys_ioctl+0xfc/0x170
[   56.083172][ T5096]  do_syscall_64+0xf5/0x240
[   56.087664][ T5096]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   56.093559][ T5096] 
[   56.095875][ T5096] Freed by task 5095:
[   56.099838][ T5096]  kasan_save_track+0x3f/0x80
[   56.104514][ T5096]  kasan_save_free_info+0x40/0x50
[   56.109534][ T5096]  poison_slab_object+0xe0/0x150
[   56.114463][ T5096]  __kasan_slab_free+0x37/0x60
[   56.119213][ T5096]  kfree+0x149/0x350
[   56.123096][ T5096]  vhost_dev_cleanup+0x9b0/0xba0
[   56.128018][ T5096]  vhost_vsock_dev_release+0x3aa/0x410
[   56.133482][ T5096]  __fput+0x406/0x8b0
[   56.137465][ T5096]  __x64_sys_close+0x7f/0x110
[   56.142137][ T5096]  do_syscall_64+0xf5/0x240
[   56.146635][ T5096]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   56.152551][ T5096] 
[   56.154908][ T5096] The buggy address belongs to the object at ffff88802a913400
[   56.154908][ T5096]  which belongs to the cache kmalloc-512 of size 512
[   56.168946][ T5096] The buggy address is located 128 bytes inside of
[   56.168946][ T5096]  freed 512-byte region [ffff88802a913400, ffff88802a913600)
[   56.182721][ T5096] 
[   56.185031][ T5096] The buggy address belongs to the physical page:
[   56.191420][ T5096] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a910
[   56.200163][ T5096] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   56.208640][ T5096] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[   56.216166][ T5096] page_type: 0xffffefff(slab)
[   56.220830][ T5096] raw: 00fff00000000040 ffff888015041c80 dead000000000100 dead000000000122
[   56.229398][ T5096] raw: 0000000000000000 0000000080100010 00000001ffffefff 0000000000000000
[   56.237964][ T5096] head: 00fff00000000040 ffff888015041c80 dead000000000100 dead000000000122
[   56.246617][ T5096] head: 0000000000000000 0000000080100010 00000001ffffefff 0000000000000000
[   56.255270][ T5096] head: 00fff00000000002 ffffea0000aa4401 ffffffffffffffff 0000000000000000
[   56.263921][ T5096] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
[   56.272570][ T5096] page dumped because: kasan: bad access detected
[   56.278963][ T5096] page_owner tracks the page as allocated
[   56.284656][ T5096] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4548, tgid 4548 (udevadm), ts 18785566211, free_ts 18575012092
[   56.305560][ T5096]  post_alloc_hook+0x1f3/0x230
[   56.310313][ T5096]  get_page_from_freelist+0x2ce2/0x2d90
[   56.315852][ T5096]  __alloc_pages_noprof+0x256/0x6c0
[   56.321040][ T5096]  alloc_slab_page+0x5f/0x120
[   56.325700][ T5096]  allocate_slab+0x5a/0x2e0
[   56.330185][ T5096]  ___slab_alloc+0xcd1/0x14b0
[   56.334845][ T5096]  __slab_alloc+0x58/0xa0
[   56.339158][ T5096]  kmalloc_trace_noprof+0x1d5/0x2b0
[   56.344349][ T5096]  kernfs_fop_open+0x3e0/0xd10
[   56.349096][ T5096]  do_dentry_open+0x95a/0x1720
[   56.353849][ T5096]  path_openat+0x289f/0x3280
[   56.358421][ T5096]  do_filp_open+0x235/0x490
[   56.362906][ T5096]  do_sys_openat2+0x13e/0x1d0
[   56.367570][ T5096]  __x64_sys_openat+0x247/0x2a0
[   56.372406][ T5096]  do_syscall_64+0xf5/0x240
[   56.376898][ T5096]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   56.382787][ T5096] page last free pid 4548 tgid 4548 stack trace:
[   56.389091][ T5096]  free_unref_page+0xd22/0xea0
[   56.393841][ T5096]  __slab_free+0x31b/0x3d0
[   56.398240][ T5096]  qlist_free_all+0x9e/0x140
[   56.402812][ T5096]  kasan_quarantine_reduce+0x14f/0x170
[   56.408254][ T5096]  __kasan_slab_alloc+0x23/0x80
[   56.413090][ T5096]  kmem_cache_alloc_lru_noprof+0x139/0x2b0
[   56.418882][ T5096]  iget_locked+0x214/0x850
[   56.423285][ T5096]  kernfs_get_inode+0x50/0x760
[   56.428047][ T5096]  kernfs_iop_lookup+0x266/0x390
[   56.432967][ T5096]  path_openat+0x1033/0x3280
[   56.437540][ T5096]  do_filp_open+0x235/0x490
[   56.442024][ T5096]  do_sys_openat2+0x13e/0x1d0
[   56.446687][ T5096]  __x64_sys_openat+0x247/0x2a0
[   56.451523][ T5096]  do_syscall_64+0xf5/0x240
[   56.456015][ T5096]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   56.461895][ T5096] 
[   56.464207][ T5096] Memory state around the buggy address:
[   56.469816][ T5096]  ffff88802a913380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   56.477863][ T5096]  ffff88802a913400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   56.485912][ T5096] >ffff88802a913480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   56.493952][ T5096]                    ^
[   56.497999][ T5096]  ffff88802a913500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   56.506043][ T5096]  ffff88802a913580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   56.514083][ T5096] ==================================================================
[   56.523702][ T5096] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   56.530911][ T5096] CPU: 1 PID: 5096 Comm: vhost-5095 Not tainted 6.9.0-rc6-next-20240501-syzkaller #0
[   56.540354][ T5096] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
[   56.550394][ T5096] Call Trace:
[   56.553660][ T5096]  <TASK>
[   56.556575][ T5096]  dump_stack_lvl+0x241/0x360
[   56.561248][ T5096]  ? __pfx_dump_stack_lvl+0x10/0x10
[   56.566435][ T5096]  ? __pfx__printk+0x10/0x10
[   56.571014][ T5096]  ? preempt_schedule+0xe1/0xf0
[   56.575849][ T5096]  ? vscnprintf+0x5d/0x90
[   56.580165][ T5096]  panic+0x349/0x860
[   56.584047][ T5096]  ? check_panic_on_warn+0x21/0xb0
[   56.589148][ T5096]  ? __pfx_panic+0x10/0x10
[   56.593553][ T5096]  ? _raw_spin_unlock_irqrestore+0x130/0x140
[   56.599524][ T5096]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   56.605842][ T5096]  ? print_report+0x502/0x550
[   56.610506][ T5096]  check_panic_on_warn+0x86/0xb0
[   56.615432][ T5096]  ? __mutex_unlock_slowpath+0xef/0x750
[   56.620961][ T5096]  end_report+0x77/0x160
[   56.625191][ T5096]  kasan_report+0x154/0x180
[   56.629679][ T5096]  ? __mutex_unlock_slowpath+0xef/0x750
[   56.635211][ T5096]  kasan_check_range+0x282/0x290
[   56.640134][ T5096]  ? vhost_task_fn+0x3bc/0x3f0
[   56.644885][ T5096]  __mutex_unlock_slowpath+0xef/0x750
[   56.650247][ T5096]  ? preempt_schedule_thunk+0x1a/0x30
[   56.655604][ T5096]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[   56.661567][ T5096]  ? _raw_spin_unlock_irqrestore+0x130/0x140
[   56.667537][ T5096]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   56.673856][ T5096]  ? complete+0xb4/0x1c0
[   56.678088][ T5096]  vhost_task_fn+0x3bc/0x3f0
[   56.682668][ T5096]  ? __pfx_vhost_task_fn+0x10/0x10
[   56.687765][ T5096]  ? __pfx_vhost_task_fn+0x10/0x10
[   56.692862][ T5096]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   56.698828][ T5096]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[   56.705143][ T5096]  ? __pfx_vhost_task_fn+0x10/0x10
[   56.710242][ T5096]  ? __pfx_vhost_task_fn+0x10/0x10
[   56.715340][ T5096]  ? _raw_spin_unlock_irq+0x23/0x50
[   56.720528][ T5096]  ? lockdep_hardirqs_on+0x99/0x150
[   56.725714][ T5096]  ? __pfx_vhost_task_fn+0x10/0x10
[   56.730812][ T5096]  ret_from_fork+0x4b/0x80
[   56.735216][ T5096]  ? __pfx_vhost_task_fn+0x10/0x10
[   56.740314][ T5096]  ret_from_fork_asm+0x1a/0x30
[   56.745070][ T5096]  </TASK>
[   56.748324][ T5096] Kernel Offset: disabled
[   56.752629][ T5096] Rebooting in 86400 seconds..