Warning: Permanently added '10.128.0.76' (ED25519) to the list of known hosts. 2026/07/13 02:41:18 parsed 1 programs 2026/07/13 02:41:18 serving rpc on tcp://43543 [ 84.493457][ T5610] cgroup: Unknown subsys name 'net' [ 84.735263][ T5610] cgroup: Unknown subsys name 'cpuset' [ 84.809334][ T5610] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 86.554424][ T5610] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 86.813929][ T31] cfg80211: failed to load regulatory.db [ 91.884019][ T179] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.884045][ T179] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.960157][ T67] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.960178][ T67] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.415309][ T5667] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.416665][ T5667] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.416779][ T5667] bridge_slave_0: entered allmulticast mode [ 93.418306][ T5667] bridge_slave_0: entered promiscuous mode [ 93.441917][ T5667] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.442039][ T5667] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.442209][ T5667] bridge_slave_1: entered allmulticast mode [ 93.444635][ T5667] bridge_slave_1: entered promiscuous mode [ 93.497764][ T5667] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 93.510923][ T5667] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 93.544027][ T5667] team0: Port device team_slave_0 added [ 93.545929][ T5667] team0: Port device team_slave_1 added [ 93.587929][ T5667] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 93.587940][ T5667] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 93.587953][ T5667] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 93.594393][ T5667] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 93.594408][ T5667] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 93.594431][ T5667] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 93.681102][ T5667] hsr_slave_0: entered promiscuous mode [ 93.682046][ T5667] hsr_slave_1: entered promiscuous mode [ 94.162432][ T5667] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 94.194555][ T5667] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 94.396985][ T5667] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 94.431529][ T5667] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 94.433406][ T5667] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 94.466245][ T5667] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 94.468499][ T5667] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 94.504987][ T5667] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 94.928655][ T5667] 8021q: adding VLAN 0 to HW filter on device bond0 [ 95.042789][ T5667] 8021q: adding VLAN 0 to HW filter on device team0 [ 95.054002][ T1375] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.054683][ T1375] bridge0: port 1(bridge_slave_0) entered forwarding state [ 95.092721][ T1375] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.093396][ T1375] bridge0: port 2(bridge_slave_1) entered forwarding state [ 95.634989][ T5667] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 95.891307][ T5667] veth0_vlan: entered promiscuous mode [ 95.910987][ T5667] veth1_vlan: entered promiscuous mode [ 95.971441][ T5667] veth0_macvtap: entered promiscuous mode [ 95.978522][ T5667] veth1_macvtap: entered promiscuous mode [ 96.026657][ T5667] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 96.044627][ T5667] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 96.066385][ T67] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.068593][ T67] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.068634][ T67] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.075671][ T67] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.745966][ T3275] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 96.985956][ T60] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 96.987827][ T60] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 96.988585][ T60] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 97.002808][ T60] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 97.003921][ T60] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 97.163685][ T3275] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 97.463170][ T3275] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 97.974961][ T3275] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 98.950712][ T3275] bridge_slave_1: left allmulticast mode [ 98.950816][ T3275] bridge_slave_1: left promiscuous mode [ 98.957300][ T3275] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.150622][ T3275] bridge_slave_0: left allmulticast mode [ 99.150656][ T3275] bridge_slave_0: left promiscuous mode [ 99.150889][ T3275] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.829432][ T3275] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 99.909445][ T3275] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 99.933816][ T3275] bond0 (unregistering): Released all slaves [ 99.970621][ T5260] 8021q: adding VLAN 0 to HW filter on device eth1 [ 100.308874][ T3275] hsr_slave_0: left promiscuous mode [ 100.348868][ T3275] hsr_slave_1: left promiscuous mode [ 100.349998][ T3275] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 100.350079][ T3275] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 100.400734][ T3275] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 100.400760][ T3275] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 100.494363][ T3275] veth1_macvtap: left promiscuous mode [ 100.494526][ T3275] veth0_macvtap: left promiscuous mode [ 100.494680][ T3275] veth1_vlan: left promiscuous mode [ 100.494857][ T3275] veth0_vlan: left promiscuous mode [ 101.220443][ T3275] team0 (unregistering): Port device team_slave_1 removed [ 101.269607][ T3275] team0 (unregistering): Port device team_slave_0 removed [ 101.431063][ T5260] 8021q: adding VLAN 0 to HW filter on device eth2 [ 102.083418][ T5260] 8021q: adding VLAN 0 to HW filter on device eth3 2026/07/13 02:41:38 executed programs: 0 [ 102.474233][ T60] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 102.492733][ T60] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 102.494779][ T60] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 102.497599][ T60] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 102.498271][ T60] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 102.822509][ T5260] 8021q: adding VLAN 0 to HW filter on device eth4 [ 103.810432][ T5786] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.810601][ T5786] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.810712][ T5786] bridge_slave_0: entered allmulticast mode [ 103.812126][ T5786] bridge_slave_0: entered promiscuous mode [ 103.813885][ T5786] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.814007][ T5786] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.814094][ T5786] bridge_slave_1: entered allmulticast mode [ 103.815560][ T5786] bridge_slave_1: entered promiscuous mode [ 103.877907][ T5786] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 103.881669][ T5786] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 103.933199][ T5786] team0: Port device team_slave_0 added [ 103.935226][ T5786] team0: Port device team_slave_1 added [ 103.971177][ T5786] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 103.971191][ T5786] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.971212][ T5786] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 103.973179][ T5786] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 103.973192][ T5786] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.973212][ T5786] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.041414][ T5786] hsr_slave_0: entered promiscuous mode [ 104.042564][ T5786] hsr_slave_1: entered promiscuous mode [ 104.560553][ T60] Bluetooth: hci0: command tx timeout [ 106.183824][ T5786] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 106.226215][ T5786] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 106.236097][ T5786] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 106.276593][ T5786] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 106.277938][ T5786] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 106.322716][ T5786] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 106.326832][ T5786] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 106.365583][ T5786] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 106.601284][ T5786] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.624975][ T5786] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.640286][ T60] Bluetooth: hci0: command tx timeout [ 106.643578][ T157] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.644618][ T157] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.660781][ T157] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.660976][ T157] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.346658][ T5786] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.427599][ T5786] veth0_vlan: entered promiscuous mode [ 107.458068][ T5786] veth1_vlan: entered promiscuous mode [ 107.520611][ T5786] veth0_macvtap: entered promiscuous mode [ 107.542473][ T5786] veth1_macvtap: entered promiscuous mode [ 107.596809][ T5786] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 107.615076][ T5786] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 107.647137][ T67] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.647193][ T67] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.647226][ T67] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.647259][ T67] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.153020][ T3275] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.153040][ T3275] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.220448][ T157] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.220468][ T157] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2026/07/13 02:41:44 executed programs: 2 [ 108.718798][ T60] Bluetooth: hci0: command tx timeout [ 108.772760][ T5931] loop0: detected capacity change from 0 to 32768 [ 108.947376][ T5931] [ 108.947376][ T5931] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 108.947376][ T5931] [ 109.037094][ T5786] [ 109.037094][ T5786] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 109.037094][ T5786] [ 109.054967][ T5786] [ 109.054967][ T5786] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 109.054967][ T5786] [ 109.432091][ T5938] loop0: detected capacity change from 0 to 32768 [ 109.453931][ T5938] [ 109.453931][ T5938] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 109.453931][ T5938] [ 109.497337][ T5786] [ 109.497337][ T5786] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 109.497337][ T5786] [ 109.518055][ T5786] [ 109.518055][ T5786] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 109.518055][ T5786] [ 109.892505][ T5939] loop0: detected capacity change from 0 to 32768 [ 109.962763][ T5939] [ 109.962763][ T5939] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 109.962763][ T5939] [ 110.012651][ T5786] [ 110.012651][ T5786] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 110.012651][ T5786] [ 110.013126][ T5786] [ 110.013126][ T5786] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 110.013126][ T5786] [ 110.364540][ T5940] loop0: detected capacity change from 0 to 32768 [ 110.388493][ T5940] [ 110.388493][ T5940] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 110.388493][ T5940] [ 110.439203][ T5786] [ 110.439203][ T5786] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 110.439203][ T5786] [ 110.439760][ T5786] [ 110.439760][ T5786] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 110.439760][ T5786] [ 110.760062][ T5941] loop0: detected capacity change from 0 to 32768 [ 110.780826][ T5941] [ 110.780826][ T5941] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 110.780826][ T5941] [ 110.798823][ T60] Bluetooth: hci0: command tx timeout [ 110.829596][ T5786] [ 110.829596][ T5786] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 110.829596][ T5786] [ 110.830956][ T5786] [ 110.830956][ T5786] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 110.830956][ T5786] [ 111.162538][ T5942] loop0: detected capacity change from 0 to 32768 [ 111.177659][ T5942] [ 111.177659][ T5942] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 111.177659][ T5942] [ 111.229240][ T5786] [ 111.229240][ T5786] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 111.229240][ T5786] [ 111.229622][ T5786] [ 111.229622][ T5786] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 111.229622][ T5786] [ 111.541270][ T5943] loop0: detected capacity change from 0 to 32768 [ 111.561826][ T5943] [ 111.561826][ T5943] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 111.561826][ T5943] [ 111.621461][ T5786] [ 111.621461][ T5786] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 111.621461][ T5786] [ 111.622328][ T5786] [ 111.622328][ T5786] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 111.622328][ T5786] [ 111.935313][ T5944] loop0: detected capacity change from 0 to 32768 [ 111.968569][ T5944] [ 111.968569][ T5944] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 111.968569][ T5944] [ 112.009193][ T5786] [ 112.009193][ T5786] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 112.009193][ T5786] [ 112.009599][ T5786] [ 112.009599][ T5786] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 112.009599][ T5786] [ 112.310644][ T5945] loop0: detected capacity change from 0 to 32768 [ 112.333777][ T5945] [ 112.333777][ T5945] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 112.333777][ T5945] [ 112.369200][ T5786] [ 112.369200][ T5786] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 112.369200][ T5786] [ 112.369626][ T5786] [ 112.369626][ T5786] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 112.369626][ T5786] [ 112.687755][ T5946] loop0: detected capacity change from 0 to 32768 [ 112.706668][ T5946] [ 112.706668][ T5946] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 112.706668][ T5946] [ 112.750350][ T5786] [ 112.750350][ T5786] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 112.750350][ T5786] [ 112.750590][ T5786] [ 112.750590][ T5786] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 112.750590][ T5786] [ 113.070598][ T5947] [ 113.070598][ T5947] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 113.070598][ T5947] [ 113.122453][ T5786] [ 113.122453][ T5786] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 113.122453][ T5786] [ 113.122683][ T5786] [ 113.122683][ T5786] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 113.122683][ T5786] [ 113.156864][ C0] ================================================================== [ 113.156881][ C0] BUG: KASAN: slab-use-after-free in lbmIODone+0x130e/0x16b0 [ 113.156937][ C0] Read of size 4 at addr ffff88802de89008 by task ksoftirqd/0/15 [ 113.156937][ C0] Read of size 4 at addr ffff88802de89008 by task ksoftirqd/0/15 [ 113.156955][ C0] [ 113.156977][ C0] CPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 113.157006][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 113.157034][ C0] Call Trace: [ 113.157042][ C0] [ 113.157051][ C0] dump_stack_lvl+0xe8/0x150 [ 113.157085][ C0] print_address_description+0x55/0x1e0 [ 113.157118][ C0] ? lbmIODone+0x130e/0x16b0 [ 113.157147][ C0] print_report+0x58/0x70 [ 113.157176][ C0] kasan_report+0x117/0x150 [ 113.157207][ C0] ? lbmIODone+0x130e/0x16b0 [ 113.157241][ C0] lbmIODone+0x130e/0x16b0 [ 113.157271][ C0] ? blkg_put+0x22/0x240 [ 113.157305][ C0] ? blkg_put+0x22/0x240 [ 113.157335][ C0] ? blkg_put+0x18d/0x240 [ 113.157378][ C0] ? bio_endio+0x980/0x9d0 [ 113.157401][ C0] blk_update_request+0x57b/0xe50 [ 113.157428][ C0] blk_mq_end_request+0x3e/0x70 [ 113.157451][ C0] blk_done_softirq+0x10a/0x160 [ 113.157471][ C0] handle_softirqs+0x1d9/0x6c0 [ 113.157502][ C0] run_ksoftirqd+0x52/0x180 [ 113.157529][ C0] smpboot_thread_fn+0x57c/0xa80 [ 113.157560][ C0] ? smpboot_thread_fn+0x4e/0xa80 [ 113.157589][ C0] kthread+0x388/0x470 [ 113.157619][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 113.157645][ C0] ? __pfx_kthread+0x10/0x10 [ 113.157676][ C0] ret_from_fork+0x514/0xb70 [ 113.157719][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 113.157751][ C0] ? __switch_to+0xc89/0x1420 [ 113.157779][ C0] ? __pfx_kthread+0x10/0x10 [ 113.157809][ C0] ret_from_fork_asm+0x1a/0x30 [ 113.157837][ C0] [ 113.157845][ C0] [ 113.157850][ C0] Allocated by task 5947: [ 113.157859][ C0] kasan_save_track+0x3e/0x80 [ 113.157876][ C0] __kasan_kmalloc+0x93/0xb0 [ 113.157895][ C0] __kmalloc_cache_noprof+0x3d2/0x6b0 [ 113.157915][ C0] lmLogInit+0x3e5/0x1a20 [ 113.157940][ C0] lmLogOpen+0x4e3/0xf90 [ 113.157965][ C0] jfs_mount_rw+0xf3/0x670 [ 113.157990][ C0] jfs_fill_super+0x769/0xda0 [ 113.158009][ C0] get_tree_bdev_flags+0x430/0x4f0 [ 113.158033][ C0] vfs_get_tree+0x92/0x2a0 [ 113.158055][ C0] do_new_mount+0x319/0xdc0 [ 113.158085][ C0] __se_sys_mount+0x31d/0x420 [ 113.158101][ C0] do_syscall_64+0x174/0x580 [ 113.158130][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.158150][ C0] [ 113.158155][ C0] Freed by task 5786: [ 113.158164][ C0] kasan_save_track+0x3e/0x80 [ 113.158179][ C0] kasan_save_free_info+0x40/0x50 [ 113.158208][ C0] __kasan_slab_free+0x5c/0x80 [ 113.158223][ C0] kfree+0x1c5/0x6c0 [ 113.158249][ C0] lmLogShutdown+0x456/0x850 [ 113.158272][ C0] lmLogClose+0x28c/0x530 [ 113.158302][ C0] jfs_umount+0x2da/0x3b0 [ 113.158322][ C0] jfs_put_super+0x8c/0x190 [ 113.158337][ C0] generic_shutdown_super+0x13d/0x2d0 [ 113.158367][ C0] kill_block_super+0x44/0x90 [ 113.158388][ C0] deactivate_locked_super+0xbc/0x130 [ 113.158407][ C0] cleanup_mnt+0x3d3/0x460 [ 113.158426][ C0] task_work_run+0x1d9/0x270 [ 113.158441][ C0] exit_to_user_mode_loop+0x1fa/0x730 [ 113.158459][ C0] do_syscall_64+0x353/0x580 [ 113.158485][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.158503][ C0] [ 113.158508][ C0] The buggy address belongs to the object at ffff88802de89000 [ 113.158508][ C0] which belongs to the cache kmalloc-256 of size 256 [ 113.158525][ C0] The buggy address is located 8 bytes inside of [ 113.158525][ C0] freed 256-byte region [ffff88802de89000, ffff88802de89100) [ 113.158545][ C0] [ 113.158550][ C0] The buggy address belongs to the physical page: [ 113.158571][ C0] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2de88 [ 113.158590][ C0] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 113.158606][ C0] flags: 0x80000000000040(head|node=0|zone=1) [ 113.158626][ C0] page_type: f5(slab) [ 113.158645][ C0] raw: 0080000000000040 ffff88813ffb4b40 dead000000000100 dead000000000122 [ 113.158666][ C0] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 113.158682][ C0] head: 0080000000000040 ffff88813ffb4b40 dead000000000100 dead000000000122 [ 113.158697][ C0] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 113.158715][ C0] head: 0080000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 113.158732][ C0] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002 [ 113.158742][ C0] page dumped because: kasan: bad access detected [ 113.158756][ C0] page_owner tracks the page as allocated [ 113.158764][ C0] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 16896339869, free_ts 0 [ 113.158799][ C0] post_alloc_hook+0x1f9/0x250 [ 113.158829][ C0] get_page_from_freelist+0x262a/0x26a0 [ 113.158856][ C0] __alloc_frozen_pages_noprof+0x18d/0x380 [ 113.158877][ C0] allocate_slab+0x79/0x5e0 [ 113.158902][ C0] refill_objects+0x2d8/0x350 [ 113.158926][ C0] __pcs_replace_empty_main+0x330/0x690 [ 113.158953][ C0] __kvmalloc_node_noprof+0x703/0x8a0 [ 113.158971][ C0] v4l2_ctrl_new+0xa5a/0x1820 [ 113.158996][ C0] v4l2_ctrl_new_std+0x24e/0x300 [ 113.159015][ C0] handler_new_ref+0x153/0x930 [ 113.159033][ C0] v4l2_ctrl_add_handler+0x19f/0x290 [ 113.159054][ C0] vivid_create_controls+0x2f47/0x3c40 [ 113.159081][ C0] vivid_probe+0x4112/0x70d0 [ 113.159101][ C0] platform_probe+0xf9/0x190 [ 113.159119][ C0] really_probe+0x254/0xae0 [ 113.159142][ C0] __driver_probe_device+0x1e8/0x360 [ 113.159166][ C0] page_owner free stack trace missing [ 113.159173][ C0] [ 113.159178][ C0] Memory state around the buggy address: [ 113.159189][ C0] ffff88802de88f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 113.159203][ C0] ffff88802de88f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 113.159217][ C0] >ffff88802de89000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 113.159228][ C0] ^ [ 113.159237][ C0] ffff88802de89080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 113.159249][ C0] ffff88802de89100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 113.159258][ C0] ================================================================== [ 113.182733][ C0] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 113.182753][ C0] CPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 113.182775][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 113.182787][ C0] Call Trace: [ 113.182794][ C0] [ 113.182802][ C0] vpanic+0x56c/0xa60 [ 113.182827][ C0] ? __pfx_vpanic+0x10/0x10 [ 113.182846][ C0] ? __pfx___schedule+0x10/0x10 [ 113.182873][ C0] panic+0xc5/0xd0 [ 113.182894][ C0] ? __pfx_panic+0x10/0x10 [ 113.182912][ C0] ? preempt_schedule_thunk+0x16/0x40 [ 113.182939][ C0] ? lbmIODone+0x130e/0x16b0 [ 113.182968][ C0] check_panic_on_warn+0x89/0xb0 [ 113.183009][ C0] ? lbmIODone+0x130e/0x16b0 [ 113.183036][ C0] end_report+0x73/0x170 [ 113.183059][ C0] ? lbmIODone+0x130e/0x16b0 [ 113.183086][ C0] kasan_report+0x128/0x150 [ 113.183109][ C0] ? lbmIODone+0x130e/0x16b0 [ 113.183140][ C0] lbmIODone+0x130e/0x16b0 [ 113.183169][ C0] ? blkg_put+0x22/0x240 [ 113.183198][ C0] ? blkg_put+0x22/0x240 [ 113.183227][ C0] ? blkg_put+0x18d/0x240 [ 113.183255][ C0] ? bio_endio+0x980/0x9d0 [ 113.183276][ C0] blk_update_request+0x57b/0xe50 [ 113.183301][ C0] blk_mq_end_request+0x3e/0x70 [ 113.183329][ C0] blk_done_softirq+0x10a/0x160 [ 113.183347][ C0] handle_softirqs+0x1d9/0x6c0 [ 113.183382][ C0] run_ksoftirqd+0x52/0x180 [ 113.183411][ C0] smpboot_thread_fn+0x57c/0xa80 [ 113.183439][ C0] ? smpboot_thread_fn+0x4e/0xa80 [ 113.183468][ C0] kthread+0x388/0x470 [ 113.183502][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 113.183532][ C0] ? __pfx_kthread+0x10/0x10 [ 113.183561][ C0] ret_from_fork+0x514/0xb70 [ 113.183594][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 113.183624][ C0] ? __switch_to+0xc89/0x1420 [ 113.183656][ C0] ? __pfx_kthread+0x10/0x10 [ 113.183685][ C0] ret_from_fork_asm+0x1a/0x30 [ 113.183711][ C0] [ 113.184018][ C0] Kernel Offset: disabled