Warning: Permanently added '[localhost]:26728' (ED25519) to the list of known hosts. 2026/01/03 02:58:05 parsed 1 programs syzkaller login: [ 87.406433][ T5321] cgroup: Unknown subsys name 'net' [ 87.496824][ T5321] cgroup: Unknown subsys name 'cpuset' [ 87.502170][ T5321] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 89.191625][ T5321] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 91.840316][ T1354] cfg80211: failed to load regulatory.db [ 94.070247][ T5337] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 96.666733][ T4621] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.670252][ T4621] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.725284][ T3066] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.729554][ T3066] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.282372][ T5382] chnl_net:caif_netlink_parms(): no params data found [ 98.351545][ T5382] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.355665][ T5382] bridge0: port 1(bridge_slave_0) entered disabled state [ 98.359344][ T5382] bridge_slave_0: entered allmulticast mode [ 98.364822][ T5382] bridge_slave_0: entered promiscuous mode [ 98.370730][ T5382] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.374451][ T5382] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.377723][ T5382] bridge_slave_1: entered allmulticast mode [ 98.381261][ T5382] bridge_slave_1: entered promiscuous mode [ 98.403779][ T5382] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 98.409541][ T5382] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 98.433878][ T5382] team0: Port device team_slave_0 added [ 98.438761][ T5382] team0: Port device team_slave_1 added [ 98.460412][ T5382] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 98.463275][ T5382] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.475928][ T5382] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 98.482530][ T5382] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 98.485934][ T5382] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.497411][ T5382] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 98.530761][ T5382] hsr_slave_0: entered promiscuous mode [ 98.534589][ T5382] hsr_slave_1: entered promiscuous mode [ 98.690248][ T5382] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 98.700057][ T5382] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 98.706987][ T5382] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 98.714696][ T5382] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 98.748776][ T5382] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.751777][ T5382] bridge0: port 2(bridge_slave_1) entered forwarding state [ 98.755525][ T5382] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.758484][ T5382] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.785403][ T4621] bridge0: port 1(bridge_slave_0) entered disabled state [ 98.789459][ T4621] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.856000][ T5382] 8021q: adding VLAN 0 to HW filter on device bond0 [ 98.888061][ T5382] 8021q: adding VLAN 0 to HW filter on device team0 [ 98.909893][ T3066] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.912968][ T3066] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.932313][ T3066] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.935614][ T3066] bridge0: port 2(bridge_slave_1) entered forwarding state [ 99.221946][ T5382] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 99.258656][ T5382] veth0_vlan: entered promiscuous mode [ 99.268702][ T5382] veth1_vlan: entered promiscuous mode [ 99.295146][ T5382] veth0_macvtap: entered promiscuous mode [ 99.301818][ T5382] veth1_macvtap: entered promiscuous mode [ 99.318765][ T5382] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 99.341379][ T5382] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 99.375769][ T1139] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.398261][ T1139] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.401918][ T1139] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.419683][ T1139] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.736919][ T4621] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.807303][ T4621] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.866542][ T4621] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.966645][ T4621] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 101.538873][ T4678] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 101.542424][ T4678] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 101.546391][ T4678] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 101.549881][ T4678] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 101.554491][ T4678] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 102.116427][ T4621] bridge_slave_1: left allmulticast mode [ 102.119359][ T4621] bridge_slave_1: left promiscuous mode [ 102.122575][ T4621] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.166047][ T4621] bridge_slave_0: left allmulticast mode [ 102.168468][ T4621] bridge_slave_0: left promiscuous mode [ 102.171231][ T4621] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.868816][ T4621] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 102.876558][ T4621] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 102.885491][ T4621] bond0 (unregistering): Released all slaves [ 103.049635][ T4621] hsr_slave_0: left promiscuous mode [ 103.071079][ T4621] hsr_slave_1: left promiscuous mode [ 103.084225][ T4621] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 103.087347][ T4621] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 103.135256][ T4621] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 103.153512][ T4621] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 103.228358][ T4621] veth1_macvtap: left promiscuous mode [ 103.231485][ T4621] veth0_macvtap: left promiscuous mode [ 103.265387][ T4621] veth1_vlan: left promiscuous mode [ 103.268036][ T4621] veth0_vlan: left promiscuous mode 2026/01/03 02:58:24 executed programs: 0 [ 104.331522][ T47] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 104.337244][ T47] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 104.340571][ T47] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 104.344766][ T47] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 104.348035][ T47] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 104.438963][ T4621] team0 (unregistering): Port device team_slave_1 removed [ 104.495910][ T4621] team0 (unregistering): Port device team_slave_0 removed [ 105.087952][ T5446] chnl_net:caif_netlink_parms(): no params data found [ 105.644567][ T5446] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.648576][ T5446] bridge0: port 1(bridge_slave_0) entered disabled state [ 105.652098][ T5446] bridge_slave_0: entered allmulticast mode [ 105.696422][ T5446] bridge_slave_0: entered promiscuous mode [ 105.701191][ T5446] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.727227][ T5446] bridge0: port 2(bridge_slave_1) entered disabled state [ 105.730495][ T5446] bridge_slave_1: entered allmulticast mode [ 105.735505][ T5446] bridge_slave_1: entered promiscuous mode [ 105.864480][ T5446] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 105.879292][ T5446] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 105.944521][ T5446] team0: Port device team_slave_0 added [ 105.958258][ T5446] team0: Port device team_slave_1 added [ 106.006071][ T5446] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 106.009225][ T5446] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 106.037484][ T5446] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 106.051195][ T5446] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 106.062700][ T5446] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 106.079492][ T5446] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 106.154308][ T5446] hsr_slave_0: entered promiscuous mode [ 106.156973][ T5446] hsr_slave_1: entered promiscuous mode [ 106.385528][ T47] Bluetooth: hci0: command tx timeout [ 106.683958][ T5446] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 106.696427][ T5446] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 106.708011][ T5446] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 106.727067][ T5446] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 106.849650][ T5446] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.883291][ T5446] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.925030][ T4621] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.928284][ T4621] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.935849][ T4621] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.939034][ T4621] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.238844][ T5446] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.307164][ T5446] veth0_vlan: entered promiscuous mode [ 107.328293][ T5446] veth1_vlan: entered promiscuous mode [ 107.381624][ T5446] veth0_macvtap: entered promiscuous mode [ 107.398980][ T5446] veth1_macvtap: entered promiscuous mode [ 107.430420][ T5446] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 107.450999][ T5446] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 107.473591][ T4621] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.478270][ T4621] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.482245][ T4621] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.518362][ T4621] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.594339][ T167] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.598095][ T167] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.654964][ T2657] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.658087][ T2657] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.757508][ T5507] loop0: detected capacity change from 0 to 512 [ 107.781296][ T5507] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 107.814483][ T5507] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 107.871132][ T5507] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2857: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 107.893766][ T5507] EXT4-fs (loop0): 1 truncate cleaned up [ 107.897121][ T5507] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 107.946733][ T5507] ================================================================== [ 107.950242][ T5507] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x8e9/0x1e20 [ 107.953694][ T5507] Read of size 18446744073709551572 at addr ffff888040c34850 by task syz.0.17/5507 [ 107.958118][ T5507] [ 107.959005][ T5507] CPU: 0 UID: 0 PID: 5507 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 107.959018][ T5507] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 107.959024][ T5507] Call Trace: [ 107.959031][ T5507] [ 107.959037][ T5507] dump_stack_lvl+0xe8/0x150 [ 107.959052][ T5507] print_report+0xca/0x240 [ 107.959059][ T5507] ? ext4_xattr_set_entry+0x8e9/0x1e20 [ 107.959070][ T5507] kasan_report+0x118/0x150 [ 107.959080][ T5507] ? ext4_xattr_set_entry+0x8e9/0x1e20 [ 107.959093][ T5507] ? ext4_xattr_set_entry+0x8e9/0x1e20 [ 107.959104][ T5507] kasan_check_range+0x2b0/0x2c0 [ 107.959113][ T5507] ? ext4_xattr_set_entry+0x8e9/0x1e20 [ 107.959126][ T5507] __asan_memmove+0x29/0x70 [ 107.959138][ T5507] ext4_xattr_set_entry+0x8e9/0x1e20 [ 107.959149][ T5507] ext4_xattr_block_set+0x872/0x2ac0 [ 107.959158][ T5507] ? fs_reclaim_acquire+0x7d/0x100 [ 107.959170][ T5507] ? __pfx_check_xattrs+0x10/0x10 [ 107.959178][ T5507] ? __pfx_ext4_xattr_block_set+0x10/0x10 [ 107.959187][ T5507] ? ext4_xattr_block_find+0x2d4/0x350 [ 107.959201][ T5507] ext4_expand_extra_isize_ea+0x12da/0x1ea0 [ 107.959220][ T5507] __ext4_expand_extra_isize+0x30d/0x400 [ 107.959235][ T5507] __ext4_mark_inode_dirty+0x45c/0x6e0 [ 107.959247][ T5507] __ext4_unlink+0x631/0xab0 [ 107.959259][ T5507] ? __pfx___ext4_unlink+0x10/0x10 [ 107.959270][ T5507] ? __pfx___dquot_initialize+0x10/0x10 [ 107.959286][ T5507] ? down_write+0x162/0x1f0 [ 107.959330][ T5507] ? __pfx_down_write+0x10/0x10 [ 107.959337][ T5507] ext4_unlink+0x206/0x590 [ 107.959345][ T5507] vfs_unlink+0x380/0x640 [ 107.959357][ T5507] do_unlinkat+0x2cf/0x560 [ 107.959366][ T5507] ? __pfx_do_unlinkat+0x10/0x10 [ 107.959376][ T5507] ? getname_flags+0x1e5/0x540 [ 107.959382][ T5507] __x64_sys_unlink+0x47/0x50 [ 107.959391][ T5507] do_syscall_64+0xec/0xf80 [ 107.959398][ T5507] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.959404][ T5507] ? trace_irq_disable+0x37/0x100 [ 107.959413][ T5507] ? clear_bhb_loop+0x60/0xb0 [ 107.959424][ T5507] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.959431][ T5507] RIP: 0033:0x7fc38dd8f7c9 [ 107.959439][ T5507] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 107.959449][ T5507] RSP: 002b:00007ffc1b915968 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 [ 107.959457][ T5507] RAX: ffffffffffffffda RBX: 00007fc38dfe5fa0 RCX: 00007fc38dd8f7c9 [ 107.959462][ T5507] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000180 [ 107.959466][ T5507] RBP: 00007fc38de13f91 R08: 0000000000000000 R09: 0000000000000000 [ 107.959471][ T5507] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 107.959475][ T5507] R13: 00007fc38dfe5fa0 R14: 00007fc38dfe5fa0 R15: 0000000000000001 [ 107.959483][ T5507] [ 107.959487][ T5507] [ 108.075262][ T5507] Allocated by task 5507: [ 108.077692][ T5507] kasan_save_track+0x3e/0x80 [ 108.080255][ T5507] __kasan_kmalloc+0x93/0xb0 [ 108.082762][ T5507] __kmalloc_node_track_caller_noprof+0x575/0x820 [ 108.085859][ T5507] kmemdup_noprof+0x2b/0x70 [ 108.088071][ T5507] ext4_xattr_block_set+0x781/0x2ac0 [ 108.090610][ T5507] ext4_expand_extra_isize_ea+0x12da/0x1ea0 [ 108.093144][ T5507] __ext4_expand_extra_isize+0x30d/0x400 [ 108.095616][ T5507] __ext4_mark_inode_dirty+0x45c/0x6e0 [ 108.098008][ T5507] __ext4_unlink+0x631/0xab0 [ 108.100088][ T5507] ext4_unlink+0x206/0x590 [ 108.102085][ T5507] vfs_unlink+0x380/0x640 [ 108.103786][ T5507] do_unlinkat+0x2cf/0x560 [ 108.105461][ T5507] __x64_sys_unlink+0x47/0x50 [ 108.107406][ T5507] do_syscall_64+0xec/0xf80 [ 108.108904][ T5507] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.110909][ T5507] [ 108.111730][ T5507] The buggy address belongs to the object at ffff888040c34800 [ 108.111730][ T5507] which belongs to the cache kmalloc-1k of size 1024 [ 108.117070][ T5507] The buggy address is located 80 bytes inside of [ 108.117070][ T5507] 1024-byte region [ffff888040c34800, ffff888040c34c00) [ 108.122315][ T5507] [ 108.123406][ T5507] The buggy address belongs to the physical page: [ 108.126230][ T5507] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x40c34 [ 108.130150][ T5507] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 108.133589][ T5507] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 108.136787][ T5507] page_type: f5(slab) [ 108.138716][ T5507] raw: 04fff00000000040 ffff88801a441dc0 ffffea0001024c00 dead000000000002 [ 108.142712][ T5507] raw: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000 [ 108.146262][ T5507] head: 04fff00000000040 ffff88801a441dc0 ffffea0001024c00 dead000000000002 [ 108.149715][ T5507] head: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000 [ 108.153357][ T5507] head: 04fff00000000002 ffffea0001030d01 00000000ffffffff 00000000ffffffff [ 108.157010][ T5507] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 108.160141][ T5507] page dumped because: kasan: bad access detected [ 108.162816][ T5507] page_owner tracks the page as allocated [ 108.165187][ T5507] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 27761924209, free_ts 0 [ 108.173566][ T5507] post_alloc_hook+0x234/0x290 [ 108.176159][ T5507] get_page_from_freelist+0x24e0/0x2580 [ 108.179085][ T5507] __alloc_frozen_pages_noprof+0x181/0x370 [ 108.182078][ T5507] alloc_pages_mpol+0x232/0x4a0 [ 108.184439][ T5507] allocate_slab+0x86/0x3b0 [ 108.186629][ T5507] ___slab_alloc+0xe53/0x1820 [ 108.188871][ T5507] __slab_alloc+0x65/0x100 [ 108.190939][ T5507] __kmalloc_cache_noprof+0x41e/0x700 [ 108.193201][ T5507] init_srcu_struct_fields+0x7f/0xa20 [ 108.195575][ T5507] rtnl_link_register+0x141/0x2f0 [ 108.197818][ T5507] ovs_internal_dev_rtnl_link_register+0x16/0x80 [ 108.200512][ T5507] dp_init+0x1f/0x100 [ 108.202242][ T5507] do_one_initcall+0x1f1/0x800 [ 108.204100][ T5507] do_initcall_level+0x104/0x190 [ 108.206182][ T5507] do_initcalls+0x59/0xa0 [ 108.208042][ T5507] kernel_init_freeable+0x2a7/0x3d0 [ 108.210395][ T5507] page_owner free stack trace missing [ 108.212801][ T5507] [ 108.213875][ T5507] Memory state around the buggy address: [ 108.215909][ T5507] ffff888040c34700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 108.219088][ T5507] ffff888040c34780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 108.222534][ T5507] >ffff888040c34800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 108.225652][ T5507] ^ [ 108.228278][ T5507] ffff888040c34880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 108.231440][ T5507] ffff888040c34900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 108.234808][ T5507] ================================================================== [ 108.363525][ T5507] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 108.366707][ T5507] CPU: 0 UID: 0 PID: 5507 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 108.370335][ T5507] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 108.374786][ T5507] Call Trace: [ 108.376271][ T5507] [ 108.377601][ T5507] vpanic+0x1e0/0x670 [ 108.379391][ T5507] panic+0xb9/0xc0 [ 108.380966][ T5507] ? __pfx_panic+0x10/0x10 [ 108.382958][ T5507] ? preempt_schedule_thunk+0x16/0x30 [ 108.385168][ T5507] ? ext4_xattr_set_entry+0x8e9/0x1e20 [ 108.387537][ T5507] check_panic_on_warn+0x89/0xb0 [ 108.389794][ T5507] ? ext4_xattr_set_entry+0x8e9/0x1e20 [ 108.392297][ T5507] end_report+0x6f/0x140 [ 108.394173][ T5507] kasan_report+0x129/0x150 [ 108.396113][ T5507] ? ext4_xattr_set_entry+0x8e9/0x1e20 [ 108.398327][ T5507] ? ext4_xattr_set_entry+0x8e9/0x1e20 [ 108.400623][ T5507] kasan_check_range+0x2b0/0x2c0 [ 108.402771][ T5507] ? ext4_xattr_set_entry+0x8e9/0x1e20 [ 108.405151][ T5507] __asan_memmove+0x29/0x70 [ 108.406800][ T5507] ext4_xattr_set_entry+0x8e9/0x1e20 [ 108.408833][ T5507] ext4_xattr_block_set+0x872/0x2ac0 [ 108.411010][ T5507] ? fs_reclaim_acquire+0x7d/0x100 [ 108.413285][ T5507] ? __pfx_check_xattrs+0x10/0x10 [ 108.415585][ T5507] ? __pfx_ext4_xattr_block_set+0x10/0x10 [ 108.418162][ T5507] ? ext4_xattr_block_find+0x2d4/0x350 [ 108.420277][ T5507] ext4_expand_extra_isize_ea+0x12da/0x1ea0 [ 108.422758][ T5507] __ext4_expand_extra_isize+0x30d/0x400 [ 108.425140][ T5507] __ext4_mark_inode_dirty+0x45c/0x6e0 [ 108.427561][ T5507] __ext4_unlink+0x631/0xab0 [ 108.429549][ T5507] ? __pfx___ext4_unlink+0x10/0x10 [ 108.431722][ T5507] ? __pfx___dquot_initialize+0x10/0x10 [ 108.434137][ T5507] ? down_write+0x162/0x1f0 [ 108.436186][ T5507] ? __pfx_down_write+0x10/0x10 [ 108.438374][ T5507] ext4_unlink+0x206/0x590 [ 108.440406][ T5507] vfs_unlink+0x380/0x640 [ 108.442394][ T5507] do_unlinkat+0x2cf/0x560 [ 108.444436][ T5507] ? __pfx_do_unlinkat+0x10/0x10 [ 108.446593][ T5507] ? getname_flags+0x1e5/0x540 [ 108.448654][ T5507] __x64_sys_unlink+0x47/0x50 [ 108.450708][ T5507] do_syscall_64+0xec/0xf80 [ 108.452699][ T5507] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.455201][ T5507] ? trace_irq_disable+0x37/0x100 [ 108.457480][ T5507] ? clear_bhb_loop+0x60/0xb0 [ 108.459493][ T5507] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.462216][ T5507] RIP: 0033:0x7fc38dd8f7c9 [ 108.464194][ T5507] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 108.472566][ T5507] RSP: 002b:00007ffc1b915968 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 [ 108.476403][ T5507] RAX: ffffffffffffffda RBX: 00007fc38dfe5fa0 RCX: 00007fc38dd8f7c9 [ 108.479850][ T5507] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000180 [ 108.483697][ T5507] RBP: 00007fc38de13f91 R08: 0000000000000000 R09: 0000000000000000 [ 108.487994][ T5507] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 108.491436][ T5507] R13: 00007fc38dfe5fa0 R14: 00007fc38dfe5fa0 R15: 0000000000000001 [ 108.494838][ T5507] [ 108.496543][ T5507] Kernel Offset: disabled [ 108.498374][ T5507] Rebooting in 86400 seconds.. VM DIAGNOSIS: 02:58:28 Registers: info registers vcpu 0 CPU#0 RAX=1ffffffff3382a60 RBX=00000000000003fd RCX=0000000000000000 RDX=00000000000003fd RSI=0000000000000000 RDI=0000000000000020 RBP=ffffffff99c15930 RSP=ffffc90002ca6f50 R8 =ffff888033c40237 R9 =1ffff11006788046 R10=dffffc0000000000 R11=ffffffff851bb590 R12=dffffc0000000000 R13=0000000000000000 R14=ffffffff99c156a0 R15=0000000000000000 RIP=ffffffff851bb607 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000555566263500 ffffffff 00c00000 GS =0000 ffff88808d414000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f62cbfc3440 CR3=0000000059a04000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000008000100 Opmask01=0000000000000000 Opmask02=00000000ffffffef Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000f1d0f55e 0000000061d82e56 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 3734c660a62facc2 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 00000000ffffffff ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc38de15050 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc38de1505d ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc38de15057 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc38de1506b ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc38de150f1 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc38de151cf ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000