Warning: Permanently added '[localhost]:9435' (ED25519) to the list of known hosts. 2025/07/16 21:47:48 ignoring optional flag "sandboxArg"="0" syzkaller login: [ 91.870906][ T10] cfg80211: failed to load regulatory.db 2025/07/16 21:47:49 parsed 1 programs [ 94.740687][ T5331] cgroup: Unknown subsys name 'net' [ 94.828026][ T5331] cgroup: Unknown subsys name 'cpuset' [ 94.832757][ T5331] cgroup: Unknown subsys name 'rlimit' [ 96.396838][ T5331] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 100.161528][ T5345] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 100.166365][ T5345] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 100.169964][ T5345] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 100.173369][ T5345] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 100.177367][ T5345] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 100.401239][ T5344] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 101.546529][ T5362] chnl_net:caif_netlink_parms(): no params data found [ 101.616975][ T5362] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.620849][ T5362] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.627208][ T5362] bridge_slave_0: entered allmulticast mode [ 101.630996][ T5362] bridge_slave_0: entered promiscuous mode [ 101.637760][ T5362] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.641189][ T5362] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.645122][ T5362] bridge_slave_1: entered allmulticast mode [ 101.649137][ T5362] bridge_slave_1: entered promiscuous mode [ 101.676220][ T5362] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.682791][ T5362] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.711199][ T5362] team0: Port device team_slave_0 added [ 101.717333][ T5362] team0: Port device team_slave_1 added [ 101.739932][ T5362] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.743144][ T5362] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 101.754839][ T5362] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.762176][ T5362] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.765607][ T5362] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 101.777975][ T5362] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.818452][ T5362] hsr_slave_0: entered promiscuous mode [ 101.821907][ T5362] hsr_slave_1: entered promiscuous mode [ 101.989720][ T5362] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 102.000498][ T5362] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 102.008415][ T5362] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 102.016321][ T5362] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 102.051976][ T5362] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.055659][ T5362] bridge0: port 2(bridge_slave_1) entered forwarding state [ 102.059734][ T5362] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.062825][ T5362] bridge0: port 1(bridge_slave_0) entered forwarding state [ 102.123540][ T5362] 8021q: adding VLAN 0 to HW filter on device bond0 [ 102.138571][ T1050] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.143514][ T1050] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.159540][ T5362] 8021q: adding VLAN 0 to HW filter on device team0 [ 102.171627][ T31] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.175064][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state [ 102.188055][ T31] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.191570][ T31] bridge0: port 2(bridge_slave_1) entered forwarding state [ 102.407518][ T5362] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 102.450390][ T5362] veth0_vlan: entered promiscuous mode [ 102.461822][ T5362] veth1_vlan: entered promiscuous mode [ 102.490702][ T5362] veth0_macvtap: entered promiscuous mode [ 102.498996][ T5362] veth1_macvtap: entered promiscuous mode [ 102.519688][ T5362] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 102.530603][ T5362] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 102.540329][ T5362] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.545545][ T5362] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.549421][ T5362] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.555419][ T5362] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.725887][ T5362] syz-executor (5362) used greatest stack depth: 19928 bytes left [ 102.757742][ T3040] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 102.798683][ T3040] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 102.847335][ T3040] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 102.896526][ T3040] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 104.006724][ T1039] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.010522][ T1039] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.050232][ T1050] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.055952][ T1050] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.083023][ T3040] bridge_slave_1: left allmulticast mode [ 105.104637][ T3040] bridge_slave_1: left promiscuous mode [ 105.108196][ T3040] bridge0: port 2(bridge_slave_1) entered disabled state [ 105.130987][ T3040] bridge_slave_0: left allmulticast mode [ 105.144938][ T3040] bridge_slave_0: left promiscuous mode [ 105.160444][ T3040] bridge0: port 1(bridge_slave_0) entered disabled state [ 105.796725][ T3040] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 105.804542][ T3040] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 105.817358][ T3040] bond0 (unregistering): Released all slaves [ 105.922247][ T3040] hsr_slave_0: left promiscuous mode [ 105.930738][ T3040] hsr_slave_1: left promiscuous mode [ 105.934948][ T3040] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 105.938128][ T3040] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 105.942423][ T3040] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 105.947556][ T3040] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 105.960510][ T3040] veth1_macvtap: left promiscuous mode [ 105.963256][ T3040] veth0_macvtap: left promiscuous mode [ 105.966878][ T3040] veth1_vlan: left promiscuous mode [ 105.969247][ T3040] veth0_vlan: left promiscuous mode [ 106.274481][ T3040] team0 (unregistering): Port device team_slave_1 removed [ 106.293317][ T3040] team0 (unregistering): Port device team_slave_0 removed 2025/07/16 21:48:06 executed programs: 0 [ 109.006824][ T4685] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 109.010917][ T4685] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 109.015584][ T4685] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 109.019862][ T4685] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 109.023349][ T4685] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 109.372283][ T5460] chnl_net:caif_netlink_parms(): no params data found [ 109.510463][ T5460] bridge0: port 1(bridge_slave_0) entered blocking state [ 109.524135][ T5460] bridge0: port 1(bridge_slave_0) entered disabled state [ 109.527405][ T5460] bridge_slave_0: entered allmulticast mode [ 109.536114][ T5460] bridge_slave_0: entered promiscuous mode [ 109.557595][ T5460] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.561404][ T5460] bridge0: port 2(bridge_slave_1) entered disabled state [ 109.575933][ T5460] bridge_slave_1: entered allmulticast mode [ 109.579438][ T5460] bridge_slave_1: entered promiscuous mode [ 109.629124][ T5460] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 109.647864][ T5460] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 109.698193][ T5460] team0: Port device team_slave_0 added [ 109.716849][ T5460] team0: Port device team_slave_1 added [ 109.757616][ T5460] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 109.760700][ T5460] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 109.775815][ T5460] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 109.805388][ T5460] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 109.808692][ T5460] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 109.844379][ T5460] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 109.915736][ T5460] hsr_slave_0: entered promiscuous mode [ 109.925410][ T5460] hsr_slave_1: entered promiscuous mode [ 110.610301][ T5460] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 110.640655][ T5460] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 110.658271][ T5460] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 110.675302][ T5460] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 110.823402][ T5460] 8021q: adding VLAN 0 to HW filter on device bond0 [ 110.858483][ T5460] 8021q: adding VLAN 0 to HW filter on device team0 [ 110.877455][ T3040] bridge0: port 1(bridge_slave_0) entered blocking state [ 110.880673][ T3040] bridge0: port 1(bridge_slave_0) entered forwarding state [ 110.918904][ T3040] bridge0: port 2(bridge_slave_1) entered blocking state [ 110.922600][ T3040] bridge0: port 2(bridge_slave_1) entered forwarding state [ 111.074611][ T4685] Bluetooth: hci0: command tx timeout [ 111.255325][ T5460] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 111.326417][ T5460] veth0_vlan: entered promiscuous mode [ 111.356121][ T5460] veth1_vlan: entered promiscuous mode [ 111.399552][ T5460] veth0_macvtap: entered promiscuous mode [ 111.418974][ T5460] veth1_macvtap: entered promiscuous mode [ 111.457300][ T5460] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.477326][ T5460] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.482865][ T5460] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.503252][ T5460] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.514227][ T5460] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.518258][ T5460] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.646885][ T1133] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.650402][ T1133] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.702171][ T3040] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.706825][ T3040] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.811278][ T5516] loop0: detected capacity change from 0 to 128 [ 111.837627][ T5516] ======================================================= [ 111.837627][ T5516] WARNING: The mand mount option has been deprecated and [ 111.837627][ T5516] and is ignored by this kernel. Remove the mand [ 111.837627][ T5516] option from the mount to silence this warning. [ 111.837627][ T5516] ======================================================= [ 111.915721][ T5516] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 111.926433][ T5516] hpfs: filesystem error: improperly stopped [ 111.929091][ T5516] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 111.932526][ T5516] hpfs: You really don't want any checks? You are crazy... [ 111.957284][ T5516] hpfs: hpfs_map_sector(): read error [ 111.959578][ T5516] hpfs: code page support is disabled [ 111.973958][ T5516] hpfs: hpfs_map_sector(): read error [ 111.976166][ T5516] hpfs: hpfs_map_sector(): read error [ 111.978551][ T5516] hpfs: hpfs_map_sector(): read error [ 111.981072][ T5516] hpfs: hpfs_map_sector(): read error [ 111.983229][ T5516] hpfs: hpfs_map_4sectors(): unaligned read [ 111.994551][ T5516] hpfs: hpfs_map_4sectors(): unaligned read [ 111.997288][ T5516] hpfs: filesystem error: unable to find root dir [ 112.081862][ T5521] loop0: detected capacity change from 0 to 128 [ 112.111371][ T5521] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 112.146017][ T5521] hpfs: filesystem error: improperly stopped [ 112.148325][ T5521] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 112.151837][ T5521] hpfs: You really don't want any checks? You are crazy... [ 112.186934][ T5521] hpfs: hpfs_map_sector(): read error [ 112.189283][ T5521] hpfs: code page support is disabled [ 112.192101][ T5521] hpfs: hpfs_map_sector(): read error [ 112.212284][ T5521] ================================================================== [ 112.216337][ T5521] BUG: KASAN: use-after-free in strcmp+0x6f/0xc0 [ 112.219639][ T5521] Read of size 1 at addr ffff88804e7d7003 by task syz.0.17/5521 [ 112.223878][ T5521] [ 112.224904][ T5521] CPU: 0 UID: 0 PID: 5521 Comm: syz.0.17 Not tainted 6.16.0-rc6-syzkaller-00002-g155a3c003e55 #0 PREEMPT(full) [ 112.224920][ T5521] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 112.224927][ T5521] Call Trace: [ 112.224935][ T5521] [ 112.224942][ T5521] dump_stack_lvl+0x189/0x250 [ 112.224960][ T5521] ? __virt_addr_valid+0x1c8/0x5c0 [ 112.224976][ T5521] ? rcu_is_watching+0x15/0xb0 [ 112.225045][ T5521] ? __kasan_check_byte+0x12/0x40 [ 112.225059][ T5521] ? __pfx_dump_stack_lvl+0x10/0x10 [ 112.225071][ T5521] ? rcu_is_watching+0x15/0xb0 [ 112.225083][ T5521] ? lock_release+0x4b/0x3e0 [ 112.225094][ T5521] ? __virt_addr_valid+0x1c8/0x5c0 [ 112.225109][ T5521] ? __virt_addr_valid+0x4a5/0x5c0 [ 112.225123][ T5521] print_report+0xca/0x230 [ 112.225132][ T5521] ? strcmp+0x6f/0xc0 [ 112.225145][ T5521] kasan_report+0x118/0x150 [ 112.225158][ T5521] ? strcmp+0x6f/0xc0 [ 112.225204][ T5521] strcmp+0x6f/0xc0 [ 112.225218][ T5521] hpfs_get_ea+0x114/0xdb0 [ 112.225238][ T5521] ? __pfx_hpfs_get_ea+0x10/0x10 [ 112.225259][ T5521] ? hpfs_map_fnode+0x27e/0x6a0 [ 112.225270][ T5521] ? set_normalized_timespec64+0xf0/0x1a0 [ 112.225281][ T5521] ? __lock_acquire+0xab9/0xd20 [ 112.225292][ T5521] hpfs_read_inode+0x516/0x1010 [ 112.225311][ T5521] ? __pfx_hpfs_read_inode+0x10/0x10 [ 112.225327][ T5521] ? inode_set_ctime_to_ts+0x126/0x2f0 [ 112.225339][ T5521] ? __pfx_inode_set_ctime_to_ts+0x10/0x10 [ 112.225351][ T5521] ? do_raw_spin_unlock+0x4d/0x240 [ 112.225368][ T5521] ? hpfs_init_inode+0x216/0x350 [ 112.225387][ T5521] hpfs_fill_super+0x12bd/0x2070 [ 112.225402][ T5521] ? __pfx_hpfs_fill_super+0x10/0x10 [ 112.225413][ T5521] ? __pfx_snprintf+0x10/0x10 [ 112.225427][ T5521] ? set_blocksize+0x21e/0x500 [ 112.225440][ T5521] ? sb_set_blocksize+0x104/0x180 [ 112.225451][ T5521] ? setup_bdev_super+0x4c1/0x5b0 [ 112.225464][ T5521] get_tree_bdev_flags+0x40e/0x4d0 [ 112.225478][ T5521] ? __pfx_hpfs_fill_super+0x10/0x10 [ 112.225489][ T5521] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 112.225503][ T5521] vfs_get_tree+0x8f/0x2b0 [ 112.225516][ T5521] do_new_mount+0x24a/0xa40 [ 112.225532][ T5521] __se_sys_mount+0x317/0x410 [ 112.225548][ T5521] ? __pfx___se_sys_mount+0x10/0x10 [ 112.225563][ T5521] ? do_syscall_64+0xbe/0x3b0 [ 112.225574][ T5521] ? __x64_sys_mount+0x20/0xc0 [ 112.225588][ T5521] do_syscall_64+0xfa/0x3b0 [ 112.225598][ T5521] ? lockdep_hardirqs_on+0x9c/0x150 [ 112.225612][ T5521] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.225624][ T5521] ? clear_bhb_loop+0x60/0xb0 [ 112.225636][ T5521] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.225647][ T5521] RIP: 0033:0x7f30539900ca [ 112.225664][ T5521] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 112.225674][ T5521] RSP: 002b:00007fffac3e4588 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 112.225687][ T5521] RAX: ffffffffffffffda RBX: 00007fffac3e4610 RCX: 00007f30539900ca [ 112.225697][ T5521] RDX: 0000200000009e80 RSI: 0000200000009ec0 RDI: 00007fffac3e45d0 [ 112.225704][ T5521] RBP: 0000200000009e80 R08: 00007fffac3e4610 R09: 0000000000000041 [ 112.225712][ T5521] R10: 0000000000000041 R11: 0000000000000246 R12: 0000200000009ec0 [ 112.225719][ T5521] R13: 00007fffac3e45d0 R14: 0000000000009e02 R15: 0000200000009fc0 [ 112.225732][ T5521] [ 112.225745][ T5521] [ 112.367926][ T5521] The buggy address belongs to the physical page: [ 112.370542][ T5521] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4e7d7 [ 112.373974][ T5521] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 112.377044][ T5521] raw: 04fff00000000000 ffffea000139f608 ffff88801fc3fef0 0000000000000000 [ 112.380900][ T5521] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 112.384773][ T5521] page dumped because: kasan: bad access detected [ 112.387615][ T5521] page_owner tracks the page as freed [ 112.389782][ T5521] page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 5342, tgid 5342 (udevd), ts 112209694728, free_ts 112211381607 [ 112.396851][ T5521] post_alloc_hook+0x240/0x2a0 [ 112.398906][ T5521] get_page_from_freelist+0x21e4/0x22c0 [ 112.401364][ T5521] __alloc_frozen_pages_noprof+0x181/0x370 [ 112.403956][ T5521] alloc_pages_mpol+0x232/0x4a0 [ 112.406189][ T5521] folio_alloc_mpol_noprof+0x39/0x70 [ 112.408672][ T5521] shmem_alloc_and_add_folio+0x447/0xf60 [ 112.411184][ T5521] shmem_get_folio_gfp+0x59d/0x1660 [ 112.413479][ T5521] shmem_write_begin+0xf7/0x2b0 [ 112.415630][ T5521] generic_perform_write+0x2c4/0x910 [ 112.418147][ T5521] shmem_file_write_iter+0xf8/0x120 [ 112.421403][ T5521] vfs_write+0x54b/0xa90 [ 112.423798][ T5521] ksys_write+0x145/0x250 [ 112.426144][ T5521] do_syscall_64+0xfa/0x3b0 [ 112.428178][ T5521] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.430616][ T5521] page last free pid 5342 tgid 5342 stack trace: [ 112.432821][ T5521] free_unref_folios+0xc66/0x14d0 [ 112.434722][ T5521] folios_put_refs+0x559/0x640 [ 112.436599][ T5521] shmem_undo_range+0x49e/0x14b0 [ 112.438809][ T5521] shmem_evict_inode+0x272/0xa70 [ 112.440698][ T5521] evict+0x504/0x9c0 [ 112.442270][ T5521] __dentry_kill+0x209/0x660 [ 112.444405][ T5521] dput+0x19f/0x2b0 [ 112.446235][ T5521] do_renameat2+0x888/0xc50 [ 112.448292][ T5521] __x64_sys_rename+0x82/0x90 [ 112.450397][ T5521] do_syscall_64+0xfa/0x3b0 [ 112.452344][ T5521] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.454949][ T5521] [ 112.456034][ T5521] Memory state around the buggy address: [ 112.458493][ T5521] ffff88804e7d6f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 112.461989][ T5521] ffff88804e7d6f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 112.465473][ T5521] >ffff88804e7d7000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 112.469096][ T5521] ^ [ 112.471101][ T5521] ffff88804e7d7080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 112.474831][ T5521] ffff88804e7d7100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 112.477750][ T5521] ================================================================== [ 112.655643][ T5521] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 112.658980][ T5521] CPU: 0 UID: 0 PID: 5521 Comm: syz.0.17 Not tainted 6.16.0-rc6-syzkaller-00002-g155a3c003e55 #0 PREEMPT(full) [ 112.664125][ T5521] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 112.668732][ T5521] Call Trace: [ 112.670469][ T5521] [ 112.672039][ T5521] dump_stack_lvl+0x99/0x250 [ 112.674225][ T5521] ? __asan_memcpy+0x40/0x70 [ 112.676363][ T5521] ? __pfx_dump_stack_lvl+0x10/0x10 [ 112.678698][ T5521] ? __pfx__printk+0x10/0x10 [ 112.680614][ T5521] panic+0x2db/0x790 [ 112.682319][ T5521] ? __pfx_preempt_schedule+0x10/0x10 [ 112.684557][ T5521] ? __pfx_panic+0x10/0x10 [ 112.686446][ T5521] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 112.688856][ T5521] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 112.691233][ T5521] ? strcmp+0x6f/0xc0 [ 112.692806][ T5521] check_panic_on_warn+0x89/0xb0 [ 112.695049][ T5521] ? strcmp+0x6f/0xc0 [ 112.697020][ T5521] end_report+0x78/0x160 [ 112.698989][ T5521] kasan_report+0x129/0x150 [ 112.701228][ T5521] ? strcmp+0x6f/0xc0 [ 112.702974][ T5521] strcmp+0x6f/0xc0 [ 112.704672][ T5521] hpfs_get_ea+0x114/0xdb0 [ 112.706634][ T5521] ? __pfx_hpfs_get_ea+0x10/0x10 [ 112.708851][ T5521] ? hpfs_map_fnode+0x27e/0x6a0 [ 112.711028][ T5521] ? set_normalized_timespec64+0xf0/0x1a0 [ 112.713418][ T5521] ? __lock_acquire+0xab9/0xd20 [ 112.715588][ T5521] hpfs_read_inode+0x516/0x1010 [ 112.717753][ T5521] ? __pfx_hpfs_read_inode+0x10/0x10 [ 112.720127][ T5521] ? inode_set_ctime_to_ts+0x126/0x2f0 [ 112.722573][ T5521] ? __pfx_inode_set_ctime_to_ts+0x10/0x10 [ 112.725430][ T5521] ? do_raw_spin_unlock+0x4d/0x240 [ 112.727779][ T5521] ? hpfs_init_inode+0x216/0x350 [ 112.730020][ T5521] hpfs_fill_super+0x12bd/0x2070 [ 112.732336][ T5521] ? __pfx_hpfs_fill_super+0x10/0x10 [ 112.734768][ T5521] ? __pfx_snprintf+0x10/0x10 [ 112.736873][ T5521] ? set_blocksize+0x21e/0x500 [ 112.738880][ T5521] ? sb_set_blocksize+0x104/0x180 [ 112.741070][ T5521] ? setup_bdev_super+0x4c1/0x5b0 [ 112.743322][ T5521] get_tree_bdev_flags+0x40e/0x4d0 [ 112.745694][ T5521] ? __pfx_hpfs_fill_super+0x10/0x10 [ 112.747957][ T5521] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 112.750354][ T5521] vfs_get_tree+0x8f/0x2b0 [ 112.752271][ T5521] do_new_mount+0x24a/0xa40 [ 112.754262][ T5521] __se_sys_mount+0x317/0x410 [ 112.756296][ T5521] ? __pfx___se_sys_mount+0x10/0x10 [ 112.758460][ T5521] ? do_syscall_64+0xbe/0x3b0 [ 112.760560][ T5521] ? __x64_sys_mount+0x20/0xc0 [ 112.762714][ T5521] do_syscall_64+0xfa/0x3b0 [ 112.764574][ T5521] ? lockdep_hardirqs_on+0x9c/0x150 [ 112.766864][ T5521] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.769691][ T5521] ? clear_bhb_loop+0x60/0xb0 [ 112.771627][ T5521] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.774140][ T5521] RIP: 0033:0x7f30539900ca [ 112.776007][ T5521] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 112.784438][ T5521] RSP: 002b:00007fffac3e4588 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 112.788132][ T5521] RAX: ffffffffffffffda RBX: 00007fffac3e4610 RCX: 00007f30539900ca [ 112.791647][ T5521] RDX: 0000200000009e80 RSI: 0000200000009ec0 RDI: 00007fffac3e45d0 [ 112.794978][ T5521] RBP: 0000200000009e80 R08: 00007fffac3e4610 R09: 0000000000000041 [ 112.798231][ T5521] R10: 0000000000000041 R11: 0000000000000246 R12: 0000200000009ec0 [ 112.801521][ T5521] R13: 00007fffac3e45d0 R14: 0000000000009e02 R15: 0000200000009fc0 [ 112.804799][ T5521] [ 112.806745][ T5521] Kernel Offset: disabled [ 112.809437][ T5521] Rebooting in 86400 seconds.. VM DIAGNOSIS: 21:48:10 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000065 RBX=0000000000000065 RCX=0000000000000000 RDX=00000000000003f8 RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc9000234efd0 R8 =ffff888033de8237 R9 =1ffff110067bd046 R10=dffffc0000000000 R11=ffffffff85479720 R12=dffffc0000000000 R13=ffffffff99af98a3 R14=ffffffff99dfe700 R15=0000000000000000 RIP=ffffffff8547979c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 000055558eef2500 ffffffff 00c00000 GS =0000 ffff88808d21b000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f96ba9bf440 CR3=000000005189d000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000010100 Opmask02=00000000ffffffef Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fffac3e4a30 0000003000000018 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 00000000ffffffff ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 00000000ffffffff ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f3053a11c7a ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f3053a11c87 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f3053a11c81 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f3053a11c95 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f3053a11d1b ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f3053a11df9 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000000000004c 0000000000000001 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000