Warning: Permanently added '[localhost]:32574' (ED25519) to the list of known hosts.
2025/09/26 13:31:59 parsed 1 programs
syzkaller login: [ 84.489285][ T5346] cgroup: Unknown subsys name 'net'
[ 84.564848][ T5346] cgroup: Unknown subsys name 'cpuset'
[ 84.571757][ T5346] cgroup: Unknown subsys name 'rlimit'
[ 86.273163][ T5346] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 90.019483][ T5359] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 90.852494][ T14] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 90.855540][ T14] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 90.892876][ T14] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 90.896055][ T14] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 91.881727][ T11] cfg80211: failed to load regulatory.db
[ 93.436389][ T5417] chnl_net:caif_netlink_parms(): no params data found
[ 93.503551][ T5417] bridge0: port 1(bridge_slave_0) entered blocking state
[ 93.507193][ T5417] bridge0: port 1(bridge_slave_0) entered disabled state
[ 93.510783][ T5417] bridge_slave_0: entered allmulticast mode
[ 93.514660][ T5417] bridge_slave_0: entered promiscuous mode
[ 93.519593][ T5417] bridge0: port 2(bridge_slave_1) entered blocking state
[ 93.523039][ T5417] bridge0: port 2(bridge_slave_1) entered disabled state
[ 93.525575][ T5417] bridge_slave_1: entered allmulticast mode
[ 93.528870][ T5417] bridge_slave_1: entered promiscuous mode
[ 93.552180][ T5417] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 93.558592][ T5417] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 93.581056][ T5417] team0: Port device team_slave_0 added
[ 93.585558][ T5417] team0: Port device team_slave_1 added
[ 93.607177][ T5417] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 93.610762][ T5417] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 93.622844][ T5417] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 93.630387][ T5417] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 93.633318][ T5417] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 93.645320][ T5417] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 93.682360][ T5417] hsr_slave_0: entered promiscuous mode
[ 93.685551][ T5417] hsr_slave_1: entered promiscuous mode
[ 93.830487][ T5417] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 93.838697][ T5417] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 93.845511][ T5417] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 93.852396][ T5417] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 93.879140][ T5417] bridge0: port 2(bridge_slave_1) entered blocking state
[ 93.881972][ T5417] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 93.885883][ T5417] bridge0: port 1(bridge_slave_0) entered blocking state
[ 93.888758][ T5417] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 93.954560][ T5417] 8021q: adding VLAN 0 to HW filter on device bond0
[ 93.967545][ T1045] bridge0: port 1(bridge_slave_0) entered disabled state
[ 93.973063][ T1045] bridge0: port 2(bridge_slave_1) entered disabled state
[ 93.983946][ T5417] 8021q: adding VLAN 0 to HW filter on device team0
[ 93.994867][ T14] bridge0: port 1(bridge_slave_0) entered blocking state
[ 93.997876][ T14] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 94.014328][ T14] bridge0: port 2(bridge_slave_1) entered blocking state
[ 94.017242][ T14] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 94.188499][ T5417] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 94.229394][ T5417] veth0_vlan: entered promiscuous mode
[ 94.239168][ T5417] veth1_vlan: entered promiscuous mode
[ 94.269583][ T5417] veth0_macvtap: entered promiscuous mode
[ 94.277582][ T5417] veth1_macvtap: entered promiscuous mode
[ 94.293119][ T5417] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 94.303912][ T5417] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 94.314575][ T14] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 94.325044][ T14] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 94.328457][ T14] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 94.351704][ T14] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 94.465075][ T14] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 94.510961][ T14] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 94.553681][ T14] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 94.615733][ T14] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 94.695644][ T5444] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 94.700847][ T5444] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 94.704310][ T5444] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 94.707827][ T5444] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 94.712274][ T5444] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
2025/09/26 13:32:13 executed programs: 0
[ 95.384505][ T4702] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 95.388438][ T4702] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 95.394438][ T4702] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 95.398466][ T4702] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 95.412154][ T4702] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 95.590903][ T5455] chnl_net:caif_netlink_parms(): no params data found
[ 95.656386][ T5455] bridge0: port 1(bridge_slave_0) entered blocking state
[ 95.659597][ T5455] bridge0: port 1(bridge_slave_0) entered disabled state
[ 95.663790][ T5455] bridge_slave_0: entered allmulticast mode
[ 95.667732][ T5455] bridge_slave_0: entered promiscuous mode
[ 95.673901][ T5455] bridge0: port 2(bridge_slave_1) entered blocking state
[ 95.677166][ T5455] bridge0: port 2(bridge_slave_1) entered disabled state
[ 95.681553][ T5455] bridge_slave_1: entered allmulticast mode
[ 95.685470][ T5455] bridge_slave_1: entered promiscuous mode
[ 95.710328][ T5455] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 95.715772][ T5455] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 95.742918][ T5455] team0: Port device team_slave_0 added
[ 95.746925][ T5455] team0: Port device team_slave_1 added
[ 95.768636][ T5455] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 95.772248][ T5455] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 95.783864][ T5455] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 95.791309][ T5455] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 95.794180][ T5455] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 95.806423][ T5455] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 95.848231][ T5455] hsr_slave_0: entered promiscuous mode
[ 95.852813][ T5455] hsr_slave_1: entered promiscuous mode
[ 95.855624][ T5455] debugfs: 'hsr0' already exists in 'hsr'
[ 95.857957][ T5455] Cannot create hsr debugfs directory
[ 97.132393][ T14] bridge_slave_1: left allmulticast mode
[ 97.134874][ T14] bridge_slave_1: left promiscuous mode
[ 97.138334][ T14] bridge0: port 2(bridge_slave_1) entered disabled state
[ 97.162765][ T14] bridge_slave_0: left allmulticast mode
[ 97.165061][ T14] bridge_slave_0: left promiscuous mode
[ 97.167324][ T14] bridge0: port 1(bridge_slave_0) entered disabled state
[ 97.481771][ T4702] Bluetooth: hci0: command tx timeout
[ 97.561649][ T14] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 97.567057][ T14] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 97.572386][ T14] bond0 (unregistering): Released all slaves
[ 97.687126][ T14] hsr_slave_0: left promiscuous mode
[ 97.703781][ T14] hsr_slave_1: left promiscuous mode
[ 97.706791][ T14] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 97.718169][ T14] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 97.725833][ T14] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 97.729023][ T14] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 97.763178][ T14] veth1_macvtap: left promiscuous mode
[ 97.765829][ T14] veth0_macvtap: left promiscuous mode
[ 97.768114][ T14] veth1_vlan: left promiscuous mode
[ 97.781562][ T14] veth0_vlan: left promiscuous mode
[ 98.194760][ T14] team0 (unregistering): Port device team_slave_1 removed
[ 98.216387][ T14] team0 (unregistering): Port device team_slave_0 removed
[ 98.692209][ T5455] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 98.721224][ T5455] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 98.737753][ T5455] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 98.755387][ T5455] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 99.150137][ T5455] 8021q: adding VLAN 0 to HW filter on device bond0
[ 99.167860][ T5455] 8021q: adding VLAN 0 to HW filter on device team0
[ 99.203128][ T1041] bridge0: port 1(bridge_slave_0) entered blocking state
[ 99.206281][ T1041] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 99.238342][ T31] bridge0: port 2(bridge_slave_1) entered blocking state
[ 99.241511][ T31] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 99.515277][ T5455] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 99.556174][ T5455] veth0_vlan: entered promiscuous mode
[ 99.561033][ T4702] Bluetooth: hci0: command tx timeout
[ 99.568131][ T5455] veth1_vlan: entered promiscuous mode
[ 99.594410][ T5455] veth0_macvtap: entered promiscuous mode
[ 99.601867][ T5455] veth1_macvtap: entered promiscuous mode
[ 99.616761][ T5455] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 99.627369][ T5455] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 99.642723][ T1041] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 99.648461][ T1041] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 99.663747][ T1041] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 99.667341][ T1041] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 99.727809][ T1041] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 99.742079][ T1041] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 99.766427][ T3051] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 99.771421][ T3051] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 99.988510][ T5497] loop0: detected capacity change from 0 to 32768
[ 100.205110][ T5497] bcachefs (loop0): starting version 1.7: mi_btree_bitmap opts=metadata_checksum=none,data_checksum=none,compression=lz4,nojournal_transaction_names
[ 100.205125][ T5497] allowing incompatible features above 0.0: (unknown version)
[ 100.205133][ T5497] features: lz4,new_siphash,inline_data,new_extent_overwrite,btree_ptr_v2,new_varint,journal_no_flush,alloc_v2,extents_across_btree_nodes
[ 100.222691][ T5497] bcachefs (loop0): Using encoding defined by superblock: utf8-12.1.0
[ 100.227152][ T5497] bcachefs (loop0): recovering from clean shutdown, journal seq 10
[ 100.231776][ T5497] bcachefs (loop0): Version upgrade required:
[ 100.231776][ T5497] Version upgrade from 0.24: unwritten_extents to 1.7: mi_btree_bitmap incomplete
[ 100.231776][ T5497] Doing incompatible version upgrade from 0.24: unwritten_extents to 1.28: inode_has_case_insensitive
[ 100.231776][ T5497] running recovery passes: check_allocations,check_alloc_info,check_lrus,check_btree_backpointers,check_backpointers_to_extents,check_extents_to_backpointers,check_alloc_to_lru_refs,bucket_gens_init,check_snapshot_trees,check_snapshots,check_subvols,check_subvol_children,delete_dead_snapshots,check_inodes,check_extents,check_indirect_extents,check_dirents,check_xattrs,check_root,check_unreachable_inodes,check_subvolume_structure,check_directory_structure,check_nlinks,check_rebalance_work,set_fs_needs_rebalance
[ 100.420405][ T5497] ==================================================================
[ 100.423651][ T5497] BUG: KASAN: slab-out-of-bounds in bch2_btree_node_read_done+0x950/0x5550
[ 100.427197][ T5497] Read of size 8 at addr ffff88804217a010 by task syz.0.17/5497
[ 100.430201][ T5497]
[ 100.431089][ T5497] CPU: 0 UID: 0 PID: 5497 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 100.431099][ T5497] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 100.431104][ T5497] Call Trace:
[ 100.431108][ T5497]
[ 100.431113][ T5497] dump_stack_lvl+0x189/0x250
[ 100.431125][ T5497] ? __kasan_check_byte+0x12/0x40
[ 100.431135][ T5497] ? __pfx_dump_stack_lvl+0x10/0x10
[ 100.431143][ T5497] ? lock_release+0x4b/0x3e0
[ 100.431154][ T5497] ? __virt_addr_valid+0x4a5/0x5c0
[ 100.431164][ T5497] print_report+0xca/0x240
[ 100.431172][ T5497] ? bch2_btree_node_read_done+0x950/0x5550
[ 100.431182][ T5497] kasan_report+0x118/0x150
[ 100.431192][ T5497] ? bch2_btree_node_read_done+0x950/0x5550
[ 100.431203][ T5497] bch2_btree_node_read_done+0x950/0x5550
[ 100.431219][ T5497] ? __pfx_bch2_btree_node_read_done+0x10/0x10
[ 100.431229][ T5497] ? bch2_extent_ptr_to_text+0x5a/0x890
[ 100.431240][ T5497] ? bch2_bkey_ptrs_to_text+0x1161/0x1310
[ 100.431247][ T5497] ? bch2_printbuf_make_room+0xdb/0x360
[ 100.431257][ T5497] ? enumerated_ref_put+0xbe/0x270
[ 100.431268][ T5497] btree_node_read_work+0x40e/0xe60
[ 100.431280][ T5497] ? __pfx_btree_node_read_work+0x10/0x10
[ 100.431293][ T5497] ? bch2_latency_acct+0x436/0x520
[ 100.431306][ T5497] ? __pfx_bch2_latency_acct+0x10/0x10
[ 100.431319][ T5497] ? bio_associate_blkg+0x6d/0x230
[ 100.431336][ T5497] bch2_btree_node_read+0x887/0x2a00
[ 100.431356][ T5497] ? bch2_btree_node_hash_insert+0x88/0xc0
[ 100.431369][ T5497] ? __mutex_unlock_slowpath+0x1a1/0x740
[ 100.431423][ T5497] ? __pfx_bch2_btree_node_read+0x10/0x10
[ 100.431437][ T5497] ? bch2_trans_unlock+0x8a/0x580
[ 100.431450][ T5497] ? bch2_trans_unlock+0x491/0x580
[ 100.431463][ T5497] bch2_btree_root_read+0x5f0/0x760
[ 100.431481][ T5497] ? __pfx_bch2_btree_root_read+0x10/0x10
[ 100.431499][ T5497] ? bch2_current_has_btree_trans+0x169/0x1a0
[ 100.431516][ T5497] read_btree_roots+0x2c6/0x840
[ 100.431529][ T5497] ? __pfx_read_btree_roots+0x10/0x10
[ 100.431542][ T5497] bch2_fs_recovery+0x261f/0x3a50
[ 100.431558][ T5497] ? __pfx_bch2_fs_recovery+0x10/0x10
[ 100.431571][ T5497] ? __lock_acquire+0xab9/0xd20
[ 100.431589][ T5497] ? __mutex_trylock_common+0x153/0x260
[ 100.431602][ T5497] ? __lock_acquire+0xab9/0xd20
[ 100.431617][ T5497] ? __lock_acquire+0xab9/0xd20
[ 100.431640][ T5497] ? bch2_fs_start+0xa0f/0xda0
[ 100.431653][ T5497] ? up_write+0x1c4/0x420
[ 100.431663][ T5497] ? bch2_fs_start+0x5e7/0xda0
[ 100.431674][ T5497] bch2_fs_start+0xaaf/0xda0
[ 100.431685][ T5497] ? bch2_fs_start+0x5e7/0xda0
[ 100.431697][ T5497] ? __pfx_bch2_fs_start+0x10/0x10
[ 100.431712][ T5497] ? sget+0x267/0x620
[ 100.431720][ T5497] bch2_fs_get_tree+0xb39/0x1520
[ 100.431731][ T5497] ? __pfx_bch2_fs_get_tree+0x10/0x10
[ 100.431741][ T5497] ? vfs_parse_fs_string+0x101/0x170
[ 100.431751][ T5497] ? __pfx_vfs_parse_comma_sep+0x10/0x10
[ 100.431762][ T5497] vfs_get_tree+0x92/0x2b0
[ 100.431770][ T5497] do_new_mount+0x2a2/0x9e0
[ 100.431780][ T5497] ? ns_capable+0x8a/0xf0
[ 100.431787][ T5497] ? __pfx_do_new_mount+0x10/0x10
[ 100.431795][ T5497] ? path_mount+0x61c/0xfe0
[ 100.431803][ T5497] ? user_path_at+0x44/0x60
[ 100.431814][ T5497] __se_sys_mount+0x317/0x410
[ 100.431829][ T5497] ? __pfx___se_sys_mount+0x10/0x10
[ 100.431845][ T5497] ? do_syscall_64+0xbe/0x3b0
[ 100.431856][ T5497] ? __x64_sys_mount+0x20/0xc0
[ 100.431872][ T5497] do_syscall_64+0xfa/0x3b0
[ 100.431883][ T5497] ? lockdep_hardirqs_on+0x9c/0x150
[ 100.431893][ T5497] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 100.431905][ T5497] ? clear_bhb_loop+0x60/0xb0
[ 100.431916][ T5497] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 100.431926][ T5497] RIP: 0033:0x7f375959066a
[ 100.431945][ T5497] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 100.431955][ T5497] RSP: 002b:00007ffc704204e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 100.431968][ T5497] RAX: ffffffffffffffda RBX: 00007ffc70420570 RCX: 00007f375959066a
[ 100.431976][ T5497] RDX: 00002000000058c0 RSI: 0000200000000000 RDI: 00007ffc70420530
[ 100.431984][ T5497] RBP: 00002000000058c0 R08: 00007ffc70420570 R09: 0000000000000000
[ 100.431991][ T5497] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000000
[ 100.431998][ T5497] R13: 00007ffc70420530 R14: 00000000000058f2 R15: 0000200000000180
[ 100.432009][ T5497]
[ 100.432013][ T5497]
[ 100.610627][ T5497] Allocated by task 5497:
[ 100.612684][ T5497] kasan_save_track+0x3e/0x80
[ 100.614692][ T5497] __kasan_kmalloc+0x93/0xb0
[ 100.616657][ T5497] __kvmalloc_node_noprof+0x30d/0x5f0
[ 100.618880][ T5497] btree_node_data_alloc+0xdc/0x270
[ 100.621040][ T5497] __bch2_btree_node_mem_alloc+0x1dc/0x2e0
[ 100.623441][ T5497] bch2_fs_btree_cache_init+0x314/0x870
[ 100.625596][ T5497] bch2_fs_open+0x1ceb/0x2600
[ 100.627588][ T5497] bch2_fs_get_tree+0x44f/0x1520
[ 100.629761][ T5497] vfs_get_tree+0x92/0x2b0
[ 100.631625][ T5497] do_new_mount+0x2a2/0x9e0
[ 100.633907][ T5497] __se_sys_mount+0x317/0x410
[ 100.636195][ T5497] do_syscall_64+0xfa/0x3b0
[ 100.638071][ T5497] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 100.640537][ T5497]
[ 100.641479][ T5497] The buggy address belongs to the object at ffff888042178000
[ 100.641479][ T5497] which belongs to the cache kmalloc-rcl-8k of size 8192
[ 100.646810][ T5497] The buggy address is located 16 bytes to the right of
[ 100.646810][ T5497] allocated 8192-byte region [ffff888042178000, ffff88804217a000)
[ 100.652531][ T5497]
[ 100.653576][ T5497] The buggy address belongs to the physical page:
[ 100.656212][ T5497] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x42178
[ 100.659777][ T5497] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 100.663115][ T5497] memcg:ffff888043f10aa1
[ 100.664957][ T5497] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff)
[ 100.668302][ T5497] page_type: f5(slab)
[ 100.670071][ T5497] raw: 04fff00000000040 ffff88801a8483c0 dead000000000122 0000000000000000
[ 100.673607][ T5497] raw: 0000000000000000 0000000080020002 00000000f5000000 ffff888043f10aa1
[ 100.677103][ T5497] head: 04fff00000000040 ffff88801a8483c0 dead000000000122 0000000000000000
[ 100.680671][ T5497] head: 0000000000000000 0000000080020002 00000000f5000000 ffff888043f10aa1
[ 100.684072][ T5497] head: 04fff00000000003 ffffea0001085e01 00000000ffffffff 00000000ffffffff
[ 100.687731][ T5497] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 100.691468][ T5497] page dumped because: kasan: bad access detected
[ 100.694266][ T5497] page_owner tracks the page as allocated
[ 100.696772][ T5497] page last allocated via order 3, migratetype Reclaimable, gfp_mask 0x528d0(GFP_NOWAIT|__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP), pid 5497, tgid 5497 (syz.0.17), ts 100005651174, free_ts 90767761954
[ 100.705353][ T5497] post_alloc_hook+0x240/0x2a0
[ 100.707269][ T5497] get_page_from_freelist+0x21e4/0x22c0
[ 100.709623][ T5497] __alloc_frozen_pages_noprof+0x181/0x370
[ 100.712060][ T5497] alloc_pages_mpol+0x232/0x4a0
[ 100.714205][ T5497] allocate_slab+0x8a/0x370
[ 100.716071][ T5497] ___slab_alloc+0xbeb/0x1420
[ 100.718118][ T5497] __kvmalloc_node_noprof+0x429/0x5f0
[ 100.720401][ T5497] btree_node_data_alloc+0xdc/0x270
[ 100.722625][ T5497] __bch2_btree_node_mem_alloc+0x1dc/0x2e0
[ 100.725114][ T5497] bch2_fs_btree_cache_init+0x314/0x870
[ 100.727505][ T5497] bch2_fs_open+0x1ceb/0x2600
[ 100.729512][ T5497] bch2_fs_get_tree+0x44f/0x1520
[ 100.731692][ T5497] vfs_get_tree+0x92/0x2b0
[ 100.733656][ T5497] do_new_mount+0x2a2/0x9e0
[ 100.735591][ T5497] __se_sys_mount+0x317/0x410
[ 100.737605][ T5497] do_syscall_64+0xfa/0x3b0
[ 100.739595][ T5497] page last free pid 5382 tgid 5382 stack trace:
[ 100.742089][ T5497] __free_frozen_pages+0xbc4/0xd30
[ 100.744311][ T5497] __slab_free+0x303/0x3c0
[ 100.746266][ T5497] qlist_free_all+0x97/0x140
[ 100.748255][ T5497] kasan_quarantine_reduce+0x148/0x160
[ 100.750606][ T5497] __kasan_slab_alloc+0x22/0x80
[ 100.752667][ T5497] __kmalloc_cache_noprof+0x1be/0x3d0
[ 100.755167][ T5497] ref_tracker_alloc+0x133/0x460
[ 100.757286][ T5497] netdev_queue_update_kobjects+0x1d1/0x6c0
[ 100.759952][ T5497] netdev_register_kobject+0x258/0x310
[ 100.762377][ T5497] register_netdevice+0x126c/0x1ae0
[ 100.764635][ T5497] __ip_tunnel_create+0x3e7/0x560
[ 100.766854][ T5497] ip_tunnel_init_net+0x2ba/0x800
[ 100.769086][ T5497] ops_init+0x359/0x5c0
[ 100.770933][ T5497] setup_net+0x10c/0x320
[ 100.772796][ T5497] copy_net_ns+0x31b/0x4d0
[ 100.774714][ T5497] create_new_namespaces+0x3f3/0x720
[ 100.776936][ T5497]
[ 100.777960][ T5497] Memory state around the buggy address:
[ 100.780372][ T5497] ffff888042179f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 100.783651][ T5497] ffff888042179f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 100.786927][ T5497] >ffff88804217a000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 100.790307][ T5497] ^
[ 100.792296][ T5497] ffff88804217a080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 100.795727][ T5497] ffff88804217a100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 100.799145][ T5497] ==================================================================
[ 100.859254][ T5497] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 100.862741][ T5497] CPU: 0 UID: 0 PID: 5497 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 100.866859][ T5497] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 100.872176][ T5497] Call Trace:
[ 100.873958][ T5497]
[ 100.875374][ T5497] dump_stack_lvl+0x99/0x250
[ 100.877695][ T5497] ? __asan_memcpy+0x40/0x70
[ 100.879891][ T5497] ? __pfx_dump_stack_lvl+0x10/0x10
[ 100.882181][ T5497] ? __pfx__printk+0x10/0x10
[ 100.884338][ T5497] vpanic+0x281/0x750
[ 100.886206][ T5497] ? preempt_schedule+0xae/0xc0
[ 100.888369][ T5497] ? __pfx_vpanic+0x10/0x10
[ 100.890395][ T5497] ? preempt_schedule_common+0x83/0xd0
[ 100.892735][ T5497] ? preempt_schedule+0xae/0xc0
[ 100.894880][ T5497] ? __pfx_preempt_schedule+0x10/0x10
[ 100.897235][ T5497] panic+0xb9/0xc0
[ 100.898843][ T5497] ? __pfx_panic+0x10/0x10
[ 100.900775][ T5497] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 100.903398][ T5497] ? bch2_btree_node_read_done+0x950/0x5550
[ 100.906034][ T5497] check_panic_on_warn+0x89/0xb0
[ 100.908307][ T5497] ? bch2_btree_node_read_done+0x950/0x5550
[ 100.910880][ T5497] end_report+0x78/0x160
[ 100.912918][ T5497] kasan_report+0x129/0x150
[ 100.915048][ T5497] ? bch2_btree_node_read_done+0x950/0x5550
[ 100.917661][ T5497] bch2_btree_node_read_done+0x950/0x5550
[ 100.920169][ T5497] ? __pfx_bch2_btree_node_read_done+0x10/0x10
[ 100.922915][ T5497] ? bch2_extent_ptr_to_text+0x5a/0x890
[ 100.925303][ T5497] ? bch2_bkey_ptrs_to_text+0x1161/0x1310
[ 100.927767][ T5497] ? bch2_printbuf_make_room+0xdb/0x360
[ 100.930181][ T5497] ? enumerated_ref_put+0xbe/0x270
[ 100.932390][ T5497] btree_node_read_work+0x40e/0xe60
[ 100.934651][ T5497] ? __pfx_btree_node_read_work+0x10/0x10
[ 100.936996][ T5497] ? bch2_latency_acct+0x436/0x520
[ 100.939193][ T5497] ? __pfx_bch2_latency_acct+0x10/0x10
[ 100.941529][ T5497] ? bio_associate_blkg+0x6d/0x230
[ 100.943720][ T5497] bch2_btree_node_read+0x887/0x2a00
[ 100.945998][ T5497] ? bch2_btree_node_hash_insert+0x88/0xc0
[ 100.948629][ T5497] ? __mutex_unlock_slowpath+0x1a1/0x740
[ 100.951088][ T5497] ? __pfx_bch2_btree_node_read+0x10/0x10
[ 100.953590][ T5497] ? bch2_trans_unlock+0x8a/0x580
[ 100.955877][ T5497] ? bch2_trans_unlock+0x491/0x580
[ 100.958144][ T5497] bch2_btree_root_read+0x5f0/0x760
[ 100.960462][ T5497] ? __pfx_bch2_btree_root_read+0x10/0x10
[ 100.963094][ T5497] ? bch2_current_has_btree_trans+0x169/0x1a0
[ 100.965749][ T5497] read_btree_roots+0x2c6/0x840
[ 100.967849][ T5497] ? __pfx_read_btree_roots+0x10/0x10
[ 100.970220][ T5497] bch2_fs_recovery+0x261f/0x3a50
[ 100.972429][ T5497] ? __pfx_bch2_fs_recovery+0x10/0x10
[ 100.974732][ T5497] ? __lock_acquire+0xab9/0xd20
[ 100.976860][ T5497] ? __mutex_trylock_common+0x153/0x260
[ 100.979213][ T5497] ? __lock_acquire+0xab9/0xd20
[ 100.981397][ T5497] ? __lock_acquire+0xab9/0xd20
[ 100.983553][ T5497] ? bch2_fs_start+0xa0f/0xda0
[ 100.985638][ T5497] ? up_write+0x1c4/0x420
[ 100.987472][ T5497] ? bch2_fs_start+0x5e7/0xda0
[ 100.989619][ T5497] bch2_fs_start+0xaaf/0xda0
[ 100.991661][ T5497] ? bch2_fs_start+0x5e7/0xda0
[ 100.993786][ T5497] ? __pfx_bch2_fs_start+0x10/0x10
[ 100.995971][ T5497] ? sget+0x267/0x620
[ 100.997738][ T5497] bch2_fs_get_tree+0xb39/0x1520
[ 100.999862][ T5497] ? __pfx_bch2_fs_get_tree+0x10/0x10
[ 101.002148][ T5497] ? vfs_parse_fs_string+0x101/0x170
[ 101.004395][ T5497] ? __pfx_vfs_parse_comma_sep+0x10/0x10
[ 101.006799][ T5497] vfs_get_tree+0x92/0x2b0
[ 101.008757][ T5497] do_new_mount+0x2a2/0x9e0
[ 101.010752][ T5497] ? ns_capable+0x8a/0xf0
[ 101.012649][ T5497] ? __pfx_do_new_mount+0x10/0x10
[ 101.015054][ T5497] ? path_mount+0x61c/0xfe0
[ 101.016960][ T5497] ? user_path_at+0x44/0x60
[ 101.018905][ T5497] __se_sys_mount+0x317/0x410
[ 101.020929][ T5497] ? __pfx___se_sys_mount+0x10/0x10
[ 101.023199][ T5497] ? do_syscall_64+0xbe/0x3b0
[ 101.025161][ T5497] ? __x64_sys_mount+0x20/0xc0
[ 101.027207][ T5497] do_syscall_64+0xfa/0x3b0
[ 101.029166][ T5497] ? lockdep_hardirqs_on+0x9c/0x150
[ 101.031395][ T5497] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 101.033970][ T5497] ? clear_bhb_loop+0x60/0xb0
[ 101.035982][ T5497] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 101.038465][ T5497] RIP: 0033:0x7f375959066a
[ 101.040396][ T5497] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 101.048172][ T5497] RSP: 002b:00007ffc704204e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 101.051605][ T5497] RAX: ffffffffffffffda RBX: 00007ffc70420570 RCX: 00007f375959066a
[ 101.054842][ T5497] RDX: 00002000000058c0 RSI: 0000200000000000 RDI: 00007ffc70420530
[ 101.058229][ T5497] RBP: 00002000000058c0 R08: 00007ffc70420570 R09: 0000000000000000
[ 101.061580][ T5497] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000000
[ 101.064808][ T5497] R13: 00007ffc70420530 R14: 00000000000058f2 R15: 0000200000000180
[ 101.068326][ T5497]
[ 101.070026][ T5497] Kernel Offset: disabled
[ 101.071893][ T5497] Rebooting in 86400 seconds..
VM DIAGNOSIS:
13:32:18 Registers:
info registers vcpu 0
CPU#0
RAX=0000000000000030 RBX=0000000000000030 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc900027ee1b0
R8 =ffff888034150237 R9 =1ffff1100682a046 R10=dffffc0000000000 R11=ffffffff85513ea0
R12=dffffc0000000000 R13=ffffffff99d0e906 R14=ffffffff9a003860 R15=0000000000000000
RIP=ffffffff85513f1c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000555585b75500 ffffffff 00c00000
GS =0000 ffff88808d007000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007fdbb81909c0 CR3=000000004cbac000 CR4=00352ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=0000000080040001 Opmask01=0000000000000fff Opmask02=00000000ffffffef Opmask03=0000000000000000
Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffc70420990 0000003000000018
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffc70420b16
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffc70420b16 00007ffc70420b1c
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f3759612fbe
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f3759612fcb
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f3759612fc5
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f3759612fd9
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f375961305f
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f375961313d
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2525252525252525 2525252525252525 2525252525252525 2525252525252525
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0063696e61703d73 726f727265006f72 2d746e756f6d6572 3d73726f72726500
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00464c4b44551856 574a575740004a57 08514b504a484057 1856574a57574000
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000