Warning: Permanently added '10.128.0.99' (ED25519) to the list of known hosts.
2026/07/14 21:06:25 parsed 1 programs
2026/07/14 21:06:25 serving rpc on tcp://40421
[ 132.160745][ T5635] cgroup: Unknown subsys name 'net'
[ 132.401230][ T5635] cgroup: Unknown subsys name 'cpuset'
[ 132.476592][ T5635] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 134.130999][ T5635] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 134.148306][ T1339] ieee802154 phy0 wpan0: encryption failed: -22
[ 134.148395][ T1339] ieee802154 phy1 wpan1: encryption failed: -22
[ 139.052253][ T5661] bridge0: port 1(bridge_slave_0) entered blocking state
[ 139.053601][ T5661] bridge0: port 1(bridge_slave_0) entered disabled state
[ 139.054535][ T5661] bridge_slave_0: entered allmulticast mode
[ 139.056427][ T5661] bridge_slave_0: entered promiscuous mode
[ 139.066625][ T5661] bridge0: port 2(bridge_slave_1) entered blocking state
[ 139.066741][ T5661] bridge0: port 2(bridge_slave_1) entered disabled state
[ 139.068152][ T5661] bridge_slave_1: entered allmulticast mode
[ 139.079786][ T5661] bridge_slave_1: entered promiscuous mode
[ 139.123339][ T5661] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 139.131512][ T5661] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 139.174502][ T5661] team0: Port device team_slave_0 added
[ 139.178902][ T5661] team0: Port device team_slave_1 added
[ 139.211498][ T5661] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 139.211508][ T5661] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 139.211524][ T5661] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 139.213833][ T5661] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 139.213846][ T5661] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 139.213865][ T5661] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 139.302487][ T5661] hsr_slave_0: entered promiscuous mode
[ 139.304156][ T5661] hsr_slave_1: entered promiscuous mode
[ 139.935850][ T5661] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 139.980026][ T5661] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 139.983375][ T5661] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 140.020224][ T5661] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 140.022784][ T5661] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 140.072217][ T5661] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 140.077186][ T5661] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 140.109763][ T5661] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 140.223816][ T5661] 8021q: adding VLAN 0 to HW filter on device bond0
[ 140.269650][ T5661] 8021q: adding VLAN 0 to HW filter on device team0
[ 140.283647][ T1194] bridge0: port 1(bridge_slave_0) entered blocking state
[ 140.283871][ T1194] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 140.330769][ T1194] bridge0: port 2(bridge_slave_1) entered blocking state
[ 140.331314][ T1194] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 140.741084][ T5661] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 140.818744][ T5661] veth0_vlan: entered promiscuous mode
[ 140.843240][ T5661] veth1_vlan: entered promiscuous mode
[ 140.894497][ T5661] veth0_macvtap: entered promiscuous mode
[ 140.908458][ T5661] veth1_macvtap: entered promiscuous mode
[ 140.934524][ T5661] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 140.960160][ T5661] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 141.003649][ T3027] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 141.018629][ T3027] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 141.019958][ T3027] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 141.023617][ T3027] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 141.720755][ T1194] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 142.709738][ T1194] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 143.035675][ T4915] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 143.048836][ T4915] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 143.052410][ T4915] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 143.053551][ T4915] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 143.054197][ T4915] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 143.531583][ T1136] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 143.531607][ T1136] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 143.663836][ T3051] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 143.663850][ T3051] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 144.100823][ T1194] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 144.481794][ T1194] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 145.468408][ T1194] bridge_slave_1: left allmulticast mode
[ 145.468519][ T1194] bridge_slave_1: left promiscuous mode
[ 145.473480][ T1194] bridge0: port 2(bridge_slave_1) entered disabled state
[ 145.687105][ T1194] bridge_slave_0: left allmulticast mode
[ 145.687129][ T1194] bridge_slave_0: left promiscuous mode
[ 145.687285][ T1194] bridge0: port 1(bridge_slave_0) entered disabled state
[ 146.456663][ T1194] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 146.516778][ T1194] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 146.558352][ T1194] bond0 (unregistering): Released all slaves
[ 146.610226][ T5261] 8021q: adding VLAN 0 to HW filter on device eth1
[ 147.066183][ T1194] hsr_slave_0: left promiscuous mode
[ 147.106082][ T1194] hsr_slave_1: left promiscuous mode
[ 147.112232][ T1194] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 147.112315][ T1194] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 147.182670][ T1194] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 147.182696][ T1194] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 147.374374][ T1194] veth1_macvtap: left promiscuous mode
[ 147.374676][ T1194] veth0_macvtap: left promiscuous mode
[ 147.374978][ T1194] veth1_vlan: left promiscuous mode
[ 147.375324][ T1194] veth0_vlan: left promiscuous mode
[ 148.096866][ T1194] team0 (unregistering): Port device team_slave_1 removed
[ 148.144515][ T1194] team0 (unregistering): Port device team_slave_0 removed
[ 148.418501][ T5261] 8021q: adding VLAN 0 to HW filter on device eth2
2026/07/14 21:06:45 executed programs: 0
[ 149.441266][ T5261] 8021q: adding VLAN 0 to HW filter on device eth3
[ 149.685536][ T59] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 149.715550][ T59] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 149.723725][ T59] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 149.729855][ T59] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 149.733143][ T59] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 150.680138][ T5261] 8021q: adding VLAN 0 to HW filter on device eth4
[ 151.376078][ T5799] bridge0: port 1(bridge_slave_0) entered blocking state
[ 151.376191][ T5799] bridge0: port 1(bridge_slave_0) entered disabled state
[ 151.376309][ T5799] bridge_slave_0: entered allmulticast mode
[ 151.378457][ T5799] bridge_slave_0: entered promiscuous mode
[ 151.402905][ T5799] bridge0: port 2(bridge_slave_1) entered blocking state
[ 151.403057][ T5799] bridge0: port 2(bridge_slave_1) entered disabled state
[ 151.403245][ T5799] bridge_slave_1: entered allmulticast mode
[ 151.408264][ T5799] bridge_slave_1: entered promiscuous mode
[ 151.450402][ T5799] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 151.452891][ T5799] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 151.494235][ T5799] team0: Port device team_slave_0 added
[ 151.498061][ T5799] team0: Port device team_slave_1 added
[ 151.543583][ T5799] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 151.543593][ T5799] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 151.543605][ T5799] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 151.545008][ T5799] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 151.545019][ T5799] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 151.545035][ T5799] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 151.640882][ T5799] hsr_slave_0: entered promiscuous mode
[ 151.641794][ T5799] hsr_slave_1: entered promiscuous mode
[ 151.838016][ T59] Bluetooth: hci0: command tx timeout
[ 153.906131][ T59] Bluetooth: hci0: command tx timeout
[ 154.670573][ T5799] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 154.715135][ T5799] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 154.719580][ T5799] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 154.740078][ T5799] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 154.741284][ T5799] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 154.796062][ T5799] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 154.798033][ T5799] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 154.854055][ T5799] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 155.030529][ T5799] 8021q: adding VLAN 0 to HW filter on device bond0
[ 155.082939][ T5799] 8021q: adding VLAN 0 to HW filter on device team0
[ 155.106837][ T1174] bridge0: port 1(bridge_slave_0) entered blocking state
[ 155.107042][ T1174] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 155.150036][ T5818] bridge0: port 2(bridge_slave_1) entered blocking state
[ 155.150880][ T5818] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 155.936310][ T5799] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 155.986126][ T59] Bluetooth: hci0: command tx timeout
[ 156.130524][ T5799] veth0_vlan: entered promiscuous mode
[ 156.165216][ T5799] veth1_vlan: entered promiscuous mode
[ 156.266209][ T5799] veth0_macvtap: entered promiscuous mode
[ 156.277144][ T5799] veth1_macvtap: entered promiscuous mode
[ 156.303890][ T5799] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 156.341192][ T5799] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 156.360508][ T1174] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 156.361349][ T1174] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 156.361387][ T1174] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 156.361416][ T1174] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 156.784853][ T5818] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 156.784872][ T5818] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 156.847251][ T1174] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 156.847272][ T1174] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
2026/07/14 21:06:52 executed programs: 2
[ 157.174820][ T5977] loop0: detected capacity change from 0 to 32768
[ 157.769838][ T5978] loop0: detected capacity change from 0 to 32768
[ 158.076472][ T59] Bluetooth: hci0: command tx timeout
[ 158.204527][ T5979] loop0: detected capacity change from 0 to 32768
[ 158.589729][ T5980] loop0: detected capacity change from 0 to 32768
[ 159.015217][ T5981] loop0: detected capacity change from 0 to 32768
[ 159.384774][ T5982] loop0: detected capacity change from 0 to 32768
[ 159.718598][ T5983] loop0: detected capacity change from 0 to 32768
[ 160.081315][ T5984] loop0: detected capacity change from 0 to 32768
[ 160.449206][ T5985] loop0: detected capacity change from 0 to 32768
[ 160.804134][ T5986] loop0: detected capacity change from 0 to 32768
2026/07/14 21:06:57 executed programs: 15
[ 162.247219][ T5990] set_capacity_and_notify: 3 callbacks suppressed
[ 162.247231][ T5990] loop0: detected capacity change from 0 to 32768
[ 162.613785][ T5991] loop0: detected capacity change from 0 to 32768
[ 162.951748][ T5992] loop0: detected capacity change from 0 to 32768
[ 163.329411][ T5993] loop0: detected capacity change from 0 to 32768
[ 163.704258][ T5994] loop0: detected capacity change from 0 to 32768
[ 164.074095][ T5995] loop0: detected capacity change from 0 to 32768
[ 164.441080][ T5996] loop0: detected capacity change from 0 to 32768
[ 164.820847][ T5997] loop0: detected capacity change from 0 to 32768
[ 165.184173][ T5998] loop0: detected capacity change from 0 to 32768
[ 165.573501][ T5999] loop0: detected capacity change from 0 to 32768
2026/07/14 21:07:02 executed programs: 29
[ 167.560818][ T6005] set_capacity_and_notify: 5 callbacks suppressed
[ 167.560829][ T6005] loop0: detected capacity change from 0 to 32768
[ 167.901537][ T6006] loop0: detected capacity change from 0 to 32768
[ 168.280627][ T6007] loop0: detected capacity change from 0 to 32768
[ 168.620359][ T6008] loop0: detected capacity change from 0 to 32768
[ 168.984553][ T6009] loop0: detected capacity change from 0 to 32768
[ 169.354085][ T6010] loop0: detected capacity change from 0 to 32768
[ 169.717216][ T6011] loop0: detected capacity change from 0 to 32768
[ 170.081690][ T6012] loop0: detected capacity change from 0 to 32768
[ 170.416984][ T6013] loop0: detected capacity change from 0 to 32768
[ 170.785728][ T6014] loop0: detected capacity change from 0 to 32768
2026/07/14 21:07:07 executed programs: 44
[ 172.575470][ T6019] set_capacity_and_notify: 4 callbacks suppressed
[ 172.575481][ T6019] loop0: detected capacity change from 0 to 32768
[ 172.636666][ C1] ==================================================================
[ 172.636683][ C1] BUG: KASAN: slab-use-after-free in lbmIODone+0x130e/0x16b0
[ 172.636724][ C1] Read of size 4 at addr ffff888039f98a08 by task syz-execprog/5630
[ 172.636740][ C1]
[ 172.636758][ C1] CPU: 1 UID: 0 PID: 5630 Comm: syz-execprog Not tainted syzkaller #0 PREEMPT_{RT,(full)}
[ 172.636784][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026
[ 172.636805][ C1] Call Trace:
[ 172.636813][ C1]
[ 172.636822][ C1] dump_stack_lvl+0xe8/0x150
[ 172.636851][ C1] print_address_description+0x55/0x1e0
[ 172.636879][ C1] ? lbmIODone+0x130e/0x16b0
[ 172.636900][ C1] print_report+0x58/0x70
[ 172.636919][ C1] kasan_report+0x117/0x150
[ 172.636937][ C1] ? lbmIODone+0x130e/0x16b0
[ 172.636961][ C1] lbmIODone+0x130e/0x16b0
[ 172.636985][ C1] ? blkg_put+0x22/0x240
[ 172.637009][ C1] ? blkg_put+0x22/0x240
[ 172.637033][ C1] ? blkg_put+0x18d/0x240
[ 172.637057][ C1] ? bio_endio+0x980/0x9d0
[ 172.637076][ C1] blk_update_request+0x57b/0xe50
[ 172.637099][ C1] blk_mq_end_request+0x3e/0x70
[ 172.637116][ C1] blk_done_softirq+0x10a/0x160
[ 172.637139][ C1] handle_softirqs+0x1d9/0x6c0
[ 172.637164][ C1] __local_bh_enable_ip+0x170/0x2b0
[ 172.637182][ C1] tcp_recvmsg+0xdb/0x540
[ 172.637211][ C1] ? __pfx_tcp_recvmsg+0x10/0x10
[ 172.637235][ C1] ? inet6_recvmsg+0xb4/0x490
[ 172.637256][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 172.637282][ C1] ? bpf_lsm_socket_recvmsg+0x9/0x20
[ 172.637305][ C1] ? security_socket_recvmsg+0x7e/0x2c0
[ 172.637330][ C1] ? __pfx_inet6_recvmsg+0x10/0x10
[ 172.637349][ C1] sock_recvmsg+0xfa/0x1e0
[ 172.637378][ C1] sock_read_iter+0x233/0x300
[ 172.637400][ C1] ? __pfx_sock_read_iter+0x10/0x10
[ 172.637424][ C1] ? bpf_lsm_file_permission+0x9/0x20
[ 172.637448][ C1] ? security_file_permission+0x75/0x260
[ 172.637470][ C1] vfs_read+0x59e/0xa90
[ 172.637494][ C1] ? __pfx_vfs_read+0x10/0x10
[ 172.637522][ C1] ? __fget_files+0x2a/0x420
[ 172.637542][ C1] ksys_read+0x156/0x270
[ 172.637562][ C1] ? __pfx_ksys_read+0x10/0x10
[ 172.637584][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 172.637611][ C1] do_syscall_64+0x174/0x580
[ 172.637636][ C1] ? trace_irq_disable+0x3b/0x140
[ 172.637663][ C1] ? clear_bhb_loop+0x40/0x90
[ 172.637682][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 172.637699][ C1] RIP: 0033:0x40d3ce
[ 172.637724][ C1] Code: ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 89 f2 48 89 fa 48 89 ce 48 89 df 0f 05 <48> 3d 01 f0 ff ff 76 15 48 f7 d8 48 89 c1 48 c7 c0 ff ff ff ff 48
[ 172.637739][ C1] RSP: 002b:0000217d87aed3d8 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[ 172.637768][ C1] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000040d3ce
[ 172.637782][ C1] RDX: 0000000001ed36e4 RSI: 0000217d87b00000 RDI: 0000000000000006
[ 172.637794][ C1] RBP: 0000217d87aed418 R08: 0000000000000000 R09: 0000000000000000
[ 172.637806][ C1] R10: 0000000000000000 R11: 0000000000000202 R12: 0000217d83d8fd30
[ 172.637818][ C1] R13: 0000000000000001 R14: 0000217d84014f00 R15: 0000000000000001
[ 172.637837][ C1]
[ 172.637843][ C1]
[ 172.637847][ C1] Allocated by task 6019:
[ 172.637855][ C1] kasan_save_track+0x3e/0x80
[ 172.637871][ C1] __kasan_kmalloc+0x93/0xb0
[ 172.637886][ C1] __kmalloc_cache_noprof+0x3d2/0x6b0
[ 172.637901][ C1] lmLogInit+0x3e5/0x1a20
[ 172.637920][ C1] lmLogOpen+0x4e3/0xf90
[ 172.637940][ C1] jfs_mount_rw+0xf3/0x670
[ 172.637961][ C1] jfs_fill_super+0x769/0xda0
[ 172.637976][ C1] get_tree_bdev_flags+0x430/0x4f0
[ 172.637997][ C1] vfs_get_tree+0x92/0x2a0
[ 172.638014][ C1] do_new_mount+0x319/0xdc0
[ 172.638035][ C1] __se_sys_mount+0x31d/0x420
[ 172.638049][ C1] do_syscall_64+0x174/0x580
[ 172.638070][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 172.638086][ C1]
[ 172.638090][ C1] Freed by task 5799:
[ 172.638097][ C1] kasan_save_track+0x3e/0x80
[ 172.638111][ C1] kasan_save_free_info+0x40/0x50
[ 172.638131][ C1] __kasan_slab_free+0x5c/0x80
[ 172.638145][ C1] kfree+0x1c5/0x6c0
[ 172.638167][ C1] lmLogShutdown+0x456/0x850
[ 172.638188][ C1] lmLogClose+0x28c/0x530
[ 172.638209][ C1] jfs_umount+0x2da/0x3b0
[ 172.638228][ C1] jfs_put_super+0x8c/0x190
[ 172.638244][ C1] generic_shutdown_super+0x13d/0x2d0
[ 172.638261][ C1] kill_block_super+0x44/0x90
[ 172.638278][ C1] deactivate_locked_super+0xbc/0x130
[ 172.638293][ C1] cleanup_mnt+0x3d3/0x460
[ 172.638310][ C1] task_work_run+0x1d9/0x270
[ 172.638335][ C1] exit_to_user_mode_loop+0x1fa/0x730
[ 172.638350][ C1] do_syscall_64+0x353/0x580
[ 172.638372][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 172.638389][ C1]
[ 172.638394][ C1] The buggy address belongs to the object at ffff888039f98a00
[ 172.638394][ C1] which belongs to the cache kmalloc-256 of size 256
[ 172.638409][ C1] The buggy address is located 8 bytes inside of
[ 172.638409][ C1] freed 256-byte region [ffff888039f98a00, ffff888039f98b00)
[ 172.638428][ C1]
[ 172.638433][ C1] The buggy address belongs to the physical page:
[ 172.638454][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x39f98
[ 172.638471][ C1] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 172.638484][ C1] flags: 0x80000000000040(head|node=0|zone=1)
[ 172.638503][ C1] page_type: f5(slab)
[ 172.638520][ C1] raw: 0080000000000040 ffff88813ffb4b40 dead000000000100 dead000000000122
[ 172.638535][ C1] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
[ 172.638551][ C1] head: 0080000000000040 ffff88813ffb4b40 dead000000000100 dead000000000122
[ 172.638566][ C1] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
[ 172.638582][ C1] head: 0080000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
[ 172.638604][ C1] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002
[ 172.638613][ C1] page dumped because: kasan: bad access detected
[ 172.638626][ C1] page_owner tracks the page as allocated
[ 172.638632][ C1] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5644, tgid 5644 (udevd), ts 171944648337, free_ts 171783085826
[ 172.638664][ C1] post_alloc_hook+0x1f9/0x250
[ 172.638687][ C1] get_page_from_freelist+0x262a/0x26a0
[ 172.638703][ C1] __alloc_frozen_pages_noprof+0x18d/0x380
[ 172.638720][ C1] allocate_slab+0x79/0x5e0
[ 172.638740][ C1] refill_objects+0x2d8/0x350
[ 172.638760][ C1] __pcs_replace_empty_main+0x330/0x690
[ 172.638780][ C1] __kmalloc_noprof+0x544/0x780
[ 172.638795][ C1] security_inode_init_security+0x102/0x3e0
[ 172.638818][ C1] shmem_mknod+0x1ea/0x340
[ 172.638837][ C1] shmem_mkdir+0x33/0x70
[ 172.638855][ C1] vfs_mkdir+0x402/0x620
[ 172.638874][ C1] filename_mkdirat+0x289/0x520
[ 172.638893][ C1] __se_sys_mkdir+0x34/0x150
[ 172.638912][ C1] do_syscall_64+0x174/0x580
[ 172.638934][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 172.638950][ C1] page last free pid 5644 tgid 5644 stack trace:
[ 172.638961][ C1] __free_frozen_pages+0x10e7/0x11c0
[ 172.638975][ C1] __slab_free+0x252/0x2a0
[ 172.638990][ C1] qlist_free_all+0x99/0x100
[ 172.639013][ C1] kasan_quarantine_reduce+0x148/0x160
[ 172.639036][ C1] __kasan_slab_alloc+0x22/0x80
[ 172.639052][ C1] kmem_cache_alloc_noprof+0x355/0x650
[ 172.639075][ C1] do_getname+0x2e/0x250
[ 172.639096][ C1] __se_sys_rename+0x2b/0x2c0
[ 172.639118][ C1] do_syscall_64+0x174/0x580
[ 172.639140][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 172.639157][ C1]
[ 172.639161][ C1] Memory state around the buggy address:
[ 172.639171][ C1] ffff888039f98900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 172.639184][ C1] ffff888039f98980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 172.639195][ C1] >ffff888039f98a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 172.639204][ C1] ^
[ 172.639213][ C1] ffff888039f98a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 172.639224][ C1] ffff888039f98b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 172.639233][ C1] ==================================================================
[ 172.639289][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 172.639305][ C1] CPU: 1 UID: 0 PID: 5630 Comm: syz-execprog Not tainted syzkaller #0 PREEMPT_{RT,(full)}
[ 172.639326][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026
[ 172.639336][ C1] Call Trace:
[ 172.639343][ C1]
[ 172.639351][ C1] vpanic+0x56c/0xa60
[ 172.639371][ C1] ? __pfx_vpanic+0x10/0x10
[ 172.639390][ C1] ? __pfx___schedule+0x10/0x10
[ 172.639416][ C1] panic+0xc5/0xd0
[ 172.639432][ C1] ? __pfx_panic+0x10/0x10
[ 172.639450][ C1] ? preempt_schedule_thunk+0x16/0x40
[ 172.639475][ C1] ? lbmIODone+0x130e/0x16b0
[ 172.639499][ C1] check_panic_on_warn+0x89/0xb0
[ 172.639525][ C1] ? lbmIODone+0x130e/0x16b0
[ 172.639548][ C1] end_report+0x73/0x170
[ 172.639567][ C1] ? lbmIODone+0x130e/0x16b0
[ 172.639598][ C1] kasan_report+0x128/0x150
[ 172.639618][ C1] ? lbmIODone+0x130e/0x16b0
[ 172.639646][ C1] lbmIODone+0x130e/0x16b0
[ 172.639670][ C1] ? blkg_put+0x22/0x240
[ 172.639694][ C1] ? blkg_put+0x22/0x240
[ 172.639718][ C1] ? blkg_put+0x18d/0x240
[ 172.639742][ C1] ? bio_endio+0x980/0x9d0
[ 172.639761][ C1] blk_update_request+0x57b/0xe50
[ 172.639785][ C1] blk_mq_end_request+0x3e/0x70
[ 172.639804][ C1] blk_done_softirq+0x10a/0x160
[ 172.639831][ C1] handle_softirqs+0x1d9/0x6c0
[ 172.639856][ C1] __local_bh_enable_ip+0x170/0x2b0
[ 172.639878][ C1] tcp_recvmsg+0xdb/0x540
[ 172.639907][ C1] ? __pfx_tcp_recvmsg+0x10/0x10
[ 172.639934][ C1] ? inet6_recvmsg+0xb4/0x490
[ 172.639956][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 172.639981][ C1] ? bpf_lsm_socket_recvmsg+0x9/0x20
[ 172.640004][ C1] ? security_socket_recvmsg+0x7e/0x2c0
[ 172.640029][ C1] ? __pfx_inet6_recvmsg+0x10/0x10
[ 172.640049][ C1] sock_recvmsg+0xfa/0x1e0
[ 172.640087][ C1] sock_read_iter+0x233/0x300
[ 172.640109][ C1] ? __pfx_sock_read_iter+0x10/0x10
[ 172.640133][ C1] ? bpf_lsm_file_permission+0x9/0x20
[ 172.640158][ C1] ? security_file_permission+0x75/0x260
[ 172.640179][ C1] vfs_read+0x59e/0xa90
[ 172.640203][ C1] ? __pfx_vfs_read+0x10/0x10
[ 172.640227][ C1] ? __fget_files+0x2a/0x420
[ 172.640247][ C1] ksys_read+0x156/0x270
[ 172.640268][ C1] ? __pfx_ksys_read+0x10/0x10
[ 172.640291][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 172.640310][ C1] do_syscall_64+0x174/0x580
[ 172.640334][ C1] ? trace_irq_disable+0x3b/0x140
[ 172.640360][ C1] ? clear_bhb_loop+0x40/0x90
[ 172.640381][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 172.640398][ C1] RIP: 0033:0x40d3ce
[ 172.640413][ C1] Code: ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 89 f2 48 89 fa 48 89 ce 48 89 df 0f 05 <48> 3d 01 f0 ff ff 76 15 48 f7 d8 48 89 c1 48 c7 c0 ff ff ff ff 48
[ 172.640428][ C1] RSP: 002b:0000217d87aed3d8 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[ 172.640448][ C1] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000040d3ce
[ 172.640460][ C1] RDX: 0000000001ed36e4 RSI: 0000217d87b00000 RDI: 0000000000000006
[ 172.640473][ C1] RBP: 0000217d87aed418 R08: 0000000000000000 R09: 0000000000000000
[ 172.640485][ C1] R10: 0000000000000000 R11: 0000000000000202 R12: 0000217d83d8fd30
[ 172.640497][ C1] R13: 0000000000000001 R14: 0000217d84014f00 R15: 0000000000000001
[ 172.640517][ C1]
[ 172.640678][ C1] Kernel Offset: disabled