syzkaller login: [ 91.992856][ T9] cfg80211: failed to load regulatory.db
Warning: Permanently added '[localhost]:39565' (ED25519) to the list of known hosts.
2025/07/16 21:34:29 ignoring optional flag "sandboxArg"="0"
2025/07/16 21:34:31 parsed 1 programs
[ 130.197861][ T5358] cgroup: Unknown subsys name 'net'
[ 130.283105][ T5358] cgroup: Unknown subsys name 'cpuset'
[ 130.291389][ T5358] cgroup: Unknown subsys name 'rlimit'
[ 132.051260][ T5358] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 135.988925][ T5369] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 135.992949][ T5369] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 135.996645][ T5369] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 136.003650][ T5369] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 136.007233][ T5369] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 136.225235][ T5366] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 136.557045][ T44] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 136.569857][ T44] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 136.598657][ T44] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 136.604603][ T44] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 138.061910][ T1313] ieee802154 phy0 wpan0: encryption failed: -22
[ 138.064823][ T1313] ieee802154 phy1 wpan1: encryption failed: -22
[ 139.144178][ T5408] chnl_net:caif_netlink_parms(): no params data found
[ 139.217628][ T5408] bridge0: port 1(bridge_slave_0) entered blocking state
[ 139.222253][ T5408] bridge0: port 1(bridge_slave_0) entered disabled state
[ 139.225296][ T5408] bridge_slave_0: entered allmulticast mode
[ 139.229105][ T5408] bridge_slave_0: entered promiscuous mode
[ 139.234992][ T5408] bridge0: port 2(bridge_slave_1) entered blocking state
[ 139.238262][ T5408] bridge0: port 2(bridge_slave_1) entered disabled state
[ 139.241979][ T5408] bridge_slave_1: entered allmulticast mode
[ 139.245828][ T5408] bridge_slave_1: entered promiscuous mode
[ 139.271749][ T5408] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 139.279165][ T5408] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 139.304084][ T5408] team0: Port device team_slave_0 added
[ 139.309105][ T5408] team0: Port device team_slave_1 added
[ 139.330778][ T5408] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 139.333628][ T5408] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 139.344775][ T5408] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 139.352564][ T5408] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 139.355378][ T5408] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 139.366992][ T5408] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 139.403988][ T5408] hsr_slave_0: entered promiscuous mode
[ 139.407485][ T5408] hsr_slave_1: entered promiscuous mode
[ 139.558135][ T5408] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 139.567629][ T5408] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 139.575654][ T5408] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 139.583252][ T5408] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 139.618057][ T5408] bridge0: port 2(bridge_slave_1) entered blocking state
[ 139.621188][ T5408] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 139.625161][ T5408] bridge0: port 1(bridge_slave_0) entered blocking state
[ 139.628207][ T5408] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 139.701661][ T5408] 8021q: adding VLAN 0 to HW filter on device bond0
[ 139.716315][ T12] bridge0: port 1(bridge_slave_0) entered disabled state
[ 139.723249][ T12] bridge0: port 2(bridge_slave_1) entered disabled state
[ 139.735669][ T5408] 8021q: adding VLAN 0 to HW filter on device team0
[ 139.747835][ T44] bridge0: port 1(bridge_slave_0) entered blocking state
[ 139.751021][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 139.766838][ T44] bridge0: port 2(bridge_slave_1) entered blocking state
[ 139.769893][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 139.950879][ T5408] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 139.994689][ T5408] veth0_vlan: entered promiscuous mode
[ 140.003916][ T5408] veth1_vlan: entered promiscuous mode
[ 140.035621][ T5408] veth0_macvtap: entered promiscuous mode
[ 140.043642][ T5408] veth1_macvtap: entered promiscuous mode
[ 140.061531][ T5408] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 140.074571][ T5408] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 140.084636][ T5408] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 140.088501][ T5408] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 140.094259][ T5408] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 140.098068][ T5408] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 140.281880][ T1036] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 140.342157][ T1036] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 140.411007][ T1036] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 140.492886][ T1036] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2025/07/16 21:34:45 executed programs: 0
[ 142.279534][ T4690] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 142.283941][ T4690] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 142.287794][ T4690] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 142.292921][ T4690] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 142.296519][ T4690] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 142.474442][ T5458] chnl_net:caif_netlink_parms(): no params data found
[ 142.545093][ T5458] bridge0: port 1(bridge_slave_0) entered blocking state
[ 142.548087][ T5458] bridge0: port 1(bridge_slave_0) entered disabled state
[ 142.551482][ T5458] bridge_slave_0: entered allmulticast mode
[ 142.555629][ T5458] bridge_slave_0: entered promiscuous mode
[ 142.562078][ T5458] bridge0: port 2(bridge_slave_1) entered blocking state
[ 142.565087][ T5458] bridge0: port 2(bridge_slave_1) entered disabled state
[ 142.568353][ T5458] bridge_slave_1: entered allmulticast mode
[ 142.572779][ T5458] bridge_slave_1: entered promiscuous mode
[ 142.598589][ T5458] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 142.606187][ T5458] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 142.634002][ T5458] team0: Port device team_slave_0 added
[ 142.639030][ T5458] team0: Port device team_slave_1 added
[ 142.663538][ T5458] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 142.667105][ T5458] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 142.680911][ T5458] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 142.687446][ T5458] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 142.690516][ T5458] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 142.702799][ T5458] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 142.745585][ T5458] hsr_slave_0: entered promiscuous mode
[ 142.750161][ T5458] hsr_slave_1: entered promiscuous mode
[ 142.753272][ T5458] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 142.756668][ T5458] Cannot create hsr debugfs directory
[ 142.933142][ T1036] bridge_slave_1: left allmulticast mode
[ 142.935782][ T1036] bridge_slave_1: left promiscuous mode
[ 142.939047][ T1036] bridge0: port 2(bridge_slave_1) entered disabled state
[ 142.962125][ T1036] bridge_slave_0: left allmulticast mode
[ 142.964541][ T1036] bridge_slave_0: left promiscuous mode
[ 142.966885][ T1036] bridge0: port 1(bridge_slave_0) entered disabled state
[ 143.409104][ T1036] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 143.415317][ T1036] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 143.421770][ T1036] bond0 (unregistering): Released all slaves
[ 143.524307][ T1036] hsr_slave_0: left promiscuous mode
[ 143.530234][ T1036] hsr_slave_1: left promiscuous mode
[ 143.533038][ T1036] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 143.536215][ T1036] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 143.543014][ T1036] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 143.546113][ T1036] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 143.556792][ T1036] veth1_macvtap: left promiscuous mode
[ 143.560487][ T1036] veth0_macvtap: left promiscuous mode
[ 143.563041][ T1036] veth1_vlan: left promiscuous mode
[ 143.565571][ T1036] veth0_vlan: left promiscuous mode
[ 143.876622][ T1036] team0 (unregistering): Port device team_slave_1 removed
[ 143.896397][ T1036] team0 (unregistering): Port device team_slave_0 removed
[ 144.381424][ T4690] Bluetooth: hci0: command tx timeout
[ 145.028650][ T5458] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 145.064262][ T5458] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 145.099787][ T5458] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 145.124532][ T5458] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 145.344114][ T5458] 8021q: adding VLAN 0 to HW filter on device bond0
[ 145.382151][ T5458] 8021q: adding VLAN 0 to HW filter on device team0
[ 145.412087][ T1042] bridge0: port 1(bridge_slave_0) entered blocking state
[ 145.415965][ T1042] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 145.437153][ T1042] bridge0: port 2(bridge_slave_1) entered blocking state
[ 145.440810][ T1042] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 145.498911][ T5458] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[ 145.522727][ T5458] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 145.813696][ T5458] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 145.885219][ T5458] veth0_vlan: entered promiscuous mode
[ 145.904855][ T5458] veth1_vlan: entered promiscuous mode
[ 145.936296][ T5458] veth0_macvtap: entered promiscuous mode
[ 145.942930][ T5458] veth1_macvtap: entered promiscuous mode
[ 145.958060][ T5458] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 145.971480][ T5458] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 145.982193][ T5458] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 145.985851][ T5458] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 145.992442][ T5458] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 145.995908][ T5458] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 146.067024][ T1036] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 146.081027][ T1036] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 146.107501][ T1042] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 146.113381][ T1042] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 146.173904][ T5499] loop0: detected capacity change from 0 to 128
[ 146.182036][ T5499] =======================================================
[ 146.182036][ T5499] WARNING: The mand mount option has been deprecated and
[ 146.182036][ T5499] and is ignored by this kernel. Remove the mand
[ 146.182036][ T5499] option from the mount to silence this warning.
[ 146.182036][ T5499] =======================================================
[ 146.227187][ T5499] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only
[ 146.234428][ T5499] hpfs: filesystem error: improperly stopped
[ 146.236995][ T5499] hpfs: filesystem error: warning: spare dnodes used, try chkdsk
[ 146.241659][ T5499] hpfs: You really don't want any checks? You are crazy...
[ 146.245424][ T5499] hpfs: hpfs_map_sector(): read error
[ 146.247970][ T5499] hpfs: code page support is disabled
[ 146.252790][ T5499] ==================================================================
[ 146.256041][ T5499] BUG: KASAN: use-after-free in strcmp+0x6f/0xc0
[ 146.258711][ T5499] Read of size 1 at addr ffff888051c00003 by task syz.0.16/5499
[ 146.261862][ T5499]
[ 146.263012][ T5499] CPU: 0 UID: 0 PID: 5499 Comm: syz.0.16 Not tainted 6.16.0-rc6-syzkaller-00002-g155a3c003e55 #0 PREEMPT(full)
[ 146.263029][ T5499] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 146.263037][ T5499] Call Trace:
[ 146.263044][ T5499]
[ 146.263051][ T5499] dump_stack_lvl+0x189/0x250
[ 146.263071][ T5499] ? __virt_addr_valid+0x1c8/0x5c0
[ 146.263087][ T5499] ? rcu_is_watching+0x15/0xb0
[ 146.263156][ T5499] ? __kasan_check_byte+0x12/0x40
[ 146.263172][ T5499] ? __pfx_dump_stack_lvl+0x10/0x10
[ 146.263186][ T5499] ? rcu_is_watching+0x15/0xb0
[ 146.263199][ T5499] ? lock_release+0x4b/0x3e0
[ 146.263212][ T5499] ? __virt_addr_valid+0x1c8/0x5c0
[ 146.263227][ T5499] ? __virt_addr_valid+0x4a5/0x5c0
[ 146.263243][ T5499] print_report+0xca/0x230
[ 146.263254][ T5499] ? strcmp+0x6f/0xc0
[ 146.263267][ T5499] kasan_report+0x118/0x150
[ 146.263283][ T5499] ? strcmp+0x6f/0xc0
[ 146.263296][ T5499] strcmp+0x6f/0xc0
[ 146.263310][ T5499] hpfs_get_ea+0x114/0xdb0
[ 146.263330][ T5499] ? __pfx_submit_bio_noacct_nocheck+0x10/0x10
[ 146.263350][ T5499] ? __pfx_hpfs_get_ea+0x10/0x10
[ 146.263371][ T5499] ? __bread_gfp+0x2ff/0x3c0
[ 146.263389][ T5499] ? hpfs_map_sector+0x14f/0x380
[ 146.263405][ T5499] ? hpfs_map_fnode+0x27e/0x6a0
[ 146.263415][ T5499] ? set_normalized_timespec64+0xf0/0x1a0
[ 146.263427][ T5499] ? __lock_acquire+0xab9/0xd20
[ 146.263440][ T5499] hpfs_read_inode+0x19d/0x1010
[ 146.263459][ T5499] ? __pfx_hpfs_read_inode+0x10/0x10
[ 146.263476][ T5499] ? inode_set_ctime_to_ts+0x126/0x2f0
[ 146.263489][ T5499] ? __pfx_inode_set_ctime_to_ts+0x10/0x10
[ 146.263501][ T5499] ? do_raw_spin_unlock+0x4d/0x240
[ 146.263519][ T5499] ? hpfs_init_inode+0x216/0x350
[ 146.263537][ T5499] hpfs_fill_super+0x12bd/0x2070
[ 146.263555][ T5499] ? __pfx_hpfs_fill_super+0x10/0x10
[ 146.263568][ T5499] ? __pfx_snprintf+0x10/0x10
[ 146.263582][ T5499] ? set_blocksize+0x21e/0x500
[ 146.263595][ T5499] ? sb_set_blocksize+0x104/0x180
[ 146.263607][ T5499] ? setup_bdev_super+0x4c1/0x5b0
[ 146.263632][ T5499] get_tree_bdev_flags+0x40e/0x4d0
[ 146.263646][ T5499] ? __pfx_hpfs_fill_super+0x10/0x10
[ 146.263659][ T5499] ? __pfx_get_tree_bdev_flags+0x10/0x10
[ 146.263675][ T5499] vfs_get_tree+0x8f/0x2b0
[ 146.263689][ T5499] do_new_mount+0x24a/0xa40
[ 146.263705][ T5499] __se_sys_mount+0x317/0x410
[ 146.263722][ T5499] ? __pfx___se_sys_mount+0x10/0x10
[ 146.263739][ T5499] ? do_syscall_64+0xbe/0x3b0
[ 146.263750][ T5499] ? __x64_sys_mount+0x20/0xc0
[ 146.263765][ T5499] do_syscall_64+0xfa/0x3b0
[ 146.263776][ T5499] ? lockdep_hardirqs_on+0x9c/0x150
[ 146.263794][ T5499] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 146.263806][ T5499] ? clear_bhb_loop+0x60/0xb0
[ 146.263820][ T5499] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 146.263832][ T5499] RIP: 0033:0x7f3b65f900ca
[ 146.263846][ T5499] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 146.263856][ T5499] RSP: 002b:00007ffcd7e41468 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 146.263869][ T5499] RAX: ffffffffffffffda RBX: 00007ffcd7e414f0 RCX: 00007f3b65f900ca
[ 146.263879][ T5499] RDX: 0000200000009e80 RSI: 0000200000009ec0 RDI: 00007ffcd7e414b0
[ 146.263887][ T5499] RBP: 0000200000009e80 R08: 00007ffcd7e414f0 R09: 0000000000000041
[ 146.263896][ T5499] R10: 0000000000000041 R11: 0000000000000246 R12: 0000200000009ec0
[ 146.263904][ T5499] R13: 00007ffcd7e414b0 R14: 0000000000009e02 R15: 0000200000009fc0
[ 146.263916][ T5499]
[ 146.263921][ T5499]
[ 146.416611][ T5499] The buggy address belongs to the physical page:
[ 146.419340][ T5499] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2866 pfn:0x51c00
[ 146.422954][ T5499] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 146.426017][ T5499] raw: 04fff00000000000 ffffea0001457fc8 ffffea0001470048 0000000000000000
[ 146.429540][ T5499] raw: 0000000000002866 0000000000000000 00000000ffffffff 0000000000000000
[ 146.433060][ T5499] page dumped because: kasan: bad access detected
[ 146.435894][ T5499] page_owner tracks the page as freed
[ 146.438483][ T5499] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO|__GFP_NOWARN), pid 5433, tgid 5433 (syz-executor), ts 140838501916, free_ts 141445648008
[ 146.446913][ T5499] post_alloc_hook+0x240/0x2a0
[ 146.448951][ T5499] get_page_from_freelist+0x21e4/0x22c0
[ 146.451238][ T5499] __alloc_frozen_pages_noprof+0x181/0x370
[ 146.453806][ T5499] alloc_pages_mpol+0x232/0x4a0
[ 146.455948][ T5499] alloc_pages_noprof+0xa9/0x190
[ 146.458304][ T5499] __vmalloc_node_range_noprof+0x97d/0x12f0
[ 146.460970][ T5499] vmalloc_user_noprof+0xad/0xf0
[ 146.463123][ T5499] kcov_ioctl+0x55/0x640
[ 146.464977][ T5499] __se_sys_ioctl+0xfc/0x170
[ 146.466958][ T5499] do_syscall_64+0xfa/0x3b0
[ 146.468893][ T5499] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 146.471446][ T5499] page last free pid 5434 tgid 5434 stack trace:
[ 146.474091][ T5499] __free_frozen_pages+0xc71/0xe70
[ 146.476241][ T5499] vfree+0x25a/0x400
[ 146.477917][ T5499] kcov_close+0x28/0x50
[ 146.479818][ T5499] __fput+0x449/0xa70
[ 146.481942][ T5499] task_work_run+0x1d1/0x260
[ 146.484252][ T5499] do_exit+0x6b5/0x22e0
[ 146.486300][ T5499] do_group_exit+0x21c/0x2d0
[ 146.488473][ T5499] get_signal+0x1286/0x1340
[ 146.490557][ T5499] arch_do_signal_or_restart+0x9a/0x750
[ 146.492902][ T5499] exit_to_user_mode_loop+0x75/0x110
[ 146.495221][ T5499] do_syscall_64+0x2bd/0x3b0
[ 146.497192][ T5499] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 146.499817][ T5499]
[ 146.500853][ T5499] Memory state around the buggy address:
[ 146.503339][ T5499] ffff888051bfff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 146.507001][ T5499] ffff888051bfff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 146.510385][ T5499] >ffff888051c00000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 146.513815][ T5499] ^
[ 146.515489][ T5499] ffff888051c00080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 146.518777][ T5499] ffff888051c00100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 146.522840][ T5499] ==================================================================
[ 146.527744][ T4690] Bluetooth: hci0: command tx timeout
[ 146.552600][ T5499] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 146.555538][ T5499] CPU: 0 UID: 0 PID: 5499 Comm: syz.0.16 Not tainted 6.16.0-rc6-syzkaller-00002-g155a3c003e55 #0 PREEMPT(full)
[ 146.560260][ T5499] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 146.564718][ T5499] Call Trace:
[ 146.566374][ T5499]
[ 146.567939][ T5499] dump_stack_lvl+0x99/0x250
[ 146.570252][ T5499] ? __asan_memcpy+0x40/0x70
[ 146.572384][ T5499] ? __pfx_dump_stack_lvl+0x10/0x10
[ 146.574643][ T5499] ? __pfx__printk+0x10/0x10
[ 146.576517][ T5499] panic+0x2db/0x790
[ 146.578259][ T5499] ? __pfx_preempt_schedule+0x10/0x10
[ 146.580696][ T5499] ? __pfx_panic+0x10/0x10
[ 146.582563][ T5499] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 146.585095][ T5499] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 146.587793][ T5499] ? strcmp+0x6f/0xc0
[ 146.589640][ T5499] check_panic_on_warn+0x89/0xb0
[ 146.591988][ T5499] ? strcmp+0x6f/0xc0
[ 146.593920][ T5499] end_report+0x78/0x160
[ 146.595670][ T5499] kasan_report+0x129/0x150
[ 146.597534][ T5499] ? strcmp+0x6f/0xc0
[ 146.599219][ T5499] strcmp+0x6f/0xc0
[ 146.600831][ T5499] hpfs_get_ea+0x114/0xdb0
[ 146.602929][ T5499] ? __pfx_submit_bio_noacct_nocheck+0x10/0x10
[ 146.606303][ T5499] ? __pfx_hpfs_get_ea+0x10/0x10
[ 146.609077][ T5499] ? __bread_gfp+0x2ff/0x3c0
[ 146.611374][ T5499] ? hpfs_map_sector+0x14f/0x380
[ 146.613344][ T5499] ? hpfs_map_fnode+0x27e/0x6a0
[ 146.615361][ T5499] ? set_normalized_timespec64+0xf0/0x1a0
[ 146.617672][ T5499] ? __lock_acquire+0xab9/0xd20
[ 146.619844][ T5499] hpfs_read_inode+0x19d/0x1010
[ 146.622012][ T5499] ? __pfx_hpfs_read_inode+0x10/0x10
[ 146.624247][ T5499] ? inode_set_ctime_to_ts+0x126/0x2f0
[ 146.626514][ T5499] ? __pfx_inode_set_ctime_to_ts+0x10/0x10
[ 146.629129][ T5499] ? do_raw_spin_unlock+0x4d/0x240
[ 146.631472][ T5499] ? hpfs_init_inode+0x216/0x350
[ 146.633788][ T5499] hpfs_fill_super+0x12bd/0x2070
[ 146.635866][ T5499] ? __pfx_hpfs_fill_super+0x10/0x10
[ 146.638433][ T5499] ? __pfx_snprintf+0x10/0x10
[ 146.640352][ T5499] ? set_blocksize+0x21e/0x500
[ 146.642295][ T5499] ? sb_set_blocksize+0x104/0x180
[ 146.644494][ T5499] ? setup_bdev_super+0x4c1/0x5b0
[ 146.646931][ T5499] get_tree_bdev_flags+0x40e/0x4d0
[ 146.649553][ T5499] ? __pfx_hpfs_fill_super+0x10/0x10
[ 146.651748][ T5499] ? __pfx_get_tree_bdev_flags+0x10/0x10
[ 146.654241][ T5499] vfs_get_tree+0x8f/0x2b0
[ 146.656285][ T5499] do_new_mount+0x24a/0xa40
[ 146.658220][ T5499] __se_sys_mount+0x317/0x410
[ 146.660508][ T5499] ? __pfx___se_sys_mount+0x10/0x10
[ 146.663055][ T5499] ? do_syscall_64+0xbe/0x3b0
[ 146.665362][ T5499] ? __x64_sys_mount+0x20/0xc0
[ 146.667587][ T5499] do_syscall_64+0xfa/0x3b0
[ 146.669542][ T5499] ? lockdep_hardirqs_on+0x9c/0x150
[ 146.671731][ T5499] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 146.674491][ T5499] ? clear_bhb_loop+0x60/0xb0
[ 146.676516][ T5499] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 146.679356][ T5499] RIP: 0033:0x7f3b65f900ca
[ 146.681623][ T5499] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 146.689887][ T5499] RSP: 002b:00007ffcd7e41468 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 146.693895][ T5499] RAX: ffffffffffffffda RBX: 00007ffcd7e414f0 RCX: 00007f3b65f900ca
[ 146.697531][ T5499] RDX: 0000200000009e80 RSI: 0000200000009ec0 RDI: 00007ffcd7e414b0
[ 146.700796][ T5499] RBP: 0000200000009e80 R08: 00007ffcd7e414f0 R09: 0000000000000041
[ 146.704145][ T5499] R10: 0000000000000041 R11: 0000000000000246 R12: 0000200000009ec0
[ 146.707423][ T5499] R13: 00007ffcd7e414b0 R14: 0000000000009e02 R15: 0000200000009fc0
[ 146.711073][ T5499]
[ 146.712916][ T5499] Kernel Offset: disabled
[ 146.714976][ T5499] Rebooting in 86400 seconds..
VM DIAGNOSIS:
21:34:50 Registers:
info registers vcpu 0
CPU#0
RAX=000000000000005d RBX=000000000000005d RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90002b8efd0
R8 =ffff888033a30237 R9 =1ffff11006746046 R10=dffffc0000000000 R11=ffffffff85479720
R12=dffffc0000000000 R13=ffffffff99af9896 R14=ffffffff99dfe700 R15=0000000000000000
RIP=ffffffff8547979c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000555582868500 ffffffff 00c00000
GS =0000 ffff88808d21b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007fe6117909c0 CR3=000000003f84f000 CR4=00352ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=0000000000000001 Opmask01=0000000000000000 Opmask02=0000000000100000 Opmask03=0000000000000000
Opmask04=00000000fffffdff Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffd7878fedb 00007ffd7878fedb
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffd787903e0 0000003000000018
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffd787903e0 0000003000000018
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0a0a0a0a0a0a0a0a 0a0a0a0a0a0a0a0a 0a0a0a0a0a0a0a0a 0a0a0a0a0a0a0a0a
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6568742065766f6d 6552202e6c656e72 656b207369687420 7962206465726f00
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6562742065766567 6552202466656472 6561207363627420 7362206465726500
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 772074276e6f6420 796c6c6165722075 6f59203a73667068 205d393934355420
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 796c6e6f2d646165 72206465746e756f 6d2079646165726c 61203b3538393434
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3836363032203a64 657375202c363839 3434383636303220 3a7365786966746f
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6820666f20726562 6d756e2064696c61 766e69203a726f72 7265206d65747379
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 73656c6966203a73 667068205d393934 3554205b5d373831 3732322e36343120
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 65746e656d676172 66206562206c6c69 7720656361667265 746e692073696874
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000