Warning: Permanently added '[localhost]:54191' (ED25519) to the list of known hosts.
2025/09/26 13:20:14 parsed 1 programs
syzkaller login: [ 84.554755][ T5347] cgroup: Unknown subsys name 'net'
[ 84.622782][ T5347] cgroup: Unknown subsys name 'cpuset'
[ 84.628890][ T5347] cgroup: Unknown subsys name 'rlimit'
[ 86.226493][ T5347] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 90.280657][ T5361] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 90.635117][ T5373] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 90.639520][ T5373] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 90.643135][ T5373] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 90.647080][ T5373] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 90.651320][ T5373] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 91.891982][ T55] cfg80211: failed to load regulatory.db
[ 93.488619][ T31] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 93.500879][ T31] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 93.525743][ T1041] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 93.529889][ T1041] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 94.254688][ T5428] chnl_net:caif_netlink_parms(): no params data found
[ 94.328908][ T5428] bridge0: port 1(bridge_slave_0) entered blocking state
[ 94.332700][ T5428] bridge0: port 1(bridge_slave_0) entered disabled state
[ 94.335742][ T5428] bridge_slave_0: entered allmulticast mode
[ 94.341525][ T5428] bridge_slave_0: entered promiscuous mode
[ 94.347049][ T5428] bridge0: port 2(bridge_slave_1) entered blocking state
[ 94.351317][ T5428] bridge0: port 2(bridge_slave_1) entered disabled state
[ 94.354758][ T5428] bridge_slave_1: entered allmulticast mode
[ 94.358415][ T5428] bridge_slave_1: entered promiscuous mode
[ 94.382696][ T5428] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 94.388749][ T5428] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 94.413917][ T5428] team0: Port device team_slave_0 added
[ 94.420544][ T5428] team0: Port device team_slave_1 added
[ 94.438439][ T5428] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 94.442944][ T5428] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 94.454593][ T5428] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 94.462253][ T5428] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 94.466439][ T5428] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 94.478488][ T5428] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 94.515327][ T5428] hsr_slave_0: entered promiscuous mode
[ 94.518450][ T5428] hsr_slave_1: entered promiscuous mode
[ 94.660402][ T5428] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 94.668601][ T5428] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 94.674946][ T5428] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 94.681828][ T5428] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 94.757680][ T5428] 8021q: adding VLAN 0 to HW filter on device bond0
[ 94.777341][ T5428] 8021q: adding VLAN 0 to HW filter on device team0
[ 94.786893][ T31] bridge0: port 1(bridge_slave_0) entered blocking state
[ 94.790117][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 94.805447][ T31] bridge0: port 2(bridge_slave_1) entered blocking state
[ 94.808187][ T31] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 94.848802][ T5428] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 94.988077][ T5428] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 95.033800][ T5428] veth0_vlan: entered promiscuous mode
[ 95.043122][ T5428] veth1_vlan: entered promiscuous mode
[ 95.071714][ T5428] veth0_macvtap: entered promiscuous mode
[ 95.078237][ T5428] veth1_macvtap: entered promiscuous mode
[ 95.095377][ T5428] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 95.106162][ T5428] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 95.121085][ T1045] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 95.128514][ T1045] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 95.144048][ T1045] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 95.147583][ T1045] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 95.301985][ T31] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 95.371780][ T31] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 95.441871][ T31] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 95.501370][ T31] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2025/09/26 13:20:28 executed programs: 0
[ 96.416266][ T4703] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 96.424006][ T4703] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 96.427549][ T4703] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 96.431986][ T4703] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 96.436325][ T4703] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 96.598813][ T5458] chnl_net:caif_netlink_parms(): no params data found
[ 96.672039][ T5458] bridge0: port 1(bridge_slave_0) entered blocking state
[ 96.675099][ T5458] bridge0: port 1(bridge_slave_0) entered disabled state
[ 96.678134][ T5458] bridge_slave_0: entered allmulticast mode
[ 96.683008][ T5458] bridge_slave_0: entered promiscuous mode
[ 96.688082][ T5458] bridge0: port 2(bridge_slave_1) entered blocking state
[ 96.695536][ T5458] bridge0: port 2(bridge_slave_1) entered disabled state
[ 96.698627][ T5458] bridge_slave_1: entered allmulticast mode
[ 96.703815][ T5458] bridge_slave_1: entered promiscuous mode
[ 96.733963][ T5458] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 96.741800][ T5458] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 96.766952][ T5458] team0: Port device team_slave_0 added
[ 96.775756][ T5458] team0: Port device team_slave_1 added
[ 96.800884][ T5458] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 96.803715][ T5458] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 96.815026][ T5458] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 96.821875][ T5458] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 96.824769][ T5458] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 96.838740][ T5458] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 96.883638][ T5458] hsr_slave_0: entered promiscuous mode
[ 96.886883][ T5458] hsr_slave_1: entered promiscuous mode
[ 96.890999][ T5458] debugfs: 'hsr0' already exists in 'hsr'
[ 96.893534][ T5458] Cannot create hsr debugfs directory
[ 98.122408][ T31] bridge_slave_1: left allmulticast mode
[ 98.124899][ T31] bridge_slave_1: left promiscuous mode
[ 98.128136][ T31] bridge0: port 2(bridge_slave_1) entered disabled state
[ 98.151405][ T31] bridge_slave_0: left allmulticast mode
[ 98.153948][ T31] bridge_slave_0: left promiscuous mode
[ 98.156499][ T31] bridge0: port 1(bridge_slave_0) entered disabled state
[ 98.456336][ T5373] Bluetooth: hci0: command tx timeout
[ 98.563442][ T31] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 98.570085][ T31] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 98.574984][ T31] bond0 (unregistering): Released all slaves
[ 98.671856][ T31] hsr_slave_0: left promiscuous mode
[ 98.674612][ T31] hsr_slave_1: left promiscuous mode
[ 98.681713][ T31] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 98.684813][ T31] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 98.700128][ T31] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 98.703092][ T31] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 98.725934][ T31] veth1_macvtap: left promiscuous mode
[ 98.728249][ T31] veth0_macvtap: left promiscuous mode
[ 98.751120][ T31] veth1_vlan: left promiscuous mode
[ 98.753560][ T31] veth0_vlan: left promiscuous mode
[ 99.194407][ T31] team0 (unregistering): Port device team_slave_1 removed
[ 99.222703][ T31] team0 (unregistering): Port device team_slave_0 removed
[ 99.937848][ T5458] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 99.966870][ T5458] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 100.001477][ T5458] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 100.028647][ T5458] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 100.196605][ T5458] 8021q: adding VLAN 0 to HW filter on device bond0
[ 100.231336][ T5458] 8021q: adding VLAN 0 to HW filter on device team0
[ 100.241957][ T31] bridge0: port 1(bridge_slave_0) entered blocking state
[ 100.246286][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 100.271424][ T31] bridge0: port 2(bridge_slave_1) entered blocking state
[ 100.274488][ T31] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 100.491540][ T5458] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 100.526244][ T5458] veth0_vlan: entered promiscuous mode
[ 100.533491][ T5373] Bluetooth: hci0: command tx timeout
[ 100.543133][ T5458] veth1_vlan: entered promiscuous mode
[ 100.571576][ T5458] veth0_macvtap: entered promiscuous mode
[ 100.577162][ T5458] veth1_macvtap: entered promiscuous mode
[ 100.592232][ T5458] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 100.605478][ T5458] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 100.617613][ T1041] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 100.632953][ T1041] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 100.636173][ T1041] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 100.652501][ T1041] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 100.695636][ T1041] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 100.698864][ T1041] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 100.730749][ T31] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 100.734201][ T31] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 100.966961][ T5501] loop0: detected capacity change from 0 to 32768
[ 101.144808][ T5501] bcachefs (loop0): starting version 1.7: mi_btree_bitmap opts=metadata_checksum=none,data_checksum=none,compression=lz4,nojournal_transaction_names
[ 101.144825][ T5501] allowing incompatible features above 0.0: (unknown version)
[ 101.144832][ T5501] features: lz4,new_siphash,inline_data,new_extent_overwrite,btree_ptr_v2,new_varint,journal_no_flush,alloc_v2,extents_across_btree_nodes
[ 101.190238][ T5501] bcachefs (loop0): Using encoding defined by superblock: utf8-12.1.0
[ 101.193856][ T5501] bcachefs (loop0): recovering from clean shutdown, journal seq 10
[ 101.197125][ T5501] bcachefs (loop0): Version upgrade required:
[ 101.197125][ T5501] Version upgrade from 0.24: unwritten_extents to 1.7: mi_btree_bitmap incomplete
[ 101.197125][ T5501] Doing incompatible version upgrade from 0.24: unwritten_extents to 1.28: inode_has_case_insensitive
[ 101.197125][ T5501] running recovery passes: check_allocations,check_alloc_info,check_lrus,check_btree_backpointers,check_backpointers_to_extents,check_extents_to_backpointers,check_alloc_to_lru_refs,bucket_gens_init,check_snapshot_trees,check_snapshots,check_subvols,check_subvol_children,delete_dead_snapshots,check_inodes,check_extents,check_indirect_extents,check_dirents,check_xattrs,check_root,check_unreachable_inodes,check_subvolume_structure,check_directory_structure,check_nlinks,check_rebalance_work,set_fs_needs_rebalance
[ 101.303381][ T5501] ==================================================================
[ 101.306830][ T5501] BUG: KASAN: slab-out-of-bounds in bch2_btree_node_read_done+0x950/0x5550
[ 101.310562][ T5501] Read of size 8 at addr ffff888038a22010 by task syz.0.17/5501
[ 101.314850][ T5501]
[ 101.315938][ T5501] CPU: 0 UID: 0 PID: 5501 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 101.315953][ T5501] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 101.315961][ T5501] Call Trace:
[ 101.315968][ T5501]
[ 101.315974][ T5501] dump_stack_lvl+0x189/0x250
[ 101.315991][ T5501] ? __kasan_check_byte+0x12/0x40
[ 101.316007][ T5501] ? __pfx_dump_stack_lvl+0x10/0x10
[ 101.316020][ T5501] ? lock_release+0x4b/0x3e0
[ 101.316039][ T5501] ? __virt_addr_valid+0x4a5/0x5c0
[ 101.316055][ T5501] print_report+0xca/0x240
[ 101.316066][ T5501] ? bch2_btree_node_read_done+0x950/0x5550
[ 101.316082][ T5501] kasan_report+0x118/0x150
[ 101.316097][ T5501] ? bch2_btree_node_read_done+0x950/0x5550
[ 101.316114][ T5501] bch2_btree_node_read_done+0x950/0x5550
[ 101.316142][ T5501] ? __pfx_bch2_btree_node_read_done+0x10/0x10
[ 101.316160][ T5501] ? bch2_extent_ptr_to_text+0x5a/0x890
[ 101.316179][ T5501] ? bch2_bkey_ptrs_to_text+0x1161/0x1310
[ 101.316191][ T5501] ? bch2_printbuf_make_room+0xdb/0x360
[ 101.316208][ T5501] ? enumerated_ref_put+0xbe/0x270
[ 101.316225][ T5501] btree_node_read_work+0x40e/0xe60
[ 101.316246][ T5501] ? __pfx_btree_node_read_work+0x10/0x10
[ 101.316261][ T5501] ? bch2_latency_acct+0x436/0x520
[ 101.316274][ T5501] ? __pfx_bch2_latency_acct+0x10/0x10
[ 101.316286][ T5501] ? bio_associate_blkg+0x6d/0x230
[ 101.316304][ T5501] bch2_btree_node_read+0x887/0x2a00
[ 101.316323][ T5501] ? bch2_btree_node_hash_insert+0x88/0xc0
[ 101.316336][ T5501] ? __mutex_unlock_slowpath+0x1a1/0x740
[ 101.316392][ T5501] ? __pfx_bch2_btree_node_read+0x10/0x10
[ 101.316409][ T5501] ? bch2_trans_unlock+0x8a/0x580
[ 101.316422][ T5501] ? bch2_trans_unlock+0x491/0x580
[ 101.316437][ T5501] bch2_btree_root_read+0x5f0/0x760
[ 101.316454][ T5501] ? __pfx_bch2_btree_root_read+0x10/0x10
[ 101.316473][ T5501] ? bch2_current_has_btree_trans+0x169/0x1a0
[ 101.316489][ T5501] read_btree_roots+0x2c6/0x840
[ 101.316503][ T5501] ? __pfx_read_btree_roots+0x10/0x10
[ 101.316518][ T5501] bch2_fs_recovery+0x261f/0x3a50
[ 101.316533][ T5501] ? __pfx_bch2_fs_recovery+0x10/0x10
[ 101.316547][ T5501] ? __lock_acquire+0xab9/0xd20
[ 101.316565][ T5501] ? __mutex_trylock_common+0x153/0x260
[ 101.316578][ T5501] ? __lock_acquire+0xab9/0xd20
[ 101.316597][ T5501] ? __lock_acquire+0xab9/0xd20
[ 101.316618][ T5501] ? bch2_fs_start+0xa0f/0xda0
[ 101.316656][ T5501] ? up_write+0x1c4/0x420
[ 101.316669][ T5501] ? bch2_fs_start+0x5e7/0xda0
[ 101.316681][ T5501] bch2_fs_start+0xaaf/0xda0
[ 101.316694][ T5501] ? bch2_fs_start+0x5e7/0xda0
[ 101.316707][ T5501] ? __pfx_bch2_fs_start+0x10/0x10
[ 101.316724][ T5501] ? sget+0x267/0x620
[ 101.316737][ T5501] bch2_fs_get_tree+0xb39/0x1520
[ 101.316756][ T5501] ? __pfx_bch2_fs_get_tree+0x10/0x10
[ 101.316773][ T5501] ? vfs_parse_fs_string+0x101/0x170
[ 101.316789][ T5501] ? __pfx_vfs_parse_comma_sep+0x10/0x10
[ 101.316809][ T5501] vfs_get_tree+0x92/0x2b0
[ 101.316823][ T5501] do_new_mount+0x2a2/0x9e0
[ 101.316844][ T5501] ? ns_capable+0x8a/0xf0
[ 101.316855][ T5501] ? __pfx_do_new_mount+0x10/0x10
[ 101.316869][ T5501] ? path_mount+0x61c/0xfe0
[ 101.316882][ T5501] ? user_path_at+0x44/0x60
[ 101.316895][ T5501] __se_sys_mount+0x317/0x410
[ 101.316911][ T5501] ? __pfx___se_sys_mount+0x10/0x10
[ 101.316927][ T5501] ? do_syscall_64+0xbe/0x3b0
[ 101.316938][ T5501] ? __x64_sys_mount+0x20/0xc0
[ 101.316953][ T5501] do_syscall_64+0xfa/0x3b0
[ 101.316964][ T5501] ? lockdep_hardirqs_on+0x9c/0x150
[ 101.316976][ T5501] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 101.316987][ T5501] ? clear_bhb_loop+0x60/0xb0
[ 101.317000][ T5501] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 101.317011][ T5501] RIP: 0033:0x7f73e1f9066a
[ 101.317022][ T5501] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 101.317032][ T5501] RSP: 002b:00007ffdc93b4e08 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 101.317050][ T5501] RAX: ffffffffffffffda RBX: 00007ffdc93b4e90 RCX: 00007f73e1f9066a
[ 101.317058][ T5501] RDX: 00002000000058c0 RSI: 0000200000000000 RDI: 00007ffdc93b4e50
[ 101.317066][ T5501] RBP: 00002000000058c0 R08: 00007ffdc93b4e90 R09: 0000000000000000
[ 101.317074][ T5501] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000000
[ 101.317081][ T5501] R13: 00007ffdc93b4e50 R14: 00000000000058f2 R15: 0000200000000180
[ 101.317093][ T5501]
[ 101.317097][ T5501]
[ 101.499782][ T5501] Allocated by task 5501:
[ 101.501651][ T5501] kasan_save_track+0x3e/0x80
[ 101.504155][ T5501] __kasan_kmalloc+0x93/0xb0
[ 101.506351][ T5501] __kvmalloc_node_noprof+0x30d/0x5f0
[ 101.508648][ T5501] btree_node_data_alloc+0xdc/0x270
[ 101.510904][ T5501] __bch2_btree_node_mem_alloc+0x1dc/0x2e0
[ 101.513442][ T5501] bch2_fs_btree_cache_init+0x314/0x870
[ 101.515715][ T5501] bch2_fs_open+0x1ceb/0x2600
[ 101.517688][ T5501] bch2_fs_get_tree+0x44f/0x1520
[ 101.519859][ T5501] vfs_get_tree+0x92/0x2b0
[ 101.521694][ T5501] do_new_mount+0x2a2/0x9e0
[ 101.523707][ T5501] __se_sys_mount+0x317/0x410
[ 101.525804][ T5501] do_syscall_64+0xfa/0x3b0
[ 101.527683][ T5501] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 101.530203][ T5501]
[ 101.531318][ T5501] The buggy address belongs to the object at ffff888038a20000
[ 101.531318][ T5501] which belongs to the cache kmalloc-rcl-8k of size 8192
[ 101.537275][ T5501] The buggy address is located 16 bytes to the right of
[ 101.537275][ T5501] allocated 8192-byte region [ffff888038a20000, ffff888038a22000)
[ 101.543063][ T5501]
[ 101.544077][ T5501] The buggy address belongs to the physical page:
[ 101.546503][ T5501] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x38a20
[ 101.549883][ T5501] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 101.553218][ T5501] memcg:ffff88803f2be2c1
[ 101.555074][ T5501] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff)
[ 101.558167][ T5501] page_type: f5(slab)
[ 101.559819][ T5501] raw: 04fff00000000040 ffff88801a8483c0 dead000000000122 0000000000000000
[ 101.563279][ T5501] raw: 0000000000000000 0000000080020002 00000000f5000000 ffff88803f2be2c1
[ 101.566857][ T5501] head: 04fff00000000040 ffff88801a8483c0 dead000000000122 0000000000000000
[ 101.570443][ T5501] head: 0000000000000000 0000000080020002 00000000f5000000 ffff88803f2be2c1
[ 101.573891][ T5501] head: 04fff00000000003 ffffea0000e28801 00000000ffffffff 00000000ffffffff
[ 101.577560][ T5501] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 101.581457][ T5501] page dumped because: kasan: bad access detected
[ 101.584261][ T5501] page_owner tracks the page as allocated
[ 101.586606][ T5501] page last allocated via order 3, migratetype Reclaimable, gfp_mask 0x528d0(GFP_NOWAIT|__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP), pid 5501, tgid 5501 (syz.0.17), ts 100986819053, free_ts 91056731621
[ 101.595451][ T5501] post_alloc_hook+0x240/0x2a0
[ 101.597582][ T5501] get_page_from_freelist+0x21e4/0x22c0
[ 101.599921][ T5501] __alloc_frozen_pages_noprof+0x181/0x370
[ 101.602547][ T5501] alloc_pages_mpol+0x232/0x4a0
[ 101.604592][ T5501] allocate_slab+0x8a/0x370
[ 101.606519][ T5501] ___slab_alloc+0xbeb/0x1420
[ 101.608651][ T5501] __kvmalloc_node_noprof+0x429/0x5f0
[ 101.611041][ T5501] btree_node_data_alloc+0xdc/0x270
[ 101.613393][ T5501] __bch2_btree_node_mem_alloc+0x1dc/0x2e0
[ 101.615960][ T5501] bch2_fs_btree_cache_init+0x314/0x870
[ 101.618368][ T5501] bch2_fs_open+0x1ceb/0x2600
[ 101.620418][ T5501] bch2_fs_get_tree+0x44f/0x1520
[ 101.622636][ T5501] vfs_get_tree+0x92/0x2b0
[ 101.624784][ T5501] do_new_mount+0x2a2/0x9e0
[ 101.626908][ T5501] __se_sys_mount+0x317/0x410
[ 101.628984][ T5501] do_syscall_64+0xfa/0x3b0
[ 101.630875][ T5501] page last free pid 1040 tgid 1040 stack trace:
[ 101.633648][ T5501] __free_frozen_pages+0xbc4/0xd30
[ 101.635952][ T5501] __slab_free+0x303/0x3c0
[ 101.638070][ T5501] qlist_free_all+0x97/0x140
[ 101.639935][ T5501] kasan_quarantine_reduce+0x148/0x160
[ 101.642369][ T5501] __kasan_slab_alloc+0x22/0x80
[ 101.644501][ T5501] __kmalloc_cache_noprof+0x1be/0x3d0
[ 101.646774][ T5501] kobject_uevent_env+0x27c/0x8c0
[ 101.648882][ T5501] nfs_netns_sysfs_destroy+0x54/0xb0
[ 101.651057][ T5501] nfs_clients_exit+0x4e/0x170
[ 101.653205][ T5501] ops_undo_list+0x497/0x990
[ 101.655315][ T5501] cleanup_net+0x4c5/0x800
[ 101.657303][ T5501] process_scheduled_works+0xae1/0x17b0
[ 101.659670][ T5501] worker_thread+0x8a0/0xda0
[ 101.661824][ T5501] kthread+0x70e/0x8a0
[ 101.663635][ T5501] ret_from_fork+0x439/0x7d0
[ 101.665532][ T5501] ret_from_fork_asm+0x1a/0x30
[ 101.667497][ T5501]
[ 101.668517][ T5501] Memory state around the buggy address:
[ 101.670637][ T5501] ffff888038a21f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 101.673822][ T5501] ffff888038a21f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 101.677253][ T5501] >ffff888038a22000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 101.680700][ T5501] ^
[ 101.682758][ T5501] ffff888038a22080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 101.686363][ T5501] ffff888038a22100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 101.689661][ T5501] ==================================================================
[ 101.737418][ T5501] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 101.740806][ T5501] CPU: 0 UID: 0 PID: 5501 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 101.744732][ T5501] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 101.749281][ T5501] Call Trace:
[ 101.750736][ T5501]
[ 101.752054][ T5501] dump_stack_lvl+0x99/0x250
[ 101.754076][ T5501] ? __asan_memcpy+0x40/0x70
[ 101.756015][ T5501] ? __pfx_dump_stack_lvl+0x10/0x10
[ 101.758192][ T5501] ? __pfx__printk+0x10/0x10
[ 101.760140][ T5501] vpanic+0x281/0x750
[ 101.761933][ T5501] ? preempt_schedule+0xae/0xc0
[ 101.764092][ T5501] ? __pfx_vpanic+0x10/0x10
[ 101.766090][ T5501] ? preempt_schedule_common+0x83/0xd0
[ 101.768551][ T5501] ? preempt_schedule+0xae/0xc0
[ 101.770735][ T5501] ? __pfx_preempt_schedule+0x10/0x10
[ 101.773178][ T5501] panic+0xb9/0xc0
[ 101.774841][ T5501] ? __pfx_panic+0x10/0x10
[ 101.776773][ T5501] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 101.779384][ T5501] ? bch2_btree_node_read_done+0x950/0x5550
[ 101.782028][ T5501] check_panic_on_warn+0x89/0xb0
[ 101.784184][ T5501] ? bch2_btree_node_read_done+0x950/0x5550
[ 101.786788][ T5501] end_report+0x78/0x160
[ 101.788766][ T5501] kasan_report+0x129/0x150
[ 101.790638][ T5501] ? bch2_btree_node_read_done+0x950/0x5550
[ 101.793204][ T5501] bch2_btree_node_read_done+0x950/0x5550
[ 101.795685][ T5501] ? __pfx_bch2_btree_node_read_done+0x10/0x10
[ 101.798401][ T5501] ? bch2_extent_ptr_to_text+0x5a/0x890
[ 101.800953][ T5501] ? bch2_bkey_ptrs_to_text+0x1161/0x1310
[ 101.803502][ T5501] ? bch2_printbuf_make_room+0xdb/0x360
[ 101.805900][ T5501] ? enumerated_ref_put+0xbe/0x270
[ 101.808198][ T5501] btree_node_read_work+0x40e/0xe60
[ 101.810488][ T5501] ? __pfx_btree_node_read_work+0x10/0x10
[ 101.812914][ T5501] ? bch2_latency_acct+0x436/0x520
[ 101.815298][ T5501] ? __pfx_bch2_latency_acct+0x10/0x10
[ 101.817798][ T5501] ? bio_associate_blkg+0x6d/0x230
[ 101.820020][ T5501] bch2_btree_node_read+0x887/0x2a00
[ 101.822258][ T5501] ? bch2_btree_node_hash_insert+0x88/0xc0
[ 101.824868][ T5501] ? __mutex_unlock_slowpath+0x1a1/0x740
[ 101.827369][ T5501] ? __pfx_bch2_btree_node_read+0x10/0x10
[ 101.829823][ T5501] ? bch2_trans_unlock+0x8a/0x580
[ 101.832024][ T5501] ? bch2_trans_unlock+0x491/0x580
[ 101.834306][ T5501] bch2_btree_root_read+0x5f0/0x760
[ 101.836580][ T5501] ? __pfx_bch2_btree_root_read+0x10/0x10
[ 101.839041][ T5501] ? bch2_current_has_btree_trans+0x169/0x1a0
[ 101.841711][ T5501] read_btree_roots+0x2c6/0x840
[ 101.843772][ T5501] ? __pfx_read_btree_roots+0x10/0x10
[ 101.846156][ T5501] bch2_fs_recovery+0x261f/0x3a50
[ 101.848400][ T5501] ? __pfx_bch2_fs_recovery+0x10/0x10
[ 101.850696][ T5501] ? __lock_acquire+0xab9/0xd20
[ 101.852840][ T5501] ? __mutex_trylock_common+0x153/0x260
[ 101.855250][ T5501] ? __lock_acquire+0xab9/0xd20
[ 101.857334][ T5501] ? __lock_acquire+0xab9/0xd20
[ 101.859427][ T5501] ? bch2_fs_start+0xa0f/0xda0
[ 101.861453][ T5501] ? up_write+0x1c4/0x420
[ 101.863344][ T5501] ? bch2_fs_start+0x5e7/0xda0
[ 101.865389][ T5501] bch2_fs_start+0xaaf/0xda0
[ 101.867433][ T5501] ? bch2_fs_start+0x5e7/0xda0
[ 101.869489][ T5501] ? __pfx_bch2_fs_start+0x10/0x10
[ 101.871728][ T5501] ? sget+0x267/0x620
[ 101.873489][ T5501] bch2_fs_get_tree+0xb39/0x1520
[ 101.875658][ T5501] ? __pfx_bch2_fs_get_tree+0x10/0x10
[ 101.877912][ T5501] ? vfs_parse_fs_string+0x101/0x170
[ 101.880166][ T5501] ? __pfx_vfs_parse_comma_sep+0x10/0x10
[ 101.882589][ T5501] vfs_get_tree+0x92/0x2b0
[ 101.884504][ T5501] do_new_mount+0x2a2/0x9e0
[ 101.886403][ T5501] ? ns_capable+0x8a/0xf0
[ 101.888292][ T5501] ? __pfx_do_new_mount+0x10/0x10
[ 101.890423][ T5501] ? path_mount+0x61c/0xfe0
[ 101.892430][ T5501] ? user_path_at+0x44/0x60
[ 101.894362][ T5501] __se_sys_mount+0x317/0x410
[ 101.896587][ T5501] ? __pfx___se_sys_mount+0x10/0x10
[ 101.898734][ T5501] ? do_syscall_64+0xbe/0x3b0
[ 101.900742][ T5501] ? __x64_sys_mount+0x20/0xc0
[ 101.902888][ T5501] do_syscall_64+0xfa/0x3b0
[ 101.904859][ T5501] ? lockdep_hardirqs_on+0x9c/0x150
[ 101.907064][ T5501] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 101.909611][ T5501] ? clear_bhb_loop+0x60/0xb0
[ 101.911747][ T5501] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 101.914316][ T5501] RIP: 0033:0x7f73e1f9066a
[ 101.916321][ T5501] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 101.924631][ T5501] RSP: 002b:00007ffdc93b4e08 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 101.928158][ T5501] RAX: ffffffffffffffda RBX: 00007ffdc93b4e90 RCX: 00007f73e1f9066a
[ 101.931361][ T5501] RDX: 00002000000058c0 RSI: 0000200000000000 RDI: 00007ffdc93b4e50
[ 101.934603][ T5501] RBP: 00002000000058c0 R08: 00007ffdc93b4e90 R09: 0000000000000000
[ 101.937637][ T5501] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000000
[ 101.940819][ T5501] R13: 00007ffdc93b4e50 R14: 00000000000058f2 R15: 0000200000000180
[ 101.943896][ T5501]
[ 101.945420][ T5501] Kernel Offset: disabled
[ 101.947101][ T5501] Rebooting in 86400 seconds..
VM DIAGNOSIS:
13:20:34 Registers:
info registers vcpu 0
CPU#0
RAX=0000000000000065 RBX=0000000000000065 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90002a7e1b0
R8 =ffff888033cf0237 R9 =1ffff1100679e046 R10=dffffc0000000000 R11=ffffffff85513ea0
R12=dffffc0000000000 R13=ffffffff99d0e8e3 R14=ffffffff9a003860 R15=0000000000000000
RIP=ffffffff85513f1c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000555588ec6500 ffffffff 00c00000
GS =0000 ffff88808d007000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007ff7caba0d80 CR3=0000000043f1f000 CR4=00352ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=0000000080040001 Opmask01=0000000000000fff Opmask02=00000000ffffffef Opmask03=0000000000000000
Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffdc93b52b0 0000003000000018
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffdc93b5436
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffdc93b5436 00007ffdc93b543c
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f73e2012fbe
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f73e2012fcb
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f73e2012fc5
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f73e2012fd9
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f73e201305f
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f73e201313d
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2525252525252525 2525252525252525 2525252525252525 2525252525252525
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0063696e61703d73 726f727265006f72 2d746e756f6d6572 3d73726f72726500
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00464c4b44551856 574a575740004a57 08514b504a484057 1856574a57574000
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000