Warning: Permanently added '10.128.0.191' (ED25519) to the list of known hosts. 2026/07/13 23:07:19 parsed 1 programs 2026/07/13 23:07:19 serving rpc on tcp://43307 [ 66.935198][ T4197] cgroup: Unknown subsys name 'net' [ 67.074961][ T4197] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 68.491957][ T4197] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 69.889077][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.897045][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.907438][ T335] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 69.931570][ T335] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.939982][ T335] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.950905][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 70.501141][ T4229] chnl_net:caif_netlink_parms(): no params data found [ 70.559504][ T4229] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.566983][ T4229] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.575175][ T4229] device bridge_slave_0 entered promiscuous mode [ 70.584668][ T4229] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.591867][ T4229] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.599940][ T4229] device bridge_slave_1 entered promiscuous mode [ 70.623959][ T4229] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.643000][ T4229] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.670226][ T4229] team0: Port device team_slave_0 added [ 70.677971][ T4229] team0: Port device team_slave_1 added [ 70.699927][ T4229] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.706900][ T4229] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 70.732943][ T4229] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.745688][ T4229] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.752798][ T4229] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 70.778751][ T4229] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.816151][ T4229] device hsr_slave_0 entered promiscuous mode [ 70.823837][ T4229] device hsr_slave_1 entered promiscuous mode [ 70.950158][ T4229] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 70.961114][ T4229] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 70.971216][ T4229] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 70.980663][ T4229] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 71.054100][ T4229] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.068107][ T335] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 71.076904][ T335] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 71.089965][ T4229] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.100186][ T335] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 71.110791][ T335] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 71.119868][ T335] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.127122][ T335] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.136211][ T1427] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.142886][ T1427] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.153037][ T335] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 71.171513][ T335] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 71.180272][ T335] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 71.189010][ T335] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.196103][ T335] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.213946][ T335] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 71.223043][ T335] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 71.241988][ T335] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 71.251713][ T335] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 71.262254][ T335] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 71.272447][ T335] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 71.285979][ T335] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 71.302802][ T335] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 71.320757][ T4229] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 71.332152][ T4229] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 71.343762][ T335] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 71.353591][ T335] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 71.363546][ T335] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 71.491151][ T4229] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.499733][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 71.508079][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 71.530053][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 71.540510][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 71.560519][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 71.570803][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 71.581614][ T4229] device veth0_vlan entered promiscuous mode [ 71.590177][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 71.598299][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 71.618962][ T4229] device veth1_vlan entered promiscuous mode [ 71.644099][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 71.653622][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 71.662628][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 71.673545][ T4229] device veth0_macvtap entered promiscuous mode [ 71.684378][ T4229] device veth1_macvtap entered promiscuous mode [ 71.703912][ T4229] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.712320][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 71.721376][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 71.730675][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 71.741992][ T4229] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.750122][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 71.759872][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 71.772013][ T4229] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.781496][ T4229] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.791086][ T4229] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.800263][ T4229] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.909456][ T4229] syz-executor (4229) used greatest stack depth: 20896 bytes left [ 72.174280][ T9] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 74.205127][ T9] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 76.784005][ T9] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 76.825476][ T9] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 78.107778][ T9] device hsr_slave_0 left promiscuous mode [ 78.121069][ T9] device hsr_slave_1 left promiscuous mode [ 78.134227][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 78.143616][ T9] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 78.163904][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 78.182978][ T9] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 78.200301][ T9] device bridge_slave_1 left promiscuous mode [ 78.217837][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.254013][ T9] device bridge_slave_0 left promiscuous mode [ 78.268789][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.310017][ T9] device veth1_macvtap left promiscuous mode [ 78.316297][ T9] device veth0_macvtap left promiscuous mode [ 78.343613][ T9] device veth1_vlan left promiscuous mode [ 78.355615][ T9] device veth0_vlan left promiscuous mode 2026/07/13 23:07:33 executed programs: 0 [ 78.550513][ T9] team0 (unregistering): Port device team_slave_1 removed [ 78.563125][ T9] team0 (unregistering): Port device team_slave_0 removed [ 78.575422][ T9] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 78.591317][ T9] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 78.643915][ T9] bond0 (unregistering): Released all slaves [ 78.825420][ T4341] chnl_net:caif_netlink_parms(): no params data found [ 78.888518][ T4341] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.895864][ T4341] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.903963][ T4341] device bridge_slave_0 entered promiscuous mode [ 78.912475][ T4341] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.919668][ T4341] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.932479][ T4341] device bridge_slave_1 entered promiscuous mode [ 78.959331][ T4341] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.971276][ T4341] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.999470][ T4341] team0: Port device team_slave_0 added [ 79.007096][ T4341] team0: Port device team_slave_1 added [ 79.027681][ T4341] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.034819][ T4341] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.060977][ T4341] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.073159][ T4341] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.080204][ T4341] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.106579][ T4341] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.172322][ T4341] device hsr_slave_0 entered promiscuous mode [ 79.189840][ T4341] device hsr_slave_1 entered promiscuous mode [ 79.728983][ T4341] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 79.738803][ T4341] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 79.749790][ T4341] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 79.760170][ T4341] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 79.865098][ T4341] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.881891][ T4212] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 79.891574][ T4212] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 79.902563][ T4341] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.926082][ T4212] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 79.936325][ T4212] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 79.946335][ T4212] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.953460][ T4212] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.972981][ T4212] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 79.982472][ T4212] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 79.992586][ T4212] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 80.002680][ T4212] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.009816][ T4212] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.018484][ T4212] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 80.030309][ T4212] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 80.052185][ T4212] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 80.070331][ T4212] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 80.083035][ T4212] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 80.092409][ T4212] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 80.103390][ T4212] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 80.117131][ T4212] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 80.129341][ T4341] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 80.141400][ T4212] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 80.312841][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 80.328783][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 80.342315][ T4341] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.377448][ T4212] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 80.400494][ T4212] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 80.418654][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 80.428074][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 80.452722][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 80.461137][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 80.479633][ T13] Bluetooth: hci0: command 0x0409 tx timeout [ 80.488936][ T4341] device veth0_vlan entered promiscuous mode [ 80.509190][ T4341] device veth1_vlan entered promiscuous mode [ 80.550542][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 80.569015][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 80.580198][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 80.591428][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 80.601815][ T4341] device veth0_macvtap entered promiscuous mode [ 80.614358][ T4341] device veth1_macvtap entered promiscuous mode [ 80.644652][ T4341] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.667413][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 80.690834][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 80.704084][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 80.715403][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 80.726562][ T4341] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.734725][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 80.745907][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 80.761087][ T4341] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.778586][ T4341] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.788285][ T4341] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.818641][ T4341] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.923100][ T4212] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.931586][ T4212] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.949888][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 80.994811][ T4212] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.008623][ T4212] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.016125][ T1421] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 81.486238][ T4409] loop0: detected capacity change from 0 to 32768 [ 81.591071][ T4409] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 81.608979][ T4409] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 81.659362][ T4409] gfs2: fsid=syz:syz.0: journal 0 mapped with 5 extents in 0ms [ 81.687434][ T4425] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 81.708995][ T4425] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 81.759591][ T4425] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 50ms [ 81.779658][ T4425] gfs2: fsid=syz:syz.0: jid=0: Done [ 81.785513][ T4409] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 81.991718][ T4409] gfs2: fsid=syz:syz.0: found 1 quota changes [ 82.066568][ T4341] gfs2: fsid=syz:syz.0: fatal: filesystem consistency error [ 82.066568][ T4341] inode = 11 2339 [ 82.066568][ T4341] function = gfs2_dinode_in, file = fs/gfs2/glops.c, line = 414 [ 82.108815][ T4341] gfs2: fsid=syz:syz.0: about to withdraw this file system [ 82.136580][ T4341] gfs2: fsid=syz:syz.0: warning: assertion "!qd->qd_change" failed at function = gfs2_quota_cleanup, file = fs/gfs2/quota.c, line = 1485 [ 82.170488][ T4341] CPU: 1 PID: 4341 Comm: syz-executor Not tainted syzkaller #0 [ 82.178091][ T4341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 82.188179][ T4341] Call Trace: [ 82.191478][ T4341] [ 82.194425][ T4341] dump_stack_lvl+0x188/0x250 [ 82.199149][ T4341] ? show_regs_print_info+0x20/0x20 [ 82.204381][ T4341] ? load_image+0x410/0x410 [ 82.208921][ T4341] ? do_raw_spin_unlock+0x11d/0x230 [ 82.214183][ T4341] gfs2_assert_warn_i+0x187/0x2c0 [ 82.219237][ T4341] gfs2_quota_cleanup+0x48c/0x670 [ 82.224295][ T4341] gfs2_make_fs_ro+0x440/0x620 [ 82.229121][ T4341] ? __might_sleep+0xf0/0xf0 [ 82.233771][ T4341] ? gfs2_dinode_out+0xb00/0xb00 [ 82.238743][ T4341] ? _raw_spin_unlock+0x24/0x40 [ 82.243636][ T4341] ? gfs2_glock_nq+0xcaa/0x1510 [ 82.248534][ T4341] gfs2_withdraw+0x660/0x14e0 [ 82.253241][ T4341] ? gfs2_meta_new+0x160/0x160 [ 82.258028][ T4341] ? gfs2_lm+0x240/0x240 [ 82.262291][ T4341] ? gfs2_freeze_lock+0x52/0xc0 [ 82.267173][ T4341] ? gfs2_consist_inode_i+0xc0/0xe0 [ 82.272404][ T4341] gfs2_inode_refresh+0xb2d/0x11a0 [ 82.277546][ T4341] ? gfs2_inode_metasync+0xf0/0xf0 [ 82.282700][ T4341] inode_go_lock+0x127/0x450 [ 82.287322][ T4341] do_promote+0x75b/0xb20 [ 82.291682][ T4341] finish_xmote+0x4c2/0xaf0 [ 82.296222][ T4341] do_xmote+0x752/0x10a0 [ 82.300499][ T4341] gfs2_glock_nq+0xc6b/0x1510 [ 82.305215][ T4341] do_sync+0x49c/0xba0 [ 82.309324][ T4341] ? slot_put+0x1e0/0x1e0 [ 82.313698][ T4341] ? do_sync+0x494/0xba0 [ 82.317970][ T4341] ? do_raw_spin_unlock+0x11d/0x230 [ 82.323296][ T4341] gfs2_quota_sync+0x355/0x780 [ 82.328096][ T4341] gfs2_sync_fs+0x48/0xb0 [ 82.332452][ T4341] sync_filesystem+0xe6/0x220 [ 82.337160][ T4341] generic_shutdown_super+0x6b/0x300 [ 82.342484][ T4341] kill_block_super+0x7c/0xe0 [ 82.347201][ T4341] deactivate_locked_super+0x93/0xf0 [ 82.352608][ T4341] cleanup_mnt+0x426/0x4d0 [ 82.357060][ T4341] task_work_run+0x125/0x1a0 [ 82.361684][ T4341] get_signal+0x123e/0x12e0 [ 82.366238][ T4341] ? task_work_add+0x1a7/0x1d0 [ 82.371035][ T4341] arch_do_signal_or_restart+0xe6/0x12a0 [ 82.376709][ T4341] ? vfs_submount+0xb0/0xb0 [ 82.381231][ T4341] ? lockref_put_or_lock+0x6e/0xb0 [ 82.386382][ T4341] ? path_umount+0x341/0xfe0 [ 82.390996][ T4341] ? get_sigframe_size+0x10/0x10 [ 82.395989][ T4341] ? exit_to_user_mode_loop+0x3b/0x130 [ 82.401484][ T4341] exit_to_user_mode_loop+0x9e/0x130 [ 82.406796][ T4341] exit_to_user_mode_prepare+0xee/0x180 [ 82.412366][ T4341] syscall_exit_to_user_mode+0x16/0x40 [ 82.417850][ T4341] do_syscall_64+0x58/0xa0 [ 82.422285][ T4341] ? clear_bhb_loop+0x30/0x80 [ 82.426991][ T4341] ? clear_bhb_loop+0x30/0x80 [ 82.431689][ T4341] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 82.437624][ T4341] RIP: 0033:0x7fd4a83a5097 [ 82.442068][ T4341] Code: a2 c7 05 5c 26 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 82.461701][ T4341] RSP: 002b:00007fff6f3e5088 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 82.470151][ T4341] RAX: 0000000000000000 RBX: 00007fd4a84392ca RCX: 00007fd4a83a5097 [ 82.478143][ T4341] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff6f3e5140 [ 82.486143][ T4341] RBP: 00007fff6f3e5140 R08: 00007fff6f3e6140 R09: 00000000ffffffff [ 82.494147][ T4341] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff6f3e61d0 [ 82.502296][ T4341] R13: 00007fd4a84392ca R14: 0000000000014052 R15: 00007fff6f3e6210 [ 82.510316][ T4341] [ 82.527429][ T4341] gfs2: fsid=syz:syz.0: Journal recovery skipped for jid 0 until next mount. [ 82.537420][ T4341] gfs2: fsid=syz:syz.0: Glock dequeues delayed: 0 [ 82.550388][ T4341] gfs2: fsid=syz:syz.0: File system withdrawn [ 82.556585][ T4341] CPU: 1 PID: 4341 Comm: syz-executor Not tainted syzkaller #0 [ 82.564153][ T4341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 82.574233][ T4341] Call Trace: [ 82.577537][ T4341] [ 82.580500][ T4341] dump_stack_lvl+0x188/0x250 [ 82.585212][ T4341] ? show_regs_print_info+0x20/0x20 [ 82.590441][ T4341] ? load_image+0x410/0x410 [ 82.595007][ T4341] ? lockref_put_or_lock+0x6e/0xb0 [ 82.600182][ T4341] gfs2_withdraw+0xb9a/0x14e0 [ 82.604900][ T4341] ? gfs2_meta_new+0x160/0x160 [ 82.609690][ T4341] ? gfs2_lm+0x240/0x240 [ 82.613974][ T4341] ? gfs2_consist_inode_i+0xc0/0xe0 [ 82.619207][ T4341] gfs2_inode_refresh+0xb2d/0x11a0 [ 82.624366][ T4341] ? gfs2_inode_metasync+0xf0/0xf0 [ 82.629515][ T4341] inode_go_lock+0x127/0x450 [ 82.634170][ T4341] do_promote+0x75b/0xb20 [ 82.638531][ T4341] finish_xmote+0x4c2/0xaf0 [ 82.643077][ T4341] do_xmote+0x752/0x10a0 [ 82.647355][ T4341] gfs2_glock_nq+0xc6b/0x1510 [ 82.652081][ T4341] do_sync+0x49c/0xba0 [ 82.656198][ T4341] ? slot_put+0x1e0/0x1e0 [ 82.660572][ T4341] ? do_sync+0x494/0xba0 [ 82.664946][ T4341] ? do_raw_spin_unlock+0x11d/0x230 [ 82.670174][ T4341] gfs2_quota_sync+0x355/0x780 [ 82.675083][ T4341] gfs2_sync_fs+0x48/0xb0 [ 82.679446][ T4341] sync_filesystem+0xe6/0x220 [ 82.684168][ T4341] generic_shutdown_super+0x6b/0x300 [ 82.689509][ T4341] kill_block_super+0x7c/0xe0 [ 82.694266][ T4341] deactivate_locked_super+0x93/0xf0 [ 82.699574][ T4341] cleanup_mnt+0x426/0x4d0 [ 82.704019][ T4341] task_work_run+0x125/0x1a0 [ 82.708644][ T4341] get_signal+0x123e/0x12e0 [ 82.713186][ T4341] ? task_work_add+0x1a7/0x1d0 [ 82.717985][ T4341] arch_do_signal_or_restart+0xe6/0x12a0 [ 82.723645][ T4341] ? vfs_submount+0xb0/0xb0 [ 82.728194][ T4341] ? lockref_put_or_lock+0x6e/0xb0 [ 82.733343][ T4341] ? path_umount+0x341/0xfe0 [ 82.737958][ T4341] ? get_sigframe_size+0x10/0x10 [ 82.742957][ T4341] ? exit_to_user_mode_loop+0x3b/0x130 [ 82.748437][ T4341] exit_to_user_mode_loop+0x9e/0x130 [ 82.753747][ T4341] exit_to_user_mode_prepare+0xee/0x180 [ 82.759317][ T4341] syscall_exit_to_user_mode+0x16/0x40 [ 82.764818][ T4341] do_syscall_64+0x58/0xa0 [ 82.769262][ T4341] ? clear_bhb_loop+0x30/0x80 [ 82.773969][ T4341] ? clear_bhb_loop+0x30/0x80 [ 82.778663][ T4341] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 82.784617][ T4341] RIP: 0033:0x7fd4a83a5097 [ 82.789057][ T4341] Code: a2 c7 05 5c 26 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 82.808682][ T4341] RSP: 002b:00007fff6f3e5088 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 82.817156][ T4341] RAX: 0000000000000000 RBX: 00007fd4a84392ca RCX: 00007fd4a83a5097 [ 82.825151][ T4341] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff6f3e5140 [ 82.833146][ T4341] RBP: 00007fff6f3e5140 R08: 00007fff6f3e6140 R09: 00000000ffffffff [ 82.841159][ T4341] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff6f3e61d0 [ 82.849155][ T4341] R13: 00007fd4a84392ca R14: 0000000000014052 R15: 00007fff6f3e6210 [ 82.857161][ T4341] [ 82.865542][ T4425] Bluetooth: hci0: command 0x041b tx timeout [ 82.885068][ T4341] ================================================================== [ 82.893560][ T4341] BUG: KASAN: use-after-free in qd_unlock+0x30/0x2d0 [ 82.900283][ T4341] Read of size 8 at addr ffff888071224090 by task syz-executor/4341 [ 82.908319][ T4341] [ 82.910662][ T4341] CPU: 1 PID: 4341 Comm: syz-executor Not tainted syzkaller #0 [ 82.918237][ T4341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 82.928314][ T4341] Call Trace: [ 82.931618][ T4341] [ 82.934575][ T4341] dump_stack_lvl+0x188/0x250 [ 82.939306][ T4341] ? show_regs_print_info+0x20/0x20 [ 82.944542][ T4341] ? load_image+0x410/0x410 [ 82.949075][ T4341] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 82.954584][ T4341] print_address_description+0x60/0x2d0 [ 82.960167][ T4341] ? qd_unlock+0x30/0x2d0 [ 82.964519][ T4341] kasan_report+0xdf/0x130 [ 82.969014][ T4341] ? qd_unlock+0x30/0x2d0 [ 82.973375][ T4341] kasan_check_range+0x235/0x290 [ 82.978337][ T4341] qd_unlock+0x30/0x2d0 [ 82.982520][ T4341] gfs2_quota_sync+0x63b/0x780 [ 82.987346][ T4341] gfs2_sync_fs+0x48/0xb0 [ 82.991708][ T4341] sync_filesystem+0xe6/0x220 [ 82.996424][ T4341] generic_shutdown_super+0x6b/0x300 [ 83.001737][ T4341] kill_block_super+0x7c/0xe0 [ 83.006460][ T4341] deactivate_locked_super+0x93/0xf0 [ 83.011941][ T4341] cleanup_mnt+0x426/0x4d0 [ 83.016383][ T4341] task_work_run+0x125/0x1a0 [ 83.021097][ T4341] get_signal+0x123e/0x12e0 [ 83.025647][ T4341] ? task_work_add+0x1a7/0x1d0 [ 83.030451][ T4341] arch_do_signal_or_restart+0xe6/0x12a0 [ 83.036115][ T4341] ? vfs_submount+0xb0/0xb0 [ 83.040643][ T4341] ? lockref_put_or_lock+0x6e/0xb0 [ 83.045796][ T4341] ? path_umount+0x341/0xfe0 [ 83.050508][ T4341] ? get_sigframe_size+0x10/0x10 [ 83.055503][ T4341] ? exit_to_user_mode_loop+0x3b/0x130 [ 83.060987][ T4341] exit_to_user_mode_loop+0x9e/0x130 [ 83.066292][ T4341] exit_to_user_mode_prepare+0xee/0x180 [ 83.071867][ T4341] syscall_exit_to_user_mode+0x16/0x40 [ 83.077358][ T4341] do_syscall_64+0x58/0xa0 [ 83.081803][ T4341] ? clear_bhb_loop+0x30/0x80 [ 83.086522][ T4341] ? clear_bhb_loop+0x30/0x80 [ 83.091228][ T4341] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 83.097156][ T4341] RIP: 0033:0x7fd4a83a5097 [ 83.101600][ T4341] Code: a2 c7 05 5c 26 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 83.121350][ T4341] RSP: 002b:00007fff6f3e5088 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 83.129794][ T4341] RAX: 0000000000000000 RBX: 00007fd4a84392ca RCX: 00007fd4a83a5097 [ 83.137794][ T4341] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff6f3e5140 [ 83.145791][ T4341] RBP: 00007fff6f3e5140 R08: 00007fff6f3e6140 R09: 00000000ffffffff [ 83.153800][ T4341] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff6f3e61d0 [ 83.161794][ T4341] R13: 00007fd4a84392ca R14: 0000000000014052 R15: 00007fff6f3e6210 [ 83.169810][ T4341] [ 83.172858][ T4341] [ 83.175197][ T4341] Allocated by task 4409: [ 83.179539][ T4341] __kasan_slab_alloc+0x92/0xc0 [ 83.184421][ T4341] slab_post_alloc_hook+0x4c/0x380 [ 83.189568][ T4341] kmem_cache_alloc+0x15d/0x280 [ 83.194444][ T4341] qd_alloc+0x50/0x260 [ 83.198532][ T4341] gfs2_quota_init+0x74d/0xe80 [ 83.203319][ T4341] gfs2_make_fs_rw+0x41c/0x590 [ 83.208108][ T4341] gfs2_fill_super+0x17d1/0x1ea0 [ 83.213071][ T4341] get_tree_bdev+0x3e6/0x610 [ 83.217680][ T4341] gfs2_get_tree+0x4d/0x1e0 [ 83.222196][ T4341] vfs_get_tree+0x88/0x270 [ 83.226635][ T4341] do_new_mount+0x247/0xa40 [ 83.231163][ T4341] __se_sys_mount+0x2e3/0x3d0 [ 83.235869][ T4341] do_syscall_64+0x4c/0xa0 [ 83.240305][ T4341] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 83.246414][ T4341] [ 83.248789][ T4341] Freed by task 4435: [ 83.252789][ T4341] kasan_set_track+0x4b/0x70 [ 83.257402][ T4341] kasan_set_free_info+0x1f/0x40 [ 83.262374][ T4341] ____kasan_slab_free+0xd5/0x110 [ 83.267421][ T4341] slab_free_freelist_hook+0xec/0x170 [ 83.272810][ T4341] kmem_cache_free+0x8f/0x210 [ 83.277547][ T4341] rcu_core+0x96e/0x1650 [ 83.281810][ T4341] handle_softirqs+0x336/0x830 [ 83.286595][ T4341] __irq_exit_rcu+0x13b/0x230 [ 83.291301][ T4341] irq_exit_rcu+0x5/0x20 [ 83.295597][ T4341] sysvec_call_function_single+0x9d/0xc0 [ 83.301253][ T4341] asm_sysvec_call_function_single+0x16/0x20 [ 83.307252][ T4341] [ 83.309591][ T4341] Last potentially related work creation: [ 83.315411][ T4341] kasan_save_stack+0x35/0x60 [ 83.320226][ T4341] kasan_record_aux_stack+0xb8/0x100 [ 83.325622][ T4341] call_rcu+0x189/0x900 [ 83.329800][ T4341] gfs2_quota_cleanup+0x414/0x670 [ 83.334851][ T4341] gfs2_make_fs_ro+0x440/0x620 [ 83.339641][ T4341] gfs2_withdraw+0x660/0x14e0 [ 83.344341][ T4341] gfs2_inode_refresh+0xb2d/0x11a0 [ 83.349492][ T4341] inode_go_lock+0x127/0x450 [ 83.354103][ T4341] do_promote+0x75b/0xb20 [ 83.358454][ T4341] finish_xmote+0x4c2/0xaf0 [ 83.362978][ T4341] do_xmote+0x752/0x10a0 [ 83.367246][ T4341] gfs2_glock_nq+0xc6b/0x1510 [ 83.371953][ T4341] do_sync+0x49c/0xba0 [ 83.376048][ T4341] gfs2_quota_sync+0x355/0x780 [ 83.380834][ T4341] gfs2_sync_fs+0x48/0xb0 [ 83.385209][ T4341] sync_filesystem+0xe6/0x220 [ 83.389915][ T4341] generic_shutdown_super+0x6b/0x300 [ 83.395315][ T4341] kill_block_super+0x7c/0xe0 [ 83.400044][ T4341] deactivate_locked_super+0x93/0xf0 [ 83.405358][ T4341] cleanup_mnt+0x426/0x4d0 [ 83.409805][ T4341] task_work_run+0x125/0x1a0 [ 83.414419][ T4341] get_signal+0x123e/0x12e0 [ 83.418942][ T4341] arch_do_signal_or_restart+0xe6/0x12a0 [ 83.424713][ T4341] exit_to_user_mode_loop+0x9e/0x130 [ 83.430070][ T4341] exit_to_user_mode_prepare+0xee/0x180 [ 83.435643][ T4341] syscall_exit_to_user_mode+0x16/0x40 [ 83.441124][ T4341] do_syscall_64+0x58/0xa0 [ 83.445569][ T4341] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 83.451509][ T4341] [ 83.453856][ T4341] The buggy address belongs to the object at ffff888071224000 [ 83.453856][ T4341] which belongs to the cache gfs2_quotad of size 272 [ 83.468045][ T4341] The buggy address is located 144 bytes inside of [ 83.468045][ T4341] 272-byte region [ffff888071224000, ffff888071224110) [ 83.481355][ T4341] The buggy address belongs to the page: [ 83.487018][ T4341] page:ffffea0001c48900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x71224 [ 83.497275][ T4341] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 83.504868][ T4341] raw: 00fff00000000200 0000000000000000 dead000000000122 ffff88801e6143c0 [ 83.513535][ T4341] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 [ 83.522142][ T4341] page dumped because: kasan: bad access detected [ 83.528582][ T4341] page_owner tracks the page as allocated [ 83.534407][ T4341] page last allocated via order 0, migratetype Reclaimable, gfp_mask 0x112c50(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 4409, ts 81985172069, free_ts 81923049143 [ 83.553471][ T4341] get_page_from_freelist+0x24f6/0x2670 [ 83.559053][ T4341] __alloc_pages+0x1ee/0x480 [ 83.563666][ T4341] new_slab+0xc0/0x4b0 [ 83.567751][ T4341] ___slab_alloc+0x807/0xdd0 [ 83.572362][ T4341] kmem_cache_alloc+0xf0/0x280 [ 83.577148][ T4341] qd_alloc+0x50/0x260 [ 83.581237][ T4341] gfs2_quota_init+0x74d/0xe80 [ 83.586022][ T4341] gfs2_make_fs_rw+0x41c/0x590 [ 83.590806][ T4341] gfs2_fill_super+0x17d1/0x1ea0 [ 83.595763][ T4341] get_tree_bdev+0x3e6/0x610 [ 83.600390][ T4341] gfs2_get_tree+0x4d/0x1e0 [ 83.604933][ T4341] vfs_get_tree+0x88/0x270 [ 83.609377][ T4341] do_new_mount+0x247/0xa40 [ 83.613929][ T4341] __se_sys_mount+0x2e3/0x3d0 [ 83.618847][ T4341] do_syscall_64+0x4c/0xa0 [ 83.623303][ T4341] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 83.629223][ T4341] page last free stack trace: [ 83.633905][ T4341] free_unref_page_prepare+0x637/0x6c0 [ 83.639393][ T4341] free_unref_page+0x8f/0x2a0 [ 83.644093][ T4341] __unfreeze_partials+0x188/0x1e0 [ 83.649227][ T4341] put_cpu_partial+0x12d/0x190 [ 83.654023][ T4341] qlist_free_all+0x35/0x90 [ 83.658559][ T4341] kasan_quarantine_reduce+0x150/0x160 [ 83.664074][ T4341] __kasan_slab_alloc+0x2f/0xc0 [ 83.668960][ T4341] slab_post_alloc_hook+0x4c/0x380 [ 83.674105][ T4341] kmem_cache_alloc+0x15d/0x280 [ 83.678974][ T4341] getname_flags+0xb7/0x4f0 [ 83.683508][ T4341] do_sys_openat2+0xdd/0x500 [ 83.68812