syzkaller login: [ 91.954162][ T810] cfg80211: failed to load regulatory.db
Warning: Permanently added '[localhost]:64411' (ED25519) to the list of known hosts.
2026/10/12 21:56:40 parsed 1 programs
2026/10/12 21:56:40 serving rpc on tcp://46163
[ 130.929712][ T5310] cgroup: Unknown subsys name 'net'
[ 130.994052][ T5310] cgroup: Unknown subsys name 'cpuset'
[ 131.000344][ T5310] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 132.578095][ T5310] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 138.030387][ T1329] ieee802154 phy0 wpan0: encryption failed: -22
[ 138.030473][ T1329] ieee802154 phy1 wpan1: encryption failed: -22
[ 138.410095][ T5321] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 138.763833][ T47] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 138.765762][ T47] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 138.766178][ T47] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 138.766979][ T47] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 138.778861][ T47] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 141.873692][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 141.873711][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 141.949635][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 141.949655][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 144.919825][ T5375] bridge0: port 1(bridge_slave_0) entered blocking state
[ 144.920800][ T5375] bridge0: port 1(bridge_slave_0) entered disabled state
[ 144.920945][ T5375] bridge_slave_0: entered allmulticast mode
[ 144.922128][ T5375] bridge_slave_0: entered promiscuous mode
[ 144.940733][ T5375] bridge0: port 2(bridge_slave_1) entered blocking state
[ 144.941647][ T5375] bridge0: port 2(bridge_slave_1) entered disabled state
[ 144.941748][ T5375] bridge_slave_1: entered allmulticast mode
[ 144.945212][ T5375] bridge_slave_1: entered promiscuous mode
[ 144.993919][ T5375] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 144.995866][ T5375] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 145.027556][ T5375] team0: Port device team_slave_0 added
[ 145.029055][ T5375] team0: Port device team_slave_1 added
[ 145.051050][ T5375] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 145.051064][ T5375] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 145.051074][ T5375] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 145.053081][ T5375] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 145.053090][ T5375] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 145.053098][ T5375] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 145.171957][ T5375] hsr_slave_0: entered promiscuous mode
[ 145.173398][ T5375] hsr_slave_1: entered promiscuous mode
[ 145.549557][ T5375] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 145.568550][ T5375] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 145.570248][ T5375] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 145.585161][ T5375] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 145.586832][ T5375] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 145.601229][ T5375] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 145.603020][ T5375] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 145.616355][ T5375] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 145.697365][ T5375] bridge0: port 2(bridge_slave_1) entered blocking state
[ 145.697478][ T5375] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 145.697887][ T5375] bridge0: port 1(bridge_slave_0) entered blocking state
[ 145.697963][ T5375] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 145.727591][ T13] bridge0: port 1(bridge_slave_0) entered disabled state
[ 145.729171][ T13] bridge0: port 2(bridge_slave_1) entered disabled state
[ 145.850703][ T5375] 8021q: adding VLAN 0 to HW filter on device bond0
[ 145.886510][ T5375] 8021q: adding VLAN 0 to HW filter on device team0
[ 145.901161][ T13] bridge0: port 1(bridge_slave_0) entered blocking state
[ 145.901210][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 145.921299][ T12] bridge0: port 2(bridge_slave_1) entered blocking state
[ 145.921357][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 146.661108][ T5375] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 146.756065][ T5375] veth0_vlan: entered promiscuous mode
[ 146.773361][ T5375] veth1_vlan: entered promiscuous mode
[ 146.834824][ T5375] veth0_macvtap: entered promiscuous mode
[ 146.852033][ T5375] veth1_macvtap: entered promiscuous mode
[ 146.887785][ T5375] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 146.897124][ T5375] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 146.949077][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 146.949109][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 146.949122][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 147.003047][ T183] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 147.317184][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 147.368687][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 148.202706][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 148.752051][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 149.403540][ T12] bridge_slave_1: left allmulticast mode
[ 149.403575][ T12] bridge_slave_1: left promiscuous mode
[ 149.404495][ T12] bridge0: port 2(bridge_slave_1) entered disabled state
[ 149.429444][ T12] bridge_slave_0: left allmulticast mode
[ 149.431532][ T12] bridge_slave_0: left promiscuous mode
[ 149.431734][ T12] bridge0: port 1(bridge_slave_0) entered disabled state
2026/10/12 21:57:02 executed programs: 0
[ 149.613446][ T47] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 149.617140][ T47] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 149.624659][ T47] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 149.626020][ T47] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 149.626792][ T47] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 149.932305][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 149.934743][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 149.935909][ T12] bond0 (unregistering): Released all slaves
[ 150.045283][ T12] hsr_slave_0: left promiscuous mode
[ 150.051571][ T12] hsr_slave_1: left promiscuous mode
[ 150.052176][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 150.052198][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 150.054341][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 150.054350][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 150.100596][ T12] veth1_macvtap: left promiscuous mode
[ 150.100660][ T12] veth0_macvtap: left promiscuous mode
[ 150.100765][ T12] veth1_vlan: left promiscuous mode
[ 150.100829][ T12] veth0_vlan: left promiscuous mode
[ 150.381579][ T12] team0 (unregistering): Port device team_slave_1 removed
[ 150.399587][ T12] team0 (unregistering): Port device team_slave_0 removed
[ 151.104099][ T4991] 8021q: adding VLAN 0 to HW filter on device eth2
[ 151.692351][ T4991] 8021q: adding VLAN 0 to HW filter on device eth3
[ 151.709417][ T4646] Bluetooth: hci0: command tx timeout
[ 151.744864][ T5435] bridge0: port 1(bridge_slave_0) entered blocking state
[ 151.744981][ T5435] bridge0: port 1(bridge_slave_0) entered disabled state
[ 151.745062][ T5435] bridge_slave_0: entered allmulticast mode
[ 151.757275][ T5435] bridge_slave_0: entered promiscuous mode
[ 151.765228][ T5435] bridge0: port 2(bridge_slave_1) entered blocking state
[ 151.765619][ T5435] bridge0: port 2(bridge_slave_1) entered disabled state
[ 151.765712][ T5435] bridge_slave_1: entered allmulticast mode
[ 151.767035][ T5435] bridge_slave_1: entered promiscuous mode
[ 151.822239][ T5435] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 151.824176][ T5435] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 151.890015][ T5435] team0: Port device team_slave_0 added
[ 151.902750][ T5435] team0: Port device team_slave_1 added
[ 151.957004][ T5435] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 151.957019][ T5435] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 151.957033][ T5435] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 151.987292][ T5435] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 151.990862][ T5435] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 151.990882][ T5435] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 152.078826][ T5435] hsr_slave_0: entered promiscuous mode
[ 152.082523][ T5435] hsr_slave_1: entered promiscuous mode
[ 152.247039][ T4991] 8021q: adding VLAN 0 to HW filter on device eth4
[ 152.762044][ T5435] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 152.773302][ T5435] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 152.774223][ T5435] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 152.790748][ T5435] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 152.792450][ T5435] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 152.811451][ T5435] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 152.813918][ T5435] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 152.828070][ T5435] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 152.977173][ T5435] 8021q: adding VLAN 0 to HW filter on device bond0
[ 153.004888][ T5435] 8021q: adding VLAN 0 to HW filter on device team0
[ 153.021815][ T12] bridge0: port 1(bridge_slave_0) entered blocking state
[ 153.021890][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 153.040494][ T12] bridge0: port 2(bridge_slave_1) entered blocking state
[ 153.040563][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 153.711658][ T5435] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 153.779322][ T5435] veth0_vlan: entered promiscuous mode
[ 153.787769][ T4646] Bluetooth: hci0: command tx timeout
[ 153.803705][ T5435] veth1_vlan: entered promiscuous mode
[ 153.864489][ T5435] veth0_macvtap: entered promiscuous mode
[ 153.884542][ T5435] veth1_macvtap: entered promiscuous mode
[ 153.916781][ T5435] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 153.935585][ T5435] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 154.009685][ T183] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 154.009708][ T183] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 154.009720][ T183] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 154.009732][ T183] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 154.081067][ T183] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 154.081088][ T183] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 154.126276][ T1058] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 154.126292][ T1058] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 154.572084][ T5509] loop0: detected capacity change from 0 to 32768
2026/10/12 21:57:07 executed programs: 3
[ 155.439000][ T5510] loop0: detected capacity change from 0 to 32768
[ 155.867759][ T4646] Bluetooth: hci0: command tx timeout
[ 155.920194][ T5511] loop0: detected capacity change from 0 to 32768
[ 156.360463][ T5512] loop0: detected capacity change from 0 to 32768
[ 156.742860][ T5513] loop0: detected capacity change from 0 to 32768
[ 157.276112][ T5514] loop0: detected capacity change from 0 to 32768
[ 157.638065][ T5515] loop0: detected capacity change from 0 to 32768
[ 157.948160][ T4646] Bluetooth: hci0: command tx timeout
[ 158.004858][ T5516] loop0: detected capacity change from 0 to 32768
[ 158.810978][ T5517] loop0: detected capacity change from 0 to 32768
[ 159.449455][ T5518] loop0: detected capacity change from 0 to 32768
[ 159.996021][ T5519] loop0: detected capacity change from 0 to 32768
2026/10/12 21:57:12 executed programs: 13
[ 160.291713][ T5520] loop0: detected capacity change from 0 to 32768
[ 160.607037][ T5521] loop0: detected capacity change from 0 to 32768
[ 161.402138][ T5522] loop0: detected capacity change from 0 to 32768
[ 161.728029][ T5523] loop0: detected capacity change from 0 to 32768
[ 162.125493][ T5524] loop0: detected capacity change from 0 to 32768
[ 162.505635][ T5525] loop0: detected capacity change from 0 to 32768
[ 162.863598][ T5526] loop0: detected capacity change from 0 to 32768
[ 163.248514][ T5527] loop0: detected capacity change from 0 to 32768
[ 163.585554][ T5528] loop0: detected capacity change from 0 to 32768
[ 165.133991][ T5533] set_capacity_and_notify: 4 callbacks suppressed
[ 165.135934][ T5533] loop0: detected capacity change from 0 to 32768
2026/10/12 21:57:17 executed programs: 27
[ 165.460397][ T5534] loop0: detected capacity change from 0 to 32768
[ 165.783703][ T5535] loop0: detected capacity change from 0 to 32768
[ 166.090744][ T5536] loop0: detected capacity change from 0 to 32768
[ 166.433652][ T5537] loop0: detected capacity change from 0 to 32768
[ 166.746214][ T5538] loop0: detected capacity change from 0 to 32768
[ 167.083608][ T5539] loop0: detected capacity change from 0 to 32768
[ 167.409171][ T5540] loop0: detected capacity change from 0 to 32768
[ 167.750994][ T5541] loop0: detected capacity change from 0 to 32768
[ 168.046748][ T5542] loop0: detected capacity change from 0 to 32768
[ 170.452569][ T5549] set_capacity_and_notify: 6 callbacks suppressed
[ 170.452607][ T5549] loop0: detected capacity change from 0 to 32768
2026/10/12 21:57:23 executed programs: 43
[ 170.758802][ T5550] loop0: detected capacity change from 0 to 32768
[ 171.078553][ T5551] loop0: detected capacity change from 0 to 32768
[ 171.438314][ T5552] loop0: detected capacity change from 0 to 32768
[ 171.741510][ T5553] loop0: detected capacity change from 0 to 32768
[ 172.062916][ T5554] loop0: detected capacity change from 0 to 32768
[ 172.381542][ T5555] loop0: detected capacity change from 0 to 32768
[ 172.695550][ T5556] loop0: detected capacity change from 0 to 32768
[ 173.059811][ T5557] loop0: detected capacity change from 0 to 32768
[ 173.410034][ T5558] loop0: detected capacity change from 0 to 32768
[ 175.525045][ T5564] set_capacity_and_notify: 5 callbacks suppressed
[ 175.525073][ T5564] loop0: detected capacity change from 0 to 32768
2026/10/12 21:57:28 executed programs: 58
[ 176.066525][ T5565] loop0: detected capacity change from 0 to 32768
[ 176.397223][ T5566] loop0: detected capacity change from 0 to 32768
[ 176.990677][ T5567] loop0: detected capacity change from 0 to 32768
[ 177.355318][ T5568] loop0: detected capacity change from 0 to 32768
[ 177.716830][ T5569] loop0: detected capacity change from 0 to 32768
[ 178.068678][ T5570] loop0: detected capacity change from 0 to 32768
[ 178.419944][ T5571] loop0: detected capacity change from 0 to 32768
[ 178.770101][ T5572] loop0: detected capacity change from 0 to 32768
[ 179.084805][ T5573] loop0: detected capacity change from 0 to 32768
[ 180.660473][ T5578] set_capacity_and_notify: 4 callbacks suppressed
[ 180.660498][ T5578] loop0: detected capacity change from 0 to 32768
2026/10/12 21:57:33 executed programs: 72
[ 180.939408][ T5579] loop0: detected capacity change from 0 to 32768
[ 181.248862][ T5580] loop0: detected capacity change from 0 to 32768
[ 181.480239][ T5581] loop0: detected capacity change from 0 to 32768
[ 181.783973][ T5582] loop0: detected capacity change from 0 to 32768
[ 182.150659][ T5583] loop0: detected capacity change from 0 to 32768
[ 182.489163][ T5584] loop0: detected capacity change from 0 to 32768
[ 182.811166][ T5585] loop0: detected capacity change from 0 to 32768
[ 183.118985][ T5586] loop0: detected capacity change from 0 to 32768
[ 183.453534][ T5587] loop0: detected capacity change from 0 to 32768
[ 185.753077][ T5594] set_capacity_and_notify: 6 callbacks suppressed
[ 185.753090][ T5594] loop0: detected capacity change from 0 to 32768
2026/10/12 21:57:38 executed programs: 88
[ 186.084403][ T5595] loop0: detected capacity change from 0 to 32768
[ 186.382815][ T5596] loop0: detected capacity change from 0 to 32768
[ 186.692411][ T5597] loop0: detected capacity change from 0 to 32768
[ 187.000327][ T5598] loop0: detected capacity change from 0 to 32768
[ 187.542285][ T5599] loop0: detected capacity change from 0 to 32768
[ 188.206217][ T5600] loop0: detected capacity change from 0 to 32768
[ 188.561604][ T5601] loop0: detected capacity change from 0 to 32768
[ 188.932647][ T5602] loop0: detected capacity change from 0 to 32768
[ 189.257281][ T5604] loop0: detected capacity change from 0 to 32768
[ 191.031875][ T5613] set_capacity_and_notify: 5 callbacks suppressed
[ 191.031903][ T5613] loop0: detected capacity change from 0 to 32768
2026/10/12 21:57:43 executed programs: 103
[ 191.301735][ T5614] loop0: detected capacity change from 0 to 32768
[ 191.666232][ T5615] loop0: detected capacity change from 0 to 32768
[ 192.063044][ T5618] loop0: detected capacity change from 0 to 32768
[ 192.406877][ T5619] loop0: detected capacity change from 0 to 32768
[ 192.721476][ T5620] loop0: detected capacity change from 0 to 32768
[ 193.033101][ T5621] loop0: detected capacity change from 0 to 32768
[ 193.359894][ T5622] loop0: detected capacity change from 0 to 32768
[ 193.683136][ T5624] loop0: detected capacity change from 0 to 32768
[ 194.000021][ T5625] loop0: detected capacity change from 0 to 32768
[ 196.163760][ T5632] set_capacity_and_notify: 6 callbacks suppressed
[ 196.163830][ T5632] loop0: detected capacity change from 0 to 32768
2026/10/12 21:57:48 executed programs: 119
[ 196.425263][ T5633] loop0: detected capacity change from 0 to 32768
[ 196.715262][ T5634] loop0: detected capacity change from 0 to 32768
[ 197.015273][ T5635] loop0: detected capacity change from 0 to 32768
[ 197.320340][ T5636] loop0: detected capacity change from 0 to 32768
[ 197.666089][ T5637] loop0: detected capacity change from 0 to 32768
[ 197.986469][ T5638] loop0: detected capacity change from 0 to 32768
[ 198.289628][ T5639] loop0: detected capacity change from 0 to 32768
[ 198.604809][ T5640] loop0: detected capacity change from 0 to 32768
[ 198.919400][ T5641] loop0: detected capacity change from 0 to 32768
[ 199.471694][ T1329] ieee802154 phy0 wpan0: encryption failed: -22
[ 199.471746][ T1329] ieee802154 phy1 wpan1: encryption failed: -22
[ 201.449467][ T5649] set_capacity_and_notify: 7 callbacks suppressed
[ 201.449513][ T5649] loop0: detected capacity change from 0 to 32768
[ 201.483631][ T1058] ==================================================================
[ 201.483651][ T1058] BUG: KASAN: slab-use-after-free in lbmIODone+0x13f9/0x1790
[ 201.483820][ T1058] Read of size 4 at addr ffff888013e08e08 by task kworker/u4:10/1058
[ 201.483830][ T1058]
[ 201.483850][ T1058] CPU: 0 UID: 0 PID: 1058 Comm: kworker/u4:10 Not tainted syzkaller #0 PREEMPT(full)
[ 201.483862][ T1058] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 201.483869][ T1058] Workqueue: loop0 loop_rootcg_workfn
[ 201.483898][ T1058] Call Trace:
[ 201.483903][ T1058]
[ 201.483909][ T1058] dump_stack_lvl+0xe8/0x150
[ 201.483942][ T1058] print_address_description+0x55/0x1e0
[ 201.483984][ T1058] ? lbmIODone+0x13f9/0x1790
[ 201.484015][ T1058] print_report+0x58/0x70
[ 201.484027][ T1058] kasan_report+0x117/0x150
[ 201.484053][ T1058] ? lbmIODone+0x13f9/0x1790
[ 201.484067][ T1058] lbmIODone+0x13f9/0x1790
[ 201.484083][ T1058] blk_update_request+0x57b/0xe50
[ 201.484109][ T1058] blk_mq_end_request+0x3e/0x70
[ 201.484119][ T1058] lo_rw_aio+0xcd4/0xf20
[ 201.484136][ T1058] ? __pfx_lo_rw_aio+0x10/0x10
[ 201.484149][ T1058] ? do_raw_spin_lock+0x12b/0x2f0
[ 201.484177][ T1058] ? kthread_associate_blkcg+0x359/0x600
[ 201.484189][ T1058] ? _raw_spin_unlock_irq+0x23/0x50
[ 201.484264][ T1058] loop_process_work+0x621/0x11c0
[ 201.484282][ T1058] ? __pfx_loop_process_work+0x10/0x10
[ 201.484296][ T1058] ? look_up_lock_class+0x57/0x110
[ 201.484307][ T1058] ? register_lock_class+0x31/0x2e0
[ 201.484319][ T1058] ? __lock_acquire+0x747/0x2de0
[ 201.484332][ T1058] ? trace_hrtimer_start+0x82/0x200
[ 201.484344][ T1058] ? do_raw_spin_lock+0x12b/0x2f0
[ 201.484359][ T1058] ? lock_acquire+0x115/0x350
[ 201.484372][ T1058] ? rcu_is_watching+0x16/0xb0
[ 201.484385][ T1058] ? process_scheduled_works+0x97a/0x1630
[ 201.484400][ T1058] process_scheduled_works+0xc3d/0x1630
[ 201.484421][ T1058] ? __pfx_process_scheduled_works+0x10/0x10
[ 201.484434][ T1058] ? assign_work+0x3cf/0x5d0
[ 201.484448][ T1058] worker_thread+0xa47/0xfb0
[ 201.484465][ T1058] ? __kthread_parkme+0x71/0x1f0
[ 201.484480][ T1058] kthread+0x38b/0x480
[ 201.484489][ T1058] ? __pfx_worker_thread+0x10/0x10
[ 201.484501][ T1058] ? __pfx_kthread+0x10/0x10
[ 201.484512][ T1058] ret_from_fork+0x514/0xb70
[ 201.484523][ T1058] ? __pfx_ret_from_fork+0x10/0x10
[ 201.484533][ T1058] ? __switch_to+0xc89/0x1420
[ 201.484547][ T1058] ? __pfx_kthread+0x10/0x10
[ 201.484557][ T1058] ret_from_fork_asm+0x1a/0x30
[ 201.484566][ T1058]
[ 201.484569][ T1058]
[ 201.484571][ T1058] Allocated by task 5649:
[ 201.484576][ T1058] kasan_save_track+0x3e/0x80
[ 201.484586][ T1058] __kasan_kmalloc+0x93/0xb0
[ 201.484595][ T1058] __kmalloc_cache_noprof+0x321/0x600
[ 201.484604][ T1058] lmLogInit+0x3d5/0x1a00
[ 201.484615][ T1058] lmLogOpen+0x4e3/0xf90
[ 201.484625][ T1058] jfs_mount_rw+0xf3/0x670
[ 201.484635][ T1058] jfs_fill_super+0x769/0xda0
[ 201.484650][ T1058] get_tree_bdev_flags+0x430/0x4f0
[ 201.484659][ T1058] vfs_get_tree+0x92/0x2a0
[ 201.484667][ T1058] do_new_mount+0x325/0xb00
[ 201.484678][ T1058] __se_sys_mount+0x31d/0x420
[ 201.484689][ T1058] do_syscall_64+0x166/0x520
[ 201.484699][ T1058] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 201.484708][ T1058]
[ 201.484711][ T1058] Freed by task 5435:
[ 201.484715][ T1058] kasan_save_track+0x3e/0x80
[ 201.484725][ T1058] kasan_save_free_info+0x40/0x50
[ 201.484738][ T1058] __kasan_slab_free+0x5c/0x80
[ 201.484748][ T1058] kfree+0x1c5/0x650
[ 201.484761][ T1058] lmLogShutdown+0x456/0x850
[ 201.484772][ T1058] lmLogClose+0x28c/0x530
[ 201.484782][ T1058] jfs_umount+0x2da/0x3b0
[ 201.484792][ T1058] jfs_put_super+0x8c/0x190
[ 201.484805][ T1058] generic_shutdown_super+0x13d/0x2d0
[ 201.484818][ T1058] kill_block_super+0x44/0xa0
[ 201.484826][ T1058] deactivate_locked_super+0xbe/0x110
[ 201.484838][ T1058] cleanup_mnt+0x204/0x2a0
[ 201.484845][ T1058] task_work_run+0x1d9/0x270
[ 201.484854][ T1058] exit_to_user_mode_loop+0x204/0x770
[ 201.484865][ T1058] do_syscall_64+0x328/0x520
[ 201.484874][ T1058] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 201.484883][ T1058]
[ 201.484886][ T1058] The buggy address belongs to the object at ffff888013e08e00
[ 201.484886][ T1058] which belongs to the cache kmalloc-192 of size 192
[ 201.484895][ T1058] The buggy address is located 8 bytes inside of
[ 201.484895][ T1058] freed 192-byte region [ffff888013e08e00, ffff888013e08ec0)
[ 201.484905][ T1058]
[ 201.484908][ T1058] The buggy address belongs to the physical page:
[ 201.484913][ T1058] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13e08
[ 201.484923][ T1058] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 201.484939][ T1058] page_type: f5(slab)
[ 201.484949][ T1058] raw: 00fff00000000000 ffff88801c0413c0 dead000000000100 dead000000000122
[ 201.484957][ T1058] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 201.484962][ T1058] page dumped because: kasan: bad access detected
[ 201.484967][ T1058] page_owner tracks the page as allocated
[ 201.484971][ T1058] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 5355, tgid 5355 (syz-executor), ts 141992175600
[ 201.484987][ T1058] post_alloc_hook+0x1f9/0x250
[ 201.485002][ T1058] get_page_from_freelist+0x2209/0x2280
[ 201.485012][ T1058] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 201.485021][ T1058] allocate_slab+0x7d/0x620
[ 201.485032][ T1058] ___slab_alloc+0x16a/0x960
[ 201.485043][ T1058] __kmalloc_flags_noprof+0x341/0x7a0
[ 201.485052][ T1058] alloc_slab_obj_exts+0x5c/0x180
[ 201.485064][ T1058] __memcg_slab_post_alloc_hook+0x60b/0xd90
[ 201.485074][ T1058] kmem_cache_alloc_lru_noprof+0x351/0x5f0
[ 201.485087][ T1058] __d_alloc+0x37/0x6f0
[ 201.485100][ T1058] d_alloc_pseudo+0x21/0xc0
[ 201.485112][ T1058] alloc_path_pseudo+0x107/0x220
[ 201.485123][ T1058] alloc_file_pseudo+0xa8/0x1e0
[ 201.485133][ T1058] sock_alloc_file+0xb8/0x2e0
[ 201.487239][ T1058] __sys_socket+0x13f/0x1b0
[ 201.487249][ T1058] __x64_sys_socket+0x7a/0x90
[ 201.487259][ T1058] page last free pid 4684 tgid 4684 ts 141904655222 stack trace:
[ 201.487279][ T1058] __free_frozen_pages+0xc93/0xd90
[ 201.487293][ T1058] __slab_free+0x274/0x2c0
[ 201.487302][ T1058] qlist_free_all+0x99/0x100
[ 201.487311][ T1058] kasan_quarantine_reduce+0x148/0x160
[ 201.487321][ T1058] __kasan_slab_alloc+0x22/0x80
[ 201.487331][ T1058] kmem_cache_alloc_node_noprof+0x354/0x610
[ 201.487344][ T1058] __alloc_skb+0x1db/0x7a0
[ 201.487356][ T1058] alloc_skb_with_frags+0xc6/0x760
[ 201.487369][ T1058] sock_alloc_send_pskb+0x878/0x990
[ 201.487377][ T1058] unix_dgram_sendmsg+0x4fe/0x1870
[ 201.490000][ T1058] sock_sendmsg_nosec+0x13a/0x180
[ 201.490012][ T1058] __sys_sendto+0x408/0x5a0
[ 201.490029][ T1058] __x64_sys_sendto+0xde/0x100
[ 201.490040][ T1058] do_syscall_64+0x166/0x520
[ 201.490050][ T1058] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 201.490060][ T1058]
[ 201.490066][ T1058] Memory state around the buggy address:
[ 201.490072][ T1058] ffff888013e08d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 201.490080][ T1058] ffff888013e08d80: 00 00 00 00 00 00 00 05 fc fc fc fc fc fc fc fc
[ 201.490086][ T1058] >ffff888013e08e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 201.490091][ T1058] ^
[ 201.490096][ T1058] ffff888013e08e80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 201.490103][ T1058] ffff888013e08f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 201.490108][ T1058] ==================================================================
[ 201.490115][ T1058] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 201.787455][ T1058] CPU: 0 UID: 0 PID: 1058 Comm: kworker/u4:10 Not tainted syzkaller #0 PREEMPT(full)
[ 201.790764][ T1058] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 201.794605][ T1058] Workqueue: loop0 loop_rootcg_workfn
[ 201.796576][ T1058] Call Trace:
[ 201.797920][ T1058]
[ 201.799285][ T1058] vpanic+0x56d/0xa60
[ 201.801064][ T1058] ? __pfx_vpanic+0x10/0x10
[ 201.803136][ T1058] panic+0xc5/0xd0
[ 201.804880][ T1058] ? __pfx_panic+0x10/0x10
[ 201.806510][ T1058] ? lbmIODone+0x13f9/0x1790
[ 201.808151][ T1058] ? rcu_is_watching+0x16/0xb0
[ 201.809802][ T1058] ? lbmIODone+0x13f9/0x1790
[ 201.811470][ T1058] ? lbmIODone+0x13f9/0x1790
[ 201.813133][ T1058] check_panic_on_warn+0x89/0xb0
[ 201.814856][ T1058] ? lbmIODone+0x13f9/0x1790
[ 201.816529][ T1058] end_report+0x73/0x170
[ 201.817992][ T1058] ? lbmIODone+0x13f9/0x1790
[ 201.819681][ T1058] kasan_report+0x128/0x150
[ 201.821347][ T1058] ? lbmIODone+0x13f9/0x1790
[ 201.822967][ T1058] lbmIODone+0x13f9/0x1790
[ 201.824770][ T1058] blk_update_request+0x57b/0xe50
[ 201.826984][ T1058] blk_mq_end_request+0x3e/0x70
[ 201.828995][ T1058] lo_rw_aio+0xcd4/0xf20
[ 201.830588][ T1058] ? __pfx_lo_rw_aio+0x10/0x10
[ 201.832315][ T1058] ? do_raw_spin_lock+0x12b/0x2f0
[ 201.834124][ T1058] ? kthread_associate_blkcg+0x359/0x600
[ 201.836244][ T1058] ? _raw_spin_unlock_irq+0x23/0x50
[ 201.838210][ T1058] loop_process_work+0x621/0x11c0
[ 201.840422][ T1058] ? __pfx_loop_process_work+0x10/0x10
[ 201.842645][ T1058] ? look_up_lock_class+0x57/0x110
[ 201.844863][ T1058] ? register_lock_class+0x31/0x2e0
[ 201.847040][ T1058] ? __lock_acquire+0x747/0x2de0
[ 201.848990][ T1058] ? trace_hrtimer_start+0x82/0x200
[ 201.851341][ T1058] ? do_raw_spin_lock+0x12b/0x2f0
[ 201.854056][ T1058] ? lock_acquire+0x115/0x350
[ 201.856501][ T1058] ? rcu_is_watching+0x16/0xb0
[ 201.858516][ T1058] ? process_scheduled_works+0x97a/0x1630
[ 201.861033][ T1058] process_scheduled_works+0xc3d/0x1630
[ 201.863532][ T1058] ? __pfx_process_scheduled_works+0x10/0x10
[ 201.866256][ T1058] ? assign_work+0x3cf/0x5d0
[ 201.868328][ T1058] worker_thread+0xa47/0xfb0
[ 201.870427][ T1058] ? __kthread_parkme+0x71/0x1f0
[ 201.872657][ T1058] kthread+0x38b/0x480
[ 201.874517][ T1058] ? __pfx_worker_thread+0x10/0x10
[ 201.876825][ T1058] ? __pfx_kthread+0x10/0x10
[ 201.878935][ T1058] ret_from_fork+0x514/0xb70
[ 201.881056][ T1058] ? __pfx_ret_from_fork+0x10/0x10
[ 201.883285][ T1058] ? __switch_to+0xc89/0x1420
[ 201.885389][ T1058] ? __pfx_kthread+0x10/0x10
[ 201.887509][ T1058] ret_from_fork_asm+0x1a/0x30
[ 201.889708][ T1058]
[ 201.893563][ T1058] Kernel Offset: disabled
[ 201.895643][ T1058] Rebooting in 86400 seconds..
VM DIAGNOSIS:
21:57:54 Registers:
info registers vcpu 0
CPU#0
RAX=000000000000000d RBX=000000000000000d RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc900017deaa0
R8 =0000000000000003 R9 =0000000000000004 R10=dffffc0000000000 R11=ffffffff85765530
R12=dffffc0000000000 R13=000000000000000a R14=ffffffff9bd57220 R15=0000000000000000
RIP=ffffffff857655ac RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff88808b0b4000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007ffe170f1e70 CR3=000000003bea5000 CR4=00352ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=0000000000020081 Opmask01=0000000001000001 Opmask02=00000000ffffffef Opmask03=0000000000000000
Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe170f24d0 0000003000000018
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 307a79732f74656e 2f70756f7267637a
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe170f3746
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe170f3746 00007ffe170f374c
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f35bfa35e6b
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f35bfa35eab
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f35bfa3600f
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f35bfa35e9d
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2525252525252525 2525252525252525 2525252525252525 2525252525252525
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 47414c46585f5346 2074657365720064 656c696166202973 2528746174736c00
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 47414c46585f5346 0551405640570041 40494c4443050c56 000d514451564900
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 0000000000000000 0000000000000000 0000000000000050
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000