Warning: Permanently added '10.128.1.42' (ED25519) to the list of known hosts.
syzkaller login: [ 93.350991][ T9] cfg80211: failed to load regulatory.db
2026/06/15 10:44:19 parsed 1 programs
[ 98.077888][ T5618] cgroup: Unknown subsys name 'net'
[ 98.319381][ T5618] cgroup: Unknown subsys name 'cpuset'
[ 98.372959][ T5618] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 100.546575][ T5618] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 105.320452][ T5643] bridge0: port 1(bridge_slave_0) entered blocking state
[ 105.321568][ T5643] bridge0: port 1(bridge_slave_0) entered disabled state
[ 105.321738][ T5643] bridge_slave_0: entered allmulticast mode
[ 105.328912][ T5643] bridge_slave_0: entered promiscuous mode
[ 105.342702][ T5643] bridge0: port 2(bridge_slave_1) entered blocking state
[ 105.342816][ T5643] bridge0: port 2(bridge_slave_1) entered disabled state
[ 105.343044][ T5643] bridge_slave_1: entered allmulticast mode
[ 105.347278][ T5643] bridge_slave_1: entered promiscuous mode
[ 105.393575][ T5643] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 105.396659][ T5643] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 105.431117][ T5643] team0: Port device team_slave_0 added
[ 105.436993][ T5643] team0: Port device team_slave_1 added
[ 105.471790][ T5643] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 105.471805][ T5643] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 105.471818][ T5643] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 105.479585][ T5643] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 105.479601][ T5643] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 105.479625][ T5643] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 105.680014][ T5643] hsr_slave_0: entered promiscuous mode
[ 105.680930][ T5643] hsr_slave_1: entered promiscuous mode
[ 105.940554][ T5643] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 105.989857][ T5643] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 105.999941][ T5643] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 106.035945][ T5643] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 106.038532][ T5643] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 106.078647][ T5643] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 106.253839][ T5643] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 106.289928][ T5643] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 106.451622][ T5643] 8021q: adding VLAN 0 to HW filter on device bond0
[ 106.495755][ T5643] 8021q: adding VLAN 0 to HW filter on device team0
[ 106.509210][ T3399] bridge0: port 1(bridge_slave_0) entered blocking state
[ 106.509422][ T3399] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 106.582008][ T3399] bridge0: port 2(bridge_slave_1) entered blocking state
[ 106.582085][ T3399] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 107.008350][ T5643] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 107.078509][ T5643] veth0_vlan: entered promiscuous mode
[ 107.098149][ T5643] veth1_vlan: entered promiscuous mode
[ 107.168638][ T5643] veth0_macvtap: entered promiscuous mode
[ 107.180734][ T5643] veth1_macvtap: entered promiscuous mode
[ 107.203427][ T5643] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 107.222822][ T5643] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 107.250045][ T3399] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 107.261530][ T3399] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 107.261574][ T3399] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 107.261603][ T3399] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 107.969866][ T2282] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 108.808034][ T2282] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 109.458729][ T5702] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 109.488023][ T5702] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 109.510123][ T5702] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 109.547602][ T5702] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 109.550511][ T5702] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 109.886067][ T2282] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 110.209266][ T2282] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 111.333496][ T2282] bridge_slave_1: left allmulticast mode
[ 111.333936][ T2282] bridge_slave_1: left promiscuous mode
[ 111.357357][ T2282] bridge0: port 2(bridge_slave_1) entered disabled state
[ 111.473448][ T2282] bridge_slave_0: left allmulticast mode
[ 111.473474][ T2282] bridge_slave_0: left promiscuous mode
[ 111.473639][ T2282] bridge0: port 1(bridge_slave_0) entered disabled state
[ 112.413179][ T2282] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 112.493009][ T2282] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 112.514542][ T2282] bond0 (unregistering): Released all slaves
[ 113.042486][ T2282] hsr_slave_0: left promiscuous mode
[ 113.082716][ T2282] hsr_slave_1: left promiscuous mode
[ 113.084015][ T2282] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 113.084100][ T2282] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 113.143932][ T2282] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 113.143958][ T2282] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 113.216583][ T2282] veth1_macvtap: left promiscuous mode
[ 113.216776][ T2282] veth0_macvtap: left promiscuous mode
[ 113.216956][ T2282] veth1_vlan: left promiscuous mode
[ 113.217149][ T2282] veth0_vlan: left promiscuous mode
[ 113.983386][ T2282] team0 (unregistering): Port device team_slave_1 removed
[ 114.022916][ T2282] team0 (unregistering): Port device team_slave_0 removed
[ 114.227583][ T5265] 8021q: adding VLAN 0 to HW filter on device eth1
[ 114.552907][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 114.552935][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 114.660568][ T1888] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 114.660590][ T1888] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 115.214974][ T5265] 8021q: adding VLAN 0 to HW filter on device eth2
[ 116.028182][ T5265] 8021q: adding VLAN 0 to HW filter on device eth3
[ 117.007670][ T5265] 8021q: adding VLAN 0 to HW filter on device eth4
2026/06/15 10:44:42 executed programs: 0
[ 118.614959][ T60] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 118.618530][ T60] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 118.619344][ T60] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 118.620373][ T60] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 118.621149][ T60] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 119.565150][ T5807] bridge0: port 1(bridge_slave_0) entered blocking state
[ 119.565325][ T5807] bridge0: port 1(bridge_slave_0) entered disabled state
[ 119.565606][ T5807] bridge_slave_0: entered allmulticast mode
[ 119.567113][ T5807] bridge_slave_0: entered promiscuous mode
[ 119.577832][ T5807] bridge0: port 2(bridge_slave_1) entered blocking state
[ 119.578110][ T5807] bridge0: port 2(bridge_slave_1) entered disabled state
[ 119.578598][ T5807] bridge_slave_1: entered allmulticast mode
[ 119.581077][ T5807] bridge_slave_1: entered promiscuous mode
[ 119.848075][ T5807] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 119.851003][ T5807] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 119.891601][ T5807] team0: Port device team_slave_0 added
[ 119.900986][ T5807] team0: Port device team_slave_1 added
[ 119.987088][ T5807] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 119.987104][ T5807] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 119.987117][ T5807] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 119.988442][ T5807] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 119.988453][ T5807] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 119.988474][ T5807] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 120.069167][ T5807] hsr_slave_0: entered promiscuous mode
[ 120.070463][ T5807] hsr_slave_1: entered promiscuous mode
[ 120.704670][ T60] Bluetooth: hci0: command tx timeout
[ 122.582717][ T5807] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 122.624469][ T5807] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 122.630407][ T5807] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 122.674801][ T5807] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 122.782333][ T60] Bluetooth: hci0: command tx timeout
[ 122.993173][ T5807] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 123.039236][ T5807] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 123.040314][ T5807] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 123.122947][ T5807] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 123.415415][ T5807] 8021q: adding VLAN 0 to HW filter on device bond0
[ 123.449255][ T5807] 8021q: adding VLAN 0 to HW filter on device team0
[ 123.498062][ T44] bridge0: port 1(bridge_slave_0) entered blocking state
[ 123.508035][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 123.569079][ T44] bridge0: port 2(bridge_slave_1) entered blocking state
[ 123.569266][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 124.518995][ T5807] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 124.667141][ T5807] veth0_vlan: entered promiscuous mode
[ 124.684958][ T5807] veth1_vlan: entered promiscuous mode
[ 124.766205][ T5807] veth0_macvtap: entered promiscuous mode
[ 124.779697][ T5807] veth1_macvtap: entered promiscuous mode
[ 124.828308][ T5807] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 124.844743][ T5807] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 124.873160][ T60] Bluetooth: hci0: command tx timeout
[ 124.875060][ T168] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 124.890112][ T168] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 124.897616][ T168] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 124.897662][ T168] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 125.540968][ T168] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 125.540989][ T168] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 125.697215][ T3399] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 125.697235][ T3399] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
2026/06/15 10:44:50 executed programs: 2
[ 126.177963][ T5961] loop0: detected capacity change from 0 to 32768
[ 126.942361][ T60] Bluetooth: hci0: command tx timeout
[ 126.989158][ T5962] loop0: detected capacity change from 0 to 32768
[ 127.575169][ T5963] loop0: detected capacity change from 0 to 32768
[ 128.211656][ T5964] loop0: detected capacity change from 0 to 32768
[ 128.774972][ T5965] loop0: detected capacity change from 0 to 32768
[ 129.326398][ T5966] loop0: detected capacity change from 0 to 32768
[ 129.885412][ T5967] loop0: detected capacity change from 0 to 32768
[ 130.418302][ T5968] loop0: detected capacity change from 0 to 32768
[ 130.958597][ T5969] loop0: detected capacity change from 0 to 32768
2026/06/15 10:44:55 executed programs: 11
[ 131.534449][ T5971] loop0: detected capacity change from 0 to 32768
[ 132.530775][ T5975] loop0: detected capacity change from 0 to 32768
[ 133.118197][ T5978] loop0: detected capacity change from 0 to 32768
[ 133.675583][ T5979] loop0: detected capacity change from 0 to 32768
[ 134.201801][ T5981] loop0: detected capacity change from 0 to 32768
[ 134.740870][ T5982] loop0: detected capacity change from 0 to 32768
[ 135.323480][ T5983] loop0: detected capacity change from 0 to 32768
[ 135.865749][ T5984] loop0: detected capacity change from 0 to 32768
2026/06/15 10:45:00 executed programs: 21
[ 136.819712][ T5986] loop0: detected capacity change from 0 to 32768
[ 137.367757][ T5987] loop0: detected capacity change from 0 to 32768
[ 137.916397][ T5988] loop0: detected capacity change from 0 to 32768
[ 138.486267][ T5989] loop0: detected capacity change from 0 to 32768
[ 139.034980][ T5990] loop0: detected capacity change from 0 to 32768
[ 139.587252][ T5991] loop0: detected capacity change from 0 to 32768
[ 140.166717][ T5992] loop0: detected capacity change from 0 to 32768
[ 140.705456][ T5993] loop0: detected capacity change from 0 to 32768
[ 141.215893][ T5994] loop0: detected capacity change from 0 to 32768
[ 141.788769][ T5995] loop0: detected capacity change from 0 to 32768
2026/06/15 10:45:06 executed programs: 31
[ 142.336107][ T5996] loop0: detected capacity change from 0 to 32768
[ 142.878890][ T5997] loop0: detected capacity change from 0 to 32768
[ 143.432091][ T5998] loop0: detected capacity change from 0 to 32768
[ 143.987305][ T5999] loop0: detected capacity change from 0 to 32768
[ 144.538032][ T6000] loop0: detected capacity change from 0 to 32768
[ 144.559107][ T1337] ieee802154 phy0 wpan0: encryption failed: -22
[ 144.559167][ T1337] ieee802154 phy1 wpan1: encryption failed: -22
[ 145.138645][ T6001] loop0: detected capacity change from 0 to 32768
[ 145.697479][ T6002] loop0: detected capacity change from 0 to 32768
[ 146.238404][ T6003] loop0: detected capacity change from 0 to 32768
[ 146.748145][ T6004] loop0: detected capacity change from 0 to 32768
[ 147.319172][ T6005] loop0: detected capacity change from 0 to 32768
2026/06/15 10:45:11 executed programs: 41
[ 147.855433][ T6006] loop0: detected capacity change from 0 to 32768
[ 148.383383][ T6007] loop0: detected capacity change from 0 to 32768
[ 148.886278][ T6008] loop0: detected capacity change from 0 to 32768
[ 149.423577][ T6009] loop0: detected capacity change from 0 to 32768
[ 150.003998][ T6010] loop0: detected capacity change from 0 to 32768
[ 150.546117][ T6011] loop0: detected capacity change from 0 to 32768
[ 151.545113][ T6013] loop0: detected capacity change from 0 to 32768
[ 152.087366][ T6014] loop0: detected capacity change from 0 to 32768
2026/06/15 10:45:17 executed programs: 51
[ 152.618123][ T6015] loop0: detected capacity change from 0 to 32768
[ 153.159301][ T6016] loop0: detected capacity change from 0 to 32768
[ 153.676877][ T6017] loop0: detected capacity change from 0 to 32768
[ 154.252926][ T6018] loop0: detected capacity change from 0 to 32768
[ 154.778638][ T6019] loop0: detected capacity change from 0 to 32768
[ 155.380464][ T6020] loop0: detected capacity change from 0 to 32768
[ 155.917587][ T6021] loop0: detected capacity change from 0 to 32768
[ 156.476506][ T6022] loop0: detected capacity change from 0 to 32768
[ 157.015201][ T6023] loop0: detected capacity change from 0 to 32768
[ 157.622006][ T6024] loop0: detected capacity change from 0 to 32768
2026/06/15 10:45:22 executed programs: 60
[ 158.186676][ T6025] loop0: detected capacity change from 0 to 32768
[ 159.201284][ T6027] loop0: detected capacity change from 0 to 32768
[ 159.739431][ T6028] loop0: detected capacity change from 0 to 32768
[ 160.274496][ T6029] loop0: detected capacity change from 0 to 32768
[ 160.867038][ T6030] loop0: detected capacity change from 0 to 32768
[ 161.419274][ T6031] loop0: detected capacity change from 0 to 32768
[ 161.965721][ T6032] loop0: detected capacity change from 0 to 32768
[ 162.501696][ T6033] loop0: detected capacity change from 0 to 32768
[ 162.972959][ T6034] loop0: detected capacity change from 0 to 32768
2026/06/15 10:45:27 executed programs: 70
[ 163.514510][ T6035] loop0: detected capacity change from 0 to 32768
[ 164.067874][ T6036] loop0: detected capacity change from 0 to 32768
[ 164.616305][ T6037] loop0: detected capacity change from 0 to 32768
[ 165.116517][ T6038] loop0: detected capacity change from 0 to 32768
[ 165.628198][ T6039] loop0: detected capacity change from 0 to 32768
[ 165.720311][ T44] ==================================================================
[ 165.720329][ T44] BUG: KASA[ 165.720329][ T44] BUG: KASAN: use-after-free in copy_folio_from_iter_atomic+0xbbf/0x1a30
[ 165.720442][ T44] Read of size 4096 at addr ffff888034f86000 by task kworker/u8:3/44
[ 165.720459][ T44]
[ 165.720571][ T44] CPU: 0 UID: 0 PID: 44 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
[ 165.720598][ T44] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
[ 165.720611][ T44] Workqueue: loop0 loop_workfn
[ 165.720719][ T44] Call Trace:
[ 165.720756][ T44]
[ 165.720816][ T44] dump_stack_lvl+0xe8/0x150
[ 165.720873][ T44] print_address_description+0x55/0x1e0
[ 165.720896][ T44] ? copy_folio_from_iter_atomic+0xbbf/0x1a30
[ 165.720927][ T44] print_report+0x58/0x70
[ 165.720945][ T44] kasan_report+0x117/0x150
[ 165.720970][ T44] ? copy_folio_from_iter_atomic+0xbbf/0x1a30
[ 165.720999][ T44] kasan_check_range+0x264/0x2c0
[ 165.721021][ T44] ? copy_folio_from_iter_atomic+0xbbf/0x1a30
[ 165.721047][ T44] __asan_memcpy+0x29/0x70
[ 165.721065][ T44] copy_folio_from_iter_atomic+0xbbf/0x1a30
[ 165.721100][ T44] ? __pfx_copy_folio_from_iter_atomic+0x10/0x10
[ 165.721156][ T44] ? rcu_is_watching+0x15/0xb0
[ 165.721185][ T44] ? shmem_write_begin+0x1ce/0x320
[ 165.721209][ T44] generic_perform_write+0x5a8/0x8b0
[ 165.721236][ T44] ? __pfx_generic_perform_write+0x10/0x10
[ 165.721257][ T44] ? __mark_inode_dirty+0x4e7/0x13b0
[ 165.721285][ T44] ? preempt_count_add+0x91/0x190
[ 165.721308][ T44] ? mnt_put_write_access_file+0xbf/0x100
[ 165.721331][ T44] ? file_update_time_flags+0x406/0x4b0
[ 165.721353][ T44] shmem_file_write_iter+0xfb/0x120
[ 165.721400][ T44] lo_rw_aio+0xdcf/0x1080
[ 165.721429][ T44] ? __pfx_lo_rw_aio+0x10/0x10
[ 165.721453][ T44] ? kthread_associate_blkcg+0x490/0x600
[ 165.721477][ T44] ? rt_spin_unlock+0x160/0x200
[ 165.721500][ T44] loop_process_work+0x638/0x11d0
[ 165.721529][ T44] ? __pfx_loop_process_work+0x10/0x10
[ 165.721549][ T44] ? __lock_acquire+0x683/0x2cc0
[ 165.721571][ T44] ? look_up_lock_class+0x57/0x110
[ 165.721597][ T44] ? register_lock_class+0x31/0x2e0
[ 165.721622][ T44] ? __lock_acquire+0x683/0x2cc0
[ 165.721645][ T44] ? timerqueue_linked_add+0x287/0x2e0
[ 165.721668][ T44] ? do_raw_spin_lock+0x12b/0x2f0
[ 165.721686][ T44] ? lock_acquire+0x106/0x350
[ 165.721709][ T44] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 165.721730][ T44] ? process_scheduled_works+0xa20/0x14e0
[ 165.721750][ T44] ? process_scheduled_works+0xa20/0x14e0
[ 165.721770][ T44] ? rcu_is_watching+0x15/0xb0
[ 165.721795][ T44] ? process_scheduled_works+0xa20/0x14e0
[ 165.721813][ T44] process_scheduled_works+0xa8e/0x14e0
[ 165.721843][ T44] ? __pfx_process_scheduled_works+0x10/0x10
[ 165.721864][ T44] ? assign_work+0x3cf/0x5d0
[ 165.721883][ T44] worker_thread+0xa47/0xfb0
[ 165.721908][ T44] ? __kthread_parkme+0x71/0x1f0
[ 165.721932][ T44] kthread+0x388/0x470
[ 165.721954][ T44] ? __pfx_worker_thread+0x10/0x10
[ 165.721972][ T44] ? __pfx_kthread+0x10/0x10
[ 165.721994][ T44] ret_from_fork+0x514/0xb70
[ 165.722016][ T44] ? __pfx_ret_from_fork+0x10/0x10
[ 165.722035][ T44] ? __switch_to+0xc89/0x1420
[ 165.722062][ T44] ? __pfx_kthread+0x10/0x10
[ 165.722085][ T44] ret_from_fork_asm+0x1a/0x30
[ 165.722114][ T44]
[ 165.722149][ T44]
[ 165.722154][ T44] The buggy address belongs to the physical page:
[ 165.722217][ T44] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xf00 pfn:0x34f86
[ 165.722240][ T44] flags: 0x80000000000000(node=0|zone=1)
[ 165.722296][ T44] raw: 0080000000000000 ffffea0000fa97c8 ffffea000133eec8 0000000000000000
[ 165.722312][ T44] raw: 0000000000000f00 0000000000000000 00000000ffffffff 0000000000000000
[ 165.722321][ T44] page dumped because: kasan: bad access detected
[ 165.722362][ T44] page_owner tracks the page as freed
[ 165.722369][ T44] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xdc0(GFP_KERNEL|__GFP_ZERO), pid 6039, tgid 6039 (syz.0.89), ts 165643208835, free_ts 165718584322
[ 165.722399][ T44] post_alloc_hook+0x22d/0x280
[ 165.722421][ T44] get_page_from_freelist+0x2877/0x28f0
[ 165.722447][ T44] __alloc_frozen_pages_noprof+0x18d/0x380
[ 165.722468][ T44] alloc_pages_mpol+0xce/0x280
[ 165.722489][ T44] alloc_pages_noprof+0xd2/0x2f0
[ 165.722509][ T44] lmLogInit+0x357/0x1a20
[ 165.722532][ T44] lmLogOpen+0x4e3/0xf90
[ 165.722553][ T44] jfs_mount_rw+0xf3/0x670
[ 165.722574][ T44] jfs_fill_super+0x772/0xd90
[ 165.722591][ T44] get_tree_bdev_flags+0x430/0x4f0
[ 165.722610][ T44] vfs_get_tree+0x92/0x2a0
[ 165.722629][ T44] do_new_mount+0x319/0xdc0
[ 165.722651][ T44] __se_sys_mount+0x31d/0x420
[ 165.722675][ T44] do_syscall_64+0x174/0x580
[ 165.722698][ T44] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 165.722715][ T44] page last free pid 5807 tgid 5807 stack trace:
[ 165.722725][ T44] __free_frozen_pages+0x1019/0x1100
[ 165.722743][ T44] lmLogShutdown+0x44e/0x850
[ 165.722765][ T44] lmLogClose+0x28c/0x530
[ 165.722787][ T44] jfs_umount+0x2da/0x3b0
[ 165.722807][ T44] jfs_put_super+0x8c/0x190
[ 165.722824][ T44] generic_shutdown_super+0x13d/0x2d0
[ 165.722840][ T44] kill_block_super+0x44/0x90
[ 165.722858][ T44] deactivate_locked_super+0xbc/0x130
[ 165.722874][ T44] cleanup_mnt+0x3d3/0x460
[ 165.722890][ T44] task_work_run+0x1d9/0x270
[ 165.722912][ T44] exit_to_user_mode_loop+0x193/0x6b0
[ 165.722932][ T44] do_syscall_64+0x353/0x580
[ 165.722954][ T44] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 165.722970][ T44]
[ 165.722974][ T44] Memory state around the buggy address:
[ 165.722989][ T44] ffff888034f85f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 165.723001][ T44] ffff888034f85f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 165.723012][ T44] >ffff888034f86000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 165.723021][ T44] ^
[ 165.723062][ T44] ffff888034f86080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 165.723074][ T44] ffff888034f86100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 165.723082][ T44] ==================================================================
[ 165.732938][ T44] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 165.732960][ T44] CPU: 0 UID: 0 PID: 44 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
[ 165.733007][ T44] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
[ 165.733020][ T44] Workqueue: loop0 loop_workfn
[ 165.733047][ T44] Call Trace:
[ 165.733054][ T44]
[ 165.733064][ T44] vpanic+0x56c/0xa60
[ 165.733088][ T44] ? rcu_is_watching+0x15/0xb0
[ 165.733113][ T44] ? __pfx_vpanic+0x10/0x10
[ 165.733136][ T44] panic+0xc5/0xd0
[ 165.733152][ T44] ? __pfx_panic+0x10/0x10
[ 165.733179][ T44] ? preempt_schedule_thunk+0x16/0x30
[ 165.733207][ T44] ? copy_folio_from_iter_atomic+0xbbf/0x1a30
[ 165.733232][ T44] ? preempt_schedule_thunk+0x16/0x30
[ 165.733256][ T44] ? copy_folio_from_iter_atomic+0xbbf/0x1a30
[ 165.733321][ T44] check_panic_on_warn+0x89/0xb0
[ 165.733351][ T44] ? copy_folio_from_iter_atomic+0xbbf/0x1a30
[ 165.733375][ T44] end_report+0x73/0x170
[ 165.733396][ T44] ? copy_folio_from_iter_atomic+0xbbf/0x1a30
[ 165.733419][ T44] kasan_report+0x128/0x150
[ 165.733440][ T44] ? copy_folio_from_iter_atomic+0xbbf/0x1a30
[ 165.733467][ T44] kasan_check_range+0x264/0x2c0
[ 165.733488][ T44] ? copy_folio_from_iter_atomic+0xbbf/0x1a30
[ 165.733513][ T44] __asan_memcpy+0x29/0x70
[ 165.733529][ T44] copy_folio_from_iter_atomic+0xbbf/0x1a30
[ 165.733562][ T44] ? __pfx_copy_folio_from_iter_atomic+0x10/0x10
[ 165.733587][ T44] ? rcu_is_watching+0x15/0xb0
[ 165.733612][ T44] ? shmem_write_begin+0x1ce/0x320
[ 165.733635][ T44] generic_perform_write+0x5a8/0x8b0
[ 165.733661][ T44] ? __pfx_generic_perform_write+0x10/0x10
[ 165.733682][ T44] ? __mark_inode_dirty+0x4e7/0x13b0
[ 165.733703][ T44] ? preempt_count_add+0x91/0x190
[ 165.733722][ T44] ? mnt_put_write_access_file+0xbf/0x100
[ 165.733745][ T44] ? file_update_time_flags+0x406/0x4b0
[ 165.733766][ T44] shmem_file_write_iter+0xfb/0x120
[ 165.733791][ T44] lo_rw_aio+0xdcf/0x1080
[ 165.733817][ T44] ? __pfx_lo_rw_aio+0x10/0x10
[ 165.733840][ T44] ? kthread_associate_blkcg+0x490/0x600
[ 165.733863][ T44] ? rt_spin_unlock+0x160/0x200
[ 165.733884][ T44] loop_process_work+0x638/0x11d0
[ 165.733912][ T44] ? __pfx_loop_process_work+0x10/0x10
[ 165.733932][ T44] ? __lock_acquire+0x683/0x2cc0
[ 165.733953][ T44] ? look_up_lock_class+0x57/0x110
[ 165.733977][ T44] ? register_lock_class+0x31/0x2e0
[ 165.734001][ T44] ? __lock_acquire+0x683/0x2cc0
[ 165.734023][ T44] ? timerqueue_linked_add+0x287/0x2e0
[ 165.734045][ T44] ? do_raw_spin_lock+0x12b/0x2f0
[ 165.734063][ T44] ? lock_acquire+0x106/0x350
[ 165.734084][ T44] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 165.734104][ T44] ? process_scheduled_works+0xa20/0x14e0
[ 165.734123][ T44] ? process_scheduled_works+0xa20/0x14e0
[ 165.734142][ T44] ? rcu_is_watching+0x15/0xb0
[ 165.734167][ T44] ? process_scheduled_works+0xa20/0x14e0
[ 165.734184][ T44] process_scheduled_works+0xa8e/0x14e0
[ 165.734213][ T44] ? __pfx_process_scheduled_works+0x10/0x10
[ 165.734233][ T44] ? assign_work+0x3cf/0x5d0
[ 165.734252][ T44] worker_thread+0xa47/0xfb0
[ 165.734286][ T44] ? __kthread_parkme+0x71/0x1f0
[ 165.734308][ T44] kthread+0x388/0x470
[ 165.734330][ T44] ? __pfx_worker_thread+0x10/0x10
[ 165.734347][ T44] ? __pfx_kthread+0x10/0x10
[ 165.734369][ T44] ret_from_fork+0x514/0xb70
[ 165.734390][ T44] ? __pfx_ret_from_fork+0x10/0x10
[ 165.734407][ T44] ? __switch_to+0xc89/0x1420
[ 165.734434][ T44] ? __pfx_kthread+0x10/0x10
[ 165.734456][ T44] ret_from_fork_asm+0x1a/0x30
[ 165.734484][ T44]
[ 165.734911][ T44] Kernel Offset: disabled