./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3458377981

<...>
Warning: Permanently added '10.128.1.101' (ED25519) to the list of known hosts.
execve("./syz-executor3458377981", ["./syz-executor3458377981"], 0x7ffe0abd77e0 /* 10 vars */) = 0
brk(NULL)                               = 0x5555663ca000
brk(0x5555663cad00)                     = 0x5555663cad00
arch_prctl(ARCH_SET_FS, 0x5555663ca380) = 0
set_tid_address(0x5555663ca650)         = 5838
set_robust_list(0x5555663ca660, 24)     = 0
rseq(0x5555663caca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor3458377981", 4096) = 28
getrandom("\x68\x25\xc6\xd2\x6e\x59\xf7\x07", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x5555663cad00
brk(0x5555663ebd00)                     = 0x5555663ebd00
brk(0x5555663ec000)                     = 0x5555663ec000
mprotect(0x7fc4572e1000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
mkdir("/syzcgroup", 0777)               = 0
mkdir("/syzcgroup/unified", 0777)       = 0
mount("none", "/syzcgroup/unified", "cgroup2", 0, NULL) = 0
chmod("/syzcgroup/unified", 0777)       = 0
openat(AT_FDCWD, "/syzcgroup/unified/cgroup.subtree_control", O_WRONLY) = 3
write(3, "+cpu", 4)                     = 4
write(3, "+io", 3)                      = 3
write(3, "+pids", 5)                    = 5
close(3)                                = 0
mkdir("/syzcgroup/net", 0777)           = 0
mount("none", "/syzcgroup/net", "cgroup", 0, "net") = -1 EINVAL (Invalid argument)
mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio") = 0
umount2("/syzcgroup/net", 0)            = 0
mount("none", "/syzcgroup/net", "cgroup", 0, "devices") = 0
umount2("/syzcgroup/net", 0)            = 0
mount("none", "/syzcgroup/net", "cgroup", 0, "blkio") = 0
umount2("/syzcgroup/net", 0)            = 0
mount("none", "/syzcgroup/net", "cgroup", 0, "freezer") = 0
umount2("/syzcgroup/net", 0)            = 0
mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted)
[   62.545492][ T5838] cgroup: Unknown subsys name 'net'
mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = 0
chmod("/syzcgroup/net", 0777)           = 0
mkdir("/syzcgroup/cpu", 0777)           = 0
mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset") = -1 EINVAL (Invalid argument)
mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct") = 0
umount2("/syzcgroup/cpu", 0)            = 0
mount("none", "/syzcgroup/cpu", "cgroup", 0, "hugetlb") = 0
umount2("/syzcgroup/cpu", 0)            = 0
mount("none", "/syzcgroup/cpu", "cgroup", 0, "rlimit") = -1 EINVAL (Invalid argument)
mount("none", "/syzcgroup/cpu", "cgroup", 0, "memory") = 0
umount2("/syzcgroup/cpu", 0)            = 0
mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted)
[   62.690540][ T5838] cgroup: Unknown subsys name 'cpuset'
[   62.703005][ T5838] cgroup: Unknown subsys name 'rlimit'
mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = 0
chmod("/syzcgroup/cpu", 0777)           = 0
openat(AT_FDCWD, "/syzcgroup/cpu/cgroup.clone_children", O_WRONLY|O_CLOEXEC) = 3
write(3, "1", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/syzcgroup/cpu/cpuset.memory_pressure_enabled", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
mkdir("./syzkaller.2IsO2L", 0700)       = 0
chmod("./syzkaller.2IsO2L", 0777)       = 0
chdir("./syzkaller.2IsO2L")             = 0
unshare(CLONE_NEWPID)                   = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5839 attached
, child_tidptr=0x5555663ca650) = 5839
[pid  5839] set_robust_list(0x5555663ca660, 24) = 0
[pid  5839] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5839] getppid()                   = 0
[pid  5839] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0
[pid  5839] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid  5839] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid  5839] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0
[pid  5839] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid  5839] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid  5839] unshare(CLONE_NEWNS)        = 0
[pid  5839] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
[pid  5839] unshare(CLONE_NEWIPC)       = 0
[pid  5839] unshare(CLONE_NEWCGROUP)    = 0
[pid  5839] unshare(CLONE_NEWUTS)       = 0
[pid  5839] unshare(CLONE_SYSVSEM)      = 0
[pid  5839] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3
[pid  5839] write(3, "16777216", 8)     = 8
[pid  5839] close(3)                    = 0
[pid  5839] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3
[pid  5839] write(3, "536870912", 9)    = 9
[pid  5839] close(3)                    = 0
[pid  5839] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3
[pid  5839] write(3, "1024", 4)         = 4
[pid  5839] close(3)                    = 0
[pid  5839] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3
[pid  5839] write(3, "8192", 4)         = 4
[pid  5839] close(3)                    = 0
[pid  5839] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3
[pid  5839] write(3, "1024", 4)         = 4
[pid  5839] close(3)                    = 0
[pid  5839] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3
[pid  5839] write(3, "1024", 4)         = 4
[pid  5839] close(3)                    = 0
[pid  5839] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3
[pid  5839] write(3, "1024 1048576 500 1024", 21) = 21
[pid  5839] close(3)                    = 0
[pid  5839] getpid()                    = 1
[pid  5839] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  5839] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  5839] unshare(CLONE_NEWNET)       = 0
[pid  5839] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3
[pid  5839] write(3, "0 65535", 7)      = 7
[pid  5839] close(3)                    = 0
[pid  5839] openat(AT_FDCWD, "/dev/net/tun", O_RDWR|O_NONBLOCK) = 3
[pid  5839] dup2(3, 200)                = 200
[pid  5839] close(3)                    = 0
[pid  5839] ioctl(200, TUNSETIFF, 0x7ffd22484370) = 0
[pid  5839] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/accept_dad", O_WRONLY|O_CLOEXEC) = 3
[pid  5839] write(3, "0", 1)            = 1
[pid  5839] close(3)                    = 0
[pid  5839] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/router_solicitations", O_WRONLY|O_CLOEXEC) = 3
[pid  5839] write(3, "0", 1)            = 1
[pid  5839] close(3)                    = 0
[pid  5839] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3
[pid  5839] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid  5839] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid  5839] close(4)                    = 0
[pid  5839] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x0b\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\xaa\x08\x00\x01\x00\xac\x14\x14\xaa"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 40
[pid  5839] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid  5839] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid  5839] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid  5839] close(4)                    = 0
[pid  5839] sendto(3, [{nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x78\x00\x00\x0b\x00\x00\x00\x14\x00\x02\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 64
[pid  5839] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid  5839] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid  5839] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid  5839] close(4)                    = 0
[pid  5839] sendto(3, [{nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x08\x00\x01\x00\xac\x14\x14\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 48
[pid  5839] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid  5839] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid  5839] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid  5839] close(4)                    = 0
[pid  5839] sendto(3, [{nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 60, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 60
[pid  5839] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid  5839] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid  5839] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid  5839] close(4)                    = 0
[pid  5839] sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0a\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\xaa\x00\x00"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44
[pid  5839] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid  5839] close(3)                    = 0
[pid  5839] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3
[pid  5839] write(3, "100000", 6)       = 6
[pid  5839] close(3)                    = 0
[pid  5839] mkdir("./syz-tmp", 0777)    = 0
[pid  5839] mount("", "./syz-tmp", "tmpfs", 0, NULL) = 0
[pid  5839] mkdir("./syz-tmp/newroot", 0777) = 0
[pid  5839] mkdir("./syz-tmp/newroot/dev", 0700) = 0
[pid  5839] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid  5839] mkdir("./syz-tmp/newroot/proc", 0700) = 0
[pid  5839] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL) = 0
[pid  5839] mkdir("./syz-tmp/newroot/selinux", 0700) = 0
[pid  5839] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory)
[pid  5839] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory)
[pid  5839] mkdir("./syz-tmp/newroot/sys", 0700) = 0
[pid  5839] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid  5839] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid  5839] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid  5839] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid  5839] mkdir("./syz-tmp/newroot/syzcgroup", 0700) = 0
[pid  5839] mkdir("./syz-tmp/newroot/syzcgroup/unified", 0700) = 0
[pid  5839] mkdir("./syz-tmp/newroot/syzcgroup/cpu", 0700) = 0
[pid  5839] mkdir("./syz-tmp/newroot/syzcgroup/net", 0700) = 0
[pid  5839] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid  5839] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid  5839] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid  5839] mkdir("./syz-tmp/pivot", 0777) = 0
[pid  5839] pivot_root("./syz-tmp", "./syz-tmp/pivot") = 0
[pid  5839] chdir("/")                  = 0
[pid  5839] umount2("./pivot", MNT_DETACH) = 0
[pid  5839] chroot("./newroot")         = 0
[pid  5839] chdir("/")                  = 0
[pid  5839] mkdir("/dev/binderfs", 0777) = 0
[pid  5839] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0
[pid  5839] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy)
[pid  5839] getpid()                    = 1
[pid  5839] mkdir("/syzcgroup/unified/syz0", 0777) = 0
[pid  5839] openat(AT_FDCWD, "/syzcgroup/unified/syz0/pids.max", O_WRONLY|O_CLOEXEC) = 3
[pid  5839] write(3, "32", 2)           = 2
[pid  5839] close(3)                    = 0
[pid  5839] openat(AT_FDCWD, "/syzcgroup/unified/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC) = 3
[pid  5839] write(3, "1", 1)            = 1
[pid  5839] close(3)                    = 0
[pid  5839] mkdir("/syzcgroup/cpu/syz0", 0777) = 0
[pid  5839] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC) = 3
[pid  5839] write(3, "1", 1)            = 1
[pid  5839] close(3)                    = 0
[pid  5839] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC) = 3
[pid  5839] write(3, "313524224", 9)    = 9
[pid  5839] close(3)                    = 0
[pid  5839] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC) = 3
[pid  5839] write(3, "314572800", 9)    = 9
[pid  5839] close(3)                    = 0
[pid  5839] mkdir("/syzcgroup/net/syz0", 0777) = 0
[pid  5839] openat(AT_FDCWD, "/syzcgroup/net/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC) = 3
[pid  5839] write(3, "1", 1)            = 1
[pid  5839] close(3)                    = 0
[pid  5839] mkdir("./0", 0777)          = 0
[pid  5839] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
[pid  5839] ioctl(3, LOOP_CLR_FD)       = -1 ENXIO (No such device or address)
[pid  5839] close(3)                    = 0
[pid  5839] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555663ca650) = 2
./strace-static-x86_64: Process 5842 attached
[pid  5842] set_robust_list(0x5555663ca660, 24) = 0
[pid  5842] chdir("./0")                = 0
[pid  5842] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5842] setpgid(0, 0)               = 0
[pid  5842] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0
[pid  5842] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0
[pid  5842] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0
[pid  5842] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[   63.873254][ T5839] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[pid  5842] write(3, "1000", 4)         = 4
[pid  5842] close(3)                    = 0
[pid  5842] read(200, "\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110
[pid  5842] read(200, 0x7ffd22483ca0, 1000) = -1 EAGAIN (Resource temporarily unavailable)
[pid  5842] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5842] write(1, "executing program\n", 18executing program
) = 18
[pid  5842] memfd_create("syzkaller", 0) = 3
[pid  5842] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc44ee00000
[pid  5842] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
[pid  5842] munmap(0x7fc44ee00000, 138412032) = 0
[pid  5842] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5842] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5842] close(3)                    = 0
[pid  5842] close(4)                    = 0
[pid  5842] mkdir("./file1", 0777)      = 0
[   64.095793][ T5842] loop0: detected capacity change from 0 to 32768
[   64.185086][ T5842] bcachefs (loop0): starting version 1.7: mi_btree_bitmap opts=errors=continue,metadata_checksum=none,data_checksum=none,compression=lz4,nojournal_transaction_names
[   64.202011][ T5842] bcachefs (loop0): recovering from clean shutdown, journal seq 10
[   64.210327][ T5842] bcachefs (loop0): Version upgrade required:
[   64.210327][ T5842] Version upgrade from 0.24: unwritten_extents to 1.7: mi_btree_bitmap incomplete
[   64.210327][ T5842] Doing incompatible version upgrade from 0.24: unwritten_extents to 1.13: inode_has_child_snapshots
[   64.210327][ T5842]   running recovery passes: check_allocations,check_alloc_info,check_lrus,check_btree_backpointers,check_backpointers_to_extents,check_extents_to_backpointers,check_alloc_to_lru_refs,bucket_gens_init,check_snapshot_trees,check_snapshots,check_subvols,check_subvol_children,delete_dead_snapshots,check_inodes,check_extents,check_indirect_extents,check_dirents,check_xattrs,check_root,check_unreachable_inodes,check_subvolume_structure,check_directory_structure,check_nlinks,set_fs_needs_rebalance
[   64.288073][ T5842] bcachefs (loop0): error validating btree node on loop0 at btree dirents level 0/0
[   64.288102][ T5842]   u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 9aa2895aefce4bdf written 24 min_key POS_MIN durability: 1 ptr: 0:41:0 gen 0  
[   64.288116][ T5842]   node offset 16/24: btree node data missing: expected 24 sectors, found 16, fixing
[   64.321906][ T5842] bcachefs (loop0): btree_node_read_work: rewriting btree node at btree=dirents level=0 SPOS_MAX due to error
[   64.335498][ T5842] bcachefs (loop0): error validating btree node at btree alloc level 0/0
[   64.335511][ T5842]   u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ac62141f8dc7e261 written 24 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0  
[   64.335519][ T5842]   node offset 8/24 bset u64s 375 bset byte offset 184: keys out of order: u64s 11 type alloc_v4 0:32:0 len 0 ver 0 > u64s 11 type alloc_v4 0:2:0 len 0 ver 0, fixing
[   64.374811][ T5842] bcachefs (loop0): btree_node_read_work: rewriting btree node at btree=alloc level=0 SPOS_MAX due to error
[   64.389381][ T5842] ==================================================================
[   64.397467][ T5842] BUG: KASAN: use-after-free in bch2_btree_node_read_done+0xfbe/0x5e90
[   64.405757][ T5842] Read of size 8 at addr ffff888076abc010 by task syz-executor345/5842
[   64.413977][ T5842] 
[   64.416305][ T5842] CPU: 1 UID: 0 PID: 5842 Comm: syz-executor345 Not tainted 6.12.0-syzkaller-08446-g228a1157fb9f #0
[   64.427042][ T5842] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[   64.437097][ T5842] Call Trace:
[   64.440385][ T5842]  <TASK>
[   64.443320][ T5842]  dump_stack_lvl+0x241/0x360
[   64.448000][ T5842]  ? __pfx_dump_stack_lvl+0x10/0x10
[   64.453188][ T5842]  ? __pfx__printk+0x10/0x10
[   64.457765][ T5842]  ? _printk+0xd5/0x120
[   64.461905][ T5842]  ? __virt_addr_valid+0x183/0x530
[   64.467020][ T5842]  ? __virt_addr_valid+0x183/0x530
[   64.472136][ T5842]  print_report+0x169/0x550
[   64.476641][ T5842]  ? __virt_addr_valid+0x183/0x530
[   64.481745][ T5842]  ? __virt_addr_valid+0x183/0x530
[   64.486850][ T5842]  ? __virt_addr_valid+0x45f/0x530
[   64.491947][ T5842]  ? __phys_addr+0xba/0x170
[   64.496435][ T5842]  ? bch2_btree_node_read_done+0xfbe/0x5e90
[   64.502329][ T5842]  kasan_report+0x143/0x180
[   64.506840][ T5842]  ? bch2_btree_node_read_done+0xfbe/0x5e90
[   64.512758][ T5842]  bch2_btree_node_read_done+0xfbe/0x5e90
[   64.518500][ T5842]  ? bch2_bkey_pick_read_device+0x221/0x1670
[   64.524486][ T5842]  ? __pfx_bch2_btree_node_read_done+0x10/0x10
[   64.530628][ T5842]  ? bch2_bkey_pick_read_device+0x137d/0x1670
[   64.536684][ T5842]  ? bch2_bkey_pick_read_device+0x221/0x1670
[   64.542678][ T5842]  ? __pfx_bch2_bkey_pick_read_device+0x10/0x10
[   64.548902][ T5842]  ? bch2_btree_ptr_v2_to_text+0x209/0x2f0
[   64.554698][ T5842]  ? __pfx_bch2_btree_ptr_v2_to_text+0x10/0x10
[   64.560839][ T5842]  btree_node_read_work+0x68b/0x1260
[   64.566132][ T5842]  ? __pfx_btree_node_read_work+0x10/0x10
[   64.571836][ T5842]  ? __bch2_time_stats_update+0x2c0/0x370
[   64.577550][ T5842]  ? __pfx_bch2_latency_acct+0x10/0x10
[   64.582991][ T5842]  ? bio_associate_blkg+0x6c/0x230
[   64.588092][ T5842]  bch2_btree_node_read+0x2433/0x2a10
[   64.593450][ T5842]  ? __pfx_lock_release+0x10/0x10
[   64.598459][ T5842]  ? bch2_trans_unlock+0x346/0x470
[   64.603557][ T5842]  ? __pfx_bch2_btree_node_read+0x10/0x10
[   64.609258][ T5842]  ? __pfx___bch2_btree_node_hash_insert+0x10/0x10
[   64.615747][ T5842]  ? bch2_trans_unlock+0x3a6/0x470
[   64.620847][ T5842]  bch2_btree_root_read+0x617/0x7a0
[   64.626032][ T5842]  ? __pfx_bch2_btree_root_read+0x10/0x10
[   64.631757][ T5842]  ? bch2_current_has_btree_trans+0x142/0x180
[   64.637807][ T5842]  read_btree_roots+0x296/0x840
[   64.642649][ T5842]  bch2_fs_recovery+0x2585/0x39d0
[   64.647659][ T5842]  ? __pfx_bch2_fs_recovery+0x10/0x10
[   64.653020][ T5842]  ? __pfx_lock_release+0x10/0x10
[   64.658029][ T5842]  ? bch2_get_next_online_dev+0x2b/0x4f0
[   64.663647][ T5842]  ? __pfx_lock_release+0x10/0x10
[   64.668652][ T5842]  ? bch2_get_next_online_dev+0x2b/0x4f0
[   64.674289][ T5842]  ? bch2_get_next_online_dev+0x4b9/0x4f0
[   64.679995][ T5842]  ? bch2_get_next_online_dev+0x2b/0x4f0
[   64.685621][ T5842]  ? llist_reverse_order+0x72/0x90
[   64.690717][ T5842]  bch2_fs_start+0x356/0x5b0
[   64.695297][ T5842]  bch2_fs_get_tree+0xd68/0x1710
[   64.700227][ T5842]  ? __pfx_bch2_fs_get_tree+0x10/0x10
[   64.705586][ T5842]  ? generic_parse_monolithic+0x387/0x400
[   64.711298][ T5842]  ? __pfx_vfs_parse_fs_string+0x10/0x10
[   64.716933][ T5842]  ? cap_capable+0x1b4/0x250
[   64.721505][ T5842]  ? safesetid_security_capable+0xb2/0x1d0
[   64.727295][ T5842]  vfs_get_tree+0x90/0x2b0
[   64.731719][ T5842]  do_new_mount+0x2be/0xb40
[   64.736228][ T5842]  ? __pfx_do_new_mount+0x10/0x10
[   64.741266][ T5842]  __se_sys_mount+0x2d6/0x3c0
[   64.745969][ T5842]  ? __pfx___se_sys_mount+0x10/0x10
[   64.751164][ T5842]  ? do_syscall_64+0x100/0x230
[   64.755940][ T5842]  ? __x64_sys_mount+0x20/0xc0
[   64.760701][ T5842]  do_syscall_64+0xf3/0x230
[   64.765197][ T5842]  ? clear_bhb_loop+0x35/0x90
[   64.769863][ T5842]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   64.775744][ T5842] RIP: 0033:0x7fc4572667ea
[   64.780149][ T5842] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 3e 06 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   64.799746][ T5842] RSP: 002b:00007ffd22484098 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
[   64.808146][ T5842] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc4572667ea
[   64.816103][ T5842] RDX: 00000000200000c0 RSI: 0000000020000180 RDI: 00007ffd224840f0
[   64.824081][ T5842] RBP: 0000000000000004 R08: 00007ffd22484130 R09: 000000000000593e
[   64.832068][ T5842] R10: 0000000000000010 R11: 0000000000000282 R12: 00007ffd22484130
[   64.840046][ T5842] R13: 0000000001000000 R14: 0000000000000003 R15: 0000000000000010
[   64.848016][ T5842]  </TASK>
[   64.851032][ T5842] 
[   64.853344][ T5842] The buggy address belongs to the physical page:
[   64.859759][ T5842] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x76abc
[   64.868518][ T5842] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[   64.875617][ T5842] raw: 00fff00000000000 ffffea0001ca0108 ffff8880b87447e0 0000000000000000
[   64.884183][ T5842] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   64.892753][ T5842] page dumped because: kasan: bad access detected
[   64.899153][ T5842] page_owner tracks the page as freed
[   64.904518][ T5842] page last allocated via order 2, migratetype Reclaimable, gfp_mask 0x452cd0(GFP_KERNEL_ACCOUNT|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_RECLAIMABLE), pid 5842, tgid 5842 (syz-executor345), ts 64163821991, free_ts 64389007908
[   64.926569][ T5842]  post_alloc_hook+0x1f3/0x230
[   64.931352][ T5842]  get_page_from_freelist+0x363e/0x3790
[   64.936919][ T5842]  __alloc_pages_noprof+0x292/0x710
[   64.942105][ T5842]  ___kmalloc_large_node+0x8b/0x1d0
[   64.947287][ T5842]  __kmalloc_large_node_noprof+0x1a/0x80
[   64.952903][ T5842]  __kmalloc_node_noprof+0x2d2/0x440
[   64.958169][ T5842]  __kvmalloc_node_noprof+0x72/0x190
[   64.963440][ T5842]  btree_node_data_alloc+0xdb/0x260
[   64.968626][ T5842]  __bch2_btree_node_mem_alloc+0x1d8/0x3e0
[   64.974415][ T5842]  bch2_fs_btree_cache_init+0x26f/0x630
[   64.980035][ T5842]  bch2_fs_open+0x2aa4/0x2f80
[   64.984696][ T5842]  bch2_fs_get_tree+0x738/0x1710
[   64.989616][ T5842]  vfs_get_tree+0x90/0x2b0
[   64.994019][ T5842]  do_new_mount+0x2be/0xb40
[   64.998530][ T5842]  __se_sys_mount+0x2d6/0x3c0
[   65.003192][ T5842]  do_syscall_64+0xf3/0x230
[   65.007685][ T5842] page last free pid 5842 tgid 5842 stack trace:
[   65.014081][ T5842]  free_unref_page+0xded/0x1130
[   65.018916][ T5842]  __folio_put+0x2c7/0x440
[   65.023318][ T5842]  free_large_kmalloc+0x105/0x1c0
[   65.028326][ T5842]  kfree+0x21c/0x440
[   65.032213][ T5842]  bch2_btree_node_read_done+0x3c8a/0x5e90
[   65.038007][ T5842]  btree_node_read_work+0x68b/0x1260
[   65.043283][ T5842]  bch2_btree_node_read+0x2433/0x2a10
[   65.048639][ T5842]  bch2_btree_root_read+0x617/0x7a0
[   65.053840][ T5842]  read_btree_roots+0x296/0x840
[   65.058688][ T5842]  bch2_fs_recovery+0x2585/0x39d0
[   65.063693][ T5842]  bch2_fs_start+0x356/0x5b0
[   65.068264][ T5842]  bch2_fs_get_tree+0xd68/0x1710
[   65.073185][ T5842]  vfs_get_tree+0x90/0x2b0
[   65.077605][ T5842]  do_new_mount+0x2be/0xb40
[   65.082108][ T5842]  __se_sys_mount+0x2d6/0x3c0
[   65.086774][ T5842]  do_syscall_64+0xf3/0x230
[   65.091284][ T5842] 
[   65.093588][ T5842] Memory state around the buggy address:
[   65.099218][ T5842]  ffff888076abbf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   65.107280][ T5842]  ffff888076abbf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   65.115323][ T5842] >ffff888076abc000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   65.123381][ T5842]                          ^
[   65.127993][ T5842]  ffff888076abc080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   65.136050][ T5842]  ffff888076abc100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   65.144095][ T5842] ==================================================================
[   65.152851][ T5842] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   65.160066][ T5842] CPU: 1 UID: 0 PID: 5842 Comm: syz-executor345 Not tainted 6.12.0-syzkaller-08446-g228a1157fb9f #0
[   65.170910][ T5842] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[   65.180961][ T5842] Call Trace:
[   65.184232][ T5842]  <TASK>
[   65.187155][ T5842]  dump_stack_lvl+0x241/0x360
[   65.191831][ T5842]  ? __pfx_dump_stack_lvl+0x10/0x10
[   65.197020][ T5842]  ? __pfx__printk+0x10/0x10
[   65.201599][ T5842]  ? preempt_schedule+0xe1/0xf0
[   65.206446][ T5842]  ? vscnprintf+0x5d/0x90
[   65.210771][ T5842]  panic+0x349/0x880
[   65.214657][ T5842]  ? check_panic_on_warn+0x21/0xb0
[   65.219761][ T5842]  ? __pfx_panic+0x10/0x10
[   65.224170][ T5842]  ? _raw_spin_unlock_irqrestore+0x130/0x140
[   65.230152][ T5842]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   65.236471][ T5842]  ? print_report+0x502/0x550
[   65.241145][ T5842]  check_panic_on_warn+0x86/0xb0
[   65.246074][ T5842]  ? bch2_btree_node_read_done+0xfbe/0x5e90
[   65.251962][ T5842]  end_report+0x77/0x160
[   65.256203][ T5842]  kasan_report+0x154/0x180
[   65.260698][ T5842]  ? bch2_btree_node_read_done+0xfbe/0x5e90
[   65.266584][ T5842]  bch2_btree_node_read_done+0xfbe/0x5e90
[   65.272311][ T5842]  ? bch2_bkey_pick_read_device+0x221/0x1670
[   65.278289][ T5842]  ? __pfx_bch2_btree_node_read_done+0x10/0x10
[   65.284441][ T5842]  ? bch2_bkey_pick_read_device+0x137d/0x1670
[   65.290501][ T5842]  ? bch2_bkey_pick_read_device+0x221/0x1670
[   65.296476][ T5842]  ? __pfx_bch2_bkey_pick_read_device+0x10/0x10
[   65.302725][ T5842]  ? bch2_btree_ptr_v2_to_text+0x209/0x2f0
[   65.308553][ T5842]  ? __pfx_bch2_btree_ptr_v2_to_text+0x10/0x10
[   65.314715][ T5842]  btree_node_read_work+0x68b/0x1260
[   65.320002][ T5842]  ? __pfx_btree_node_read_work+0x10/0x10
[   65.325713][ T5842]  ? __bch2_time_stats_update+0x2c0/0x370
[   65.331430][ T5842]  ? __pfx_bch2_latency_acct+0x10/0x10
[   65.336881][ T5842]  ? bio_associate_blkg+0x6c/0x230
[   65.341985][ T5842]  bch2_btree_node_read+0x2433/0x2a10
[   65.347357][ T5842]  ? __pfx_lock_release+0x10/0x10
[   65.352380][ T5842]  ? bch2_trans_unlock+0x346/0x470
[   65.357490][ T5842]  ? __pfx_bch2_btree_node_read+0x10/0x10
[   65.363220][ T5842]  ? __pfx___bch2_btree_node_hash_insert+0x10/0x10
[   65.369721][ T5842]  ? bch2_trans_unlock+0x3a6/0x470
[   65.374828][ T5842]  bch2_btree_root_read+0x617/0x7a0
[   65.380019][ T5842]  ? __pfx_bch2_btree_root_read+0x10/0x10
[   65.385733][ T5842]  ? bch2_current_has_btree_trans+0x142/0x180
[   65.391791][ T5842]  read_btree_roots+0x296/0x840
[   65.396635][ T5842]  bch2_fs_recovery+0x2585/0x39d0
[   65.401656][ T5842]  ? __pfx_bch2_fs_recovery+0x10/0x10
[   65.407025][ T5842]  ? __pfx_lock_release+0x10/0x10
[   65.412041][ T5842]  ? bch2_get_next_online_dev+0x2b/0x4f0
[   65.417664][ T5842]  ? __pfx_lock_release+0x10/0x10
[   65.422680][ T5842]  ? bch2_get_next_online_dev+0x2b/0x4f0
[   65.428303][ T5842]  ? bch2_get_next_online_dev+0x4b9/0x4f0
[   65.434018][ T5842]  ? bch2_get_next_online_dev+0x2b/0x4f0
[   65.439643][ T5842]  ? llist_reverse_order+0x72/0x90
[   65.444744][ T5842]  bch2_fs_start+0x356/0x5b0
[   65.449328][ T5842]  bch2_fs_get_tree+0xd68/0x1710
[   65.454272][ T5842]  ? __pfx_bch2_fs_get_tree+0x10/0x10
[   65.459640][ T5842]  ? generic_parse_monolithic+0x387/0x400
[   65.465368][ T5842]  ? __pfx_vfs_parse_fs_string+0x10/0x10
[   65.470994][ T5842]  ? cap_capable+0x1b4/0x250
[   65.475572][ T5842]  ? safesetid_security_capable+0xb2/0x1d0
[   65.481371][ T5842]  vfs_get_tree+0x90/0x2b0
[   65.485782][ T5842]  do_new_mount+0x2be/0xb40
[   65.490279][ T5842]  ? __pfx_do_new_mount+0x10/0x10
[   65.495303][ T5842]  __se_sys_mount+0x2d6/0x3c0
[   65.499994][ T5842]  ? __pfx___se_sys_mount+0x10/0x10
[   65.505194][ T5842]  ? do_syscall_64+0x100/0x230
[   65.510039][ T5842]  ? __x64_sys_mount+0x20/0xc0
[   65.514803][ T5842]  do_syscall_64+0xf3/0x230
[   65.519388][ T5842]  ? clear_bhb_loop+0x35/0x90
[   65.524058][ T5842]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   65.529941][ T5842] RIP: 0033:0x7fc4572667ea
[   65.534351][ T5842] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 3e 06 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   65.553945][ T5842] RSP: 002b:00007ffd22484098 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
[   65.562361][ T5842] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc4572667ea
[   65.570321][ T5842] RDX: 00000000200000c0 RSI: 0000000020000180 RDI: 00007ffd224840f0
[   65.578287][ T5842] RBP: 0000000000000004 R08: 00007ffd22484130 R09: 000000000000593e
[   65.586247][ T5842] R10: 0000000000000010 R11: 0000000000000282 R12: 00007ffd22484130
[   65.594204][ T5842] R13: 0000000001000000 R14: 0000000000000003 R15: 0000000000000010
[   65.602168][ T5842]  </TASK>
[   65.605429][ T5842] Kernel Offset: disabled
[   65.609741][ T5842] Rebooting in 86400 seconds..