BUG: corrupted list in dst_destroy list_del corruption, ffff888068070490->next is NULL ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:53! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 5970 Comm: dhcpcd-run-hook Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 RIP: 0010:__list_del_entry_valid_or_report+0xdf/0x190 lib/list_debug.c:52 Code: 49 39 1f 0f 85 9e 00 00 00 b0 01 5b 41 5c 41 5d 41 5e 41 5f e9 d2 54 f9 06 cc 48 c7 c7 40 c1 29 8c 48 89 de e8 a2 29 65 fc 90 <0f> 0b 48 c7 c7 a0 c1 29 8c 48 89 de e8 90 29 65 fc 90 0f 0b 4c 89 RSP: 0000:ffffc90000007d58 EFLAGS: 00010046 RAX: 0000000000000033 RBX: ffff888068070490 RCX: 012eaabed941b600 RDX: 0000000000000100 RSI: 0000000000000102 RDI: 0000000000000000 RBP: 0000000000000203 R08: ffffc90000007ae7 R09: 1ffff92000000f5c R10: dffffc0000000000 R11: fffff52000000f5d R12: 1ffff1100d00e092 R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 00007fa4b2416c80(0000) GS:ffff888125009000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa4b262a9b0 CR3: 0000000028754000 CR4: 00000000003526f0 Call Trace: __list_del_entry_valid include/linux/list.h:132 [inline] __list_del_entry include/linux/list.h:223 [inline] list_del_init include/linux/list.h:295 [inline] dst_destroy+0x202/0x5a0 net/core/dst.c:163 rcu_do_batch kernel/rcu/tree.c:2617 [inline] rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869 handle_softirqs+0x22a/0x870 kernel/softirq.c:626 __do_softirq kernel/softirq.c:660 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x5f/0x150 kernel/softirq.c:727 irq_exit_rcu+0x9/0x30 kernel/softirq.c:743 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:lock_is_held_type+0x106/0x150 kernel/locking/lockdep.c:5945 Code: 18 00 00 b8 ff ff ff ff 65 0f c1 05 04 b0 88 07 83 f8 01 75 25 9c 58 a9 00 02 00 00 75 39 41 f7 c4 00 02 00 00 74 01 fb 89 d8 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 4b e3 02 00 cc 90 0f 0b 90 48 c7 RSP: 0000:ffffc900036c7838 EFLAGS: 00000206 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000080000001 RDX: ffff88801d7c1e40 RSI: ffffffff8e2861b8 RDI: ffffffff8c29be00 RBP: 00000000ffffffff R08: ffffea00004cc547 R09: 1ffffd40000998a8 R10: dffffc0000000000 R11: fffff940000998a9 R12: 0000000000000246 R13: ffff88801d7c1e40 R14: ffff888036c9a1a0 R15: 0000000000000005 lock_is_held include/linux/lockdep.h:249 [inline] xa_entry include/linux/xarray.h:1227 [inline] xas_next_entry+0x1de/0x3d0 include/linux/xarray.h:1738 next_uptodate_folio+0x32/0x5d0 mm/filemap.c:3704 filemap_map_pages+0x14fc/0x2050 mm/filemap.c:3934 do_fault_around mm/memory.c:5757 [inline] do_read_fault mm/memory.c:5790 [inline] do_fault mm/memory.c:5933 [inline] do_pte_missing+0x211a/0x3750 mm/memory.c:4477 handle_pte_fault mm/memory.c:6317 [inline] __handle_mm_fault mm/memory.c:6455 [inline] handle_mm_fault+0x1bec/0x3310 mm/memory.c:6624 do_user_addr_fault+0xa73/0x1340 arch/x86/mm/fault.c:1334 handle_page_fault arch/x86/mm/fault.c:1474 [inline] exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1527 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618 RIP: 0033:0x7fa4b262a9b0 Code: Unable to access opcode bytes at 0x7fa4b262a986. RSP: 002b:00007ffcfd95ee88 EFLAGS: 00010206 RAX: 00007fa4b24ed7e8 RBX: 0000002d8cdc83ac RCX: 00007fa4b24ed7e8 RDX: 00007fa4b262a9b0 RSI: 00007fa4b27b4980 RDI: 0000000000000001 RBP: 00007ffcfd95f140 R08: 0000000000000000 R09: 000000000000000e R10: fffffffffffff68e R11: 0000000000000206 R12: fffffffffffffff8 R13: 0000002d8cb8514a R14: 0000000000000000 R15: 00007fa4b27c1310 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__list_del_entry_valid_or_report+0xdf/0x190 lib/list_debug.c:52 Code: 49 39 1f 0f 85 9e 00 00 00 b0 01 5b 41 5c 41 5d 41 5e 41 5f e9 d2 54 f9 06 cc 48 c7 c7 40 c1 29 8c 48 89 de e8 a2 29 65 fc 90 <0f> 0b 48 c7 c7 a0 c1 29 8c 48 89 de e8 90 29 65 fc 90 0f 0b 4c 89 RSP: 0000:ffffc90000007d58 EFLAGS: 00010046 RAX: 0000000000000033 RBX: ffff888068070490 RCX: 012eaabed941b600 RDX: 0000000000000100 RSI: 0000000000000102 RDI: 0000000000000000 RBP: 0000000000000203 R08: ffffc90000007ae7 R09: 1ffff92000000f5c R10: dffffc0000000000 R11: fffff52000000f5d R12: 1ffff1100d00e092 R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 00007fa4b2416c80(0000) GS:ffff888125009000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa4b262a986 CR3: 0000000028754000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: 18 00 sbb %al,(%rax) 2: 00 b8 ff ff ff ff add %bh,-0x1(%rax) 8: 65 0f c1 05 04 b0 88 xadd %eax,%gs:0x788b004(%rip) # 0x788b014 f: 07 10: 83 f8 01 cmp $0x1,%eax 13: 75 25 jne 0x3a 15: 9c pushf 16: 58 pop %rax 17: a9 00 02 00 00 test $0x200,%eax 1c: 75 39 jne 0x57 1e: 41 f7 c4 00 02 00 00 test $0x200,%r12d 25: 74 01 je 0x28 27: fb sti 28: 89 d8 mov %ebx,%eax * 2a: 5b pop %rbx <-- trapping instruction 2b: 41 5c pop %r12 2d: 41 5d pop %r13 2f: 41 5e pop %r14 31: 41 5f pop %r15 33: 5d pop %rbp 34: e9 4b e3 02 00 jmp 0x2e384 39: cc int3 3a: 90 nop 3b: 0f 0b ud2 3d: 90 nop 3e: 48 rex.W 3f: c7 .byte 0xc7 Warning: Permanently added '10.128.0.235' (ED25519) to the list of known hosts. 2026/02/24 13:27:23 parsed 1 programs [ 73.089850][ T5821] cgroup: Unknown subsys name 'net' [ 73.224354][ T5821] cgroup: Unknown subsys name 'cpuset' [ 73.233663][ T5821] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 74.618391][ T5821] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 77.452475][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.460838][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.496048][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.505383][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.540463][ T5843] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 78.926304][ T5874] chnl_net:caif_netlink_parms(): no params data found [ 79.026012][ T5874] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.036469][ T5874] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.044844][ T5874] bridge_slave_0: entered allmulticast mode [ 79.052321][ T5874] bridge_slave_0: entered promiscuous mode [ 79.061519][ T5874] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.068734][ T5874] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.076618][ T5874] bridge_slave_1: entered allmulticast mode [ 79.084366][ T5874] bridge_slave_1: entered promiscuous mode [ 79.117511][ T5874] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.129752][ T5874] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.159157][ T5874] team0: Port device team_slave_0 added [ 79.167641][ T5874] team0: Port device team_slave_1 added [ 79.193568][ T5874] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.200634][ T5874] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.226989][ T5874] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.241048][ T5874] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.248014][ T5874] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.274275][ T5874] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.326427][ T5874] hsr_slave_0: entered promiscuous mode [ 79.333609][ T5874] hsr_slave_1: entered promiscuous mode [ 79.479609][ T5874] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 79.492629][ T5874] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 79.504029][ T5874] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 79.513724][ T5874] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 79.544748][ T5874] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.551980][ T5874] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.559806][ T5874] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.567317][ T5874] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.579979][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.588627][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.647822][ T5874] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.674326][ T5874] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.687821][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.695009][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.711068][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.718167][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.879123][ T5874] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 79.933237][ T5874] veth0_vlan: entered promiscuous mode [ 79.946133][ T5874] veth1_vlan: entered promiscuous mode [ 79.980280][ T5874] veth0_macvtap: entered promiscuous mode [ 79.992098][ T5874] veth1_macvtap: entered promiscuous mode [ 80.015864][ T5874] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.031064][ T5874] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.049681][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.059171][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.071549][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.086545][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.200110][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 80.276191][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 80.359253][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 80.432395][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 80.588243][ T5907] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 80.597789][ T5907] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 80.606315][ T5907] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 80.614742][ T5907] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 80.641184][ T5907] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 81.648721][ T9] cfg80211: failed to load regulatory.db 2026/02/24 13:27:34 executed programs: 0 [ 81.786666][ T5907] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 81.795108][ T5907] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 81.803290][ T5907] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 81.814111][ T5907] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 81.822119][ T5907] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 81.961043][ T5933] chnl_net:caif_netlink_parms(): no params data found [ 82.038456][ T5933] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.045915][ T5933] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.053597][ T5933] bridge_slave_0: entered allmulticast mode [ 82.061207][ T5933] bridge_slave_0: entered promiscuous mode [ 82.069175][ T5933] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.076544][ T5933] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.083862][ T5933] bridge_slave_1: entered allmulticast mode [ 82.091381][ T5933] bridge_slave_1: entered promiscuous mode [ 82.120654][ T5933] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.136001][ T5933] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.166254][ T5933] team0: Port device team_slave_0 added [ 82.174949][ T5933] team0: Port device team_slave_1 added [ 82.201367][ T5933] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.208333][ T5933] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.234645][ T5933] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.247725][ T5933] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.254788][ T5933] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.281104][ T5933] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.324170][ T5933] hsr_slave_0: entered promiscuous mode [ 82.331224][ T5933] hsr_slave_1: entered promiscuous mode [ 82.337728][ T5933] debugfs: 'hsr0' already exists in 'hsr' [ 82.343846][ T5933] Cannot create hsr debugfs directory [ 83.175488][ T12] bridge_slave_1: left allmulticast mode [ 83.188136][ T12] bridge_slave_1: left promiscuous mode [ 83.195507][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.210421][ T12] bridge_slave_0: left allmulticast mode [ 83.220613][ T12] bridge_slave_0: left promiscuous mode [ 83.226573][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.452800][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 83.467415][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 83.480559][ T12] bond0 (unregistering): Released all slaves [ 83.639762][ T12] hsr_slave_0: left promiscuous mode [ 83.652709][ T12] hsr_slave_1: left promiscuous mode [ 83.659191][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 83.667220][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 83.676357][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 83.684506][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 83.699936][ T12] veth1_macvtap: left promiscuous mode [ 83.705952][ T12] veth0_macvtap: left promiscuous mode [ 83.711828][ T12] veth1_vlan: left promiscuous mode [ 83.717141][ T12] veth0_vlan: left promiscuous mode [ 83.882387][ T5142] Bluetooth: hci0: command tx timeout [ 84.002876][ T12] team0 (unregistering): Port device team_slave_1 removed [ 84.032029][ T12] team0 (unregistering): Port device team_slave_0 removed [ 84.190776][ C0] list_del corruption, ffff888068070490->next is NULL [ 84.198046][ C0] ------------[ cut here ]------------ [ 84.203501][ C0] kernel BUG at lib/list_debug.c:53! [ 84.208835][ C0] Oops: invalid opcode: 0000 [#1] SMP KASAN PTI [ 84.215279][ C0] CPU: 0 UID: 0 PID: 5970 Comm: dhcpcd-run-hook Not tainted syzkaller #0 PREEMPT(full) [ 84.225059][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 84.235103][ C0] RIP: 0010:__list_del_entry_valid_or_report+0xdf/0x190 [ 84.242043][ C0] Code: 49 39 1f 0f 85 9e 00 00 00 b0 01 5b 41 5c 41 5d 41 5e 41 5f e9 d2 54 f9 06 cc 48 c7 c7 40 c1 29 8c 48 89 de e8 a2 29 65 fc 90 <0f> 0b 48 c7 c7 a0 c1 29 8c 48 89 de e8 90 29 65 fc 90 0f 0b 4c 89 [ 84.261814][ C0] RSP: 0000:ffffc90000007d58 EFLAGS: 00010046 [ 84.267871][ C0] RAX: 0000000000000033 RBX: ffff888068070490 RCX: 012eaabed941b600 [ 84.275823][ C0] RDX: 0000000000000100 RSI: 0000000000000102 RDI: 0000000000000000 [ 84.283774][ C0] RBP: 0000000000000203 R08: ffffc90000007ae7 R09: 1ffff92000000f5c [ 84.291724][ C0] R10: dffffc0000000000 R11: fffff52000000f5d R12: 1ffff1100d00e092 [ 84.299677][ C0] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 84.307713][ C0] FS: 00007fa4b2416c80(0000) GS:ffff888125009000(0000) knlGS:0000000000000000 [ 84.316621][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 84.323187][ C0] CR2: 00007fa4b262a9b0 CR3: 0000000028754000 CR4: 00000000003526f0 [ 84.331143][ C0] Call Trace: [ 84.334492][ C0] [ 84.337330][ C0] dst_destroy+0x202/0x5a0 [ 84.341731][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 84.347554][ C0] ? rcu_core+0x751/0x1070 [ 84.351952][ C0] ? __pfx_dst_destroy_rcu+0x10/0x10 [ 84.357219][ C0] rcu_core+0x7cd/0x1070 [ 84.361477][ C0] ? __pfx_rcu_core+0x10/0x10 [ 84.366220][ C0] ? sched_clock_cpu+0x74/0x440 [ 84.371137][ C0] handle_softirqs+0x22a/0x870 [ 84.375880][ C0] ? __irq_exit_rcu+0x5f/0x150 [ 84.380619][ C0] __irq_exit_rcu+0x5f/0x150 [ 84.385274][ C0] irq_exit_rcu+0x9/0x30 [ 84.389501][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 84.395115][ C0] [ 84.398130][ C0] [ 84.401212][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 84.407175][ C0] RIP: 0010:lock_is_held_type+0x106/0x150 [ 84.412885][ C0] Code: 18 00 00 b8 ff ff ff ff 65 0f c1 05 04 b0 88 07 83 f8 01 75 25 9c 58 a9 00 02 00 00 75 39 41 f7 c4 00 02 00 00 74 01 fb 89 d8 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 4b e3 02 00 cc 90 0f 0b 90 48 c7 [ 84.432657][ C0] RSP: 0000:ffffc900036c7838 EFLAGS: 00000206 [ 84.438709][ C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000080000001 [ 84.446663][ C0] RDX: ffff88801d7c1e40 RSI: ffffffff8e2861b8 RDI: ffffffff8c29be00 [ 84.454622][ C0] RBP: 00000000ffffffff R08: ffffea00004cc547 R09: 1ffffd40000998a8 [ 84.462578][ C0] R10: dffffc0000000000 R11: fffff940000998a9 R12: 0000000000000246 [ 84.470563][ C0] R13: ffff88801d7c1e40 R14: ffff888036c9a1a0 R15: 0000000000000005 [ 84.478608][ C0] xas_next_entry+0x1de/0x3d0 [ 84.483279][ C0] next_uptodate_folio+0x32/0x5d0 [ 84.488299][ C0] ? folio_unlock+0x101/0x160 [ 84.492960][ C0] filemap_map_pages+0x14fc/0x2050 [ 84.498050][ C0] ? __lock_acquire+0x6b5/0x2cf0 [ 84.502970][ C0] ? __lock_acquire+0x6b5/0x2cf0 [ 84.507991][ C0] ? filemap_map_pages+0x185/0x2050 [ 84.513181][ C0] ? __pfx_native_flush_tlb_one_user+0x10/0x10 [ 84.519318][ C0] ? __pfx_filemap_map_pages+0x10/0x10 [ 84.524766][ C0] ? __pfx_filemap_map_pages+0x10/0x10 [ 84.530214][ C0] do_pte_missing+0x211a/0x3750 [ 84.535055][ C0] ? do_pte_missing+0x130a/0x3750 [ 84.540062][ C0] ? handle_mm_fault+0xee/0x3310 [ 84.544978][ C0] handle_mm_fault+0x1bec/0x3310 [ 84.549900][ C0] ? handle_mm_fault+0xee/0x3310 [ 84.555001][ C0] ? __pfx_handle_mm_fault+0x10/0x10 [ 84.560268][ C0] ? lock_vma_under_rcu+0x45a/0x500 [ 84.565452][ C0] do_user_addr_fault+0xa73/0x1340 [ 84.570553][ C0] ? rcu_is_watching+0x15/0xb0 [ 84.575387][ C0] ? trace_page_fault_user+0x84/0x210 [ 84.580748][ C0] exc_page_fault+0x6a/0xc0 [ 84.585241][ C0] asm_exc_page_fault+0x26/0x30 [ 84.590069][ C0] RIP: 0033:0x7fa4b262a9b0 [ 84.594493][ C0] Code: Unable to access opcode bytes at 0x7fa4b262a986. [ 84.601920][ C0] RSP: 002b:00007ffcfd95ee88 EFLAGS: 00010206 [ 84.607966][ C0] RAX: 00007fa4b24ed7e8 RBX: 0000002d8cdc83ac RCX: 00007fa4b24ed7e8 [ 84.616002][ C0] RDX: 00007fa4b262a9b0 RSI: 00007fa4b27b4980 RDI: 0000000000000001 [ 84.624014][ C0] RBP: 00007ffcfd95f140 R08: 0000000000000000 R09: 000000000000000e [ 84.632162][ C0] R10: fffffffffffff68e R11: 0000000000000206 R12: fffffffffffffff8 [ 84.640112][ C0] R13: 0000002d8cb8514a R14: 0000000000000000 R15: 00007fa4b27c1310 [ 84.648067][ C0] [ 84.651086][ C0] Modules linked in: [ 84.655063][ C0] ---[ end trace 0000000000000000 ]--- [ 84.660494][ C0] RIP: 0010:__list_del_entry_valid_or_report+0xdf/0x190 [ 84.667412][ C0] Code: 49 39 1f 0f 85 9e 00 00 00 b0 01 5b 41 5c 41 5d 41 5e 41 5f e9 d2 54 f9 06 cc 48 c7 c7 40 c1 29 8c 48 89 de e8 a2 29 65 fc 90 <0f> 0b 48 c7 c7 a0 c1 29 8c 48 89 de e8 90 29 65 fc 90 0f 0b 4c 89 [ 84.687016][ C0] RSP: 0000:ffffc90000007d58 EFLAGS: 00010046 [ 84.693246][ C0] RAX: 0000000000000033 RBX: ffff888068070490 RCX: 012eaabed941b600 [ 84.701376][ C0] RDX: 0000000000000100 RSI: 0000000000000102 RDI: 0000000000000000 [ 84.709453][ C0] RBP: 0000000000000203 R08: ffffc90000007ae7 R09: 1ffff92000000f5c [ 84.717402][ C0] R10: dffffc0000000000 R11: fffff52000000f5d R12: 1ffff1100d00e092 [ 84.725466][ C0] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 84.733506][ C0] FS: 00007fa4b2416c80(0000) GS:ffff888125009000(0000) knlGS:0000000000000000 [ 84.742416][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 84.749068][ C0] CR2: 00007fa4b262a986 CR3: 0000000028754000 CR4: 00000000003526f0 [ 84.757027][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 84.764569][ C0] Kernel Offset: disabled [ 84.768900][ C0] Rebooting in 86400 seconds.. syzkaller build log: go env (err=) AR='ar' CC='gcc' CGO_CFLAGS='-O2 -g' CGO_CPPFLAGS='' CGO_CXXFLAGS='-O2 -g' CGO_ENABLED='1' CGO_FFLAGS='-O2 -g' CGO_LDFLAGS='-O2 -g' CXX='g++' GCCGO='gccgo' GO111MODULE='auto' GOAMD64='v1' GOARCH='amd64' GOAUTH='netrc' GOBIN='' GOCACHE='/syzkaller/.cache/go-build' GOCACHEPROG='' GODEBUG='' GOENV='/syzkaller/.config/go/env' GOEXE='' GOEXPERIMENT='' GOFIPS140='off' GOFLAGS='' GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1006307869=/tmp/go-build -gno-record-gcc-switches' GOHOSTARCH='amd64' GOHOSTOS='linux' GOINSECURE='' GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod' GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod' GONOPROXY='' GONOSUMDB='' GOOS='linux' GOPATH='/syzkaller/jobs-2/linux/gopath' GOPRIVATE='' GOPROXY='https://proxy.golang.org,direct' GOROOT='/usr/local/go' GOSUMDB='sum.golang.org' GOTELEMETRY='local' GOTELEMETRYDIR='/syzkaller/.config/go/telemetry' GOTMPDIR='' GOTOOLCHAIN='auto' GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64' GOVCS='' GOVERSION='go1.24.4' GOWORK='' PKG_CONFIG='pkg-config' git status (err=) HEAD detached at c75a2f6e84 nothing to commit, working tree clean tput: No value for $TERM and no -T specified tput: No value for $TERM and no -T specified Makefile:31: run command via tools/syz-env for best compatibility, see: Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=c75a2f6e84cea17ba1565057ba436f5fed990ef6 -X github.com/google/syzkaller/prog.gitRevisionDate=20260130-182635" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=c75a2f6e84cea17ba1565057ba436f5fed990ef6 -X github.com/google/syzkaller/prog.gitRevisionDate=20260130-182635" ./sys/syz-sysgen make .descriptions tput: No value for $TERM and no -T specified tput: No value for $TERM and no -T specified Makefile:31: run command via tools/syz-env for best compatibility, see: Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env bin/syz-sysgen touch .descriptions GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=c75a2f6e84cea17ba1565057ba436f5fed990ef6 -X github.com/google/syzkaller/prog.gitRevisionDate=20260130-182635" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog mkdir -p ./bin/linux_amd64 g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \ -m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \ -DHOSTGOOS_linux=1 -DGIT_REVISION=\"c75a2f6e84cea17ba1565057ba436f5fed990ef6\" /usr/bin/ld: /tmp/cc346YbT.o: in function `Connection::Connect(char const*, char const*)': executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking ./tools/check-syzos.sh 2>/dev/null