Warning: Permanently added '10.128.1.183' (ED25519) to the list of known hosts. 2026/07/12 10:07:30 parsed 1 programs Setting up swapspace version 1, size = 127995904 bytes [ 74.304787][ T3423] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 75.440700][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.461740][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.472312][ T35] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 75.489987][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.498359][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.508106][ T35] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 80.796269][ T3640] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 80.806736][ T3640] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 80.817026][ T3640] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 80.826658][ T3640] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 89.059564][ T3640] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.069086][ T3640] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.077849][ T3640] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.086613][ T3640] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.594795][ T906] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 89.639237][ T906] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 89.698308][ T906] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 89.769269][ T906] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2026/07/12 10:07:46 executed programs: 0 [ 93.322237][ T4344] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 93.332110][ T4344] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 93.341375][ T4344] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 93.351101][ T4344] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 99.641074][ T4344] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.650129][ T4344] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.659974][ T4344] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.669434][ T4344] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.066556][ T906] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.076631][ T906] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.084399][ T906] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 100.098847][ T906] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.107531][ T906] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.115207][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready 2026/07/12 10:07:56 executed programs: 2 [ 100.321773][ T4955] loop2: detected capacity change from 0 to 32768 [ 100.341552][ T4955] [ 100.341552][ T4955] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 100.341552][ T4955] [ 100.356495][ T4955] read_mapping_page failed! [ 100.361241][ T4955] ERROR: (device loop2): txCommit: [ 100.361241][ T4955] [ 100.370196][ T4955] read_mapping_page failed! [ 100.375091][ T4955] ERROR: (device loop2): txCommit: [ 100.375091][ T4955] [ 100.389171][ T4955] ================================================================== [ 100.397640][ T4955] BUG: KASAN: slab-out-of-bounds in dtSplitPage+0x1064/0x30b0 [ 100.405305][ T4955] Read of size 1 at addr ffff88806dfebfd5 by task syz.2.17/4955 [ 100.414066][ T4955] [ 100.416422][ T4955] CPU: 0 PID: 4955 Comm: syz.2.17 Not tainted syzkaller #0 [ 100.423900][ T4955] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 100.434155][ T4955] Call Trace: [ 100.437480][ T4955] [ 100.440421][ T4955] dump_stack_lvl+0x199/0x25e [ 100.445245][ T4955] ? __lock_acquire+0xb60/0xb60 [ 100.450129][ T4955] ? show_regs_print_info+0x12/0x12 [ 100.456636][ T4955] ? load_image+0x680/0x680 [ 100.461750][ T4955] ? _raw_spin_lock_irqsave+0xae/0xf0 [ 100.467147][ T4955] ? __virt_addr_valid+0x168/0x380 [ 100.472259][ T4955] ? __virt_addr_valid+0x2c3/0x380 [ 100.477450][ T4955] ? dtSplitPage+0x1064/0x30b0 [ 100.482390][ T4955] print_report+0xa8/0x210 [ 100.486793][ T4955] kasan_report+0x10b/0x140 [ 100.491278][ T4955] ? dtSplitPage+0x1064/0x30b0 [ 100.496025][ T4955] dtSplitPage+0x1064/0x30b0 [ 100.500608][ T4955] ? dbAlloc+0x765/0xad0 [ 100.504922][ T4955] dtInsert+0x1010/0x57e0 [ 100.509251][ T4955] ? txLock+0x2ab/0x20c0 [ 100.513483][ T4955] ? __lock_acquire+0xb60/0xb60 [ 100.518317][ T4955] ? do_raw_spin_lock+0x11b/0x2b0 [ 100.523340][ T4955] ? UniStrupr+0x2e0/0x2e0 [ 100.527763][ T4955] ? txLock+0x11ca/0x20c0 [ 100.532096][ T4955] ? txEnd+0x520/0x520 [ 100.536188][ T4955] jfs_create+0x729/0xae0 [ 100.540517][ T4955] ? jfs_lookup+0x420/0x420 [ 100.545012][ T4955] ? jfs_get_parent+0xa0/0xa0 [ 100.549678][ T4955] ? make_kgid+0x650/0x650 [ 100.554082][ T4955] ? generic_permission+0x220/0x510 [ 100.559265][ T4955] ? inode_permission+0xef/0x480 [ 100.564217][ T4955] ? security_inode_create+0xb3/0x100 [ 100.569758][ T4955] ? jfs_lookup+0x420/0x420 [ 100.574245][ T4955] path_openat+0x17d4/0x3160 [ 100.578840][ T4955] ? do_filp_open+0x420/0x420 [ 100.583624][ T4955] ? __virt_addr_valid+0x168/0x380 [ 100.588723][ T4955] do_filp_open+0x1ee/0x420 [ 100.593214][ T4955] ? vfs_tmpfile+0x460/0x460 [ 100.597789][ T4955] ? _raw_spin_unlock+0x24/0x40 [ 100.602623][ T4955] ? alloc_fd+0x4d2/0x580 [ 100.607204][ T4955] do_sys_openat2+0x14b/0x4f0 [ 100.611880][ T4955] ? do_sys_open+0xe0/0xe0 [ 100.616464][ T4955] __x64_sys_openat+0x135/0x160 [ 100.621406][ T4955] do_syscall_64+0x4c/0xa0 [ 100.625806][ T4955] ? clear_bhb_loop+0x60/0xb0 [ 100.630465][ T4955] ? clear_bhb_loop+0x60/0xb0 [ 100.635211][ T4955] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 100.641090][ T4955] RIP: 0033:0x7f86dd59c819 [ 100.645519][ T4955] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 100.665403][ T4955] RSP: 002b:00007f86de3b3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 100.673828][ T4955] RAX: ffffffffffffffda RBX: 00007f86dd815fa0 RCX: 00007f86dd59c819 [ 100.681786][ T4955] RDX: 000000000000275a RSI: 0000200000000200 RDI: ffffffffffffff9c [ 100.689758][ T4955] RBP: 00007f86dd632c91 R08: 0000000000000000 R09: 0000000000000000 [ 100.697718][ T4955] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 100.705676][ T4955] R13: 00007f86dd816038 R14: 00007f86dd815fa0 R15: 00007ffc448ac178 [ 100.713643][ T4955] [ 100.716673][ T4955] [ 100.718987][ T4955] Allocated by task 4955: [ 100.723379][ T4955] kasan_set_track+0x4b/0x70 [ 100.727959][ T4955] __kasan_slab_alloc+0x6b/0x80 [ 100.732822][ T4955] slab_post_alloc_hook+0x4d/0x400 [ 100.738016][ T4955] kmem_cache_alloc_lru+0x178/0x2a0 [ 100.743218][ T4955] jfs_alloc_inode+0x24/0x60 [ 100.747939][ T4955] iget_locked+0x163/0x840 [ 100.752560][ T4955] jfs_iget+0x20/0x3f0 [ 100.756924][ T4955] jfs_lookup+0x21d/0x420 [ 100.761267][ T4955] __lookup_slow+0x29d/0x3f0 [ 100.765862][ T4955] lookup_slow+0x53/0x70 [ 100.770196][ T4955] walk_component+0x2ad/0x3e0 [ 100.774875][ T4955] path_lookupat+0x148/0x420 [ 100.779549][ T4955] filename_lookup+0x229/0x580 [ 100.784322][ T4955] user_path_at_empty+0x3e/0x60 [ 100.789171][ T4955] __se_sys_chdir+0x98/0x280 [ 100.793754][ T4955] do_syscall_64+0x4c/0xa0 [ 100.798185][ T4955] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 100.804079][ T4955] [ 100.806394][ T4955] The buggy address belongs to the object at ffff88806dfeb720 [ 100.806394][ T4955] which belongs to the cache jfs_ip of size 2224 [ 100.820089][ T4955] The buggy address is located 5 bytes to the right of [ 100.820089][ T4955] 2224-byte region [ffff88806dfeb720, ffff88806dfebfd0) [ 100.833878][ T4955] [ 100.836195][ T4955] The buggy address belongs to the physical page: [ 100.842780][ T4955] page:ffffea0001b7fa00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6dfe8 [ 100.853019][ T4955] head:ffffea0001b7fa00 order:3 compound_mapcount:0 compound_pincount:0 [ 100.861349][ T4955] memcg:ffff888064d4a601 [ 100.865580][ T4955] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 100.873642][ T4955] raw: 00fff00000010200 0000000000000000 dead000000000122 ffff8881456b3b40 [ 100.882319][ T4955] raw: 0000000000000000 00000000800d000d 00000001ffffffff ffff888064d4a601 [ 100.890890][ T4955] page dumped because: kasan: bad access detected [ 100.897376][ T4955] page_owner tracks the page as allocated [ 100.903089][ T4955] page last allocated via order 3, migratetype Reclaimable, gfp_mask 0x1d2050(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 4955, tgid 4954 (syz.2.17), ts 100329486824, free_ts 95073032634 [ 100.926616][ T4955] post_alloc_hook+0x260/0x290 [ 100.931383][ T4955] get_page_from_freelist+0x2ce7/0x2e30 [ 100.936918][ T4955] __alloc_pages+0x1ec/0x430 [ 100.941517][ T4955] alloc_slab_page+0x5d/0x180 [ 100.946306][ T4955] new_slab+0x70/0x250 [ 100.950379][ T4955] ___slab_alloc+0x9d2/0xe40 [ 100.954985][ T4955] kmem_cache_alloc_lru+0xfa/0x2a0 [ 100.961252][ T4955] jfs_alloc_inode+0x24/0x60 [ 100.965861][ T4955] new_inode_pseudo+0x5f/0x1c0 [ 100.970634][ T4955] new_inode+0x25/0x1d0 [ 100.974795][ T4955] jfs_fill_super+0x38f/0xab0 [ 100.979597][ T4955] mount_bdev+0x267/0x380 [ 100.984131][ T4955] legacy_get_tree+0xe6/0x180 [ 100.988998][ T4955] vfs_get_tree+0x89/0x1b0 [ 100.993414][ T4955] do_new_mount+0x244/0x940 [ 100.997942][ T4955] __se_sys_mount+0x328/0x3a0 [ 101.002622][ T4955] page last free stack trace: [ 101.007320][ T4955] free_unref_page_prepare+0x821/0x940 [ 101.012782][ T4955] free_unref_page+0x2e/0x3a0 [ 101.017561][ T4955] qlist_free_all+0x76/0xe0 [ 101.022071][ T4955] kasan_quarantine_reduce+0x144/0x160 [ 101.027562][ T4955] __kasan_slab_alloc+0x1e/0x80 [ 101.032598][ T4955] slab_post_alloc_hook+0x4d/0x400 [ 101.037718][ T4955] kmem_cache_alloc+0x181/0x2a0 [ 101.042766][ T4955] getname_flags+0xb7/0x500 [ 101.047509][ T4955] do_sys_openat2+0xdd/0x4f0 [ 101.052210][ T4955] __x64_sys_openat+0x135/0x160 [ 101.057078][ T4955] do_syscall_64+0x4c/0xa0 [ 101.061519][ T4955] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 101.067461][ T4955] [ 101.069782][ T4955] Memory state around the buggy address: [ 101.075407][ T4955] ffff88806dfebe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 101.083625][ T4955] ffff88806dfebf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 101.091759][ T4955] >ffff88806dfebf80: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc [ 101.099846][ T4955] ^ [ 101.106517][ T4955] ffff88806dfec000: fc fc fc fc fc fc fc fc fc fc 00 00 00 00 00 00 [ 101.114576][ T4955] ffff88806dfec080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 101.122794][ T4955] ================================================================== [ 101.134265][ T4955] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 101.141772][ T4955] Kernel Offset: disabled [ 101.146180][ T4955] Rebooting in 86400 seconds..