[ 132.969209][ T1333] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.969269][ T1333] ieee802154 phy1 wpan1: encryption failed: -22 Warning: Permanently added '10.128.1.233' (ED25519) to the list of known hosts. 2026/05/14 15:40:57 parsed 1 programs [ 142.658978][ T6121] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 148.815509][ T6162] bridge0: port 1(bridge_slave_0) entered blocking state [ 148.815734][ T6162] bridge0: port 1(bridge_slave_0) entered disabled state [ 148.815900][ T6162] bridge_slave_0: entered allmulticast mode [ 148.818162][ T6162] bridge_slave_0: entered promiscuous mode [ 148.821531][ T6162] bridge0: port 2(bridge_slave_1) entered blocking state [ 148.821663][ T6162] bridge0: port 2(bridge_slave_1) entered disabled state [ 148.821760][ T6162] bridge_slave_1: entered allmulticast mode [ 148.823181][ T6162] bridge_slave_1: entered promiscuous mode [ 149.112358][ T6162] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 149.117646][ T6162] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 149.357698][ T6162] team0: Port device team_slave_0 added [ 149.361822][ T6162] team0: Port device team_slave_1 added [ 149.529142][ T6162] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 149.529158][ T6162] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 149.529180][ T6162] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 149.532266][ T6162] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 149.532280][ T6162] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 149.532299][ T6162] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 149.729992][ T6162] hsr_slave_0: entered promiscuous mode [ 149.730743][ T6162] hsr_slave_1: entered promiscuous mode [ 151.686662][ T6162] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 151.720872][ T6162] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 151.722243][ T6162] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 151.757400][ T6162] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 151.759295][ T6162] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 151.820099][ T6162] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 151.821408][ T6162] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 151.896370][ T6162] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 152.051308][ T6162] 8021q: adding VLAN 0 to HW filter on device bond0 [ 152.083774][ T6162] 8021q: adding VLAN 0 to HW filter on device team0 [ 152.093418][ T1060] bridge0: port 1(bridge_slave_0) entered blocking state [ 152.096938][ T1060] bridge0: port 1(bridge_slave_0) entered forwarding state [ 152.130923][ T1060] bridge0: port 2(bridge_slave_1) entered blocking state [ 152.131122][ T1060] bridge0: port 2(bridge_slave_1) entered forwarding state [ 152.890973][ T6162] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 152.998531][ T6162] veth0_vlan: entered promiscuous mode [ 153.028252][ T6162] veth1_vlan: entered promiscuous mode [ 153.098222][ T6162] veth0_macvtap: entered promiscuous mode [ 153.112464][ T6162] veth1_macvtap: entered promiscuous mode [ 153.163353][ T6162] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 153.185928][ T6162] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 153.222893][ T1060] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 153.222949][ T1060] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 153.222982][ T1060] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 153.223013][ T1060] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 154.151803][ T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 154.978363][ T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 155.242562][ T150] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 155.242582][ T150] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 155.518836][ T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 155.568453][ T150] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 155.568475][ T150] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 155.904043][ T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 156.973926][ T13] bridge_slave_1: left allmulticast mode [ 156.973992][ T13] bridge_slave_1: left promiscuous mode [ 156.974189][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 157.054741][ T13] bridge_slave_0: left allmulticast mode [ 157.054774][ T13] bridge_slave_0: left promiscuous mode [ 157.054933][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 157.634342][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 157.714607][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 157.735626][ T13] bond0 (unregistering): Released all slaves [ 158.043956][ T13] hsr_slave_0: left promiscuous mode [ 158.083700][ T13] hsr_slave_1: left promiscuous mode [ 158.104120][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 158.104149][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 158.133621][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 158.133648][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 158.256525][ T13] veth1_macvtap: left promiscuous mode [ 158.269510][ T13] veth0_macvtap: left promiscuous mode [ 158.287086][ T13] veth1_vlan: left promiscuous mode [ 158.287258][ T13] veth0_vlan: left promiscuous mode [ 158.864391][ T13] team0 (unregistering): Port device team_slave_1 removed [ 158.904256][ T13] team0 (unregistering): Port device team_slave_0 removed [ 159.106095][ T5260] 8021q: adding VLAN 0 to HW filter on device eth1 [ 159.862220][ T5260] 8021q: adding VLAN 0 to HW filter on device eth2 [ 160.571094][ T59] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 160.588581][ T59] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 160.590699][ T59] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 160.591871][ T59] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 160.593939][ T59] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 161.337651][ T5260] 8021q: adding VLAN 0 to HW filter on device eth3 2026/05/14 15:41:21 executed programs: 0 [ 162.220700][ T59] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 162.267511][ T59] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 162.268474][ T59] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 162.269532][ T59] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 162.271269][ T59] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 162.409207][ T5260] 8021q: adding VLAN 0 to HW filter on device eth4 [ 163.875769][ T6458] bridge0: port 1(bridge_slave_0) entered blocking state [ 163.875875][ T6458] bridge0: port 1(bridge_slave_0) entered disabled state [ 163.875988][ T6458] bridge_slave_0: entered allmulticast mode [ 163.878855][ T6458] bridge_slave_0: entered promiscuous mode [ 163.880844][ T6458] bridge0: port 2(bridge_slave_1) entered blocking state [ 163.880959][ T6458] bridge0: port 2(bridge_slave_1) entered disabled state [ 163.881063][ T6458] bridge_slave_1: entered allmulticast mode [ 163.882494][ T6458] bridge_slave_1: entered promiscuous mode [ 164.044782][ T6458] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 164.050961][ T6458] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 164.361621][ T6458] team0: Port device team_slave_0 added [ 164.364505][ T6458] team0: Port device team_slave_1 added [ 164.403769][ T59] Bluetooth: hci0: command tx timeout [ 164.614524][ T6458] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 164.614541][ T6458] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 164.614554][ T6458] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 164.615916][ T6458] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 164.615928][ T6458] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 164.615953][ T6458] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 164.821480][ T6458] hsr_slave_0: entered promiscuous mode [ 164.822273][ T6458] hsr_slave_1: entered promiscuous mode [ 166.483649][ T59] Bluetooth: hci0: command tx timeout [ 166.928488][ T6458] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 166.967966][ T6458] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 166.969152][ T6458] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 167.027071][ T6458] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 167.029859][ T6458] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 167.067946][ T6458] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 167.069115][ T6458] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 167.108108][ T6458] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 167.294109][ T6458] 8021q: adding VLAN 0 to HW filter on device bond0 [ 167.321622][ T6458] 8021q: adding VLAN 0 to HW filter on device team0 [ 167.330736][ T150] bridge0: port 1(bridge_slave_0) entered blocking state [ 167.330944][ T150] bridge0: port 1(bridge_slave_0) entered forwarding state [ 167.359439][ T150] bridge0: port 2(bridge_slave_1) entered blocking state [ 167.361905][ T150] bridge0: port 2(bridge_slave_1) entered forwarding state [ 168.024620][ T6458] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 168.156732][ T6458] veth0_vlan: entered promiscuous mode [ 168.171221][ T6458] veth1_vlan: entered promiscuous mode [ 168.224711][ T6458] veth0_macvtap: entered promiscuous mode [ 168.230458][ T6458] veth1_macvtap: entered promiscuous mode [ 168.270771][ T6458] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 168.287620][ T6458] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 168.301892][ T1543] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 168.302134][ T1543] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 168.302168][ T1543] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 168.302199][ T1543] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 168.566044][ T59] Bluetooth: hci0: command tx timeout [ 168.906862][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 168.906882][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 168.989302][ T1060] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 168.989322][ T1060] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2026/05/14 15:41:28 executed programs: 2 [ 169.508096][ T6598] loop0: detected capacity change from 0 to 32768 [ 170.081947][ T6598] UFO tlock:0xffffc9000344a1f8 [ 170.643700][ T59] Bluetooth: hci0: command tx timeout [ 170.658040][ T6620] loop0: detected capacity change from 0 to 32768 [ 170.702587][ T6620] UFO tlock:0xffffc9000344a090 [ 171.077163][ T6622] loop0: detected capacity change from 0 to 32768 [ 171.146868][ T6622] UFO tlock:0xffffc9000344a1f8 [ 171.499422][ T6624] loop0: detected capacity change from 0 to 32768 [ 171.545822][ T6624] UFO tlock:0xffffc9000344a090 [ 171.896176][ T6626] loop0: detected capacity change from 0 to 32768 [ 171.932705][ T6626] UFO tlock:0xffffc9000344a1f8 [ 172.279319][ T6628] loop0: detected capacity change from 0 to 32768 [ 172.333568][ T6628] UFO tlock:0xffffc9000344a090 [ 173.259094][ T6630] loop0: detected capacity change from 0 to 32768 [ 173.332183][ T6630] UFO tlock:0xffffc9000344a1f8 [ 173.709563][ T6632] loop0: detected capacity change from 0 to 32768 [ 173.799534][ T6632] UFO tlock:0xffffc9000344a090 [ 174.179964][ T6634] loop0: detected capacity change from 0 to 32768 [ 174.228725][ T6634] UFO tlock:0xffffc9000344a1f8 2026/05/14 15:41:33 executed programs: 11 [ 174.806443][ T6636] loop0: detected capacity change from 0 to 32768 [ 174.842316][ T6636] UFO tlock:0xffffc9000344a090 [ 175.221146][ T6638] loop0: detected capacity change from 0 to 32768 [ 175.269253][ T6638] UFO tlock:0xffffc9000344a1f8 [ 175.866181][ T6640] loop0: detected capacity change from 0 to 32768 [ 175.904136][ T6640] UFO tlock:0xffffc9000344a090 [ 176.247405][ T6642] loop0: detected capacity change from 0 to 32768 [ 176.288751][ T6642] UFO tlock:0xffffc9000344a1f8 [ 176.627145][ T6644] loop0: detected capacity change from 0 to 32768 [ 176.672155][ T6644] UFO tlock:0xffffc9000344a090 [ 177.031228][ T6646] loop0: detected capacity change from 0 to 32768 [ 177.068587][ T6646] UFO tlock:0xffffc9000344a1f8 [ 177.409186][ T6648] loop0: detected capacity change from 0 to 32768 [ 177.473397][ T6648] UFO tlock:0xffffc9000344a090 [ 177.810585][ T6650] loop0: detected capacity change from 0 to 32768 [ 177.839584][ T6650] UFO tlock:0xffffc9000344a1f8 [ 178.191167][ T6653] loop0: detected capacity change from 0 to 32768 [ 178.231764][ T6653] UFO tlock:0xffffc9000344a090 [ 178.578150][ T6655] loop0: detected capacity change from 0 to 32768 [ 178.644305][ T6655] UFO tlock:0xffffc9000344a1f8 [ 179.045488][ T6658] UFO tlock:0xffffc9000344a090 [ 179.445196][ T6660] UFO tlock:0xffffc9000344a1f8 2026/05/14 15:41:38 executed programs: 23 [ 179.820778][ T6662] UFO tlock:0xffffc9000344a090 [ 180.414861][ T6664] set_capacity_and_notify: 3 callbacks suppressed [ 180.414874][ T6664] loop0: detected capacity change from 0 to 32768 [ 180.471422][ T6664] UFO tlock:0xffffc9000344a1f8 [ 181.082003][ T6667] loop0: detected capacity change from 0 to 32768 [ 181.116570][ T6667] UFO tlock:0xffffc9000344a090 [ 181.179679][ T66] ================================================================== [ 181.179696][ T66] BUG: KASAN: use-after-free in copy_folio_from_iter_atomic+0xbb5/0x1ad0 [ 181.179727][ T66] Read of size 4096 at addr ffff888040de9000 by task kworker/u8:4/66 [ 181.179741][ T66] [ 181.179766][ T66] CPU: 1 UID: 0 PID: 66 Comm: kworker/u8:4 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 181.179785][ T66] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 181.179795][ T66] Workqueue: loop0 loop_workfn [ 181.179832][ T66] Call Trace: [ 181.179840][ T66] [ 181.179847][ T66] dump_stack_lvl+0xe8/0x150 [ 181.179867][ T66] print_address_description+0x55/0x1e0 [ 181.179887][ T66] ? copy_folio_from_iter_atomic+0xbb5/0x1ad0 [ 181.179903][ T66] print_report+0x58/0x70 [ 181.179918][ T66] kasan_report+0x117/0x150 [ 181.179938][ T66] ? copy_folio_from_iter_atomic+0xbb5/0x1ad0 [ 181.179958][ T66] kasan_check_range+0x264/0x2c0 [ 181.179976][ T66] ? copy_folio_from_iter_atomic+0xbb5/0x1ad0 [ 181.179994][ T66] __asan_memcpy+0x29/0x70 [ 181.180017][ T66] copy_folio_from_iter_atomic+0xbb5/0x1ad0 [ 181.180043][ T66] ? __pfx_copy_folio_from_iter_atomic+0x10/0x10 [ 181.180062][ T66] ? ktime_get_coarse_real_ts64_mg+0x59/0x1e0 [ 181.180086][ T66] ? shmem_write_begin+0x1ce/0x320 [ 181.180107][ T66] generic_perform_write+0x5b1/0x8b0 [ 181.180131][ T66] ? __pfx_generic_perform_write+0x10/0x10 [ 181.180153][ T66] ? file_update_time_flags+0x3b9/0x4b0 [ 181.180182][ T66] shmem_file_write_iter+0xfb/0x120 [ 181.180205][ T66] lo_rw_aio+0xc80/0xf00 [ 181.180231][ T66] ? __pfx_lo_rw_aio+0x10/0x10 [ 181.180261][ T66] ? kthread_associate_blkcg+0x490/0x600 [ 181.180282][ T66] ? rt_spin_unlock+0x160/0x200 [ 181.180300][ T66] loop_process_work+0x637/0x11b0 [ 181.180328][ T66] ? __pfx_loop_process_work+0x10/0x10 [ 181.180347][ T66] ? __lock_acquire+0x6b5/0x2cf0 [ 181.180367][ T66] ? look_up_lock_class+0x57/0x110 [ 181.180388][ T66] ? register_lock_class+0x31/0x2e0 [ 181.180409][ T66] ? __lock_acquire+0x6b5/0x2cf0 [ 181.180431][ T66] ? trace_hrtimer_start+0x82/0x200 [ 181.180450][ T66] ? do_raw_spin_lock+0x12b/0x2f0 [ 181.180467][ T66] ? lock_acquire+0x106/0x350 [ 181.180487][ T66] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 181.180506][ T66] ? process_scheduled_works+0xa70/0x1860 [ 181.180524][ T66] ? process_scheduled_works+0xa70/0x1860 [ 181.180544][ T66] ? process_scheduled_works+0xa70/0x1860 [ 181.180561][ T66] ? process_scheduled_works+0xa70/0x1860 [ 181.180579][ T66] process_scheduled_works+0xb5d/0x1860 [ 181.180608][ T66] ? __pfx_process_scheduled_works+0x10/0x10 [ 181.180628][ T66] ? assign_work+0x3d5/0x5e0 [ 181.180645][ T66] worker_thread+0xa53/0xfc0 [ 181.180674][ T66] kthread+0x388/0x470 [ 181.180694][ T66] ? __pfx_worker_thread+0x10/0x10 [ 181.180710][ T66] ? __pfx_kthread+0x10/0x10 [ 181.180731][ T66] ret_from_fork+0x514/0xb70 [ 181.180749][ T66] ? __pfx_ret_from_fork+0x10/0x10 [ 181.180767][ T66] ? __switch_to+0xc79/0x1410 [ 181.180791][ T66] ? __pfx_kthread+0x10/0x10 [ 181.180811][ T66] ret_from_fork_asm+0x1a/0x30 [ 181.180837][ T66] [ 181.180844][ T66] [ 181.180848][ T66] The buggy address belongs to the physical page: [ 181.180871][ T66] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888040de9640 pfn:0x40de9 [ 181.180889][ T66] flags: 0x80000000000000(node=0|zone=1) [ 181.180912][ T66] raw: 0080000000000000 ffffea0000aff6c8 ffffea0000acfb88 0000000000000000 [ 181.180926][ T66] raw: ffff888040de9640 0000000000000000 00000000ffffffff 0000000000000000 [ 181.180934][ T66] page dumped because: kasan: bad access detected [ 181.180947][ T66] page_owner tracks the page as freed [ 181.180953][ T66] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xdc0(GFP_KERNEL|__GFP_ZERO), pid 6667, tgid 6666 (syz.0.40), ts 181095501019, free_ts 181178128306 [ 181.180980][ T66] post_alloc_hook+0x231/0x280 [ 181.180996][ T66] get_page_from_freelist+0x27c8/0x2840 [ 181.181014][ T66] __alloc_frozen_pages_noprof+0x18d/0x380 [ 181.181031][ T66] alloc_pages_mpol+0xd1/0x380 [ 181.181056][ T66] alloc_pages_noprof+0xd2/0x2f0 [ 181.181072][ T66] lmLogInit+0x357/0x1a00 [ 181.181090][ T66] lmLogOpen+0x4e1/0xfa0 [ 181.181106][ T66] jfs_mount_rw+0xee/0x670 [ 181.181123][ T66] jfs_fill_super+0x754/0xd80 [ 181.181136][ T66] get_tree_bdev_flags+0x431/0x4f0 [ 181.181153][ T66] vfs_get_tree+0x92/0x2a0 [ 181.181168][ T66] do_new_mount+0x341/0xd30 [ 181.181187][ T66] __se_sys_mount+0x31d/0x420 [ 181.181207][ T66] do_syscall_64+0x15f/0xf80 [ 181.181225][ T66] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 181.181247][ T66] page last free pid 6458 tgid 6458 stack trace: [ 181.181257][ T66] __free_frozen_pages+0xfa6/0x10f0 [ 181.181285][ T66] lmLogShutdown+0x44e/0x850 [ 181.181303][ T66] lmLogClose+0x28a/0x520 [ 181.181321][ T66] jfs_umount+0x2fb/0x3d0 [ 181.181337][ T66] jfs_put_super+0x8c/0x190 [ 181.181349][ T66] generic_shutdown_super+0x13d/0x2d0 [ 181.181362][ T66] kill_block_super+0x44/0x90 [ 181.181377][ T66] deactivate_locked_super+0xbc/0x130 [ 181.181391][ T66] cleanup_mnt+0x437/0x4d0 [ 181.181405][ T66] task_work_run+0x1d9/0x270 [ 181.181425][ T66] exit_to_user_mode_loop+0xf3/0x4d0 [ 181.181443][ T66] do_syscall_64+0x33e/0xf80 [ 181.181460][ T66] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 181.181475][ T66] [ 181.181479][ T66] Memory state around the buggy address: [ 181.181488][ T66] ffff888040de8f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 181.181499][ T66] ffff888040de8f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 181.181511][ T66] >ffff888040de9000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 181.181518][ T66] ^ [ 181.181526][ T66] ffff888040de9080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 181.181537][ T66] ffff888040de9100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 181.181545][ T66] ================================================================== [ 181.183064][ T66] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 181.183083][ T66] CPU: 1 UID: 0 PID: 66 Comm: kworker/u8:4 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 181.183104][ T66] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 181.183115][ T66] Workqueue: loop0 loop_workfn [ 181.183140][ T66] Call Trace: [ 181.183146][ T66] [ 181.183154][ T66] vpanic+0x56c/0xa60 [ 181.183177][ T66] ? __pfx_vpanic+0x10/0x10 [ 181.183205][ T66] panic+0xc5/0xd0 [ 181.183222][ T66] ? __pfx_panic+0x10/0x10 [ 181.183249][ T66] ? preempt_schedule_thunk+0x16/0x30 [ 181.183273][ T66] ? copy_folio_from_iter_atomic+0xbb5/0x1ad0 [ 181.183291][ T66] ? preempt_schedule_thunk+0x16/0x30 [ 181.183314][ T66] ? copy_folio_from_iter_atomic+0xbb5/0x1ad0 [ 181.183331][ T66] check_panic_on_warn+0x89/0xb0 [ 181.183354][ T66] ? copy_folio_from_iter_atomic+0xbb5/0x1ad0 [ 181.183371][ T66] end_report+0x73/0x170 [ 181.183389][ T66] ? copy_folio_from_iter_atomic+0xbb5/0x1ad0 [ 181.183405][ T66] kasan_report+0x128/0x150 [ 181.183424][ T66] ? copy_folio_from_iter_atomic+0xbb5/0x1ad0 [ 181.183444][ T66] kasan_check_range+0x264/0x2c0 [ 181.183465][ T66] ? copy_folio_from_iter_atomic+0xbb5/0x1ad0 [ 181.183479][ T66] __asan_memcpy+0x29/0x70 [ 181.183499][ T66] copy_folio_from_iter_atomic+0xbb5/0x1ad0 [ 181.183522][ T66] ? __pfx_copy_folio_from_iter_atomic+0x10/0x10 [ 181.183554][ T66] ? ktime_get_coarse_real_ts64_mg+0x59/0x1e0 [ 181.183575][ T66] ? shmem_write_begin+0x1ce/0x320 [ 181.183594][ T66] generic_perform_write+0x5b1/0x8b0 [ 181.183616][ T66] ? __pfx_generic_perform_write+0x10/0x10 [ 181.183636][ T66] ? file_update_time_flags+0x3b9/0x4b0 [ 181.183655][ T66] shmem_file_write_iter+0xfb/0x120 [ 181.183678][ T66] lo_rw_aio+0xc80/0xf00 [ 181.183705][ T66] ? __pfx_lo_rw_aio+0x10/0x10 [ 181.183728][ T66] ? kthread_associate_blkcg+0x490/0x600 [ 181.183750][ T66] ? rt_spin_unlock+0x160/0x200 [ 181.183768][ T66] loop_process_work+0x637/0x11b0 [ 181.183796][ T66] ? __pfx_loop_process_work+0x10/0x10 [ 181.183816][ T66] ? __lock_acquire+0x6b5/0x2cf0 [ 181.183836][ T66] ? look_up_lock_class+0x57/0x110 [ 181.183856][ T66] ? register_lock_class+0x31/0x2e0 [ 181.183878][ T66] ? __lock_acquire+0x6b5/0x2cf0 [ 181.183900][ T66] ? trace_hrtimer_start+0x82/0x200 [ 181.183920][ T66] ? do_raw_spin_lock+0x12b/0x2f0 [ 181.183937][ T66] ? lock_acquire+0x106/0x350 [ 181.183958][ T66] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 181.183977][ T66] ? process_scheduled_works+0xa70/0x1860 [ 181.183995][ T66] ? process_scheduled_works+0xa70/0x1860 [ 181.184015][ T66] ? process_scheduled_works+0xa70/0x1860 [ 181.184031][ T66] ? process_scheduled_works+0xa70/0x1860 [ 181.184049][ T66] process_scheduled_works+0xb5d/0x1860 [ 181.184079][ T66] ? __pfx_process_scheduled_works+0x10/0x10 [ 181.184098][ T66] ? assign_work+0x3d5/0x5e0 [ 181.184117][ T66] worker_thread+0xa53/0xfc0 [ 181.184145][ T66] kthread+0x388/0x470 [ 181.184165][ T66] ? __pfx_worker_thread+0x10/0x10 [ 181.184182][ T66] ? __pfx_kthread+0x10/0x10 [ 181.184202][ T66] ret_from_fork+0x514/0xb70 [ 181.184221][ T66] ? __pfx_ret_from_fork+0x10/0x10 [ 181.184245][ T66] ? __switch_to+0xc79/0x1410 [ 181.184269][ T66] ? __pfx_kthread+0x10/0x10 [ 181.184289][ T66] ret_from_fork_asm+0x1a/0x30 [ 181.184315][ T66] [ 181.184645][ T66] Kernel Offset: disabled