[ 138.042515][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 138.046125][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 Warning: Permanently added '[localhost]:8557' (ED25519) to the list of known hosts. 2024/08/30 06:05:48 ignoring optional flag "sandboxArg"="0" 2024/08/30 06:05:49 parsed 1 programs [ 164.532285][ T5382] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 170.664740][ T2911] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 170.667893][ T2911] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 170.712236][ T2911] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 170.715998][ T2911] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 174.932422][ T5428] chnl_net:caif_netlink_parms(): no params data found [ 175.046072][ T5428] bridge0: port 1(bridge_slave_0) entered blocking state [ 175.059650][ T5428] bridge0: port 1(bridge_slave_0) entered disabled state [ 175.063073][ T5428] bridge_slave_0: entered allmulticast mode [ 175.070900][ T5428] bridge_slave_0: entered promiscuous mode [ 175.081823][ T5428] bridge0: port 2(bridge_slave_1) entered blocking state [ 175.084702][ T5428] bridge0: port 2(bridge_slave_1) entered disabled state [ 175.087600][ T5428] bridge_slave_1: entered allmulticast mode [ 175.110712][ T5428] bridge_slave_1: entered promiscuous mode [ 175.171938][ T5428] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 175.178610][ T5428] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 175.240382][ T5428] team0: Port device team_slave_0 added [ 175.251406][ T5428] team0: Port device team_slave_1 added [ 175.293745][ T5428] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 175.296557][ T5428] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 175.330387][ T5428] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 175.336234][ T5428] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 175.339312][ T5428] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 175.370527][ T5428] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 175.436544][ T5428] hsr_slave_0: entered promiscuous mode [ 175.451169][ T5428] hsr_slave_1: entered promiscuous mode [ 176.384628][ T5428] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 176.411884][ T5428] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 176.417582][ T5428] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 176.445908][ T5428] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 176.692803][ T5428] 8021q: adding VLAN 0 to HW filter on device bond0 [ 176.728392][ T5428] 8021q: adding VLAN 0 to HW filter on device team0 [ 176.764194][ T1029] bridge0: port 1(bridge_slave_0) entered blocking state [ 176.767055][ T1029] bridge0: port 1(bridge_slave_0) entered forwarding state [ 176.801184][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 176.804792][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 177.349789][ T5428] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 177.437843][ T5428] veth0_vlan: entered promiscuous mode [ 177.465213][ T5428] veth1_vlan: entered promiscuous mode [ 177.546267][ T5428] veth0_macvtap: entered promiscuous mode [ 177.581929][ T5428] veth1_macvtap: entered promiscuous mode [ 177.626269][ T5428] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 177.659177][ T5428] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 177.701200][ T5428] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 177.704988][ T5428] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 177.708391][ T5428] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 177.730578][ T5428] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 178.172509][ T165] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 178.315673][ T165] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 179.616147][ T5178] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 179.621146][ T5178] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 179.624619][ T5178] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 179.628542][ T5178] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 179.633707][ T5178] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 179.636698][ T5178] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 180.339168][ T165] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2024/08/30 06:06:16 executed programs: 0 [ 181.150505][ T4532] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 181.155270][ T4532] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 181.158449][ T4532] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 181.163250][ T4532] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 181.166844][ T4532] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 181.187076][ T4532] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 181.640934][ T5519] chnl_net:caif_netlink_parms(): no params data found [ 181.812663][ T5519] bridge0: port 1(bridge_slave_0) entered blocking state [ 181.829635][ T5519] bridge0: port 1(bridge_slave_0) entered disabled state [ 181.832542][ T5519] bridge_slave_0: entered allmulticast mode [ 181.846047][ T5519] bridge_slave_0: entered promiscuous mode [ 181.869013][ T5519] bridge0: port 2(bridge_slave_1) entered blocking state [ 181.882195][ T5519] bridge0: port 2(bridge_slave_1) entered disabled state [ 181.885139][ T5519] bridge_slave_1: entered allmulticast mode [ 181.910188][ T5519] bridge_slave_1: entered promiscuous mode [ 181.971577][ T5519] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 181.977300][ T5519] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 182.104208][ T165] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.147699][ T5519] team0: Port device team_slave_0 added [ 182.172907][ T5519] team0: Port device team_slave_1 added [ 182.250138][ T5519] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 182.252541][ T5519] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 182.287151][ T5519] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 182.312352][ T5519] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 182.315000][ T5519] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 182.367743][ T5519] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 182.623481][ T5519] hsr_slave_0: entered promiscuous mode [ 182.640524][ T5519] hsr_slave_1: entered promiscuous mode [ 182.655410][ T5519] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 182.658785][ T5519] Cannot create hsr debugfs directory [ 182.712160][ T165] bridge_slave_1: left allmulticast mode [ 182.714983][ T165] bridge_slave_1: left promiscuous mode [ 182.717763][ T165] bridge0: port 2(bridge_slave_1) entered disabled state [ 182.743699][ T165] bridge_slave_0: left allmulticast mode [ 182.745994][ T165] bridge_slave_0: left promiscuous mode [ 182.748479][ T165] bridge0: port 1(bridge_slave_0) entered disabled state [ 183.248459][ T4532] Bluetooth: hci0: command tx timeout [ 183.357346][ T165] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 183.370123][ T165] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 183.376229][ T165] bond0 (unregistering): Released all slaves [ 183.541465][ T165] hsr_slave_0: left promiscuous mode [ 183.544054][ T165] hsr_slave_1: left promiscuous mode [ 183.570493][ T165] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 183.573831][ T165] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 183.580876][ T165] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 183.583959][ T165] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 183.624384][ T165] veth1_macvtap: left promiscuous mode [ 183.627837][ T165] veth0_macvtap: left promiscuous mode [ 183.650299][ T165] veth1_vlan: left promiscuous mode [ 183.652457][ T165] veth0_vlan: left promiscuous mode [ 184.464505][ T165] team0 (unregistering): Port device team_slave_1 removed [ 184.523418][ T165] team0 (unregistering): Port device team_slave_0 removed [ 185.323196][ T4532] Bluetooth: hci0: command tx timeout [ 186.051777][ T5519] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 186.081282][ T5519] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 186.123592][ T5519] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 186.209007][ T5519] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 186.554884][ T5519] 8021q: adding VLAN 0 to HW filter on device bond0 [ 186.604126][ T5519] 8021q: adding VLAN 0 to HW filter on device team0 [ 186.635791][ T1029] bridge0: port 1(bridge_slave_0) entered blocking state [ 186.638605][ T1029] bridge0: port 1(bridge_slave_0) entered forwarding state [ 186.662790][ T2911] bridge0: port 2(bridge_slave_1) entered blocking state [ 186.665907][ T2911] bridge0: port 2(bridge_slave_1) entered forwarding state [ 186.718550][ T5519] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 186.739955][ T5519] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 187.117023][ T5519] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 187.231048][ T5519] veth0_vlan: entered promiscuous mode [ 187.262907][ T5519] veth1_vlan: entered promiscuous mode [ 187.342616][ T5519] veth0_macvtap: entered promiscuous mode [ 187.372616][ T5519] veth1_macvtap: entered promiscuous mode [ 187.402514][ T4532] Bluetooth: hci0: command tx timeout [ 187.409358][ T5519] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 187.433007][ T5519] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 187.456530][ T5519] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 187.483234][ T5519] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 187.486518][ T5519] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 187.500778][ T5519] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 187.633073][ T2911] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 187.635754][ T2911] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 187.690920][ T2911] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 187.696600][ T2911] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2024/08/30 06:06:23 executed programs: 2 [ 188.446229][ T5593] loop0: detected capacity change from 0 to 32768 [ 188.588558][ T5593] JBD2: Ignoring recovery information on journal [ 188.708771][ T5593] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 188.753142][ T24] audit: type=1800 audit(1724997984.230:2): pid=5593 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.15" name="file1" dev="loop0" ino=16946 res=0 errno=0 [ 188.843621][ T5519] ocfs2: Unmounting device (7,0) on (node local) [ 189.483212][ T4532] Bluetooth: hci0: command tx timeout [ 189.713555][ T5614] loop0: detected capacity change from 0 to 32768 [ 189.763013][ T5614] JBD2: Ignoring recovery information on journal [ 189.802631][ T5614] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 189.813179][ T24] audit: type=1800 audit(1724997985.290:3): pid=5614 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.16" name="file1" dev="loop0" ino=16946 res=0 errno=0 [ 189.846299][ T5519] ocfs2: Unmounting device (7,0) on (node local) [ 190.387343][ T5620] loop0: detected capacity change from 0 to 32768 [ 190.422368][ T5620] JBD2: Ignoring recovery information on journal [ 190.471708][ T5620] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 190.492640][ T5620] ================================================================== [ 190.496243][ T5620] BUG: KASAN: slab-out-of-bounds in ocfs2_search_dirblock+0x26b/0x830 [ 190.499353][ T5620] Read of size 1 at addr ffff8880364d0f42 by task syz.0.17/5620 [ 190.503257][ T5620] [ 190.504232][ T5620] CPU: 0 UID: 0 PID: 5620 Comm: syz.0.17 Not tainted 6.11.0-rc5-syzkaller-00176-g20371ba12063 #0 [ 190.508318][ T5620] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 190.512633][ T5620] Call Trace: [ 190.513972][ T5620] [ 190.515036][ T5620] dump_stack_lvl+0x241/0x360 [ 190.516840][ T5620] ? __pfx_dump_stack_lvl+0x10/0x10 [ 190.518891][ T5620] ? __pfx__printk+0x10/0x10 [ 190.521047][ T5620] ? _printk+0xd5/0x120 [ 190.523180][ T5620] ? __virt_addr_valid+0x183/0x530 [ 190.525362][ T5620] ? __virt_addr_valid+0x183/0x530 [ 190.527048][ T5620] print_report+0x169/0x550 [ 190.528647][ T5620] ? __virt_addr_valid+0x183/0x530 [ 190.530760][ T5620] ? __virt_addr_valid+0x183/0x530 [ 190.532966][ T5620] ? __virt_addr_valid+0x45f/0x530 [ 190.535133][ T5620] ? __phys_addr+0xba/0x170 [ 190.536915][ T5620] ? ocfs2_search_dirblock+0x26b/0x830 [ 190.539205][ T5620] kasan_report+0x143/0x180 [ 190.541486][ T5620] ? ocfs2_search_dirblock+0x26b/0x830 [ 190.544187][ T5620] ocfs2_search_dirblock+0x26b/0x830 [ 190.546254][ T5620] ? ocfs2_read_inode_block+0x14c/0x1e0 [ 190.548123][ T5620] ? __pfx_ocfs2_search_dirblock+0x10/0x10 [ 190.550055][ T5620] ? validate_chain+0x11e/0x5900 [ 190.551856][ T5620] ocfs2_find_entry+0x1169/0x2780 [ 190.553636][ T5620] ? mark_lock+0x9a/0x350 [ 190.555183][ T5620] ? __lock_acquire+0x137a/0x2040 [ 190.557301][ T5620] ? __pfx_ocfs2_find_entry+0x10/0x10 [ 190.559602][ T5620] ? __pfx_lock_acquire+0x10/0x10 [ 190.562451][ T5620] ? ocfs2_inode_lock_full_nested+0x17b/0x1c10 [ 190.565324][ T5620] ? __pfx_lock_release+0x10/0x10 [ 190.567215][ T5620] ? do_raw_spin_lock+0x14f/0x370 [ 190.569168][ T5620] ? do_raw_spin_unlock+0x58/0x8b0 [ 190.571064][ T5620] ? _raw_spin_unlock+0x28/0x50 [ 190.572908][ T5620] ? ocfs2_inode_lock_full_nested+0xb2f/0x1c10 [ 190.575456][ T5620] ? __pfx_ocfs2_inode_lock_full_nested+0x10/0x10 [ 190.578167][ T5620] ocfs2_find_files_on_disk+0xff/0x360 [ 190.580540][ T5620] ocfs2_lookup_ino_from_name+0xb1/0x1e0 [ 190.582662][ T5620] ? __pfx_ocfs2_lookup_ino_from_name+0x10/0x10 [ 190.584882][ T5620] ocfs2_lookup+0x292/0xa60 [ 190.586570][ T5620] ? __pfx_ocfs2_lookup+0x10/0x10 [ 190.588575][ T5620] ? from_kgid+0x1a7/0x730 [ 190.590391][ T5620] ? make_vfsgid+0x46/0x90 [ 190.592420][ T5620] ? HAS_UNMAPPED_ID+0xf9/0x150 [ 190.594701][ T5620] ? inode_permission+0xff/0x460 [ 190.596637][ T5620] ? __pfx_ocfs2_permission+0x10/0x10 [ 190.598596][ T5620] ? bpf_lsm_inode_create+0x9/0x10 [ 190.600487][ T5620] ? security_inode_create+0xc2/0x110 [ 190.602463][ T5620] ? __pfx_ocfs2_lookup+0x10/0x10 [ 190.604371][ T5620] path_openat+0x11cc/0x3470 [ 190.606120][ T5620] ? __pfx_path_openat+0x10/0x10 [ 190.607876][ T5620] do_filp_open+0x235/0x490 [ 190.609563][ T5620] ? __pfx_do_filp_open+0x10/0x10 [ 190.611635][ T5620] ? _raw_spin_unlock+0x28/0x50 [ 190.613746][ T5620] ? alloc_fd+0x5a1/0x640 [ 190.615741][ T5620] do_sys_openat2+0x13e/0x1d0 [ 190.617584][ T5620] ? __pfx_do_sys_openat2+0x10/0x10 [ 190.619397][ T5620] __x64_sys_openat+0x247/0x2a0 [ 190.621014][ T5620] ? __pfx___x64_sys_openat+0x10/0x10 [ 190.622886][ T5620] ? do_syscall_64+0x100/0x230 [ 190.625083][ T5620] ? do_syscall_64+0xb6/0x230 [ 190.627550][ T5620] do_syscall_64+0xf3/0x230 [ 190.629317][ T5620] ? clear_bhb_loop+0x35/0x90 [ 190.631204][ T5620] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 190.633370][ T5620] RIP: 0033:0x7f3fa09799b9 [ 190.634997][ T5620] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 190.642641][ T5620] RSP: 002b:00007f3fa1727038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 190.646580][ T5620] RAX: ffffffffffffffda RBX: 00007f3fa0b15f80 RCX: 00007f3fa09799b9 [ 190.649708][ T5620] RDX: 0000000000105042 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 190.652456][ T5620] RBP: 00007f3fa09e78d8 R08: 0000000000000000 R09: 0000000000000000 [ 190.655121][ T5620] R10: 00000000000001ff R11: 0000000000000246 R12: 0000000000000000 [ 190.657719][ T5620] R13: 0000000000000000 R14: 00007f3fa0b15f80 R15: 00007fff5e610cb8 [ 190.661036][ T5620] [ 190.662511][ T5620] [ 190.663550][ T5620] Allocated by task 1: [ 190.665127][ T5620] kasan_save_track+0x3f/0x80 [ 190.666814][ T5620] __kasan_slab_alloc+0x66/0x80 [ 190.668633][ T5620] kmem_cache_alloc_noprof+0x135/0x2a0 [ 190.670665][ T5620] __proc_create+0x44f/0xa50 [ 190.672366][ T5620] proc_create_data+0x128/0x2c0 [ 190.674280][ T5620] snd_info_register+0x1db/0x300 [ 190.676369][ T5620] snd_info_register+0x265/0x300 [ 190.678541][ T5620] snd_info_register+0x265/0x300 [ 190.680707][ T5620] snd_info_register+0x265/0x300 [ 190.682570][ T5620] snd_info_card_register+0x50/0x190 [ 190.684410][ T5620] snd_card_register+0x4fc/0x6c0 [ 190.686168][ T5620] loopback_probe+0xeb6/0x14f0 [ 190.687976][ T5620] platform_probe+0x13a/0x1c0 [ 190.689808][ T5620] really_probe+0x2b8/0xad0 [ 190.691549][ T5620] __driver_probe_device+0x1a2/0x390 [ 190.693607][ T5620] driver_probe_device+0x50/0x430 [ 190.696111][ T5620] __device_attach_driver+0x2d6/0x530 [ 190.699103][ T5620] bus_for_each_drv+0x24e/0x2e0 [ 190.701276][ T5620] __device_attach+0x333/0x520 [ 190.703722][ T5620] bus_probe_device+0x189/0x260 [ 190.705654][ T5620] device_add+0x856/0xbf0 [ 190.707316][ T5620] platform_device_add+0x45d/0x7c0 [ 190.709299][ T5620] platform_device_register_full+0x5eb/0x6f0 [ 190.711564][ T5620] alsa_card_loopback_init+0x15d/0x2e0 [ 190.713688][ T5620] do_one_initcall+0x248/0x880 [ 190.715536][ T5620] do_initcall_level+0x157/0x210 [ 190.717477][ T5620] do_initcalls+0x3f/0x80 [ 190.719226][ T5620] kernel_init_freeable+0x435/0x5d0 [ 190.721384][ T5620] kernel_init+0x1d/0x2b0 [ 190.723373][ T5620] ret_from_fork+0x4b/0x80 [ 190.725597][ T5620] ret_from_fork_asm+0x1a/0x30 [ 190.727643][ T5620] [ 190.728622][ T5620] The buggy address belongs to the object at ffff8880364d0dc0 [ 190.728622][ T5620] which belongs to the cache proc_dir_entry of size 256 [ 190.734193][ T5620] The buggy address is located 130 bytes to the right of [ 190.734193][ T5620] allocated 256-byte region [ffff8880364d0dc0, ffff8880364d0ec0) [ 190.740511][ T5620] [ 190.741589][ T5620] The buggy address belongs to the physical page: [ 190.744070][ T5620] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x364d0 [ 190.746963][ T5620] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 190.749660][ T5620] page_type: 0xfdffffff(slab) [ 190.751447][ T5620] raw: 04fff00000000000 ffff8880163748c0 dead000000000122 0000000000000000 [ 190.754509][ T5620] raw: 0000000000000000 00000000000c000c 00000001fdffffff 0000000000000000 [ 190.758359][ T5620] page dumped because: kasan: bad access detected [ 190.761059][ T5620] page_owner tracks the page as allocated [ 190.763308][ T5620] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 23812193436, free_ts 23382684759 [ 190.770203][ T5620] post_alloc_hook+0x1f3/0x230 [ 190.771848][ T5620] get_page_from_freelist+0x2e4c/0x2f10 [ 190.773913][ T5620] __alloc_pages_noprof+0x256/0x6c0 [ 190.776182][ T5620] alloc_slab_page+0x5f/0x120 [ 190.778385][ T5620] allocate_slab+0x5a/0x2f0 [ 190.780544][ T5620] ___slab_alloc+0xcd1/0x14b0 [ 190.782443][ T5620] __slab_alloc+0x58/0xa0 [ 190.784124][ T5620] kmem_cache_alloc_noprof+0x1c1/0x2a0 [ 190.786334][ T5620] __proc_create+0x44f/0xa50 [ 190.788179][ T5620] proc_create_data+0x128/0x2c0 [ 190.790052][ T5620] snd_info_register+0x1db/0x300 [ 190.791837][ T5620] snd_info_register+0x265/0x300 [ 190.793758][ T5620] snd_info_register+0x265/0x300 [ 190.795614][ T5620] snd_info_register+0x265/0x300 [ 190.797397][ T5620] snd_info_card_register+0x50/0x190 [ 190.799412][ T5620] snd_card_register+0x4fc/0x6c0 [ 190.801166][ T5620] page last free pid 8 tgid 8 stack trace: [ 190.803287][ T5620] free_unref_page+0xd22/0xea0 [ 190.804974][ T5620] vfree+0x186/0x2e0 [ 190.806439][ T5620] delayed_vfree_work+0x56/0x80 [ 190.808096][ T5620] process_scheduled_works+0xa2c/0x1830 [ 190.810320][ T5620] worker_thread+0x86d/0xd10 [ 190.812263][ T5620] kthread+0x2f0/0x390 [ 190.813778][ T5620] ret_from_fork+0x4b/0x80 [ 190.815368][ T5620] ret_from_fork_asm+0x1a/0x30 [ 190.817166][ T5620] [ 190.818080][ T5620] Memory state around the buggy address: [ 190.820214][ T5620] ffff8880364d0e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 190.823419][ T5620] ffff8880364d0e80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 190.827325][ T5620] >ffff8880364d0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 190.831518][ T5620] ^ [ 190.834337][ T5620] ffff8880364d0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 190.838034][ T5620] ffff8880364d1000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 190.841932][ T5620] ================================================================== [ 191.240286][ T5620] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 191.243211][ T5620] CPU: 0 UID: 0 PID: 5620 Comm: syz.0.17 Not tainted 6.11.0-rc5-syzkaller-00176-g20371ba12063 #0 [ 191.247465][ T5620] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 191.251415][ T5620] Call Trace: [ 191.252677][ T5620] [ 191.253854][ T5620] dump_stack_lvl+0x241/0x360 [ 191.255734][ T5620] ? __pfx_dump_stack_lvl+0x10/0x10 [ 191.258187][ T5620] ? __pfx__printk+0x10/0x10 [ 191.260698][ T5620] ? preempt_schedule+0xe1/0xf0 [ 191.262868][ T5620] ? vscnprintf+0x5d/0x90 [ 191.264568][ T5620] panic+0x349/0x860 [ 191.266226][ T5620] ? check_panic_on_warn+0x21/0xb0 [ 191.268254][ T5620] ? __pfx_panic+0x10/0x10 [ 191.270017][ T5620] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 191.272261][ T5620] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 191.275095][ T5620] ? print_report+0x502/0x550 [ 191.277240][ T5620] check_panic_on_warn+0x86/0xb0 [ 191.279252][ T5620] ? ocfs2_search_dirblock+0x26b/0x830 [ 191.281395][ T5620] end_report+0x77/0x160 [ 191.282775][ T5620] kasan_report+0x154/0x180 [ 191.284297][ T5620] ? ocfs2_search_dirblock+0x26b/0x830 [ 191.286357][ T5620] ocfs2_search_dirblock+0x26b/0x830 [ 191.288430][ T5620] ? ocfs2_read_inode_block+0x14c/0x1e0 [ 191.290415][ T5620] ? __pfx_ocfs2_search_dirblock+0x10/0x10 [ 191.292526][ T5620] ? validate_chain+0x11e/0x5900 [ 191.294549][ T5620] ocfs2_find_entry+0x1169/0x2780 [ 191.296552][ T5620] ? mark_lock+0x9a/0x350 [ 191.298319][ T5620] ? __lock_acquire+0x137a/0x2040 [ 191.300486][ T5620] ? __pfx_ocfs2_find_entry+0x10/0x10 [ 191.303113][ T5620] ? __pfx_lock_acquire+0x10/0x10 [ 191.305247][ T5620] ? ocfs2_inode_lock_full_nested+0x17b/0x1c10 [ 191.307623][ T5620] ? __pfx_lock_release+0x10/0x10 [ 191.309564][ T5620] ? do_raw_spin_lock+0x14f/0x370 [ 191.311498][ T5620] ? do_raw_spin_unlock+0x58/0x8b0 [ 191.313558][ T5620] ? _raw_spin_unlock+0x28/0x50 [ 191.315305][ T5620] ? ocfs2_inode_lock_full_nested+0xb2f/0x1c10 [ 191.317584][ T5620] ? __pfx_ocfs2_inode_lock_full_nested+0x10/0x10 [ 191.320539][ T5620] ocfs2_find_files_on_disk+0xff/0x360 [ 191.323451][ T5620] ocfs2_lookup_ino_from_name+0xb1/0x1e0 [ 191.325936][ T5620] ? __pfx_ocfs2_lookup_ino_from_name+0x10/0x10 [ 191.328228][ T5620] ocfs2_lookup+0x292/0xa60 [ 191.329903][ T5620] ? __pfx_ocfs2_lookup+0x10/0x10 [ 191.331517][ T5620] ? from_kgid+0x1a7/0x730 [ 191.333101][ T5620] ? make_vfsgid+0x46/0x90 [ 191.334707][ T5620] ? HAS_UNMAPPED_ID+0xf9/0x150 [ 191.336601][ T5620] ? inode_permission+0xff/0x460 [ 191.338493][ T5620] ? __pfx_ocfs2_permission+0x10/0x10 [ 191.340608][ T5620] ? bpf_lsm_inode_create+0x9/0x10 [ 191.342755][ T5620] ? security_inode_create+0xc2/0x110 [ 191.345053][ T5620] ? __pfx_ocfs2_lookup+0x10/0x10 [ 191.347128][ T5620] path_openat+0x11cc/0x3470 [ 191.349005][ T5620] ? __pfx_path_openat+0x10/0x10 [ 191.350944][ T5620] do_filp_open+0x235/0x490 [ 191.352672][ T5620] ? __pfx_do_filp_open+0x10/0x10 [ 191.354643][ T5620] ? _raw_spin_unlock+0x28/0x50 [ 191.356549][ T5620] ? alloc_fd+0x5a1/0x640 [ 191.358250][ T5620] do_sys_openat2+0x13e/0x1d0 [ 191.360135][ T5620] ? __pfx_do_sys_openat2+0x10/0x10 [ 191.362823][ T5620] __x64_sys_openat+0x247/0x2a0 [ 191.365337][ T5620] ? __pfx___x64_sys_openat+0x10/0x10 [ 191.367748][ T5620] ? do_syscall_64+0x100/0x230 [ 191.369606][ T5620] ? do_syscall_64+0xb6/0x230 [ 191.371451][ T5620] do_syscall_64+0xf3/0x230 [ 191.373168][ T5620] ? clear_bhb_loop+0x35/0x90 [ 191.374948][ T5620] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 191.377090][ T5620] RIP: 0033:0x7f3fa09799b9 [ 191.378630][ T5620] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 191.387700][ T5620] RSP: 002b:00007f3fa1727038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 191.391003][ T5620] RAX: ffffffffffffffda RBX: 00007f3fa0b15f80 RCX: 00007f3fa09799b9 [ 191.394103][ T5620] RDX: 0000000000105042 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 191.397401][ T5620] RBP: 00007f3fa09e78d8 R08: 0000000000000000 R09: 0000000000000000 [ 191.400758][ T5620] R10: 00000000000001ff R11: 0000000000000246 R12: 0000000000000000 [ 191.403936][ T5620] R13: 0000000000000000 R14: 00007f3fa0b15f80 R15: 00007fff5e610cb8 [ 191.406506][ T5620] [ 191.407770][ T5620] Kernel Offset: disabled [ 191.409456][ T5620] Rebooting in 86400 seconds..