Warning: Permanently added '10.128.1.179' (ED25519) to the list of known hosts. 2026/09/20 22:05:37 parsed 1 programs [ 37.509935][ T24] kauditd_printk_skb: 31 callbacks suppressed [ 37.509946][ T24] audit: type=1400 audit(1789941937.900:105): avc: denied { unlink } for pid=438 comm="syz-executor" name="swap-file" dev="sda1" ino=2027 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 37.626703][ T438] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 38.132335][ T24] audit: type=1401 audit(1789941938.520:106): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 38.496245][ T448] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.520875][ T448] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.538036][ T24] audit: type=1400 audit(1789941938.930:107): avc: denied { create } for pid=488 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 38.542899][ T448] device bridge_slave_0 entered promiscuous mode [ 38.599155][ T448] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.607076][ T448] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.615258][ T448] device bridge_slave_1 entered promiscuous mode [ 38.728292][ T448] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.735859][ T448] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.744138][ T448] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.751449][ T448] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.789543][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.799204][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.807711][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 38.817061][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 38.835539][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 38.844261][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.851358][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.859144][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 38.868794][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.876006][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.883942][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 38.900670][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 38.914674][ T448] device veth0_vlan entered promiscuous mode [ 38.921215][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 38.930815][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 38.940338][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 38.948530][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 38.962488][ T448] device veth1_macvtap entered promiscuous mode [ 38.974384][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 38.996219][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 39.006700][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/09/20 22:05:39 executed programs: 0 [ 39.040844][ T24] audit: type=1400 audit(1789941939.430:108): avc: denied { write } for pid=429 comm="syz-execprog" path="pipe:[15842]" dev="pipefs" ino=15842 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 39.149969][ T505] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.157445][ T505] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.164916][ T505] device bridge_slave_0 entered promiscuous mode [ 39.172134][ T505] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.179352][ T505] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.187079][ T505] device bridge_slave_1 entered promiscuous mode [ 39.201139][ T509] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.208656][ T509] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.216613][ T509] device bridge_slave_0 entered promiscuous mode [ 39.224298][ T509] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.231345][ T509] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.238954][ T509] device bridge_slave_1 entered promiscuous mode [ 39.341943][ T507] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.349120][ T507] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.357319][ T507] device bridge_slave_0 entered promiscuous mode [ 39.364947][ T507] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.372174][ T507] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.379916][ T507] device bridge_slave_1 entered promiscuous mode [ 39.416783][ T510] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.423985][ T510] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.431510][ T510] device bridge_slave_0 entered promiscuous mode [ 39.440053][ T510] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.448060][ T510] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.456946][ T510] device bridge_slave_1 entered promiscuous mode [ 39.485428][ T512] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.493200][ T512] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.501459][ T512] device bridge_slave_0 entered promiscuous mode [ 39.511303][ T512] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.518669][ T512] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.526418][ T512] device bridge_slave_1 entered promiscuous mode [ 39.664341][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 39.672179][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 39.696035][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 39.704897][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 39.713836][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.720990][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.728818][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 39.737467][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 39.746199][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.753460][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.761002][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 39.783504][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 39.791629][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 39.799891][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 39.823450][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 39.831705][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 39.840004][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 39.849451][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.856881][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.864774][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 39.873370][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.880525][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.888913][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 39.907003][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 39.915692][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 39.924956][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 39.933126][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 39.943549][ T509] device veth0_vlan entered promiscuous mode [ 39.971705][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 39.980248][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 39.988933][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 39.997103][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 40.005582][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 40.013625][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 40.021974][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 40.030346][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 40.038571][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.046453][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.054102][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 40.062375][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 40.070678][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.077706][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.085310][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 40.093566][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 40.101207][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 40.109296][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 40.128465][ T509] device veth1_macvtap entered promiscuous mode [ 40.137148][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 40.146359][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 40.155869][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 40.165015][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.172149][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.180322][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 40.188778][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 40.197124][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.204560][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.212235][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 40.220014][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 40.227525][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 40.235996][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 40.244568][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 40.252663][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 40.260582][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 40.268949][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.276550][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.284165][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 40.292359][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 40.306262][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 40.314451][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 40.323440][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 40.331761][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 40.347250][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 40.355381][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.362571][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.385773][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 40.394643][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 40.402337][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 40.415197][ T512] device veth0_vlan entered promiscuous mode [ 40.424581][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 40.433400][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 40.441729][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 40.450388][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 40.458501][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 40.467364][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 40.483062][ T505] device veth0_vlan entered promiscuous mode [ 40.492956][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 40.501140][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 40.509409][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 40.517997][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 40.526948][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 40.535566][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 40.544049][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 40.551575][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 40.566235][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 40.574998][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 40.588620][ T505] device veth1_macvtap entered promiscuous mode [ 40.599592][ T512] device veth1_macvtap entered promiscuous mode [ 40.616343][ T507] device veth0_vlan entered promiscuous mode [ 40.623185][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 40.631761][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 40.640590][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 40.649859][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 40.659042][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 40.668398][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 40.676533][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 40.685627][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 40.694507][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 40.703764][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 40.712637][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 40.720973][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 40.729702][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 40.737286][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 40.784648][ T510] device veth0_vlan entered promiscuous mode [ 40.804033][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 40.813674][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 40.833165][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 40.852950][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 40.875415][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 40.893134][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 40.911803][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 40.932039][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 40.952551][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 40.960486][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 41.021157][ T507] device veth1_macvtap entered promiscuous mode [ 41.033437][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 41.043556][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 41.062372][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 41.087619][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 41.103144][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 41.134854][ T510] device veth1_macvtap entered promiscuous mode [ 41.168037][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 41.183162][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 41.201828][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 41.233048][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 41.252250][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 41.279732][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 41.299470][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 41.322566][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 41.352135][ T528] ====================================================== [ 41.352135][ T528] WARNING: the mand mount option is being deprecated and [ 41.352135][ T528] will be removed in v5.15! [ 41.352135][ T528] ====================================================== [ 41.352629][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 41.390189][ T528] F2FS-fs (loop2): invalid crc value [ 41.420629][ T528] F2FS-fs (loop2): Found nat_bits in checkpoint [ 41.503921][ T528] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 41.511858][ T24] audit: type=1400 audit(1789941941.900:109): avc: denied { mount } for pid=527 comm="syz.2.19" name="/" dev="loop2" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 41.543546][ T528] F2FS-fs (loop2): access invalid blkaddr:2147563524 [ 41.551137][ T528] CPU: 0 PID: 528 Comm: syz.2.19 Not tainted syzkaller #0 [ 41.559395][ T528] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 41.570825][ T528] Call Trace: [ 41.574239][ T528] __dump_stack+0x21/0x24 [ 41.579099][ T528] dump_stack_lvl+0x1a7/0x208 [ 41.584160][ T528] ? __bpf_trace_f2fs_fiemap+0x60/0x60 [ 41.589831][ T528] ? _raw_spin_lock+0x94/0xf0 [ 41.595202][ T528] ? show_regs_print_info+0x18/0x18 [ 41.601467][ T528] ? f2fs_init_extent_tree+0x7a0/0xc90 [ 41.608610][ T528] ? memcpy+0x56/0x70 [ 41.613724][ T528] dump_stack+0x15/0x1c [ 41.617927][ T528] f2fs_is_valid_blkaddr+0xc2f/0x1330 [ 41.623769][ T528] f2fs_iget+0x1a41/0x4af0 [ 41.628521][ T528] f2fs_lookup+0x419/0xd20 [ 41.633230][ T528] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 41.640888][ T528] ? d_hash_and_lookup+0x1f0/0x1f0 [ 41.646118][ T528] ? _raw_spin_lock_irqsave+0xc2/0x130 [ 41.652216][ T528] ? __kasan_check_write+0x14/0x20 [ 41.658670][ T528] __lookup_slow+0x2b8/0x410 [ 41.663621][ T528] ? lookup_one_len+0x2d0/0x2d0 [ 41.668578][ T528] ? lookup_fast+0x316/0x740 [ 41.673441][ T528] ? __kasan_check_write+0x14/0x20 [ 41.678817][ T528] lookup_slow+0x57/0x70 [ 41.683089][ T528] walk_component+0x326/0x460 [ 41.688096][ T528] path_lookupat+0x155/0x430 [ 41.693201][ T528] filename_lookup+0x1fd/0x660 [ 41.698496][ T528] ? hashlen_string+0x120/0x120 [ 41.703731][ T528] ? getname_flags+0x205/0x510 [ 41.708723][ T528] user_path_at_empty+0x43/0x50 [ 41.713965][ T528] do_sys_truncate+0xb6/0x1c0 [ 41.719108][ T528] ? fpu__clear_all+0x20/0x20 [ 41.723824][ T528] ? locks_verify_truncate+0x170/0x170 [ 41.729636][ T528] ? __kasan_check_read+0x11/0x20 [ 41.735522][ T528] __x64_sys_truncate+0x5b/0x70 [ 41.740693][ T528] do_syscall_64+0x31/0x40 [ 41.745760][ T528] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 41.752519][ T528] RIP: 0033:0x7f0347a57339 [ 41.757087][ T528] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 41.778920][ T528] RSP: 002b:00007f03478bc028 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 41.788531][ T528] RAX: ffffffffffffffda RBX: 00007f0347c92fa0 RCX: 00007f0347a57339 [ 41.798577][ T528] RDX: 0000000000000000 RSI: 0000000000001c9e RDI: 0000200000000280 [ 41.807875][ T528] RBP: 00007f0347aead68 R08: 0000000000000000 R09: 0000000000000000 [ 41.816957][ T528] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 41.825716][ T528] R13: 00007f0347c93038 R14: 00007f0347c92fa0 R15: 00007ffe91e80188 [ 41.922972][ T528] F2FS-fs (loop2): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 41.936506][ T544] F2FS-fs (loop2): access invalid blkaddr:2147563524 [ 41.943657][ T530] F2FS-fs (loop3): invalid crc value [ 41.943704][ T544] CPU: 1 PID: 544 Comm: syz.2.19 Not tainted syzkaller #0 [ 41.956281][ T544] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 41.967348][ T544] Call Trace: [ 41.971022][ T544] __dump_stack+0x21/0x24 [ 41.975555][ T544] dump_stack_lvl+0x1a7/0x208 [ 41.980453][ T544] ? __bpf_trace_f2fs_fiemap+0x60/0x60 [ 41.986010][ T544] ? _raw_write_lock+0x94/0xf0 [ 41.990783][ T544] ? show_regs_print_info+0x18/0x18 [ 41.996001][ T544] dump_stack+0x15/0x1c [ 42.000361][ T544] f2fs_is_valid_blkaddr+0xc2f/0x1330 [ 42.005865][ T544] f2fs_iget+0x1a41/0x4af0 [ 42.010389][ T544] f2fs_lookup+0x419/0xd20 [ 42.015169][ T544] ? try_to_unlazy+0x39d/0x630 [ 42.020037][ T544] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 42.026298][ T544] ? d_hash_and_lookup+0x1f0/0x1f0 [ 42.031581][ T544] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 42.037766][ T544] path_openat+0x145d/0x3040 [ 42.042370][ T544] ? do_filp_open+0x400/0x400 [ 42.045655][ T530] F2FS-fs (loop3): Found nat_bits in checkpoint [ 42.047061][ T544] do_filp_open+0x1df/0x400 [ 42.058058][ T544] ? vfs_tmpfile+0x2c0/0x2c0 [ 42.062851][ T544] ? get_unused_fd_flags+0x92/0xa0 [ 42.068088][ T544] do_sys_openat2+0x19f/0x750 [ 42.072809][ T544] ? __se_sys_rt_sigprocmask+0x22c/0x290 [ 42.078883][ T544] ? do_sys_open+0xe0/0xe0 [ 42.083359][ T544] ? __x64_sys_rt_sigprocmask+0xb0/0xb0 [ 42.089385][ T544] ? switch_fpu_return+0x19c/0x330 [ 42.094689][ T544] __x64_sys_openat+0x136/0x160 [ 42.099636][ T544] do_syscall_64+0x31/0x40 [ 42.104480][ T544] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 42.110409][ T544] RIP: 0033:0x7f0347a57339 [ 42.114859][ T544] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 42.135982][ T544] RSP: 002b:00007f034789b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 42.145135][ T544] RAX: ffffffffffffffda RBX: 00007f0347c93090 RCX: 00007f0347a57339 [ 42.153767][ T544] RDX: 0000000000101000 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 42.161938][ T544] RBP: 00007f0347aead68 R08: 0000000000000000 R09: 0000000000000000 [ 42.170096][ T544] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 42.178631][ T544] R13: 00007f0347c93128 R14: 00007f0347c93090 R15: 00007ffe91e80188 [ 42.213079][ T530] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 42.243564][ T530] F2FS-fs (loop3): access invalid blkaddr:2147563524 [ 42.251003][ T530] CPU: 0 PID: 530 Comm: syz.3.20 Not tainted syzkaller #0 [ 42.259165][ T530] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 42.273437][ T530] Call Trace: [ 42.277651][ T530] __dump_stack+0x21/0x24 [ 42.284953][ T530] dump_stack_lvl+0x1a7/0x208 [ 42.292264][ T530] ? __bpf_trace_f2fs_fiemap+0x60/0x60 [ 42.300550][ T530] ? _raw_spin_lock+0x94/0xf0 [ 42.307150][ T530] ? show_regs_print_info+0x18/0x18 [ 42.312988][ T530] ? f2fs_init_extent_tree+0x7a0/0xc90 [ 42.319110][ T530] ? memcpy+0x56/0x70 [ 42.323485][ T530] dump_stack+0x15/0x1c [ 42.328064][ T530] f2fs_is_valid_blkaddr+0xc2f/0x1330 [ 42.333994][ T530] f2fs_iget+0x1a41/0x4af0 [ 42.338451][ T530] f2fs_lookup+0x419/0xd20 [ 42.343434][ T530] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 42.349606][ T530] ? d_hash_and_lookup+0x1f0/0x1f0 [ 42.354816][ T530] ? __kasan_check_write+0x14/0x20 [ 42.360109][ T530] __lookup_slow+0x2b8/0x410 [ 42.364696][ T530] ? lookup_one_len+0x2d0/0x2d0 [ 42.369534][ T530] ? lookup_fast+0x316/0x740 [ 42.374116][ T530] ? __kasan_check_write+0x14/0x20 [ 42.379441][ T530] lookup_slow+0x57/0x70 [ 42.383783][ T530] walk_component+0x326/0x460 [ 42.388543][ T530] path_lookupat+0x155/0x430 [ 42.393236][ T530] filename_lookup+0x1fd/0x660 [ 42.398193][ T530] ? hashlen_string+0x120/0x120 [ 42.403480][ T530] ? getname_flags+0x205/0x510 [ 42.408242][ T530] user_path_at_empty+0x43/0x50 [ 42.413174][ T530] do_sys_truncate+0xb6/0x1c0 [ 42.418022][ T530] ? fpu__clear_all+0x20/0x20 [ 42.422695][ T530] ? locks_verify_truncate+0x170/0x170 [ 42.428148][ T530] ? __kasan_check_read+0x11/0x20 [ 42.433189][ T530] __x64_sys_truncate+0x5b/0x70 [ 42.438066][ T530] do_syscall_64+0x31/0x40 [ 42.442678][ T530] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 42.448795][ T530] RIP: 0033:0x7feb75997339 [ 42.453307][ T530] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 42.473445][ T530] RSP: 002b:00007feb757fc028 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 42.482063][ T530] RAX: ffffffffffffffda RBX: 00007feb75bd2fa0 RCX: 00007feb75997339 [ 42.490328][ T530] RDX: 0000000000000000 RSI: 0000000000001c9e RDI: 0000200000000280 [ 42.498749][ T530] RBP: 00007feb75a2ad68 R08: 0000000000000000 R09: 0000000000000000 [ 42.506984][ T530] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 42.515126][ T530] R13: 00007feb75bd3038 R14: 00007feb75bd2fa0 R15: 00007ffce4ace8c8 [ 42.552817][ T530] F2FS-fs (loop3): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 42.582933][ T549] F2FS-fs (loop3): access invalid blkaddr:2147563524 [ 42.602952][ T549] CPU: 1 PID: 549 Comm: syz.3.20 Not tainted syzkaller #0 [ 42.610203][ T549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 42.620543][ T549] Call Trace: [ 42.623861][ T549] __dump_stack+0x21/0x24 [ 42.628215][ T549] dump_stack_lvl+0x1a7/0x208 [ 42.633020][ T549] ? __bpf_trace_f2fs_fiemap+0x60/0x60 [ 42.638588][ T549] ? _raw_write_lock+0x94/0xf0 [ 42.643464][ T549] ? show_regs_print_info+0x18/0x18 [ 42.648695][ T549] dump_stack+0x15/0x1c [ 42.652882][ T549] f2fs_is_valid_blkaddr+0xc2f/0x1330 [ 42.658450][ T549] f2fs_iget+0x1a41/0x4af0 [ 42.662910][ T549] f2fs_lookup+0x419/0xd20 [ 42.667458][ T549] ? try_to_unlazy+0x39d/0x630 [ 42.672748][ T549] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 42.679216][ T549] ? d_hash_and_lookup+0x1f0/0x1f0 [ 42.684736][ T549] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 42.690400][ T544] ================================================================== [ 42.690840][ T549] path_openat+0x145d/0x3040 [ 42.699004][ T544] BUG: KASAN: use-after-free in f2fs_iget+0x4295/0x4af0 [ 42.703911][ T549] ? do_filp_open+0x400/0x400 [ 42.713299][ T544] Read of size 4 at addr ffff88812ec57878 by task syz.2.19/544 [ 42.718328][ T549] do_filp_open+0x1df/0x400 [ 42.725974][ T544] [ 42.730613][ T549] ? vfs_tmpfile+0x2c0/0x2c0 [ 42.737697][ T549] ? get_unused_fd_flags+0x92/0xa0 [ 42.742810][ T549] do_sys_openat2+0x19f/0x750 [ 42.747670][ T549] ? __se_sys_rt_sigprocmask+0x22c/0x290 [ 42.753508][ T549] ? do_sys_open+0xe0/0xe0 [ 42.758007][ T549] ? __x64_sys_rt_sigprocmask+0xb0/0xb0 [ 42.763749][ T549] ? switch_fpu_return+0x19c/0x330 [ 42.769050][ T549] __x64_sys_openat+0x136/0x160 [ 42.774006][ T549] do_syscall_64+0x31/0x40 [ 42.778517][ T549] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 42.784938][ T549] RIP: 0033:0x7feb75997339 [ 42.789714][ T549] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 42.810009][ T549] RSP: 002b:00007feb757db028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 42.818941][ T549] RAX: ffffffffffffffda RBX: 00007feb75bd3090 RCX: 00007feb75997339 [ 42.826920][ T549] RDX: 0000000000101000 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 42.835179][ T549] RBP: 00007feb75a2ad68 R08: 0000000000000000 R09: 0000000000000000 [ 42.843170][ T549] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 42.851572][ T549] R13: 00007feb75bd3128 R14: 00007feb75bd3090 R15: 00007ffce4ace8c8 [ 42.859746][ T544] CPU: 0 PID: 544 Comm: syz.2.19 Not tainted syzkaller #0 [ 42.867497][ T544] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 42.877851][ T544] Call Trace: [ 42.881265][ T544] __dump_stack+0x21/0x24 [ 42.886046][ T544] dump_stack_lvl+0x1a7/0x208 [ 42.890841][ T544] ? show_regs_print_info+0x18/0x18 [ 42.896143][ T544] ? thaw_kernel_threads+0x220/0x220 [ 42.901449][ T544] ? _raw_write_lock+0x94/0xf0 [ 42.906250][ T544] ? show_regs_print_info+0x18/0x18 [ 42.911631][ T544] print_address_description+0x7f/0x2c0 [ 42.917175][ T544] ? f2fs_iget+0x4295/0x4af0 [ 42.921823][ T544] kasan_report+0x100/0x140 [ 42.926318][ T544] ? f2fs_iget+0x4295/0x4af0 [ 42.931013][ T544] __asan_report_load4_noabort+0x14/0x20 [ 42.936810][ T544] f2fs_iget+0x4295/0x4af0 [ 42.941220][ T544] f2fs_lookup+0x419/0xd20 [ 42.945648][ T544] ? try_to_unlazy+0x39d/0x630 [ 42.950420][ T544] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 42.956503][ T544] ? d_hash_and_lookup+0x1f0/0x1f0 [ 42.961619][ T544] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 42.967793][ T544] path_openat+0x145d/0x3040 [ 42.972627][ T544] ? do_filp_open+0x400/0x400 [ 42.977302][ T544] do_filp_open+0x1df/0x400 [ 42.981801][ T544] ? vfs_tmpfile+0x2c0/0x2c0 [ 42.986389][ T544] ? get_unused_fd_flags+0x92/0xa0 [ 42.991683][ T544] do_sys_openat2+0x19f/0x750 [ 42.996448][ T544] ? __se_sys_rt_sigprocmask+0x22c/0x290 [ 43.002515][ T544] ? do_sys_open+0xe0/0xe0 [ 43.007128][ T544] ? __x64_sys_rt_sigprocmask+0xb0/0xb0 [ 43.012669][ T544] ? switch_fpu_return+0x19c/0x330 [ 43.017787][ T544] __x64_sys_openat+0x136/0x160 [ 43.022818][ T544] do_syscall_64+0x31/0x40 [ 43.027227][ T544] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 43.033568][ T544] RIP: 0033:0x7f0347a57339 [ 43.037980][ T544] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 43.058556][ T544] RSP: 002b:00007f034789b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 43.067241][ T544] RAX: ffffffffffffffda RBX: 00007f0347c93090 RCX: 00007f0347a57339 [ 43.075468][ T544] RDX: 0000000000101000 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 43.083447][ T544] RBP: 00007f0347aead68 R08: 0000000000000000 R09: 0000000000000000 [ 43.091506][ T544] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 43.099498][ T544] R13: 00007f0347c93128 R14: 00007f0347c93090 R15: 00007ffe91e80188 [ 43.107643][ T544] [ 43.110060][ T544] Allocated by task 528: [ 43.114390][ T544] __kasan_slab_alloc+0xb7/0xe0 [ 43.119243][ T544] slab_post_alloc_hook+0x5d/0x2f0 [ 43.124344][ T544] kmem_cache_alloc+0x15a/0x2d0 [ 43.129211][ T544] f2fs_init_extent_tree+0x502/0xc90 [ 43.135100][ T544] f2fs_iget+0xf7d/0x4af0 [ 43.139507][ T544] f2fs_lookup+0x419/0xd20 [ 43.143936][ T544] __lookup_slow+0x2b8/0x410 [ 43.148609][ T544] lookup_slow+0x57/0x70 [ 43.153112][ T544] walk_component+0x326/0x460 [ 43.158045][ T544] path_lookupat+0x155/0x430 [ 43.162721][ T544] filename_lookup+0x1fd/0x660 [ 43.167936][ T544] user_path_at_empty+0x43/0x50 [ 43.172792][ T544] do_sys_truncate+0xb6/0x1c0 [ 43.177458][ T544] __x64_sys_truncate+0x5b/0x70 [ 43.182304][ T544] do_syscall_64+0x31/0x40 [ 43.186711][ T544] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 43.192937][ T544] [ 43.195644][ T544] Freed by task 528: [ 43.199720][ T544] kasan_set_track+0x4a/0x70 [ 43.204485][ T544] kasan_set_free_info+0x23/0x40 [ 43.209629][ T544] ____kasan_slab_free+0x125/0x160 [ 43.215170][ T544] __kasan_slab_free+0x11/0x20 [ 43.220091][ T544] slab_free_freelist_hook+0xc5/0x190 [ 43.225736][ T544] kmem_cache_free+0x100/0x2d0 [ 43.230581][ T544] f2fs_destroy_extent_tree+0x2d7/0x4e0 [ 43.236399][ T544] f2fs_evict_inode+0x3fe/0x14a0 [ 43.241419][ T544] evict+0x4a9/0x940 [ 43.245335][ T544] iput+0x654/0x7e0 [ 43.249410][ T544] iget_failed+0x162/0x1a0 [ 43.253906][ T544] f2fs_iget+0x165b/0x4af0 [ 43.258399][ T544] f2fs_lookup+0x419/0xd20 [ 43.262903][ T544] __lookup_slow+0x2b8/0x410 [ 43.267573][ T544] lookup_slow+0x57/0x70 [ 43.271905][ T544] walk_component+0x326/0x460 [ 43.276863][ T544] path_lookupat+0x155/0x430 [ 43.281529][ T544] filename_lookup+0x1fd/0x660 [ 43.286563][ T544] user_path_at_empty+0x43/0x50 [ 43.291418][ T544] do_sys_truncate+0xb6/0x1c0 [ 43.296089][ T544] __x64_sys_truncate+0x5b/0x70 [ 43.300963][ T544] do_syscall_64+0x31/0x40 [ 43.305493][ T544] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 43.311858][ T544] [ 43.314204][ T544] The buggy address belongs to the object at ffff88812ec57850 [ 43.314204][ T544] which belongs to the cache f2fs_extent_tree of size 80 [ 43.329374][ T544] The buggy address is located 40 bytes inside of [ 43.329374][ T544] 80-byte region [ffff88812ec57850, ffff88812ec578a0) [ 43.342771][ T544] The buggy address belongs to the page: [ 43.348597][ T544] page:ffffea0004bb15c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12ec57 [ 43.359455][ T544] flags: 0x4000000000000200(slab) [ 43.364574][ T544] raw: 4000000000000200 dead000000000100 dead000000000122 ffff8881029c7800 [ 43.373175][ T544] raw: 0000000000000000 0000000080240024 00000001ffffffff 0000000000000000 [ 43.381772][ T544] page dumped because: kasan: bad access detected [ 43.388456][ T544] page_owner tracks the page as allocated [ 43.394206][ T544] page last allocated via order 0, migratetype Reclaimable, gfp_mask 0x112c50(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 528, ts 41543487001, free_ts 0 [ 43.413514][ T544] prep_new_page+0x176/0x190 [ 43.418474][ T544] get_page_from_freelist+0x225f/0x23f0 [ 43.424620][ T544] __alloc_pages_nodemask+0x29a/0x640 [ 43.431923][ T544] new_slab+0x84/0x3f0 [ 43.436540][ T544] ___slab_alloc+0x2f8/0x4c0 [ 43.442229][ T544] __slab_alloc+0x63/0xa0 [ 43.446874][ T544] kmem_cache_alloc+0x1a4/0x2d0 [ 43.452508][ T544] f2fs_init_extent_tree+0x502/0xc90 [ 43.458343][ T544] f2fs_iget+0xf7d/0x4af0 [ 43.463000][ T544] f2fs_lookup+0x419/0xd20 [ 43.467578][ T544] __lookup_slow+0x2b8/0x410 [ 43.472408][ T544] lookup_slow+0x57/0x70 [ 43.476696][ T544] walk_component+0x326/0x460 [ 43.482141][ T544] path_lookupat+0x155/0x430 [ 43.486844][ T544] filename_lookup+0x1fd/0x660 [ 43.491624][ T544] user_path_at_empty+0x43/0x50 [ 43.496816][ T544] page_owner free stack trace missing [ 43.502190][ T544] [ 43.504532][ T544] Memory state around the buggy address: [ 43.510377][ T544] ffff88812ec57700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 43.518446][ T544] ffff88812ec57780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 43.526822][ T544] >ffff88812ec57800: fc fc fc fc fc fc fc fc fc fc fa fb fb fb fb fb [ 43.535176][ T544] ^ [ 43.543336][ T544] ffff88812ec57880: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc [ 43.552178][ T544] ffff88812ec57900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 43.560425][ T544] ================================================================== [ 43.569743][ T544] Disabling lock debugging due to kernel taint [ 43.577431][ T549] F2FS-fs (loop3): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 43.591014][ T549] ================================================================== [ 43.599812][ T549] BUG: KASAN: double-free or invalid-free in kmem_cache_free+0x100/0x2d0 [ 43.608503][ T549] [ 43.610954][ T549] CPU: 1 PID: 549 Comm: syz.3.20 Tainted: G B syzkaller #0 [ 43.619814][ T549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 43.630512][ T549] Call Trace: [ 43.633829][ T549] __dump_stack+0x21/0x24 [ 43.638182][ T549] dump_stack_lvl+0x1a7/0x208 [ 43.642900][ T549] ? show_regs_print_info+0x18/0x18 [ 43.648297][ T549] ? thaw_kernel_threads+0x220/0x220 [ 43.653709][ T549] print_address_description+0x7f/0x2c0 [ 43.659283][ T549] ? kmem_cache_free+0x100/0x2d0 [ 43.664249][ T549] kasan_report_invalid_free+0x3f/0x70 [ 43.669765][ T549] ? kmem_cache_free+0x100/0x2d0 [ 43.674887][ T549] ____kasan_slab_free+0x13d/0x160 [ 43.680023][ T549] __kasan_slab_free+0x11/0x20 [ 43.684819][ T549] slab_free_freelist_hook+0xc5/0x190 [ 43.690304][ T549] ? f2fs_destroy_extent_tree+0x2d7/0x4e0 [ 43.696349][ T549] kmem_cache_free+0x100/0x2d0 [ 43.701237][ T549] f2fs_destroy_extent_tree+0x2d7/0x4e0 [ 43.706818][ T549] f2fs_evict_inode+0x3fe/0x14a0 [ 43.712061][ T549] ? _raw_spin_unlock+0x4d/0x70 [ 43.717029][ T549] ? inode_wait_for_writeback+0x1df/0x220 [ 43.722778][ T549] ? f2fs_write_inode+0x6e0/0x6e0 [ 43.727981][ T549] ? bit_waitqueue+0x30/0x30 [ 43.732607][ T549] ? f2fs_write_inode+0x6e0/0x6e0 [ 43.737653][ T549] evict+0x4a9/0x940 [ 43.741584][ T549] ? mode_strip_sgid+0x150/0x150 [ 43.746544][ T549] ? _raw_spin_lock+0x94/0xf0 [ 43.751257][ T549] ? _raw_spin_trylock_bh+0x150/0x150 [ 43.756925][ T549] ? __kasan_check_read+0x11/0x20 [ 43.762151][ T549] ? f2fs_drop_inode+0x16d/0x940 [ 43.767244][ T549] ? f2fs_dirty_inode+0x2e0/0x2e0 [ 43.772741][ T549] iput+0x654/0x7e0 [ 43.776751][ T549] iget_failed+0x162/0x1a0 [ 43.781396][ T549] f2fs_iget+0x165b/0x4af0 [ 43.785845][ T549] f2fs_lookup+0x419/0xd20 [ 43.790378][ T549] ? try_to_unlazy+0x39d/0x630 [ 43.795726][ T549] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 43.801887][ T549] ? d_hash_and_lookup+0x1f0/0x1f0 [ 43.807031][ T549] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 43.813204][ T549] path_openat+0x145d/0x3040 [ 43.817822][ T549] ? do_filp_open+0x400/0x400 [ 43.822594][ T549] do_filp_open+0x1df/0x400 [ 43.827183][ T549] ? vfs_tmpfile+0x2c0/0x2c0 [ 43.831775][ T549] ? get_unused_fd_flags+0x92/0xa0 [ 43.836884][ T549] do_sys_openat2+0x19f/0x750 [ 43.841572][ T549] ? __se_sys_rt_sigprocmask+0x22c/0x290 [ 43.847284][ T549] ? do_sys_open+0xe0/0xe0 [ 43.851792][ T549] ? __x64_sys_rt_sigprocmask+0xb0/0xb0 [ 43.857777][ T549] ? switch_fpu_return+0x19c/0x330 [ 43.862980][ T549] __x64_sys_openat+0x136/0x160 [ 43.867951][ T549] do_syscall_64+0x31/0x40 [ 43.872454][ T549] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 43.878347][ T549] RIP: 0033:0x7feb75997339 [ 43.882758][ T549] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 43.903697][ T549] RSP: 002b:00007feb757db028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 43.912232][ T549] RAX: ffffffffffffffda RBX: 00007feb75bd3090 RCX: 00007feb75997339 [ 43.920592][ T549] RDX: 0000000000101000 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 43.928796][ T549] RBP: 00007feb75a2ad68 R08: 0000000000000000 R09: 0000000000000000 [ 43.936769][ T549] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 43.945110][ T549] R13: 00007feb75bd3128 R14: 00007feb75bd3090 R15: 00007ffce4ace8c8 [ 43.953748][ T549] [ 43.956427][ T549] Allocated by task 530: [ 43.960891][ T549] __kasan_slab_alloc+0xb7/0xe0 [ 43.966211][ T549] slab_post_alloc_hook+0x5d/0x2f0 [ 43.971352][ T549] kmem_cache_alloc+0x15a/0x2d0 [ 43.976208][ T549] f2fs_init_extent_tree+0x502/0xc90 [ 43.981581][ T549] f2fs_iget+0xf7d/0x4af0 [ 43.986039][ T549] f2fs_lookup+0x419/0xd20 [ 43.990576][ T549] __lookup_slow+0x2b8/0x410 [ 43.995770][ T549] lookup_slow+0x57/0x70 [ 44.000525][ T549] walk_component+0x326/0x460 [ 44.005284][ T549] path_lookupat+0x155/0x430 [ 44.010093][ T549] filename_lookup+0x1fd/0x660 [ 44.014977][ T549] user_path_at_empty+0x43/0x50 [ 44.019839][ T549] do_sys_truncate+0xb6/0x1c0 [ 44.024539][ T549] __x64_sys_truncate+0x5b/0x70 [ 44.029612][ T549] do_syscall_64+0x31/0x40 [ 44.034023][ T549] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 44.040075][ T549] [ 44.042485][ T549] Freed by task 530: [ 44.046373][ T549] kasan_set_track+0x4a/0x70 [ 44.051075][ T549] kasan_set_free_info+0x23/0x40 [ 44.056013][ T549] ____kasan_slab_free+0x125/0x160 [ 44.061121][ T549] __kasan_slab_free+0x11/0x20 [ 44.065928][ T549] slab_free_freelist_hook+0xc5/0x190 [ 44.071659][ T549] kmem_cache_free+0x100/0x2d0 [ 44.076534][ T549] f2fs_destroy_extent_tree+0x2d7/0x4e0 [ 44.082171][ T549] f2fs_evict_inode+0x3fe/0x14a0 [ 44.087306][ T549] evict+0x4a9/0x940 [ 44.091201][ T549] iput+0x654/0x7e0 [ 44.095017][ T549] iget_failed+0x162/0x1a0 [ 44.099526][ T549] f2fs_iget+0x165b/0x4af0 [ 44.104245][ T549] f2fs_lookup+0x419/0xd20 [ 44.108881][ T549] __lookup_slow+0x2b8/0x410 [ 44.113679][ T549] lookup_slow+0x57/0x70 [ 44.118021][ T549] walk_component+0x326/0x460 [ 44.122695][ T549] path_lookupat+0x155/0x430 [ 44.127458][ T549] filename_lookup+0x1fd/0x660 [ 44.132299][ T549] user_path_at_empty+0x43/0x50 [ 44.137151][ T549] do_sys_truncate+0xb6/0x1c0 [ 44.141995][ T549] __x64_sys_truncate+0x5b/0x70 [ 44.146848][ T549] do_syscall_64+0x31/0x40 [ 44.151255][ T549] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 44.157141][ T549] [ 44.159580][ T549] The buggy address belongs to the object at ffff88812ec57b60 [ 44.159580][ T549] which belongs to the cache f2fs_extent_tree of size 80 [ 44.174181][ T549] The buggy address is located 0 bytes inside of [ 44.174181][ T549] 80-byte region [ffff88812ec57b60, ffff88812ec57bb0) [ 44.187733][ T549] The buggy address belongs to the page: [ 44.193538][ T549] page:ffffea0004bb15c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12ec57 [ 44.204048][ T549] flags: 0x4000000000000200(slab) [ 44.209370][ T549] raw: 4000000000000200 dead000000000100 dead000000000122 ffff8881029c7800 [ 44.218058][ T549] raw: 0000000000000000 0000000080240024 00000001ffffffff 0000000000000000 [ 44.227075][ T549] page dumped because: kasan: bad access detected [ 44.233831][ T549] page_owner tracks the page as allocated [ 44.239729][ T549] page last allocated via order 0, migratetype Reclaimable, gfp_mask 0x112c50(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 528, ts 41543487001, free_ts 0 [ 44.259793][ T549] prep_new_page+0x176/0x190 [ 44.264734][ T549] get_page_from_freelist+0x225f/0x23f0 [ 44.270447][ T549] __alloc_pages_nodemask+0x29a/0x640 [ 44.276244][ T549] new_slab+0x84/0x3f0 [ 44.280399][ T549] ___slab_alloc+0x2f8/0x4c0 [ 44.285966][ T549] __slab_alloc+0x63/0xa0 [ 44.290462][ T549] kmem_cache_alloc+0x1a4/0x2d0 [ 44.296265][ T549] f2fs_init_extent_tree+0x502/0xc90 [ 44.301718][ T549] f2fs_iget+0xf7d/0x4af0 [ 44.306144][ T549] f2fs_lookup+0x419/0xd20 [ 44.310648][ T549] __lookup_slow+0x2b8/0x410 [ 44.315316][ T549] lookup_slow+0x57/0x70 [ 44.319737][ T549] walk_component+0x326/0x460 [ 44.324507][ T549] path_lookupat+0x155/0x430 [ 44.329090][ T549] filename_lookup+0x1fd/0x660 [ 44.334392][ T549] user_path_at_empty+0x43/0x50 [ 44.339431][ T549] page_owner free stack trace missing [ 44.345244][ T549] [ 44.347933][ T549] Memory state around the buggy address: [ 44.353566][ T549] ffff88812ec57a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.361706][ T549] ffff88812ec57a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.370204][ T549] >ffff88812ec57b00: fc fc fc fc fc fc fc fc fc fc fc fc fa fb fb fb [ 44.378465][ T549] ^ [ 44.385782][ T549] ffff88812ec57b80: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc [ 44.396009][ T549] ffff88812ec57c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.404585][ T549] ================================================================== [ 44.413746][ T544] F2FS-fs (loop2): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 44.414971][ T24] audit: type=1400 audit(1789941944.120:110): avc: denied { read } for pid=77 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 44.426794][ T544] ================================================================== [ 44.426829][ T544] BUG: KASAN: double-free or invalid-free in kmem_cache_free+0x100/0x2d0 [ 44.454955][ T24] audit: type=1400 audit(1789941944.120:111): avc: denied { search } for pid=77 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 44.457246][ T544] [ 44.457261][ T544] CPU: 0 PID: 544 Comm: syz.2.19 Tainted: G B syzkaller #0 [ 44.457267][ T544] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 44.457271][ T544] Call Trace: [ 44.457290][ T544] __dump_stack+0x21/0x24 [ 44.457299][ T544] dump_stack_lvl+0x1a7/0x208 [ 44.457310][ T544] ? show_regs_print_info+0x18/0x18 [ 44.457321][ T544] ? thaw_kernel_threads+0x220/0x220 [ 44.457334][ T544] print_address_description+0x7f/0x2c0 [ 44.457347][ T544] ? kmem_cache_free+0x100/0x2d0 [ 44.457358][ T544] kasan_report_invalid_free+0x3f/0x70 [ 44.457369][ T544] ? kmem_cache_free+0x100/0x2d0 [ 44.457379][ T544] ____kasan_slab_free+0x13d/0x160 [ 44.457389][ T544] __kasan_slab_free+0x11/0x20 [ 44.457398][ T544] slab_free_freelist_hook+0xc5/0x190 [ 44.457411][ T544] ? f2fs_destroy_extent_tree+0x2d7/0x4e0 [ 44.457421][ T544] kmem_cache_free+0x100/0x2d0 [ 44.457432][ T544] f2fs_destroy_extent_tree+0x2d7/0x4e0 [ 44.457444][ T544] f2fs_evict_inode+0x3fe/0x14a0 [ 44.457454][ T544] ? _raw_spin_unlock+0x4d/0x70 [ 44.457466][ T544] ? inode_wait_for_writeback+0x1df/0x220 [ 44.457477][ T544] ? f2fs_write_inode+0x6e0/0x6e0 [ 44.457489][ T544] ? bit_waitqueue+0x30/0x30 [ 44.457500][ T544] ? f2fs_write_inode+0x6e0/0x6e0 [ 44.457509][ T544] evict+0x4a9/0x940 [ 44.457518][ T544] ? mode_strip_sgid+0x150/0x150 [ 44.457527][ T544] ? _raw_spin_lock+0x94/0xf0 [ 44.457536][ T544] ? _raw_spin_trylock_bh+0x150/0x150 [ 44.457547][ T544] ? __kasan_check_read+0x11/0x20 [ 44.457558][ T544] ? f2fs_drop_inode+0x16d/0x940 [ 44.457568][ T544] ? f2fs_dirty_inode+0x2e0/0x2e0 [ 44.457579][ T544] iput+0x654/0x7e0 [ 44.457588][ T544] iget_failed+0x162/0x1a0 [ 44.457598][ T544] f2fs_iget+0x165b/0x4af0 [ 44.457611][ T544] f2fs_lookup+0x419/0xd20 [ 44.457620][ T544] ? try_to_unlazy+0x39d/0x630 [ 44.457640][ T544] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 44.466734][ T24] audit: type=1400 audit(1789941944.120:112): avc: denied { write } for pid=77 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 44.487936][ T544] ? d_hash_and_lookup+0x1f0/0x1f0 [ 44.487950][ T544] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 44.487960][ T544] path_openat+0x145d/0x3040 [ 44.487974][ T544] ? do_filp_open+0x400/0x400 [ 44.487985][ T544] do_filp_open+0x1df/0x400 [ 44.487995][ T544] ? vfs_tmpfile+0x2c0/0x2c0 [ 44.488013][ T544] ? get_unused_fd_flags+0x92/0xa0 [ 44.490565][ T24] audit: type=1400 audit(1789941944.120:113): avc: denied { add_name } for pid=77 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 44.499276][ T544] do_sys_openat2+0x19f/0x750 [ 44.499290][ T544] ? __se_sys_rt_sigprocmask+0x22c/0x290 [ 44.499298][ T544] ? do_sys_open+0xe0/0xe0 [ 44.499308][ T544] ? __x64_sys_rt_sigprocmask+0xb0/0xb0 [ 44.499320][ T544] ? switch_fpu_return+0x19c/0x330 [ 44.499331][ T544] __x64_sys_openat+0x136/0x160 [ 44.499350][ T544] do_syscall_64+0x31/0x40 [ 44.510250][ T24] audit: type=1400 audit(1789941944.120:114): avc: denied { create } for pid=77 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 44.512884][ T544] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 44.512895][ T544] RIP: 0033:0x7f0347a57339 [ 44.512911][ T544] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 44.517280][ T24] audit: type=1400 audit(1789941944.120:115): avc: denied { append open } for pid=77 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 44.522002][ T544] RSP: 002b:00007f034789b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 44.522018][ T544] RAX: ffffffffffffffda RBX: 00007f0347c93090 RCX: 00007f0347a57339 [ 44.522025][ T544] RDX: 0000000000101000 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 44.522032][ T544] RBP: 00007f0347aead68 R08: 0000000000000000 R09: 0000000000000000 [ 44.522038][ T544] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 44.522057][ T544] R13: 00007f0347c93128 R14: 00007f0347c93090 R15: 00007ffe91e80188 [ 44.527844][ T24] audit: type=1400 audit(1789941944.120:116): avc: denied { getattr } for pid=77 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 44.533359][ T544] [ 44.533368][ T544] Allocated by task 528: [ 44.533385][ T544] __kasan_slab_alloc+0xb7/0xe0 [ 44.533396][ T544] slab_post_alloc_hook+0x5d/0x2f0 [ 44.533405][ T544] kmem_cache_alloc+0x15a/0x2d0 [ 44.533423][ T544] f2fs_init_extent_tree+0x502/0xc90 [ 44.977465][ T544] f2fs_iget+0xf7d/0x4af0 [ 44.981876][ T544] f2fs_lookup+0x419/0xd20 [ 44.986371][ T544] __lookup_slow+0x2b8/0x410 [ 44.991641][ T544] lookup_slow+0x57/0x70 [ 44.995876][ T544] walk_component+0x326/0x460 [ 45.000552][ T544] path_lookupat+0x155/0x430 [ 45.005282][ T544] filename_lookup+0x1fd/0x660 [ 45.010197][ T544] user_path_at_empty+0x43/0x50 [ 45.015131][ T544] do_sys_truncate+0xb6/0x1c0 [ 45.019910][ T544] __x64_sys_truncate+0x5b/0x70 [ 45.024934][ T544] do_syscall_64+0x31/0x40 [ 45.029605][ T544] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 45.035662][ T544] [ 45.038140][ T544] Freed by task 528: [ 45.042148][ T544] kasan_set_track+0x4a/0x70 [ 45.046920][ T544] kasan_set_free_info+0x23/0x40 [ 45.051953][ T544] ____kasan_slab_free+0x125/0x160 [ 45.057182][ T544] __kasan_slab_free+0x11/0x20 [ 45.062059][ T544] slab_free_freelist_hook+0xc5/0x190 [ 45.067436][ T544] kmem_cache_free+0x100/0x2d0 [ 45.072373][ T544] f2fs_destroy_extent_tree+0x2d7/0x4e0 [ 45.078917][ T544] f2fs_evict_inode+0x3fe/0x14a0 [ 45.084308][ T544] evict+0x4a9/0x940 [ 45.088298][ T544] iput+0x654/0x7e0 [ 45.092307][ T544] iget_failed+0x162/0x1a0 [ 45.096723][ T544] f2fs_iget+0x165b/0x4af0 [ 45.101134][ T544] f2fs_lookup+0x419/0xd20 [ 45.105665][ T544] __lookup_slow+0x2b8/0x410 [ 45.110556][ T544] lookup_slow+0x57/0x70 [ 45.114979][ T544] walk_component+0x326/0x460 [ 45.119970][ T544] path_lookupat+0x155/0x430 [ 45.124701][ T544] filename_lookup+0x1fd/0x660 [ 45.129606][ T544] user_path_at_empty+0x43/0x50 [ 45.134717][ T544] do_sys_truncate+0xb6/0x1c0 [ 45.139386][ T544] __x64_sys_truncate+0x5b/0x70 [ 45.144879][ T544] do_syscall_64+0x31/0x40 [ 45.149378][ T544] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 45.156005][ T544] [ 45.158420][ T544] The buggy address belongs to the object at ffff88812ec57850 [ 45.158420][ T544] which belongs to the cache f2fs_extent_tree of size 80 [ 45.173443][ T544] The buggy address is located 0 bytes inside of [ 45.173443][ T544] 80-byte region [ffff88812ec57850, ffff88812ec578a0) [ 45.186923][ T544] The buggy address belongs to the page: [ 45.193105][ T544] page:ffffea0004bb15c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12ec57 [ 45.203978][ T544] flags: 0x4000000000000200(slab) [ 45.209710][ T544] raw: 4000000000000200 dead000000000100 dead000000000122 ffff8881029c7800 [ 45.218763][ T544] raw: 0000000000000000 0000000080240024 00000001ffffffff 0000000000000000 [ 45.227421][ T544] page dumped because: kasan: bad access detected [ 45.234360][ T544] page_owner tracks the page as allocated [ 45.240694][ T544] page last allocated via order 0, migratetype Reclaimable, gfp_mask 0x112c50(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 528, ts 41543487001, free_ts 0 [ 45.259442][ T544] prep_new_page+0x176/0x190 [ 45.264226][ T544] get_page_from_freelist+0x225f/0x23f0 [ 45.269938][ T544] __alloc_pages_nodemask+0x29a/0x640 [ 45.276088][ T544] new_slab+0x84/0x3f0 [ 45.280598][ T544] ___slab_alloc+0x2f8/0x4c0 [ 45.285933][ T544] __slab_alloc+0x63/0xa0 [ 45.290306][ T544] kmem_cache_alloc+0x1a4/0x2d0 [ 45.295919][ T544] f2fs_init_extent_tree+0x502/0xc90 [ 45.301459][ T544] f2fs_iget+0xf7d/0x4af0 [ 45.306357][ T544] f2fs_lookup+0x419/0xd20 [ 45.311113][ T544] __lookup_slow+0x2b8/0x410 [ 45.315707][ T544] lookup_slow+0x57/0x70 [ 45.320156][ T544] walk_component+0x326/0x460 [ 45.325201][ T544] path_lookupat+0x155/0x430 [ 45.330153][ T544] filename_lookup+0x1fd/0x660 [ 45.335101][ T544] user_path_at_empty+0x43/0x50 [ 45.340214][ T544] page_owner free stack trace missing [ 45.345572][ T544] [ 45.348003][ T544] Memory state around the buggy address: [ 45.353818][ T544] ffff88812ec57700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 45.361887][ T544] ffff88812ec57780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 45.370022][ T544] >ffff88812ec57800: fc fc fc fc fc fc fc fc fc fc fa fb fb fb fb fb [ 45.378333][ T544] ^ [ 45.385272][ T544] ffff88812ec57880: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc [ 45.393335][ T544] ffff88812ec57900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 45.401397][ T544] ================================================================== 2026/09/20 22:05:45 executed programs: 15 [ 45.644515][ T336] device bridge_slave_1 left promiscuous mode [ 45.651069][ T336] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.693190][ T336] device bridge_slave_0 left promiscuous mode [ 45.699583][ T336] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.773815][ T336] device veth1_macvtap left promiscuous mode [ 45.780068][ T336] device veth0_vlan left promiscuous mode [ 46.660647][ T552] F2FS-fs (loop0): invalid crc value [ 46.707438][ T552] F2FS-fs (loop0): Found nat_bits in checkpoint [ 46.858075][ T552] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 46.892436][ T552] F2FS-fs (loop0): access invalid blkaddr:2147563524 [ 46.914438][ T552] CPU: 1 PID: 552 Comm: syz.0.23 Tainted: G B syzkaller #0 [ 46.923249][ T552] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 46.933771][ T552] Call Trace: [ 46.937608][ T552] __dump_stack+0x21/0x24 [ 46.942056][ T552] dump_stack_lvl+0x1a7/0x208 [ 46.946764][ T552] ? __bpf_trace_f2fs_fiemap+0x60/0x60 [ 46.952245][ T552] ? _raw_spin_lock+0x94/0xf0 [ 46.957286][ T552] ? show_regs_print_info+0x18/0x18 [ 46.962517][ T552] ? f2fs_init_extent_tree+0x7a0/0xc90 [ 46.967996][ T552] ? memcpy+0x56/0x70 [ 46.972001][ T552] dump_stack+0x15/0x1c [ 46.976487][ T552] f2fs_is_valid_blkaddr+0xc2f/0x1330 [ 46.982004][ T552] f2fs_iget+0x1a41/0x4af0 [ 46.986638][ T552] f2fs_lookup+0x419/0xd20 [ 46.991168][ T552] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 46.997262][ T552] ? d_hash_and_lookup+0x1f0/0x1f0 [ 47.002503][ T552] ? __kasan_check_write+0x14/0x20 [ 47.007843][ T552] __lookup_slow+0x2b8/0x410 [ 47.012457][ T552] ? lookup_one_len+0x2d0/0x2d0 [ 47.017476][ T552] ? lookup_fast+0x316/0x740 [ 47.022179][ T552] ? __kasan_check_write+0x14/0x20 [ 47.027315][ T552] lookup_slow+0x57/0x70 [ 47.031787][ T552] walk_component+0x326/0x460 [ 47.036590][ T552] path_lookupat+0x155/0x430 [ 47.041314][ T552] filename_lookup+0x1fd/0x660 [ 47.046109][ T552] ? hashlen_string+0x120/0x120 [ 47.051018][ T552] ? getname_flags+0x205/0x510 [ 47.055905][ T552] user_path_at_empty+0x43/0x50 [ 47.060782][ T552] do_sys_truncate+0xb6/0x1c0 [ 47.065481][ T552] ? fpu__clear_all+0x20/0x20 [ 47.070577][ T552] ? locks_verify_truncate+0x170/0x170 [ 47.076084][ T552] ? __kasan_check_read+0x11/0x20 [ 47.081224][ T552] __x64_sys_truncate+0x5b/0x70 [ 47.086200][ T552] do_syscall_64+0x31/0x40 [ 47.090642][ T552] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 47.096558][ T552] RIP: 0033:0x7f23e9931339 [ 47.100997][ T552] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 47.121375][ T552] RSP: 002b:00007f23e9796028 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 47.130058][ T552] RAX: ffffffffffffffda RBX: 00007f23e9b6cfa0 RCX: 00007f23e9931339 [ 47.138216][ T552] RDX: 0000000000000000 RSI: 0000000000001c9e RDI: 0000200000000280 [ 47.146377][ T552] RBP: 00007f23e99c4d68 R08: 0000000000000000 R09: 0000000000000000 [ 47.154530][ T552] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 47.163016][ T552] R13: 00007f23e9b6d038 R14: 00007f23e9b6cfa0 R15: 00007fffe3a3f398 [ 47.173202][ T552] F2FS-fs (loop0): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 47.199857][ T562] F2FS-fs (loop3): invalid crc value [ 47.207542][ T562] F2FS-fs (loop3): Found nat_bits in checkpoint [ 47.244551][ T562] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 47.323749][ T557] F2FS-fs (loop1): invalid crc value [ 47.330182][ T555] F2FS-fs (loop6): invalid crc value [ 47.345739][ T562] F2FS-fs (loop3): access invalid blkaddr:2147563524 [ 47.356069][ T562] CPU: 0 PID: 562 Comm: syz.3.22 Tainted: G B syzkaller #0 [ 47.364638][ T562] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 47.375058][ T562] Call Trace: [ 47.378646][ T562] __dump_stack+0x21/0x24 [ 47.383131][ T562] dump_stack_lvl+0x1a7/0x208 [ 47.388005][ T562] ? __bpf_trace_f2fs_fiemap+0x60/0x60 [ 47.393585][ T562] ? _raw_spin_lock+0x94/0xf0 [ 47.398556][ T562] ? show_regs_print_info+0x18/0x18 [ 47.404087][ T562] ? f2fs_init_extent_tree+0x7a0/0xc90 [ 47.409737][ T562] ? memcpy+0x56/0x70 [ 47.413747][ T562] dump_stack+0x15/0x1c [ 47.417708][ T557] F2FS-fs (loop1): Found nat_bits in checkpoint [ 47.418302][ T562] f2fs_is_valid_blkaddr+0xc2f/0x1330 [ 47.418314][ T562] f2fs_iget+0x1a41/0x4af0 [ 47.418332][ T562] f2fs_lookup+0x419/0xd20 [ 47.439629][ T562] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 47.445908][ T562] ? d_hash_and_lookup+0x1f0/0x1f0 [ 47.451129][ T562] ? __kasan_check_write+0x14/0x20 [ 47.456354][ T562] __lookup_slow+0x2b8/0x410 [ 47.461242][ T562] ? lookup_one_len+0x2d0/0x2d0 [ 47.466592][ T562] ? lookup_fast+0x316/0x740 [ 47.471284][ T562] ? __kasan_check_write+0x14/0x20 [ 47.476466][ T562] lookup_slow+0x57/0x70 [ 47.480849][ T562] walk_component+0x326/0x460 [ 47.485553][ T562] path_lookupat+0x155/0x430 [ 47.490793][ T562] filename_lookup+0x1fd/0x660 [ 47.495583][ T562] ? hashlen_string+0x120/0x120 [ 47.500552][ T562] ? getname_flags+0x205/0x510 [ 47.505938][ T562] user_path_at_empty+0x43/0x50 [ 47.511152][ T562] do_sys_truncate+0xb6/0x1c0 [ 47.516047][ T562] ? fpu__clear_all+0x20/0x20 [ 47.521706][ T562] ? locks_verify_truncate+0x170/0x170 [ 47.527800][ T562] ? __kasan_check_read+0x11/0x20 [ 47.533198][ T562] __x64_sys_truncate+0x5b/0x70 [ 47.538152][ T562] do_syscall_64+0x31/0x40 [ 47.543010][ T562] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 47.550200][ T562] RIP: 0033:0x7feb75997339 [ 47.555344][ T562] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 47.571089][ T557] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 47.579884][ T562] RSP: 002b:00007feb757fc028 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 47.579900][ T562] RAX: ffffffffffffffda RBX: 00007feb75bd2fa0 RCX: 00007feb75997339 [ 47.579907][ T562] RDX: 0000000000000000 RSI: 0000000000001c9e RDI: 0000200000000280 [ 47.579913][ T562] RBP: 00007feb75a2ad68 R08: 0000000000000000 R09: 0000000000000000 [ 47.579919][ T562] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 47.579927][ T562] R13: 00007feb75bd3038 R14: 00007feb75bd2fa0 R15: 00007ffce4ace8c8 [ 47.582061][ T562] F2FS-fs (loop3): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 47.589604][ T555] F2FS-fs (loop6): Found nat_bits in checkpoint [ 47.597016][ T582] F2FS-fs (loop3): access invalid blkaddr:2147563524 [ 47.627951][ T555] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5 [ 47.630067][ T582] CPU: 0 PID: 582 Comm: syz.3.22 Tainted: G B syzkaller #0 [ 47.680308][ T582] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 47.690429][ T582] Call Trace: [ 47.693917][ T582] __dump_stack+0x21/0x24 [ 47.698241][ T582] dump_stack_lvl+0x1a7/0x208 [ 47.703035][ T582] ? __bpf_trace_f2fs_fiemap+0x60/0x60 [ 47.708486][ T582] ? _raw_spin_lock+0x94/0xf0 [ 47.713510][ T582] ? show_regs_print_info+0x18/0x18 [ 47.719545][ T582] ? f2fs_init_extent_tree+0x7a0/0xc90 [ 47.725880][ T582] ? memcpy+0x56/0x70 [ 47.730036][ T582] dump_stack+0x15/0x1c [ 47.734449][ T582] f2fs_is_valid_blkaddr+0xc2f/0x1330 [ 47.740593][ T582] f2fs_iget+0x1a41/0x4af0 [ 47.745302][ T582] f2fs_lookup+0x419/0xd20 [ 47.749731][ T582] ? try_to_unlazy+0x39d/0x630 [ 47.754948][ T582] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 47.761864][ T582] ? d_hash_and_lookup+0x1f0/0x1f0 [ 47.767405][ T582] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 47.774288][ T582] path_openat+0x145d/0x3040 [ 47.779407][ T582] ? do_filp_open+0x400/0x400 [ 47.784090][ T582] do_filp_open+0x1df/0x400 [ 47.788583][ T582] ? vfs_tmpfile+0x2c0/0x2c0 [ 47.793161][ T582] ? get_unused_fd_flags+0x92/0xa0 [ 47.798351][ T582] do_sys_openat2+0x19f/0x750 [ 47.803150][ T582] ? __se_sys_rt_sigprocmask+0x22c/0x290 [ 47.808779][ T582] ? do_sys_open+0xe0/0xe0 [ 47.813188][ T582] ? __x64_sys_rt_sigprocmask+0xb0/0xb0 [ 47.818754][ T582] ? switch_fpu_return+0x19c/0x330 [ 47.824123][ T582] __x64_sys_openat+0x136/0x160 [ 47.829171][ T582] do_syscall_64+0x31/0x40 [ 47.833787][ T582] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 47.839850][ T582] RIP: 0033:0x7feb75997339 [ 47.844282][ T582] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 47.865388][ T582] RSP: 002b:00007feb757db028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 47.873811][ T582] RAX: ffffffffffffffda RBX: 00007feb75bd3090 RCX: 00007feb75997339 [ 47.881971][ T582] RDX: 0000000000101000 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 47.890358][ T582] RBP: 00007feb75a2ad68 R08: 0000000000000000 R09: 0000000000000000 [ 47.898696][ T582] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 47.906950][ T582] R13: 00007feb75bd3128 R14: 00007feb75bd3090 R15: 00007ffce4ace8c8 [ 47.915057][ T582] F2FS-fs (loop3): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 47.948068][ T559] F2FS-fs (loop2): invalid crc value [ 47.954631][ T557] F2FS-fs (loop1): access invalid blkaddr:2147563524 [ 47.962030][ T557] CPU: 1 PID: 557 Comm: syz.1.26 Tainted: G B syzkaller #0 [ 47.970804][ T557] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 47.981364][ T557] Call Trace: [ 47.984690][ T557] __dump_stack+0x21/0x24 [ 47.989047][ T557] dump_stack_lvl+0x1a7/0x208 [ 47.993735][ T557] ? __bpf_trace_f2fs_fiemap+0x60/0x60 [ 47.999203][ T557] ? _raw_spin_lock+0x94/0xf0 [ 48.003978][ T557] ? show_regs_print_info+0x18/0x18 [ 48.009268][ T557] ? f2fs_init_extent_tree+0x7a0/0xc90 [ 48.015085][ T557] ? memcpy+0x56/0x70 [ 48.019643][ T557] dump_stack+0x15/0x1c [ 48.023902][ T557] f2fs_is_valid_blkaddr+0xc2f/0x1330 [ 48.029278][ T557] f2fs_iget+0x1a41/0x4af0 [ 48.033896][ T557] f2fs_lookup+0x419/0xd20 [ 48.038599][ T557] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 48.045103][ T557] ? d_hash_and_lookup+0x1f0/0x1f0 [ 48.050827][ T557] ? __kasan_check_write+0x14/0x20 [ 48.056034][ T557] __lookup_slow+0x2b8/0x410 [ 48.061419][ T557] ? lookup_one_len+0x2d0/0x2d0 [ 48.063533][ T555] F2FS-fs (loop6): access invalid blkaddr:2147563524 [ 48.066938][ T557] ? lookup_fast+0x316/0x740 [ 48.066950][ T557] ? __kasan_check_write+0x14/0x20 [ 48.066966][ T557] lookup_slow+0x57/0x70 [ 48.090260][ T557] walk_component+0x326/0x460 [ 48.094983][ T557] path_lookupat+0x155/0x430 [ 48.099921][ T557] filename_lookup+0x1fd/0x660 [ 48.105036][ T557] ? hashlen_string+0x120/0x120 [ 48.110081][ T557] ? getname_flags+0x205/0x510 [ 48.114963][ T557] user_path_at_empty+0x43/0x50 [ 48.119829][ T557] do_sys_truncate+0xb6/0x1c0 [ 48.124884][ T557] ? fpu__clear_all+0x20/0x20 [ 48.129856][ T557] ? locks_verify_truncate+0x170/0x170 [ 48.135693][ T557] ? __kasan_check_read+0x11/0x20 [ 48.140816][ T557] __x64_sys_truncate+0x5b/0x70 [ 48.145670][ T557] do_syscall_64+0x31/0x40 [ 48.150219][ T557] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 48.156297][ T557] RIP: 0033:0x7f9e42013339 [ 48.160894][ T557] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 48.181466][ T557] RSP: 002b:00007f9e41e78028 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 48.189974][ T557] RAX: ffffffffffffffda RBX: 00007f9e4224efa0 RCX: 00007f9e42013339 [ 48.199129][ T557] RDX: 0000000000000000 RSI: 0000000000001c9e RDI: 0000200000000280 [ 48.207389][ T557] RBP: 00007f9e420a6d68 R08: 0000000000000000 R09: 0000000000000000 [ 48.215737][ T557] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 48.224255][ T557] R13: 00007f9e4224f038 R14: 00007f9e4224efa0 R15: 00007ffde7480728 [ 48.232673][ T555] CPU: 0 PID: 555 Comm: syz.6.25 Tainted: G B syzkaller #0 [ 48.235403][ T557] F2FS-fs (loop1): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 48.241364][ T555] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 48.265512][ T555] Call Trace: [ 48.269099][ T555] __dump_stack+0x21/0x24 [ 48.273468][ T555] dump_stack_lvl+0x1a7/0x208 [ 48.278260][ T555] ? __bpf_trace_f2fs_fiemap+0x60/0x60 [ 48.282910][ T590] F2FS-fs (loop1): access invalid blkaddr:2147563524 [ 48.283824][ T555] ? show_regs_print_info+0x18/0x18 [ 48.296518][ T555] ? f2fs_init_extent_tree+0x7a0/0xc90 [ 48.302083][ T555] ? memcpy+0x56/0x70 [ 48.306446][ T555] dump_stack+0x15/0x1c [ 48.310703][ T555] f2fs_is_valid_blkaddr+0xc2f/0x1330 [ 48.316086][ T555] f2fs_iget+0x1a41/0x4af0 [ 48.320524][ T555] f2fs_lookup+0x419/0xd20 [ 48.325135][ T555] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 48.331933][ T555] ? d_hash_and_lookup+0x1f0/0x1f0 [ 48.337321][ T555] ? __kasan_check_write+0x14/0x20 [ 48.342671][ T555] __lookup_slow+0x2b8/0x410 [ 48.347488][ T555] ? lookup_one_len+0x2d0/0x2d0 [ 48.352438][ T555] ? lookup_fast+0x316/0x740 [ 48.357041][ T555] ? __kasan_check_write+0x14/0x20 [ 48.362873][ T555] lookup_slow+0x57/0x70 [ 48.367729][ T555] walk_component+0x326/0x460 [ 48.372573][ T555] path_lookupat+0x155/0x430 [ 48.377264][ T555] filename_lookup+0x1fd/0x660 [ 48.382061][ T555] ? hashlen_string+0x120/0x120 [ 48.387037][ T555] ? getname_flags+0x205/0x510 [ 48.391940][ T555] user_path_at_empty+0x43/0x50 [ 48.396909][ T555] do_sys_truncate+0xb6/0x1c0 [ 48.401848][ T555] ? fpu__clear_all+0x20/0x20 [ 48.406728][ T555] ? locks_verify_truncate+0x170/0x170 [ 48.412713][ T555] ? __kasan_check_read+0x11/0x20 [ 48.418297][ T555] __x64_sys_truncate+0x5b/0x70 [ 48.423398][ T555] do_syscall_64+0x31/0x40 [ 48.428650][ T555] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 48.435277][ T555] RIP: 0033:0x7f69729d8339 [ 48.440134][ T555] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 48.460609][ T555] RSP: 002b:00007f697283d028 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 48.469231][ T555] RAX: ffffffffffffffda RBX: 00007f6972c13fa0 RCX: 00007f69729d8339 [ 48.477425][ T555] RDX: 0000000000000000 RSI: 0000000000001c9e RDI: 0000200000000280 [ 48.485899][ T555] RBP: 00007f6972a6bd68 R08: 0000000000000000 R09: 0000000000000000 [ 48.494414][ T555] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 48.502668][ T555] R13: 00007f6972c14038 R14: 00007f6972c13fa0 R15: 00007ffe40705588 [ 48.542550][ T590] CPU: 1 PID: 590 Comm: syz.1.26 Tainted: G B syzkaller #0 [ 48.552086][ T590] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 48.562437][ T590] Call Trace: [ 48.565935][ T590] __dump_stack+0x21/0x24 [ 48.570373][ T590] dump_stack_lvl+0x1a7/0x208 [ 48.575343][ T590] ? __bpf_trace_f2fs_fiemap+0x60/0x60 [ 48.581084][ T590] ? show_regs_print_info+0x18/0x18 [ 48.587936][ T590] ? f2fs_init_extent_tree+0x7a0/0xc90 [ 48.594406][ T590] ? memcpy+0x56/0x70 [ 48.599748][ T590] dump_stack+0x15/0x1c [ 48.604611][ T590] f2fs_is_valid_blkaddr+0xc2f/0x1330 [ 48.611727][ T590] f2fs_iget+0x1a41/0x4af0 [ 48.616427][ T590] f2fs_lookup+0x419/0xd20 [ 48.621608][ T590] ? try_to_unlazy+0x39d/0x630 [ 48.626929][ T590] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 48.633473][ T590] ? d_hash_and_lookup+0x1f0/0x1f0 [ 48.640256][ T590] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 48.647298][ T590] path_openat+0x145d/0x3040 [ 48.652418][ T590] ? do_filp_open+0x400/0x400 [ 48.657296][ T590] do_filp_open+0x1df/0x400 [ 48.661899][ T590] ? vfs_tmpfile+0x2c0/0x2c0 [ 48.666767][ T590] ? get_unused_fd_flags+0x92/0xa0 [ 48.672106][ T590] do_sys_openat2+0x19f/0x750 [ 48.677397][ T590] ? __se_sys_rt_sigprocmask+0x22c/0x290 [ 48.683747][ T590] ? do_sys_open+0xe0/0xe0 [ 48.688286][ T590] ? __x64_sys_rt_sigprocmask+0xb0/0xb0 [ 48.694756][ T590] ? switch_fpu_return+0x19c/0x330 [ 48.700238][ T590] __x64_sys_openat+0x136/0x160 [ 48.705285][ T590] do_syscall_64+0x31/0x40 [ 48.710152][ T590] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 48.716329][ T590] RIP: 0033:0x7f9e42013339 [ 48.721121][ T590] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 48.741456][ T590] RSP: 002b:00007f9e41e57028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 48.750425][ T590] RAX: ffffffffffffffda RBX: 00007f9e4224f090 RCX: 00007f9e42013339 [ 48.758608][ T590] RDX: 0000000000101000 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 48.767123][ T590] RBP: 00007f9e420a6d68 R08: 0000000000000000 R09: 0000000000000000 [ 48.776803][ T590] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 48.785673][ T590] R13: 00007f9e4224f128 R14: 00007f9e4224f090 R15: 00007ffde7480728 [ 48.797806][ T590] F2FS-fs (loop1): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 48.812227][ T559] F2FS-fs (loop2): Found nat_bits in checkpoint [ 48.860483][ T555] F2FS-fs (loop6): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 48.882825][ T559] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 48.911500][ T559] F2FS-fs (loop2): access invalid blkaddr:2147563524 [ 48.930825][ T559] CPU: 1 PID: 559 Comm: syz.2.24 Tainted: G B syzkaller #0 [ 48.939992][ T559] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 48.950409][ T559] Call Trace: [ 48.953807][ T559] __dump_stack+0x21/0x24 [ 48.958314][ T559] dump_stack_lvl+0x1a7/0x208 [ 48.963195][ T559] ? __bpf_trace_f2fs_fiemap+0x60/0x60 [ 48.971464][ T559] ? _raw_spin_lock+0x94/0xf0 [ 48.976387][ T559] ? show_regs_print_info+0x18/0x18 [ 48.981966][ T559] ? f2fs_init_extent_tree+0x7a0/0xc90 [ 48.987712][ T559] ? memcpy+0x56/0x70 [ 48.991973][ T559] dump_stack+0x15/0x1c [ 48.996330][ T559] f2fs_is_valid_blkaddr+0xc2f/0x1330 [ 49.002607][ T559] f2fs_iget+0x1a41/0x4af0 [ 49.007160][ T559] f2fs_lookup+0x419/0xd20 [ 49.011589][ T559] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 49.018013][ T559] ? d_hash_and_lookup+0x1f0/0x1f0 [ 49.023661][ T559] ? __kasan_check_write+0x14/0x20 [ 49.030174][ T559] __lookup_slow+0x2b8/0x410 [ 49.034883][ T559] ? lookup_one_len+0x2d0/0x2d0 [ 49.040218][ T559] ? lookup_fast+0x316/0x740 [ 49.045554][ T559] ? __kasan_check_write+0x14/0x20 [ 49.050963][ T559] lookup_slow+0x57/0x70 [ 49.055555][ T559] walk_component+0x326/0x460 [ 49.060429][ T559] path_lookupat+0x155/0x430 [ 49.065410][ T559] filename_lookup+0x1fd/0x660 [ 49.070546][ T559] ? hashlen_string+0x120/0x120 [ 49.075738][ T559] ? getname_flags+0x205/0x510 [ 49.081046][ T559] user_path_at_empty+0x43/0x50 [ 49.086099][ T559] do_sys_truncate+0xb6/0x1c0 [ 49.091086][ T559] ? fpu__clear_all+0x20/0x20 [ 49.096326][ T559] ? locks_verify_truncate+0x170/0x170 [ 49.102084][ T559] ? __kasan_check_read+0x11/0x20 [ 49.107156][ T559] __x64_sys_truncate+0x5b/0x70 [ 49.112476][ T559] do_syscall_64+0x31/0x40 [ 49.117100][ T559] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 49.123189][ T559] RIP: 0033:0x7f0347a57339 [ 49.128158][ T559] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 49.148380][ T559] RSP: 002b:00007f03478bc028 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 49.157258][ T559] RAX: ffffffffffffffda RBX: 00007f0347c92fa0 RCX: 00007f0347a57339 [ 49.163457][ T592] F2FS-fs (loop6): access invalid blkaddr:2147563524 [ 49.165244][ T559] RDX: 0000000000000000 RSI: 0000000000001c9e RDI: 0000200000000280 [ 49.165252][ T559] RBP: 00007f0347aead68 R08: 0000000000000000 R09: 0000000000000000 [ 49.165258][ T559] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 49.165265][ T559] R13: 00007f0347c93038 R14: 00007f0347c92fa0 R15: 00007ffe91e80188 [ 49.207026][ T589] F2FS-fs (loop0): invalid crc value [ 49.234307][ T589] F2FS-fs (loop0): Found nat_bits in checkpoint [ 49.282750][ T592] CPU: 0 PID: 592 Comm: syz.6.25 Tainted: G B syzkaller #0 [ 49.294966][ T592] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 49.305400][ T592] Call Trace: [ 49.309394][ T592] __dump_stack+0x21/0x24 [ 49.313839][ T592] dump_stack_lvl+0x1a7/0x208 [ 49.318640][ T592] ? __bpf_trace_f2fs_fiemap+0x60/0x60 [ 49.325405][ T592] ? _raw_spin_lock+0x94/0xf0 [ 49.330545][ T592] ? show_regs_print_info+0x18/0x18 [ 49.336020][ T592] ? f2fs_init_extent_tree+0x7a0/0xc90 [ 49.338951][ T559] F2FS-fs (loop2): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 49.342085][ T592] ? memcpy+0x56/0x70 [ 49.342098][ T592] dump_stack+0x15/0x1c [ 49.342109][ T592] f2fs_is_valid_blkaddr+0xc2f/0x1330 [ 49.342130][ T592] f2fs_iget+0x1a41/0x4af0 [ 49.356511][ T602] F2FS-fs (loop2): access invalid blkaddr:2147563524 [ 49.359387][ T592] f2fs_lookup+0x419/0xd20 [ 49.385054][ T592] ? try_to_unlazy+0x39d/0x630 [ 49.389843][ T592] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 49.396202][ T592] ? d_hash_and_lookup+0x1f0/0x1f0 [ 49.401517][ T592] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 49.407876][ T592] path_openat+0x145d/0x3040 [ 49.412591][ T592] ? do_filp_open+0x400/0x400 [ 49.417373][ T592] do_filp_open+0x1df/0x400 [ 49.422821][ T592] ? vfs_tmpfile+0x2c0/0x2c0 [ 49.427616][ T592] ? get_unused_fd_flags+0x92/0xa0 [ 49.433090][ T592] do_sys_openat2+0x19f/0x750 [ 49.438605][ T592] ? __se_sys_rt_sigprocmask+0x22c/0x290 [ 49.444685][ T592] ? do_sys_open+0xe0/0xe0 [ 49.449306][ T592] ? __x64_sys_rt_sigprocmask+0xb0/0xb0 [ 49.455237][ T592] ? switch_fpu_return+0x19c/0x330 [ 49.460526][ T592] __x64_sys_openat+0x136/0x160 [ 49.465376][ T592] do_syscall_64+0x31/0x40 [ 49.469877][ T592] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 49.475772][ T592] RIP: 0033:0x7f69729d8339 [ 49.480303][ T592] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 49.500538][ T592] RSP: 002b:00007f697281c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 49.509131][ T592] RAX: ffffffffffffffda RBX: 00007f6972c14090 RCX: 00007f69729d8339 [ 49.517491][ T592] RDX: 0000000000101000 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 49.525553][ T592] RBP: 00007f6972a6bd68 R08: 0000000000000000 R09: 0000000000000000 [ 49.533788][ T592] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 49.541934][ T592] R13: 00007f6972c14128 R14: 00007f6972c14090 R15: 00007ffe40705588 [ 49.550437][ T602] CPU: 1 PID: 602 Comm: syz.2.24 Tainted: G B syzkaller #0 [ 49.551670][ T592] F2FS-fs (loop6): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 49.559431][ T602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 49.559436][ T602] Call Trace: [ 49.559453][ T602] __dump_stack+0x21/0x24 [ 49.559463][ T602] dump_stack_lvl+0x1a7/0x208 [ 49.559475][ T602] ? __bpf_trace_f2fs_fiemap+0x60/0x60 [ 49.559491][ T602] ? show_regs_print_info+0x18/0x18 [ 49.572952][ T589] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 49.582233][ T602] dump_stack+0x15/0x1c [ 49.617740][ T602] f2fs_is_valid_blkaddr+0xc2f/0x1330 [ 49.623400][ T602] f2fs_iget+0x1a41/0x4af0 [ 49.627927][ T602] f2fs_lookup+0x419/0xd20 [ 49.632456][ T602] ? try_to_unlazy+0x39d/0x630 [ 49.637706][ T602] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 49.643882][ T602] ? d_hash_and_lookup+0x1f0/0x1f0 [ 49.649172][ T602] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 49.655622][ T602] path_openat+0x145d/0x3040 [ 49.660353][ T602] ? do_filp_open+0x400/0x400 [ 49.665122][ T602] do_filp_open+0x1df/0x400 [ 49.669615][ T602] ? vfs_tmpfile+0x2c0/0x2c0 [ 49.674371][ T602] ? get_unused_fd_flags+0x92/0xa0 [ 49.679793][ T602] do_sys_openat2+0x19f/0x750 [ 49.684468][ T602] ? __se_sys_rt_sigprocmask+0x22c/0x290 [ 49.690370][ T602] ? do_sys_open+0xe0/0xe0 [ 49.694871][ T602] ? __x64_sys_rt_sigprocmask+0xb0/0xb0 [ 49.700679][ T602] ? switch_fpu_return+0x19c/0x330 [ 49.706156][ T602] __x64_sys_openat+0x136/0x160 [ 49.711246][ T602] do_syscall_64+0x31/0x40 [ 49.716436][ T602] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 49.722618][ T602] RIP: 0033:0x7f0347a57339 [ 49.727042][ T602] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 49.746921][ T602] RSP: 002b:00007f034789b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 49.755434][ T602] RAX: ffffffffffffffda RBX: 00007f0347c93090 RCX: 00007f0347a57339 [ 49.763791][ T602] RDX: 0000000000101000 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 49.772250][ T602] RBP: 00007f0347aead68 R08: 0000000000000000 R09: 0000000000000000 [ 49.780537][ T602] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 49.788714][ T602] R13: 00007f0347c93128 R14: 00007f0347c93090 R15: 00007ffe91e80188 [ 49.797199][ T602] F2FS-fs (loop2): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 49.809896][ T602] ================================================================== [ 49.818386][ T602] BUG: KASAN: double-free or invalid-free in kmem_cache_free+0x100/0x2d0 [ 49.826790][ T602] [ 49.829139][ T602] CPU: 0 PID: 602 Comm: syz.2.24 Tainted: G B syzkaller #0 [ 49.837834][ T602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 49.848172][ T602] Call Trace: [ 49.851472][ T602] __dump_stack+0x21/0x24 [ 49.856076][ T602] dump_stack_lvl+0x1a7/0x208 [ 49.860847][ T602] ? show_regs_print_info+0x18/0x18 [ 49.866310][ T602] ? thaw_kernel_threads+0x220/0x220 [ 49.872161][ T602] print_address_description+0x7f/0x2c0 [ 49.877826][ T602] ? kmem_cache_free+0x100/0x2d0 [ 49.882877][ T602] kasan_report_invalid_free+0x3f/0x70 [ 49.888343][ T602] ? kmem_cache_free+0x100/0x2d0 [ 49.893783][ T602] ____kasan_slab_free+0x13d/0x160 [ 49.899010][ T602] __kasan_slab_free+0x11/0x20 [ 49.903268][ T589] F2FS-fs (loop0): access invalid blkaddr:2147563524 [ 49.903784][ T602] slab_free_freelist_hook+0xc5/0x190 [ 49.903802][ T602] ? f2fs_destroy_extent_tree+0x2d7/0x4e0 [ 49.922305][ T602] kmem_cache_free+0x100/0x2d0 [ 49.927321][ T602] f2fs_destroy_extent_tree+0x2d7/0x4e0 [ 49.932890][ T602] f2fs_evict_inode+0x3fe/0x14a0 [ 49.937941][ T602] ? _raw_spin_unlock+0x4d/0x70 [ 49.942835][ T602] ? inode_wait_for_writeback+0x1df/0x220 [ 49.948587][ T602] ? f2fs_write_inode+0x6e0/0x6e0 [ 49.953703][ T602] ? bit_waitqueue+0x30/0x30 [ 49.958403][ T602] ? f2fs_write_inode+0x6e0/0x6e0 [ 49.963521][ T602] evict+0x4a9/0x940 [ 49.967601][ T602] ? mode_strip_sgid+0x150/0x150 [ 49.972626][ T602] ? _raw_spin_lock+0x94/0xf0 [ 49.977499][ T602] ? _raw_spin_trylock_bh+0x150/0x150 [ 49.982873][ T602] ? __kasan_check_read+0x11/0x20 [ 49.987987][ T602] ? f2fs_drop_inode+0x16d/0x940 [ 49.993018][ T602] ? f2fs_dirty_inode+0x2e0/0x2e0 [ 49.998134][ T602] iput+0x654/0x7e0 [ 50.002062][ T602] iget_failed+0x162/0x1a0 [ 50.006487][ T602] f2fs_iget+0x165b/0x4af0 [ 50.011189][ T602] f2fs_lookup+0x419/0xd20 [ 50.016047][ T602] ? try_to_unlazy+0x39d/0x630 [ 50.020826][ T602] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 50.027359][ T602] ? d_hash_and_lookup+0x1f0/0x1f0 [ 50.032651][ T602] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 50.038892][ T602] path_openat+0x145d/0x3040 [ 50.043707][ T602] ? do_filp_open+0x400/0x400 [ 50.048562][ T602] do_filp_open+0x1df/0x400 [ 50.053072][ T602] ? vfs_tmpfile+0x2c0/0x2c0 [ 50.057666][ T602] ? get_unused_fd_flags+0x92/0xa0 [ 50.062962][ T602] do_sys_openat2+0x19f/0x750 [ 50.067640][ T602] ? __se_sys_rt_sigprocmask+0x22c/0x290 [ 50.073277][ T602] ? do_sys_open+0xe0/0xe0 [ 50.077697][ T602] ? __x64_sys_rt_sigprocmask+0xb0/0xb0 [ 50.083263][ T602] ? switch_fpu_return+0x19c/0x330 [ 50.088440][ T602] __x64_sys_openat+0x136/0x160 [ 50.093389][ T602] do_syscall_64+0x31/0x40 [ 50.098190][ T602] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 50.104177][ T602] RIP: 0033:0x7f0347a57339 [ 50.108686][ T602] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 50.128659][ T602] RSP: 002b:00007f034789b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 50.137256][ T602] RAX: ffffffffffffffda RBX: 00007f0347c93090 RCX: 00007f0347a57339 [ 50.145349][ T602] RDX: 0000000000101000 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 50.153504][ T602] RBP: 00007f0347aead68 R08: 0000000000000000 R09: 0000000000000000 [ 50.161655][ T602] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 50.169850][ T602] R13: 00007f0347c93128 R14: 00007f0347c93090 R15: 00007ffe91e80188 [ 50.178296][ T602] [ 50.180725][ T602] Allocated by task 559: [ 50.182708][ T589] CPU: 1 PID: 589 Comm: syz.0.27 Tainted: G B syzkaller #0 [ 50.185238][ T602] __kasan_slab_alloc+0xb7/0xe0 [ 50.193986][ T589] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 50.199181][ T602] slab_post_alloc_hook+0x5d/0x2f0 [ 50.209393][ T589] Call Trace: [ 50.214504][ T602] kmem_cache_alloc+0x15a/0x2d0 [ 50.217950][ T589] __dump_stack+0x21/0x24 [ 50.222874][ T602] f2fs_init_extent_tree+0x502/0xc90 [ 50.227281][ T589] dump_stack_lvl+0x1a7/0x208 [ 50.233163][ T602] f2fs_iget+0xf7d/0x4af0 [ 50.238135][ T589] ? __bpf_trace_f2fs_fiemap+0x60/0x60 [ 50.242731][ T602] f2fs_lookup+0x419/0xd20 [ 50.248175][ T589] ? show_regs_print_info+0x18/0x18 [ 50.252578][ T602] __lookup_slow+0x2b8/0x410 [ 50.257773][ T589] ? f2fs_init_extent_tree+0x7a0/0xc90 [ 50.262643][ T602] lookup_slow+0x57/0x70 [ 50.268295][ T589] ? memcpy+0x56/0x70 [ 50.272526][ T602] walk_component+0x326/0x460 [ 50.276583][ T589] dump_stack+0x15/0x1c [ 50.281364][ T602] path_lookupat+0x155/0x430 [ 50.285515][ T589] f2fs_is_valid_blkaddr+0xc2f/0x1330 [ 50.290095][ T602] filename_lookup+0x1fd/0x660 [ 50.295455][ T589] f2fs_iget+0x1a41/0x4af0 [ 50.300472][ T602] user_path_at_empty+0x43/0x50 [ 50.304970][ T589] f2fs_lookup+0x419/0xd20 [ 50.309803][ T602] do_sys_truncate+0xb6/0x1c0 [ 50.314379][ T589] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 50.319046][ T602] __x64_sys_truncate+0x5b/0x70 [ 50.325098][ T589] ? d_hash_and_lookup+0x1f0/0x1f0 [ 50.330330][ T602] do_syscall_64+0x31/0x40 [ 50.335448][ T589] ? __kasan_check_write+0x14/0x20 [ 50.339941][ T602] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 50.345045][ T589] __lookup_slow+0x2b8/0x410 [ 50.350918][ T602] [ 50.355590][ T589] ? lookup_one_len+0x2d0/0x2d0 [ 50.357905][ T602] Freed by task 559: [ 50.362750][ T589] ? lookup_fast+0x316/0x740 [ 50.366749][ T602] kasan_set_track+0x4a/0x70 [ 50.371414][ T589] ? __kasan_check_write+0x14/0x20 [ 50.376168][ T602] kasan_set_free_info+0x23/0x40 [ 50.381268][ T589] lookup_slow+0x57/0x70 [ 50.386201][ T602] ____kasan_slab_free+0x125/0x160 [ 50.390433][ T589] walk_component+0x326/0x460 [ 50.395620][ T602] __kasan_slab_free+0x11/0x20 [ 50.400300][ T589] path_lookupat+0x155/0x430 [ 50.405403][ T602] slab_free_freelist_hook+0xc5/0x190 [ 50.410093][ T589] filename_lookup+0x1fd/0x660 [ 50.415800][ T602] kmem_cache_free+0x100/0x2d0 [ 50.420726][ T589] ? hashlen_string+0x120/0x120 [ 50.425568][ T602] f2fs_destroy_extent_tree+0x2d7/0x4e0 [ 50.430969][ T589] ? getname_flags+0x205/0x510 [ 50.436500][ T602] f2fs_evict_inode+0x3fe/0x14a0 [ 50.441423][ T589] user_path_at_empty+0x43/0x50 [ 50.446538][ T602] evict+0x4a9/0x940 [ 50.451374][ T589] do_sys_truncate+0xb6/0x1c0 [ 50.455255][ T602] iput+0x654/0x7e0 [ 50.460127][ T589] ? fpu__clear_all+0x20/0x20 [ 50.464100][ T602] iget_failed+0x162/0x1a0 [ 50.468788][ T589] ? locks_verify_truncate+0x170/0x170 [ 50.473392][ T602] f2fs_iget+0x165b/0x4af0 [ 50.478870][ T589] ? __kasan_check_read+0x11/0x20 [ 50.483512][ T602] f2fs_lookup+0x419/0xd20 [ 50.488611][ T589] __x64_sys_truncate+0x5b/0x70 [ 50.493116][ T602] __lookup_slow+0x2b8/0x410 [ 50.498337][ T589] do_syscall_64+0x31/0x40 [ 50.503009][ T602] lookup_slow+0x57/0x70 [ 50.507588][ T589] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 50.512009][ T602] walk_component+0x326/0x460 [ 50.517971][ T589] RIP: 0033:0x7f23e9931339 [ 50.522717][ T602] path_lookupat+0x155/0x430 [ 50.527131][ T589] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 50.531712][ T602] filename_lookup+0x1fd/0x660 [ 50.551776][ T589] RSP: 002b:00007f23e9796028 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 50.556655][ T602] user_path_at_empty+0x43/0x50 [ 50.565163][ T589] RAX: ffffffffffffffda RBX: 00007f23e9b6cfa0 RCX: 00007f23e9931339 [ 50.570271][ T602] do_sys_truncate+0xb6/0x1c0 [ 50.578488][ T589] RDX: 0000000000000000 RSI: 0000000000001c9e RDI: 0000200000000280 [ 50.583370][ T602] __x64_sys_truncate+0x5b/0x70 [ 50.591637][ T589] RBP: 00007f23e99c4d68 R08: 0000000000000000 R09: 0000000000000000 [ 50.596482][ T602] do_syscall_64+0x31/0x40 [ 50.604718][ T589] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 50.609180][ T602] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 50.617583][ T589] R13: 00007f23e9b6d038 R14: 00007f23e9b6cfa0 R15: 00007fffe3a3f398 [ 50.623489][ T602] [ 50.633852][ T602] The buggy address belongs to the object at ffff88811a716cb0 [ 50.633852][ T602] which belongs to the cache f2fs_extent_tree of size 80 [ 50.648778][ T602] The buggy address is located 0 bytes inside of [ 50.648778][ T602] 80-byte region [ffff88811a716cb0, ffff88811a716d00) [ 50.661876][ T602] The buggy address belongs to the page: [ 50.667596][ T602] page:ffffea000469c580 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11a716 [ 50.678185][ T602] flags: 0x4000000000000200(slab) [ 50.683222][ T602] raw: 4000000000000200 dead000000000100 dead000000000122 ffff8881029c7800 [ 50.692081][ T602] raw: 0000000000000000 0000000080240024 00000001ffffffff 0000000000000000 [ 50.700661][ T602] page dumped because: kasan: bad access detected [ 50.707210][ T602] page_owner tracks the page as allocated [ 50.713206][ T602] page last allocated via order 0, migratetype Reclaimable, gfp_mask 0x112c50(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 552, ts 46892387695, free_ts 45994143415 [ 50.732823][ T602] prep_new_page+0x176/0x190 [ 50.737510][ T602] get_page_from_freelist+0x225f/0x23f0 [ 50.743053][ T602] __alloc_pages_nodemask+0x29a/0x640 [ 50.748546][ T602] new_slab+0x84/0x3f0 [ 50.752611][ T602] ___slab_alloc+0x2f8/0x4c0 [ 50.757279][ T602] __slab_alloc+0x63/0xa0 [ 50.761709][ T602] kmem_cache_alloc+0x1a4/0x2d0 [ 50.766666][ T602] f2fs_init_extent_tree+0x502/0xc90 [ 50.772126][ T602] f2fs_iget+0xf7d/0x4af0 [ 50.776538][ T602] f2fs_lookup+0x419/0xd20 [ 50.781801][ T602] __lookup_slow+0x2b8/0x410 [ 50.786985][ T602] lookup_slow+0x57/0x70 [ 50.791940][ T602] walk_component+0x326/0x460 [ 50.797275][ T602] path_lookupat+0x155/0x430 [ 50.802415][ T602] filename_lookup+0x1fd/0x660 [ 50.807354][ T602] user_path_at_empty+0x43/0x50 [ 50.812415][ T602] page last free stack trace: [ 50.818944][ T602] free_unref_page_prepare+0x2b7/0x2d0 [ 50.824404][ T602] __free_pages+0x146/0x390 [ 50.829090][ T602] __free_slab+0xcf/0x190 [ 50.833639][ T602] unfreeze_partials+0x150/0x180 [ 50.838582][ T602] put_cpu_partial+0xc1/0x180 [ 50.843439][ T602] __slab_free+0x2c9/0x3a0 [ 50.847855][ T602] ___cache_free+0x10e/0x130 [ 50.852524][ T602] qlink_free+0x50/0x90 [ 50.856795][ T602] qlist_free_all+0x5f/0xb0 [ 50.862008][ T602] kasan_quarantine_reduce+0x14a/0x160 [ 50.867807][ T602] __kasan_slab_alloc+0x2f/0xe0 [ 50.872910][ T602] slab_post_alloc_hook+0x5d/0x2f0 [ 50.878276][ T602] kmem_cache_alloc+0x15a/0x2d0 [ 50.883398][ T602] __alloc_skb+0x9e/0x520 [ 50.887742][ T602] inet_netconf_notify_devconf+0x169/0x220 [ 50.893641][ T602] inetdev_event+0x7b0/0x1010 [ 50.898320][ T602] [ 50.900652][ T602] Memory state around the buggy address: [ 50.906299][ T602] ffff88811a716b80: fc fc fc fc fc fc fc fc fc fc 00 00 00 00 00 00 [ 50.914454][ T602] ffff88811a716c00: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc [ 50.922601][ T602] >ffff88811a716c80: fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb fb [ 50.930804][ T602] ^ [ 50.936428][ T602] ffff88811a716d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 50.944570][ T602] ffff88811a716d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 50.952710][ T602] ================================================================== [ 50.962360][ T589] F2FS-fs (loop0): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 50.988582][ T607] F2FS-fs (loop0): access invalid blkaddr:2147563524 [ 50.998872][ T607] CPU: 0 PID: 607 Comm: syz.0.27 Tainted: G B syzkaller #0 [ 51.007724][ T607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 51.018145][ T607] Call Trace: [ 51.021469][ T607] __dump_stack+0x21/0x24 [ 51.025847][ T607] dump_stack_lvl+0x1a7/0x208 [ 51.031269][ T607] ? __bpf_trace_f2fs_fiemap+0x60/0x60 [ 51.037892][ T607] ? _raw_write_lock+0x94/0xf0 [ 51.045407][ T607] ? show_regs_print_info+0x18/0x18 [ 51.051184][ T607] dump_stack+0x15/0x1c [ 51.056124][ T607] f2fs_is_valid_blkaddr+0xc2f/0x1330 [ 51.065272][ T607] f2fs_iget+0x1a41/0x4af0 [ 51.069835][ T607] f2fs_lookup+0x419/0xd20 [ 51.074653][ T607] ? try_to_unlazy+0x39d/0x630 [ 51.080262][ T607] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 51.086462][ T607] ? d_hash_and_lookup+0x1f0/0x1f0 [ 51.093713][ T607] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 51.100568][ T607] path_openat+0x145d/0x3040 [ 51.105630][ T607] ? do_filp_open+0x400/0x400 [ 51.111442][ T607] do_filp_open+0x1df/0x400 [ 51.117559][ T607] ? vfs_tmpfile+0x2c0/0x2c0 [ 51.124345][ T607] ? get_unused_fd_flags+0x92/0xa0 [ 51.134453][ T607] do_sys_openat2+0x19f/0x750 [ 51.140483][ T607] ? __se_sys_rt_sigprocmask+0x22c/0x290 [ 51.147626][ T607] ? do_sys_open+0xe0/0xe0 [ 51.152173][ T607] ? __x64_sys_rt_sigprocmask+0xb0/0xb0 [ 51.158268][ T607] ? switch_fpu_return+0x19c/0x330 [ 51.163543][ T607] __x64_sys_openat+0x136/0x160 [ 51.168606][ T607] do_syscall_64+0x31/0x40 [ 51.173326][ T607] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 51.179430][ T607] RIP: 0033:0x7f23e9931339 2026/09/20 22:05:51 executed programs: 24 [ 51.184130][ T607] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 51.205955][ T607] RSP: 002b:00007f23e9775028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 51.215567][ T607] RAX: ffffffffffffffda RBX: 00007f23e9b6d090 RCX: 00007f23e9931339 [ 51.224325][ T607] RDX: 0000000000101000 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 51.232581][ T607] RBP: 00007f23e99c4d68 R08: 0000000000000000 R09: 0000000000000000 [ 51.242242][ T607] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 51.250504][ T607] R13: 00007f23e9b6d128 R14: 00007f23e9b6d090 R15: 00007fffe3a3f398 [ 51.259183][ T607] F2FS-fs (loop0): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 51.272830][ T607] ================================================================== [ 51.273660][ T596] F2FS-fs (loop3): invalid crc value [ 51.281206][ T607] BUG: KASAN: double-free or invalid-free in kmem_cache_free+0x100/0x2d0 [ 51.281209][ T607] [ 51.281223][ T607] CPU: 0 PID: 607 Comm: syz.0.27 Tainted: G B syzkaller #0 [ 51.281229][ T607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 51.281233][ T607] Call Trace: [ 51.281246][ T607] __dump_stack+0x21/0x24 [ 51.281256][ T607] dump_stack_lvl+0x1a7/0x208 [ 51.281267][ T607] ? show_regs_print_info+0x18/0x18 [ 51.281279][ T607] ? thaw_kernel_threads+0x220/0x220 [ 51.281292][ T607] print_address_description+0x7f/0x2c0 [ 51.281304][ T607] ? kmem_cache_free+0x100/0x2d0 [ 51.281315][ T607] kasan_report_invalid_free+0x3f/0x70 [ 51.281326][ T607] ? kmem_cache_free+0x100/0x2d0 [ 51.281336][ T607] ____kasan_slab_free+0x13d/0x160 [ 51.281346][ T607] __kasan_slab_free+0x11/0x20 [ 51.281356][ T607] slab_free_freelist_hook+0xc5/0x190 [ 51.281369][ T607] ? f2fs_destroy_extent_tree+0x2d7/0x4e0 [ 51.281380][ T607] kmem_cache_free+0x100/0x2d0 [ 51.281392][ T607] f2fs_destroy_extent_tree+0x2d7/0x4e0 [ 51.281404][ T607] f2fs_evict_inode+0x3fe/0x14a0 [ 51.281415][ T607] ? _raw_spin_unlock+0x4d/0x70 [ 51.281428][ T607] ? inode_wait_for_writeback+0x1df/0x220 [ 51.281439][ T607] ? f2fs_write_inode+0x6e0/0x6e0 [ 51.281451][ T607] ? bit_waitqueue+0x30/0x30 [ 51.281463][ T607] ? f2fs_write_inode+0x6e0/0x6e0 [ 51.281472][ T607] evict+0x4a9/0x940 [ 51.281481][ T607] ? mode_strip_sgid+0x150/0x150 [ 51.281490][ T607] ? _raw_spin_lock+0x94/0xf0 [ 51.281507][ T607] ? _raw_spin_trylock_bh+0x150/0x150 [ 51.445838][ T607] ? __kasan_check_read+0x11/0x20 [ 51.450886][ T607] ? f2fs_drop_inode+0x16d/0x940 [ 51.456002][ T607] ? f2fs_dirty_inode+0x2e0/0x2e0 [ 51.461030][ T607] iput+0x654/0x7e0 [ 51.464836][ T607] iget_failed+0x162/0x1a0 [ 51.469343][ T607] f2fs_iget+0x165b/0x4af0 [ 51.474131][ T607] f2fs_lookup+0x419/0xd20 [ 51.478650][ T607] ? try_to_unlazy+0x39d/0x630 [ 51.483583][ T607] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 51.489856][ T607] ? d_hash_and_lookup+0x1f0/0x1f0 [ 51.495186][ T607] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 51.501267][ T607] path_openat+0x145d/0x3040 [ 51.505959][ T607] ? do_filp_open+0x400/0x400 [ 51.510744][ T607] do_filp_open+0x1df/0x400 [ 51.515443][ T607] ? vfs_tmpfile+0x2c0/0x2c0 [ 51.520216][ T607] ? get_unused_fd_flags+0x92/0xa0 [ 51.525345][ T607] do_sys_openat2+0x19f/0x750 [ 51.530109][ T607] ? __se_sys_rt_sigprocmask+0x22c/0x290 [ 51.535823][ T607] ? do_sys_open+0xe0/0xe0 [ 51.540233][ T607] ? __x64_sys_rt_sigprocmask+0xb0/0xb0 [ 51.546126][ T607] ? switch_fpu_return+0x19c/0x330 [ 51.551415][ T607] __x64_sys_openat+0x136/0x160 [ 51.556441][ T607] do_syscall_64+0x31/0x40 [ 51.561228][ T607] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 51.567854][ T607] RIP: 0033:0x7f23e9931339 [ 51.572469][ T607] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 51.595046][ T607] RSP: 002b:00007f23e9775028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 51.604518][ T607] RAX: ffffffffffffffda RBX: 00007f23e9b6d090 RCX: 00007f23e9931339 [ 51.613708][ T607] RDX: 0000000000101000 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 51.623551][ T607] RBP: 00007f23e99c4d68 R08: 0000000000000000 R09: 0000000000000000 [ 51.633892][ T607] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 51.642321][ T607] R13: 00007f23e9b6d128 R14: 00007f23e9b6d090 R15: 00007fffe3a3f398 [ 51.650890][ T607] [ 51.653493][ T607] Allocated by task 589: [ 51.658085][ T607] __kasan_slab_alloc+0xb7/0xe0 [ 51.663139][ T607] slab_post_alloc_hook+0x5d/0x2f0 [ 51.668278][ T607] kmem_cache_alloc+0x15a/0x2d0 [ 51.673136][ T607] f2fs_init_extent_tree+0x502/0xc90 [ 51.678576][ T607] f2fs_iget+0xf7d/0x4af0 [ 51.683265][ T607] f2fs_lookup+0x419/0xd20 [ 51.687704][ T607] __lookup_slow+0x2b8/0x410 [ 51.692403][ T607] lookup_slow+0x57/0x70 [ 51.696643][ T607] walk_component+0x326/0x460 [ 51.701488][ T607] path_lookupat+0x155/0x430 [ 51.706197][ T607] filename_lookup+0x1fd/0x660 [ 51.711061][ T607] user_path_at_empty+0x43/0x50 [ 51.715928][ T607] do_sys_truncate+0xb6/0x1c0 [ 51.720872][ T607] __x64_sys_truncate+0x5b/0x70 [ 51.725741][ T607] do_syscall_64+0x31/0x40 [ 51.730274][ T607] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 51.736602][ T607] [ 51.739036][ T607] Freed by task 589: [ 51.743150][ T607] kasan_set_track+0x4a/0x70 [ 51.747846][ T607] kasan_set_free_info+0x23/0x40 [ 51.752989][ T607] ____kasan_slab_free+0x125/0x160 [ 51.758407][ T607] __kasan_slab_free+0x11/0x20 [ 51.763894][ T607] slab_free_freelist_hook+0xc5/0x190 [ 51.770429][ T607] kmem_cache_free+0x100/0x2d0 [ 51.775755][ T607] f2fs_destroy_extent_tree+0x2d7/0x4e0 [ 51.783373][ T607] f2fs_evict_inode+0x3fe/0x14a0 [ 51.788900][ T607] evict+0x4a9/0x940 [ 51.792973][ T607] iput+0x654/0x7e0 [ 51.797745][ T607] iget_failed+0x162/0x1a0 [ 51.803736][ T607] f2fs_iget+0x165b/0x4af0 [ 51.808789][ T607] f2fs_lookup+0x419/0xd20 [ 51.814155][ T607] __lookup_slow+0x2b8/0x410 [ 51.818929][ T607] lookup_slow+0x57/0x70 [ 51.823807][ T607] walk_component+0x326/0x460 [ 51.828675][ T607] path_lookupat+0x155/0x430 [ 51.833260][ T607] filename_lookup+0x1fd/0x660 [ 51.838109][ T607] user_path_at_empty+0x43/0x50 [ 51.843040][ T607] do_sys_truncate+0xb6/0x1c0 [ 51.847883][ T607] __x64_sys_truncate+0x5b/0x70 [ 51.852844][ T607] do_syscall_64+0x31/0x40 [ 51.857261][ T607] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 51.863148][ T607] [ 51.865473][ T607] The buggy address belongs to the object at ffff88811a716bd0 [ 51.865473][ T607] which belongs to the cache f2fs_extent_tree of size 80 [ 51.880043][ T607] The buggy address is located 0 bytes inside of [ 51.880043][ T607] 80-byte region [ffff88811a716bd0, ffff88811a716c20) [ 51.893050][ T607] The buggy address belongs to the page: [ 51.898784][ T607] page:ffffea000469c580 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11a716 [ 51.909024][ T607] flags: 0x4000000000000200(slab) [ 51.914160][ T607] raw: 4000000000000200 dead000000000100 dead000000000122 ffff8881029c7800 [ 51.923092][ T607] raw: 0000000000000000 0000000080240024 00000001ffffffff 0000000000000000 [ 51.933476][ T607] page dumped because: kasan: bad access detected [ 51.939903][ T607] page_owner tracks the page as allocated [ 51.945629][ T607] page last allocated via order 0, migratetype Reclaimable, gfp_mask 0x112c50(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 552, ts 46892387695, free_ts 45994143415 [ 51.964737][ T607] prep_new_page+0x176/0x190 [ 51.969332][ T607] get_page_from_freelist+0x225f/0x23f0 [ 51.974956][ T607] __alloc_pages_nodemask+0x29a/0x640 [ 51.981059][ T607] new_slab+0x84/0x3f0 [ 51.985129][ T607] ___slab_alloc+0x2f8/0x4c0 [ 51.989713][ T607] __slab_alloc+0x63/0xa0 [ 51.994210][ T607] kmem_cache_alloc+0x1a4/0x2d0 [ 51.999060][ T607] f2fs_init_extent_tree+0x502/0xc90 [ 52.004339][ T607] f2fs_iget+0xf7d/0x4af0 [ 52.008832][ T607] f2fs_lookup+0x419/0xd20 [ 52.013913][ T607] __lookup_slow+0x2b8/0x410 [ 52.018619][ T607] lookup_slow+0x57/0x70 [ 52.022890][ T607] walk_component+0x326/0x460 [ 52.027813][ T607] path_lookupat+0x155/0x430 [ 52.032396][ T607] filename_lookup+0x1fd/0x660 [ 52.037345][ T607] user_path_at_empty+0x43/0x50 [ 52.042185][ T607] page last free stack trace: [ 52.047118][ T607] free_unref_page_prepare+0x2b7/0x2d0 [ 52.052576][ T607] __free_pages+0x146/0x390 [ 52.057080][ T607] __free_slab+0xcf/0x190 [ 52.061410][ T607] unfreeze_partials+0x150/0x180 [ 52.066369][ T607] put_cpu_partial+0xc1/0x180 [ 52.071049][ T607] __slab_free+0x2c9/0x3a0 [ 52.075637][ T607] ___cache_free+0x10e/0x130 [ 52.080225][ T607] qlink_free+0x50/0x90 [ 52.084384][ T607] qlist_free_all+0x5f/0xb0 [ 52.088880][ T607] kasan_quarantine_reduce+0x14a/0x160 [ 52.094334][ T607] __kasan_slab_alloc+0x2f/0xe0 [ 52.099217][ T607] slab_post_alloc_hook+0x5d/0x2f0 [ 52.104686][ T607] kmem_cache_alloc+0x15a/0x2d0 [ 52.110221][ T607] __alloc_skb+0x9e/0x520 [ 52.114654][ T607] inet_netconf_notify_devconf+0x169/0x220 [ 52.120615][ T607] inetdev_event+0x7b0/0x1010 [ 52.125491][ T607] [ 52.127814][ T607] Memory state around the buggy address: [ 52.133966][ T607] ffff88811a716a80: fa fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc [ 52.142160][ T607] ffff88811a716b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 52.150660][ T607] >ffff88811a716b80: fc fc fc fc fc fc fc fc fc fc fa fb fb fb fb fb [ 52.158712][ T607] ^ [ 52.165470][ T607] ffff88811a716c00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc [ 52.173616][ T607] ffff88811a716c80: fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb fb [ 52.182195][ T607] ================================================================== [ 52.190785][ T596] F2FS-fs (loop3): Failed to initialize F2FS segment manager (-4) [ 52.274452][ T606] F2FS-fs (loop1): invalid crc value [ 52.290072][ T606] F2FS-fs (loop1): Found nat_bits in checkpoint [ 52.442731][ T606] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 52.482969][ T606] F2FS-fs (loop1): access invalid blkaddr:2147563524 [ 52.489844][ T606] CPU: 0 PID: 606 Comm: syz.1.29 Tainted: G B syzkaller #0 [ 52.498719][ T606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 52.508973][ T606] Call Trace: [ 52.512329][ T606] __dump_stack+0x21/0x24 [ 52.516679][ T606] dump_stack_lvl+0x1a7/0x208 [ 52.521747][ T606] ? __bpf_trace_f2fs_fiemap+0x60/0x60 [ 52.527229][ T606] ? _raw_spin_lock+0x94/0xf0 [ 52.532102][ T606] ? show_regs_print_info+0x18/0x18 [ 52.537336][ T606] ? f2fs_init_extent_tree+0x7a0/0xc90 [ 52.542982][ T606] ? memcpy+0x56/0x70 [ 52.547071][ T606] dump_stack+0x15/0x1c [ 52.551610][ T606] f2fs_is_valid_blkaddr+0xc2f/0x1330 [ 52.557137][ T606] f2fs_iget+0x1a41/0x4af0 [ 52.561668][ T606] f2fs_lookup+0x419/0xd20 [ 52.566365][ T606] ? f2fs_encrypted_symlink_getattr+0x40/0x40 [ 52.572439][ T606] ? d_hash_and_lookup+0x1f0/0x1f0 [ 52.578286][ T606] ? __kasan_check_write+0x14/0x20 [ 52.583762][ T606] __lookup_slow+0x2b8/0x410 [ 52.588547][ T606] ? lookup_one_len+0x2d0/0x2d0 [ 52.594130][ T606] ? lookup_fast+0x316/0x740 [ 52.599025][ T606] ? __kasan_check_write+0x14/0x20 [ 52.604765][ T606] lookup_slow+0x57/0x70 [ 52.609256][ T606] walk_component+0x326/0x460 [ 52.614331][ T606] path_lookupat+0x155/0x430 [ 52.619127][ T606] filename_lookup+0x1fd/0x660 [ 52.624233][ T606] ? hashlen_string+0x120/0x120 [ 52.629614][ T606] ? getname_flags+0x205/0x510 [ 52.634921][ T606] user_path_at_empty+0x43/0x50 [ 52.639883][ T606] do_sys_truncate+0xb6/0x1c0 [ 52.644577][ T606] ? fpu__clear_all+0x20/0x20 [ 52.649976][ T606] ? locks_verify_truncate+0x170/0x170 [ 52.655718][ T606] ? __kasan_check_read+0x11/0x20 [ 52.660855][ T606] __x64_sys_truncate+0x5b/0x70 [ 52.665857][ T606] do_syscall_64+0x31/0x40 [ 52.670484][ T606] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 52.676483][ T606] RIP: 0033:0x7f9e42013339 [ 52.681209][ T606] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 52.701617][ T606] RSP: 002b:00007f9e41e78028 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 52.710537][ T606] RAX: ffffffffffffffda RBX: 00007f9e4224efa0 RCX: 00007f9e42013339 [ 52.719280][ T606] RDX: 0000000000000000 RSI: 0000000000001c9e RDI: 0000200000000280