Warning: Permanently added '10.128.0.199' (ED25519) to the list of known hosts. 2026/08/02 18:17:46 parsed 1 programs Setting up swapspace version 1, size = 127995904 bytes [ 40.102565][ T24] kauditd_printk_skb: 31 callbacks suppressed [ 40.102577][ T24] audit: type=1400 audit(1785694667.260:105): avc: denied { unlink } for pid=449 comm="syz-executor" name="swap-file" dev="sda1" ino=2027 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 40.166050][ T24] audit: type=1400 audit(1785694667.330:106): avc: denied { write } for pid=451 comm="mkswap" path="pipe:[15041]" dev="pipefs" ino=15041 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 40.189078][ T449] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 40.738402][ T24] audit: type=1401 audit(1785694667.900:107): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 40.881506][ T475] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.888838][ T475] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.896343][ T475] device bridge_slave_0 entered promiscuous mode [ 40.903475][ T475] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.911252][ T475] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.919183][ T475] device bridge_slave_1 entered promiscuous mode [ 40.953036][ T475] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.960272][ T475] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.967909][ T475] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.975196][ T475] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.991579][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.999078][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.006909][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 41.014414][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 41.024444][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 41.032781][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.040251][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.048813][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 41.057165][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.064248][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.077004][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 41.086870][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 41.100340][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 41.112327][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 41.120690][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 41.128445][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 41.136827][ T475] device veth0_vlan entered promiscuous mode [ 41.147860][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 41.157636][ T475] device veth1_macvtap entered promiscuous mode [ 41.167122][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 41.177405][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 41.212130][ T24] audit: type=1400 audit(1785694668.370:108): avc: denied { create } for pid=482 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 2026/08/02 18:17:48 executed programs: 0 [ 41.730585][ T511] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.737754][ T511] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.745435][ T511] device bridge_slave_0 entered promiscuous mode [ 41.752272][ T511] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.759728][ T511] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.768231][ T511] device bridge_slave_1 entered promiscuous mode [ 41.803491][ T511] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.811534][ T511] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.819191][ T511] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.826400][ T511] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.842106][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 41.850003][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.857446][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.869884][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 41.878257][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 41.887655][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.894857][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.907838][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 41.916737][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 41.925336][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.932635][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.942903][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 41.951551][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 41.967278][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 41.975577][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 41.988257][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 41.996900][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 42.010870][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 42.019253][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 42.027854][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 42.035662][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 42.043918][ T511] device veth0_vlan entered promiscuous mode [ 42.053747][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 42.062502][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 42.075738][ T511] device veth1_macvtap entered promiscuous mode [ 42.084559][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 42.092388][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 42.101516][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 42.111102][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 42.119765][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 42.129414][ T7] device bridge_slave_1 left promiscuous mode [ 42.136214][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.143961][ T7] device bridge_slave_0 left promiscuous mode [ 42.150254][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.158133][ T7] device veth1_macvtap left promiscuous mode [ 42.164371][ T7] device veth0_vlan left promiscuous mode [ 42.275491][ T516] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 42.284838][ T24] audit: type=1400 audit(1785694669.450:109): avc: denied { mount } for pid=515 comm="syz.2.17" name="/" dev="loop2" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 42.284850][ T516] ext4 filesystem being mounted at /0/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 42.318261][ T24] audit: type=1400 audit(1785694669.450:110): avc: denied { write } for pid=515 comm="syz.2.17" name="/" dev="loop2" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 42.339980][ T24] audit: type=1400 audit(1785694669.450:111): avc: denied { add_name } for pid=515 comm="syz.2.17" name="memory.stat" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 42.361962][ T24] audit: type=1400 audit(1785694669.450:112): avc: denied { create } for pid=515 comm="syz.2.17" name="memory.stat" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 42.362140][ T49] EXT4-fs error (device loop2): __ext4_get_inode_loc:4451: comm kworker/u4:2: Invalid inode table block 10675719722312467482 in block_group 0 [ 42.383031][ T24] audit: type=1400 audit(1785694669.450:113): avc: denied { read append open } for pid=515 comm="syz.2.17" path="/0/file0/memory.stat" dev="loop2" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 42.422022][ T24] audit: type=1400 audit(1785694669.450:114): avc: denied { append } for pid=515 comm="syz.2.17" name="loop2" dev="devtmpfs" ino=117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 42.525617][ T530] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 42.534830][ T530] ext4 filesystem being mounted at /1/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 42.567688][ T357] ================================================================== [ 42.576075][ T357] BUG: KASAN: use-after-free in ext4_find_extent+0xbfb/0xe30 [ 42.583641][ T357] Read of size 4 at addr ffff8881278261c8 by task kworker/u4:3/357 [ 42.591977][ T357] [ 42.594302][ T357] CPU: 0 PID: 357 Comm: kworker/u4:3 Not tainted syzkaller #0 [ 42.601737][ T357] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 42.612018][ T357] Workqueue: writeback wb_workfn (flush-7:2) [ 42.618312][ T357] Call Trace: [ 42.621597][ T357] __dump_stack+0x21/0x24 [ 42.626043][ T357] dump_stack_lvl+0x1a7/0x208 [ 42.630824][ T357] ? show_regs_print_info+0x18/0x18 [ 42.636395][ T357] ? thaw_kernel_threads+0x220/0x220 [ 42.641665][ T357] print_address_description+0x7f/0x2c0 [ 42.647288][ T357] ? ext4_find_extent+0xbfb/0xe30 [ 42.652477][ T357] kasan_report+0x100/0x140 [ 42.657058][ T357] ? __read_extent_tree_block+0x1e4/0x780 [ 42.662930][ T357] ? ext4_find_extent+0xbfb/0xe30 [ 42.667964][ T357] __asan_report_load4_noabort+0x14/0x20 [ 42.673665][ T357] ext4_find_extent+0xbfb/0xe30 [ 42.678585][ T357] ext4_ext_map_blocks+0x204/0x5da0 [ 42.683940][ T357] ? stack_trace_save+0xa6/0xf0 [ 42.688957][ T357] ? __kasan_slab_alloc+0xc9/0xe0 [ 42.693970][ T357] ? __kasan_slab_alloc+0xb7/0xe0 [ 42.698992][ T357] ? slab_post_alloc_hook+0x5d/0x2f0 [ 42.704385][ T357] ? kmem_cache_alloc+0x15a/0x2d0 [ 42.709577][ T357] ? ext4_alloc_io_end_vec+0x2a/0x160 [ 42.715111][ T357] ? ext4_writepages+0xf19/0x2f00 [ 42.720217][ T357] ? do_writepages+0x12e/0x280 [ 42.724976][ T357] ? wb_workfn+0x3ac/0xf30 [ 42.729473][ T357] ? process_one_work+0x6fd/0xbc0 [ 42.734484][ T357] ? worker_thread+0xa8e/0x13c0 [ 42.739315][ T357] ? ext4_ext_release+0x10/0x10 [ 42.744166][ T357] ? ext4_es_lookup_extent+0x563/0x900 [ 42.749874][ T357] ext4_map_blocks+0x979/0x1b10 [ 42.754890][ T357] ? slab_post_alloc_hook+0x7d/0x2f0 [ 42.760155][ T357] ? ext4_alloc_io_end_vec+0x2a/0x160 [ 42.765615][ T357] ? ext4_issue_zeroout+0x1a0/0x1a0 [ 42.770811][ T357] ? ext4_alloc_io_end_vec+0x2a/0x160 [ 42.776361][ T357] ? ext4_inode_journal_mode+0x19a/0x470 [ 42.782341][ T357] ext4_writepages+0x1238/0x2f00 [ 42.787296][ T357] ? update_load_avg+0x505/0x1540 [ 42.792676][ T357] ? ext4_readpage+0x220/0x220 [ 42.797432][ T357] ? enqueue_task_fair+0xabb/0x2250 [ 42.803484][ T357] ? ext4_readpage+0x220/0x220 [ 42.808716][ T357] do_writepages+0x12e/0x280 [ 42.814589][ T357] ? __writepage+0x130/0x130 [ 42.819714][ T357] ? __kasan_check_write+0x14/0x20 [ 42.825004][ T357] ? __kasan_check_write+0x14/0x20 [ 42.830191][ T357] ? _raw_spin_lock+0x94/0xf0 [ 42.834859][ T357] __writeback_single_inode+0xd9/0xa30 [ 42.840415][ T357] ? wbc_attach_and_unlock_inode+0x171/0x590 [ 42.846642][ T357] writeback_sb_inodes+0x96d/0x1680 [ 42.851911][ T357] ? queue_io+0x4b0/0x4b0 [ 42.856238][ T357] ? __kasan_check_read+0x11/0x20 [ 42.861253][ T357] ? queue_io+0x37a/0x4b0 [ 42.865649][ T357] wb_writeback+0x40f/0xb80 [ 42.870235][ T357] ? wb_io_lists_depopulated+0x180/0x180 [ 42.876020][ T357] ? set_worker_desc+0x1ba/0x1f0 [ 42.880988][ T357] ? _raw_spin_trylock_bh+0x150/0x150 [ 42.886433][ T357] ? __kasan_check_write+0x14/0x20 [ 42.891614][ T357] wb_workfn+0x3ac/0xf30 [ 42.895859][ T357] ? inode_wait_for_writeback+0x220/0x220 [ 42.901566][ T357] ? pick_next_task_fair+0xe5/0xa50 [ 42.906745][ T357] ? find_next_bit+0x80/0x100 [ 42.911684][ T357] ? _raw_spin_unlock_irq+0x4e/0x70 [ 42.916902][ T357] ? finish_task_switch+0x12e/0x5a0 [ 42.922171][ T357] ? __switch_to_asm+0x3a/0x60 [ 42.927029][ T357] ? __kasan_check_read+0x11/0x20 [ 42.932217][ T357] ? read_word_at_a_time+0x12/0x20 [ 42.937321][ T357] ? strscpy+0x9b/0x290 [ 42.941574][ T357] process_one_work+0x6fd/0xbc0 [ 42.946547][ T357] worker_thread+0xa8e/0x13c0 [ 42.951330][ T357] ? __kthread_parkme+0xb3/0x1b0 [ 42.956529][ T357] kthread+0x324/0x3b0 [ 42.960711][ T357] ? worker_clr_flags+0x190/0x190 [ 42.965747][ T357] ? kthread_blkcg+0xd0/0xd0 [ 42.970351][ T357] ret_from_fork+0x1f/0x30 [ 42.974762][ T357] [ 42.977075][ T357] Allocated by task 300: [ 42.981410][ T357] __kasan_kmalloc+0xd4/0x100 [ 42.986384][ T357] kmem_cache_alloc_trace+0x179/0x2e0 [ 42.991766][ T357] kernfs_iop_get_link+0x66/0x600 [ 42.996900][ T357] pick_link+0x5b2/0xcc0 [ 43.001229][ T357] step_into+0xaa6/0xcd0 [ 43.005516][ T357] path_openat+0xec4/0x3040 [ 43.010018][ T357] do_filp_open+0x1df/0x400 [ 43.014516][ T357] do_sys_openat2+0x19f/0x750 [ 43.019216][ T357] __x64_sys_openat+0x136/0x160 [ 43.024194][ T357] do_syscall_64+0x31/0x40 [ 43.028767][ T357] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 43.035061][ T357] [ 43.037553][ T357] Freed by task 300: [ 43.041661][ T357] kasan_set_track+0x4a/0x70 [ 43.046272][ T357] kasan_set_free_info+0x23/0x40 [ 43.051214][ T357] ____kasan_slab_free+0x125/0x160 [ 43.056309][ T357] __kasan_slab_free+0x11/0x20 [ 43.061228][ T357] slab_free_freelist_hook+0xc5/0x190 [ 43.066606][ T357] kfree+0xc0/0x270 [ 43.070496][ T357] kfree_link+0x15/0x20 [ 43.074640][ T357] path_openat+0xdec/0x3040 [ 43.079159][ T357] do_filp_open+0x1df/0x400 [ 43.083648][ T357] do_sys_openat2+0x19f/0x750 [ 43.088486][ T357] __x64_sys_openat+0x136/0x160 [ 43.093409][ T357] do_syscall_64+0x31/0x40 [ 43.098095][ T357] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 43.104273][ T357] [ 43.106691][ T357] The buggy address belongs to the object at ffff888127826000 [ 43.106691][ T357] which belongs to the cache kmalloc-4k of size 4096 [ 43.120746][ T357] The buggy address is located 456 bytes inside of [ 43.120746][ T357] 4096-byte region [ffff888127826000, ffff888127827000) [ 43.134088][ T357] The buggy address belongs to the page: [ 43.139714][ T357] page:ffffea00049e0800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x127820 [ 43.149953][ T357] head:ffffea00049e0800 order:3 compound_mapcount:0 compound_pincount:0 [ 43.158368][ T357] flags: 0x4000000000010200(slab|head) [ 43.163829][ T357] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100042c00 [ 43.172592][ T357] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 43.181366][ T357] page dumped because: kasan: bad access detected [ 43.187889][ T357] page_owner tracks the page as allocated [ 43.193871][ T357] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 300, ts 26807419196, free_ts 0 [ 43.215044][ T357] prep_new_page+0x176/0x190 [ 43.219685][ T357] get_page_from_freelist+0x225f/0x23f0 [ 43.225399][ T357] __alloc_pages_nodemask+0x29a/0x640 [ 43.230763][ T357] new_slab+0x84/0x3f0 [ 43.234904][ T357] ___slab_alloc+0x2f8/0x4c0 [ 43.239586][ T357] __slab_alloc+0x63/0xa0 [ 43.244382][ T357] kmem_cache_alloc_trace+0x1a8/0x2e0 [ 43.249954][ T357] uevent_show+0x15d/0x340 [ 43.254746][ T357] dev_attr_show+0x56/0xd0 [ 43.259188][ T357] sysfs_kf_seq_show+0x266/0x3d0 [ 43.264138][ T357] kernfs_seq_show+0x119/0x160 [ 43.268931][ T357] seq_read_iter+0x472/0xce0 [ 43.273512][ T357] kernfs_fop_read_iter+0x146/0x460 [ 43.278795][ T357] vfs_read+0x62a/0xa50 [ 43.283300][ T357] ksys_read+0x14a/0x260 [ 43.287812][ T357] __x64_sys_read+0x7b/0x90 [ 43.292710][ T357] page_owner free stack trace missing [ 43.298666][ T357] [ 43.300998][ T357] Memory state around the buggy address: [ 43.306918][ T357] ffff888127826080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.317501][ T357] ffff888127826100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.326105][ T357] >ffff888127826180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.334292][ T357] ^ [ 43.341162][ T357] ffff888127826200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.349600][ T357] ffff888127826280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.357939][ T357] ================================================================== [ 43.365987][ T357] Disabling lock debugging due to kernel taint [ 43.465674][ T550] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 43.474743][ T550] ext4 filesystem being mounted at /2/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 43.506100][ T357] EXT4-fs error (device loop2): __ext4_get_inode_loc:4451: comm kworker/u4:3: Invalid inode table block 11335476957231759676 in block_group 0 [ 43.696857][ T555] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 43.705925][ T555] ext4 filesystem being mounted at /3/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 43.739022][ T357] EXT4-fs error (device loop2): __ext4_get_inode_loc:4451: comm kworker/u4:3: Invalid inode table block 12251902480533084122 in block_group 0 [ 43.825328][ T560] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 43.835164][ T560] ext4 filesystem being mounted at /4/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 43.975322][ T565] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 43.984403][ T565] ext4 filesystem being mounted at /5/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 44.030501][ T357] EXT4-fs error (device loop2): __ext4_get_inode_loc:4451: comm kworker/u4:3: Invalid inode table block 4681120029152026812 in block_group 0 [ 44.125470][ T570] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 44.134865][ T570] ext4 filesystem being mounted at /6/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 44.315280][ T575] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 44.324309][ T575] ext4 filesystem being mounted at /7/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 44.356574][ T7] EXT4-fs error (device loop2): __ext4_get_inode_loc:4451: comm kworker/u4:0: Invalid inode table block 16948722491548059555 in block_group 0 [ 44.455229][ T580] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 44.464659][ T580] ext4 filesystem being mounted at /8/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 44.585188][ T585] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 44.594258][ T585] ext4 filesystem being mounted at /9/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 44.626834][ T7] EXT4-fs error (device loop2): ext4_map_blocks:742: inode #18: block 23566485575163: comm kworker/u4:0: lblock 0 mapped to illegal pblock 23566485575163 (length 16) [ 44.644498][ T7] EXT4-fs (loop2): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 16 with error 117 [ 44.657350][ T7] EXT4-fs (loop2): This should not happen!! Data will be lost [ 44.657350][ T7] [ 44.667864][ T7] EXT4-fs error (device loop2): __ext4_get_inode_loc:4451: comm kworker/u4:0: Invalid inode table block 15591525182022556990 in block_group 0 [ 44.785409][ T590] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 44.795276][ T590] ext4 filesystem being mounted at /10/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 44.827655][ T7] EXT4-fs error (device loop2): __ext4_get_inode_loc:4451: comm kworker/u4:0: Invalid inode table block 10063475407909489293 in block_group 0 [ 44.895368][ T595] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 44.905276][ T595] ext4 filesystem being mounted at /11/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 44.938023][ T7] EXT4-fs error (device loop2): __ext4_get_inode_loc:4451: comm kworker/u4:0: Invalid inode table block 10904021393100286679 in block_group 0 [ 45.055335][ T600] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 45.064850][ T600] ext4 filesystem being mounted at /12/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 45.096529][ T7] EXT4-fs error (device loop2): __ext4_get_inode_loc:4451: comm kworker/u4:0: Invalid inode table block 2018363831618170933 in block_group 0 [ 45.185250][ T605] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 45.194446][ T605] ext4 filesystem being mounted at /13/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 45.227098][ T7] EXT4-fs error (device loop2): __ext4_get_inode_loc:4451: comm kworker/u4:0: Invalid inode table block 720618060783729142 in block_group 0 [ 45.247249][ T357] ------------[ cut here ]------------ [ 45.252752][ T357] kernel BUG at fs/ext4/extents.c:2150! [ 45.258645][ T357] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 45.265022][ T357] CPU: 1 PID: 357 Comm: kworker/u4:3 Tainted: G B syzkaller #0 [ 45.274133][ T357] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 45.284226][ T357] Workqueue: writeback wb_workfn (flush-7:2) [ 45.290317][ T357] RIP: 0010:ext4_ext_insert_extent+0x45b8/0x45f0 [ 45.297220][ T357] Code: ff 44 89 f1 80 e1 07 fe c1 38 c1 0f 8c 01 e9 ff ff 4c 89 f7 e8 09 5c d4 ff e9 f4 e8 ff ff e8 1f e7 99 ff 0f 0b e8 18 e7 99 ff <0f> 0b e8 11 e7 99 ff 0f 0b 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c fe [ 45.317576][ T357] RSP: 0018:ffffc90000cc6b60 EFLAGS: 00010293 [ 45.323982][ T357] RAX: ffffffff81cabc48 RBX: ffff888122b7f000 RCX: ffff88810c644f00 [ 45.331949][ T357] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 45.339908][ T357] RBP: ffffc90000cc6d10 R08: ffff88811aa0049f R09: 1ffff11023540093 [ 45.348270][ T357] R10: dffffc0000000000 R11: ffffed1023540094 R12: ffff888122b8fbfc [ 45.356234][ T357] R13: ffff888119ea0040 R14: 0000000000000000 R15: 0000000000000000 [ 45.364217][ T357] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 45.373320][ T357] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 45.379911][ T357] CR2: 0000555583146928 CR3: 000000010d6ef000 CR4: 00000000003506a0 [ 45.387975][ T357] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 45.395984][ T357] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 45.403953][ T357] Call Trace: [ 45.407261][ T357] ? __getblk_gfp+0x3b/0x780 [ 45.411939][ T357] ? ext4_ext_search_right+0x38b/0x880 [ 45.417394][ T357] ? memcpy+0x56/0x70 [ 45.421361][ T357] ? ext4_ext_next_allocated_block+0x2a0/0x2a0 [ 45.427504][ T357] ? get_implied_cluster_alloc+0x4c0/0x8c0 [ 45.433452][ T357] ext4_ext_map_blocks+0x16f2/0x5da0 [ 45.439072][ T357] ? __kasan_slab_alloc+0xc9/0xe0 [ 45.444539][ T357] ? __kasan_slab_alloc+0xb7/0xe0 [ 45.449555][ T357] ? slab_post_alloc_hook+0x5d/0x2f0 [ 45.454943][ T357] ? kmem_cache_alloc+0x15a/0x2d0 [ 45.459981][ T357] ? ext4_alloc_io_end_vec+0x2a/0x160 [ 45.465448][ T357] ? ext4_writepages+0xf19/0x2f00 [ 45.470781][ T357] ? do_writepages+0x12e/0x280 [ 45.475838][ T357] ? wb_workfn+0x3ac/0xf30 [ 45.480491][ T357] ? process_one_work+0x6fd/0xbc0 [ 45.485578][ T357] ? worker_thread+0xa8e/0x13c0 [ 45.490660][ T357] ? ext4_ext_release+0x10/0x10 [ 45.495512][ T357] ? ext4_es_lookup_extent+0x563/0x900 [ 45.501515][ T357] ext4_map_blocks+0x979/0x1b10 [ 45.506636][ T357] ? slab_post_alloc_hook+0x7d/0x2f0 [ 45.512202][ T357] ? ext4_alloc_io_end_vec+0x2a/0x160 [ 45.517741][ T357] ? ext4_issue_zeroout+0x1a0/0x1a0 [ 45.523097][ T357] ? ext4_alloc_io_end_vec+0x2a/0x160 [ 45.528458][ T357] ? ext4_inode_journal_mode+0x19a/0x470 [ 45.534576][ T357] ext4_writepages+0x1238/0x2f00 [ 45.540043][ T357] ? ext4_readpage+0x220/0x220 [ 45.545330][ T357] ? ext4_itable_unused_set+0x100/0x100 [ 45.551326][ T357] ? __kasan_check_write+0x14/0x20 [ 45.556695][ T357] ? ext4_readpage+0x220/0x220 [ 45.561704][ T357] do_writepages+0x12e/0x280 [ 45.566393][ T357] ? __writepage+0x130/0x130 [ 45.571338][ T357] ? __kasan_check_write+0x14/0x20 [ 45.576704][ T357] ? __kasan_check_write+0x14/0x20 [ 45.581845][ T357] ? _raw_spin_lock+0x94/0xf0 [ 45.586590][ T357] __writeback_single_inode+0xd9/0xa30 [ 45.592235][ T357] ? wbc_attach_and_unlock_inode+0x171/0x590 [ 45.598874][ T357] writeback_sb_inodes+0x96d/0x1680 [ 45.604086][ T357] ? queue_io+0x4b0/0x4b0 [ 45.608430][ T357] ? __kasan_check_read+0x11/0x20 [ 45.613869][ T357] ? queue_io+0x37a/0x4b0 [ 45.618292][ T357] wb_writeback+0x40f/0xb80 [ 45.623336][ T357] ? wb_io_lists_depopulated+0x180/0x180 [ 45.628969][ T357] ? set_worker_desc+0x1ba/0x1f0 [ 45.633891][ T357] ? _raw_spin_trylock_bh+0x150/0x150 [ 45.639345][ T357] ? __kasan_check_write+0x14/0x20 [ 45.644551][ T357] wb_workfn+0x3ac/0xf30 [ 45.648919][ T357] ? inode_wait_for_writeback+0x220/0x220 [ 45.654723][ T357] ? pick_next_task_fair+0xe5/0xa50 [ 45.659986][ T357] ? find_next_bit+0x80/0x100 [ 45.664892][ T357] ? _raw_spin_unlock_irq+0x4e/0x70 [ 45.670098][ T357] ? finish_task_switch+0x12e/0x5a0 [ 45.675461][ T357] ? __switch_to_asm+0x3a/0x60 [ 45.680342][ T357] ? __kasan_check_read+0x11/0x20 [ 45.685567][ T357] ? read_word_at_a_time+0x12/0x20 [ 45.690761][ T357] ? strscpy+0x9b/0x290 [ 45.694991][ T357] process_one_work+0x6fd/0xbc0 [ 45.699923][ T357] worker_thread+0xa8e/0x13c0 [ 45.704855][ T357] ? __kthread_parkme+0xb3/0x1b0 [ 45.709787][ T357] kthread+0x324/0x3b0 [ 45.714080][ T357] ? worker_clr_flags+0x190/0x190 [ 45.719135][ T357] ? kthread_blkcg+0xd0/0xd0 [ 45.723814][ T357] ret_from_fork+0x1f/0x30 [ 45.728215][ T357] Modules linked in: [ 45.736208][ T357] ---[ end trace 2c75e22655775129 ]--- [ 45.741893][ T357] RIP: 0010:ext4_ext_insert_extent+0x45b8/0x45f0 [ 45.750083][ T357] Code: ff 44 89 f1 80 e1 07 fe c1 38 c1 0f 8c 01 e9 ff ff 4c 89 f7 e8 09 5c d4 ff e9 f4 e8 ff ff e8 1f e7 99 ff 0f 0b e8 18 e7 99 ff <0f> 0b e8 11 e7 99 ff 0f 0b 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c fe [ 45.770479][ T357] RSP: 0018:ffffc90000cc6b60 EFLAGS: 00010293 [ 45.776637][ T357] RAX: ffffffff81cabc48 RBX: ffff888122b7f000 RCX: ffff88810c644f00 [ 45.789536][ T357] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 45.797985][ T357] RBP: ffffc90000cc6d10 R08: ffff88811aa0049f R09: 1ffff11023540093 [ 45.806097][ T357] R10: dffffc0000000000 R11: ffffed1023540094 R12: ffff888122b8fbfc [ 45.815023][ T357] R13: ffff888119ea0040 R14: 0000000000000000 R15: 0000000000000000 [ 45.823544][ T357] FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 45.832815][ T357] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 45.839633][ T357] CR2: 00007f2c2a4154d0 CR3: 000000010cd27000 CR4: 00000000003506b0 [ 45.847727][ T357] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 45.856095][ T357] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 45.864308][ T357] Kernel panic - not syncing: Fatal exception [ 45.871283][ T357] Kernel Offset: disabled [ 45.875958][ T357] Rebooting in 86400 seconds..