Warning: Permanently added '10.128.1.63' (ED25519) to the list of known hosts. 2026/10/06 06:50:09 parsed 1 programs [ 132.153255][ T6006] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 132.902371][ T1330] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.902453][ T1330] ieee802154 phy1 wpan1: encryption failed: -22 [ 135.247959][ T4900] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 135.249561][ T4900] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 135.258749][ T4900] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 135.263380][ T4900] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 135.275132][ T4900] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 138.740500][ T6117] bridge0: port 1(bridge_slave_0) entered blocking state [ 138.740625][ T6117] bridge0: port 1(bridge_slave_0) entered disabled state [ 138.740751][ T6117] bridge_slave_0: entered allmulticast mode [ 138.742280][ T6117] bridge_slave_0: entered promiscuous mode [ 138.744171][ T6117] bridge0: port 2(bridge_slave_1) entered blocking state [ 138.744290][ T6117] bridge0: port 2(bridge_slave_1) entered disabled state [ 138.744400][ T6117] bridge_slave_1: entered allmulticast mode [ 138.747710][ T6117] bridge_slave_1: entered promiscuous mode [ 138.934080][ T6117] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 138.936766][ T6117] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 139.123297][ T6117] team0: Port device team_slave_0 added [ 139.125319][ T6117] team0: Port device team_slave_1 added [ 139.294246][ T6117] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 139.294265][ T6117] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 139.294287][ T6117] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 139.295642][ T6117] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 139.295654][ T6117] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 139.295676][ T6117] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 139.779385][ T6117] hsr_slave_0: entered promiscuous mode [ 139.780788][ T6117] hsr_slave_1: entered promiscuous mode [ 141.839402][ T6117] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 141.885598][ T6117] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 141.887011][ T6117] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 141.934937][ T6117] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 141.936407][ T6117] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 141.985860][ T6117] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 141.987378][ T6117] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 142.038564][ T6117] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 142.194558][ T6117] 8021q: adding VLAN 0 to HW filter on device bond0 [ 142.255461][ T6117] 8021q: adding VLAN 0 to HW filter on device team0 [ 142.273105][ T150] bridge0: port 1(bridge_slave_0) entered blocking state [ 142.273238][ T150] bridge0: port 1(bridge_slave_0) entered forwarding state [ 142.299517][ T1112] bridge0: port 2(bridge_slave_1) entered blocking state [ 142.299710][ T1112] bridge0: port 2(bridge_slave_1) entered forwarding state [ 143.040848][ T6117] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 143.122736][ T6117] veth0_vlan: entered promiscuous mode [ 143.136580][ T6117] veth1_vlan: entered promiscuous mode [ 143.293454][ T6117] veth0_macvtap: entered promiscuous mode [ 143.305899][ T6117] veth1_macvtap: entered promiscuous mode [ 143.399319][ T6117] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 143.459302][ T6117] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 143.730789][ T1112] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 143.731720][ T1112] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 143.851796][ T1112] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 143.852094][ T1112] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 144.408190][ T1112] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 145.075880][ T1112] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 145.265945][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 145.265967][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 145.391959][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 145.391982][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 145.664186][ T1112] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 145.997368][ T1112] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2026/10/06 06:50:29 executed programs: 0 [ 146.397616][ T4900] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 146.422112][ T4900] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 146.424617][ T4900] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 146.425590][ T4900] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 146.426261][ T4900] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 146.992245][ T1112] bridge_slave_1: left allmulticast mode [ 146.992281][ T1112] bridge_slave_1: left promiscuous mode [ 146.992528][ T1112] bridge0: port 2(bridge_slave_1) entered disabled state [ 147.121933][ T1112] bridge_slave_0: left allmulticast mode [ 147.121971][ T1112] bridge_slave_0: left promiscuous mode [ 147.122239][ T1112] bridge0: port 1(bridge_slave_0) entered disabled state [ 147.831017][ T1112] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 147.892190][ T1112] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 147.912042][ T1112] bond0 (unregistering): Released all slaves [ 147.957522][ T5246] 8021q: adding VLAN 0 to HW filter on device eth1 [ 148.370215][ T1112] hsr_slave_0: left promiscuous mode [ 148.390262][ T1112] hsr_slave_1: left promiscuous mode [ 148.391447][ T1112] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 148.396654][ T1112] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 148.441214][ T1112] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 148.441244][ T1112] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 148.531231][ T1112] veth1_macvtap: left promiscuous mode [ 148.531298][ T1112] veth0_macvtap: left promiscuous mode [ 148.531464][ T1112] veth1_vlan: left promiscuous mode [ 148.531579][ T1112] veth0_vlan: left promiscuous mode [ 148.580242][ T60] Bluetooth: hci0: command tx timeout [ 149.122231][ T1112] team0 (unregistering): Port device team_slave_1 removed [ 149.160853][ T1112] team0 (unregistering): Port device team_slave_0 removed [ 149.335831][ T5246] 8021q: adding VLAN 0 to HW filter on device eth2 [ 150.049708][ T5246] 8021q: adding VLAN 0 to HW filter on device eth3 [ 150.050299][ T6333] bridge0: port 1(bridge_slave_0) entered blocking state [ 150.050411][ T6333] bridge0: port 1(bridge_slave_0) entered disabled state [ 150.050573][ T6333] bridge_slave_0: entered allmulticast mode [ 150.059166][ T6333] bridge_slave_0: entered promiscuous mode [ 150.067520][ T6333] bridge0: port 2(bridge_slave_1) entered blocking state [ 150.067726][ T6333] bridge0: port 2(bridge_slave_1) entered disabled state [ 150.067882][ T6333] bridge_slave_1: entered allmulticast mode [ 150.071080][ T6333] bridge_slave_1: entered promiscuous mode [ 150.235755][ T6333] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 150.238928][ T6333] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 150.458711][ T6333] team0: Port device team_slave_0 added [ 150.469195][ T6333] team0: Port device team_slave_1 added [ 150.660174][ T60] Bluetooth: hci0: command tx timeout [ 150.966950][ T5246] 8021q: adding VLAN 0 to HW filter on device eth4 [ 150.967991][ T6333] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 150.968005][ T6333] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 150.968028][ T6333] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 150.973831][ T6333] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 150.973847][ T6333] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 150.973879][ T6333] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 151.219335][ T6333] hsr_slave_0: entered promiscuous mode [ 151.221054][ T6333] hsr_slave_1: entered promiscuous mode [ 152.740470][ T60] Bluetooth: hci0: command tx timeout [ 153.874276][ T6333] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 153.916758][ T6333] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 153.918271][ T6333] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 153.957298][ T6333] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 153.958723][ T6333] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 153.997607][ T6333] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 153.999156][ T6333] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 154.035843][ T6333] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 154.200442][ T6333] 8021q: adding VLAN 0 to HW filter on device bond0 [ 154.242870][ T6333] 8021q: adding VLAN 0 to HW filter on device team0 [ 154.251988][ T1753] bridge0: port 1(bridge_slave_0) entered blocking state [ 154.252195][ T1753] bridge0: port 1(bridge_slave_0) entered forwarding state [ 154.264258][ T1753] bridge0: port 2(bridge_slave_1) entered blocking state [ 154.264467][ T1753] bridge0: port 2(bridge_slave_1) entered forwarding state [ 154.820217][ T60] Bluetooth: hci0: command tx timeout [ 154.892921][ T6333] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 154.984221][ T6333] veth0_vlan: entered promiscuous mode [ 155.019837][ T6333] veth1_vlan: entered promiscuous mode [ 155.078740][ T6333] veth0_macvtap: entered promiscuous mode [ 155.092684][ T6333] veth1_macvtap: entered promiscuous mode [ 155.115090][ T6333] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 155.136444][ T6333] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 155.362989][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 155.646514][ T2970] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 155.646534][ T2970] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 155.650512][ T2970] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 155.691723][ T1112] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 155.691768][ T1112] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 155.771838][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 155.771860][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2026/10/06 06:50:38 executed programs: 2 [ 156.405312][ T6529] loop0: detected capacity change from 0 to 32768 [ 156.647422][ T6529] Bad index:0 in slot in dtroot [ 156.647422][ T6529] [ 156.647447][ T6529] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 156.647447][ T6529] [ 156.647743][ T6529] ERROR: (device loop0): remounting filesystem as read-only [ 157.256252][ T6553] loop0: detected capacity change from 0 to 32768 [ 157.301388][ T6553] Bad index:0 in slot in dtroot [ 157.301388][ T6553] [ 157.301407][ T6553] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 157.301407][ T6553] [ 157.302161][ T6553] ERROR: (device loop0): remounting filesystem as read-only [ 157.636955][ T6555] loop0: detected capacity change from 0 to 32768 [ 157.666508][ T6555] Bad index:0 in slot in dtroot [ 157.666508][ T6555] [ 157.666526][ T6555] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 157.666526][ T6555] [ 157.667257][ T6555] ERROR: (device loop0): remounting filesystem as read-only [ 158.013111][ T6557] loop0: detected capacity change from 0 to 32768 [ 158.038635][ T6557] Bad index:0 in slot in dtroot [ 158.038635][ T6557] [ 158.038652][ T6557] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 158.038652][ T6557] [ 158.038948][ T6557] ERROR: (device loop0): remounting filesystem as read-only [ 158.382178][ T6559] loop0: detected capacity change from 0 to 32768 [ 158.406264][ T6559] Bad index:0 in slot in dtroot [ 158.406264][ T6559] [ 158.406283][ T6559] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 158.406283][ T6559] [ 158.406513][ T6559] ERROR: (device loop0): remounting filesystem as read-only [ 158.737662][ T6561] loop0: detected capacity change from 0 to 32768 [ 158.762362][ T6561] Bad index:0 in slot in dtroot [ 158.762362][ T6561] [ 158.762380][ T6561] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 158.762380][ T6561] [ 158.762632][ T6561] ERROR: (device loop0): remounting filesystem as read-only [ 159.124953][ T6563] loop0: detected capacity change from 0 to 32768 [ 159.141271][ T6563] Bad index:0 in slot in dtroot [ 159.141271][ T6563] [ 159.141286][ T6563] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 159.141286][ T6563] [ 159.141505][ T6563] ERROR: (device loop0): remounting filesystem as read-only [ 159.499861][ T6565] loop0: detected capacity change from 0 to 32768 [ 159.516063][ T6565] Bad index:0 in slot in dtroot [ 159.516063][ T6565] [ 159.516076][ T6565] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 159.516076][ T6565] [ 159.516671][ T6565] ERROR: (device loop0): remounting filesystem as read-only [ 159.841159][ T6567] loop0: detected capacity change from 0 to 32768 [ 159.869110][ T6567] Bad index:0 in slot in dtroot [ 159.869110][ T6567] [ 159.869128][ T6567] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 159.869128][ T6567] [ 159.869546][ T6567] ERROR: (device loop0): remounting filesystem as read-only [ 160.207972][ T6569] loop0: detected capacity change from 0 to 32768 [ 160.222203][ T6569] Bad index:0 in slot in dtroot [ 160.222203][ T6569] [ 160.222220][ T6569] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 160.222220][ T6569] [ 160.222446][ T6569] ERROR: (device loop0): remounting filesystem as read-only [ 160.587136][ T6571] Bad index:0 in slot in dtroot [ 160.587136][ T6571] [ 160.587155][ T6571] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 160.587155][ T6571] [ 160.587402][ T6571] ERROR: (device loop0): remounting filesystem as read-only [ 160.924323][ T6573] Bad index:0 in slot in dtroot [ 160.924323][ T6573] [ 160.924340][ T6573] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 160.924340][ T6573] [ 160.924720][ T6573] ERROR: (device loop0): remounting filesystem as read-only 2026/10/06 06:50:44 executed programs: 14 [ 161.316701][ T6575] Bad index:0 in slot in dtroot [ 161.316701][ T6575] [ 161.316726][ T6575] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 161.316726][ T6575] [ 161.317191][ T6575] ERROR: (device loop0): remounting filesystem as read-only [ 161.641067][ T6577] set_capacity_and_notify: 3 callbacks suppressed [ 161.641080][ T6577] loop0: detected capacity change from 0 to 32768 [ 161.677200][ T6577] Bad index:0 in slot in dtroot [ 161.677200][ T6577] [ 161.677213][ T6577] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 161.677213][ T6577] [ 161.677442][ T6577] ERROR: (device loop0): remounting filesystem as read-only [ 161.697527][ C1] ========================================= ** replaying previous printk message ** [ 161.697527][ C1] ================================================================== [ 161.697545][ C1] BUG: KASAN: slab-use-after-free in lbmIODone+0x130e/0x16b0 [ 161.697574][ C1] Read of size 4 at addr ffff888046cea808 by task ksoftirqd/1/30 [ 161.697594][ C1] [ 161.697621][ C1] CPU: 1 UID: 0 PID: 30 Comm: ksoftirqd/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 161.697651][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 161.697673][ C1] Call Trace: [ 161.697681][ C1] [ 161.697690][ C1] dump_stack_lvl+0xe8/0x150 [ 161.697724][ C1] print_address_description+0x55/0x1e0 [ 161.697757][ C1] ? lbmIODone+0x130e/0x16b0 [ 161.697778][ C1] print_report+0x58/0x70 [ 161.697807][ C1] kasan_report+0x117/0x150 [ 161.697831][ C1] ? lbmIODone+0x130e/0x16b0 [ 161.697857][ C1] lbmIODone+0x130e/0x16b0 [ 161.697882][ C1] ? blkg_put+0x22/0x240 [ 161.697908][ C1] ? blkg_put+0x22/0x240 [ 161.697935][ C1] ? blkg_put+0x18d/0x240 [ 161.697963][ C1] ? bio_endio+0x984/0xac0 [ 161.697996][ C1] blk_update_request+0x57b/0xe50 [ 161.698034][ C1] blk_mq_end_request+0x3e/0x70 [ 161.698068][ C1] blk_done_softirq+0x10a/0x160 [ 161.698100][ C1] handle_softirqs+0x1da/0x6d0 [ 161.698141][ C1] ? smpboot_thread_fn+0x4e/0xa70 [ 161.698177][ C1] run_ksoftirqd+0x53/0x190 [ 161.698210][ C1] smpboot_thread_fn+0x565/0xa70 [ 161.698244][ C1] ? smpboot_thread_fn+0x4e/0xa70 [ 161.698280][ C1] kthread+0x38b/0x470 [ 161.698302][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 161.698334][ C1] ? __pfx_kthread+0x10/0x10 [ 161.698356][ C1] ret_from_fork+0x514/0xb70 [ 161.698380][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 161.698400][ C1] ? __switch_to+0xc89/0x1420 [ 161.698432][ C1] ? __pfx_kthread+0x10/0x10 [ 161.698454][ C1] ret_from_fork_asm+0x1a/0x30 [ 161.698481][ C1] [ 161.698489][ C1] [ 161.698495][ C1] Allocated by task 6577: [ 161.698506][ C1] kasan_save_track+0x3e/0x80 [ 161.698536][ C1] __kasan_kmalloc+0x93/0xb0 [ 161.698552][ C1] __kmalloc_cache_noprof+0x3d5/0x680 [ 161.698582][ C1] lmLogInit+0x3e5/0x1a20 [ 161.698600][ C1] lmLogOpen+0x4e3/0xf90 [ 161.698617][ C1] jfs_mount_rw+0xf3/0x670 [ 161.698647][ C1] jfs_fill_super+0x769/0xda0 [ 161.698672][ C1] get_tree_bdev_flags+0x430/0x4f0 [ 161.698698][ C1] vfs_get_tree+0x92/0x2a0 [ 161.698724][ C1] do_new_mount+0x319/0xdc0 [ 161.698746][ C1] __se_sys_mount+0x31d/0x420 [ 161.698767][ C1] do_syscall_64+0x166/0x520 [ 161.698790][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.698811][ C1] [ 161.698816][ C1] Freed by task 6577: [ 161.698826][ C1] kasan_save_track+0x3e/0x80 [ 161.698856][ C1] kasan_save_free_info+0x40/0x50 [ 161.698880][ C1] __kasan_slab_free+0x5c/0x80 [ 161.698910][ C1] kfree+0x1c5/0x6d0 [ 161.698935][ C1] lmLogShutdown+0x456/0x850 [ 161.698954][ C1] lmLogClose+0x28c/0x530 [ 161.698973][ C1] jfs_umount+0x2da/0x3b0 [ 161.699003][ C1] jfs_fill_super+0x9e7/0xda0 [ 161.699027][ C1] get_tree_bdev_flags+0x430/0x4f0 [ 161.699053][ C1] vfs_get_tree+0x92/0x2a0 [ 161.699079][ C1] do_new_mount+0x319/0xdc0 [ 161.699100][ C1] __se_sys_mount+0x31d/0x420 [ 161.699121][ C1] do_syscall_64+0x166/0x520 [ 161.699148][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.699169][ C1] [ 161.699174][ C1] The buggy address belongs to the object at ffff888046cea800 [ 161.699174][ C1] which belongs to the cache kmalloc-256 of size 256 [ 161.699193][ C1] The buggy address is located 8 bytes inside of [ 161.699193][ C1] freed 256-byte region [ffff888046cea800, ffff888046cea900) [ 161.699217][ C1] [ 161.699222][ C1] The buggy address belongs to the physical page: [ 161.699242][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x46cea [ 161.699267][ C1] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 161.699285][ C1] flags: 0x80000000000040(head|node=0|zone=1) [ 161.699308][ C1] page_type: f5(slab) [ 161.699329][ C1] raw: 0080000000000040 ffff88813ffbdb40 dead000000000100 dead000000000122 [ 161.699347][ C1] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 161.699368][ C1] head: 0080000000000040 ffff88813ffbdb40 dead000000000100 dead000000000122 [ 161.699386][ C1] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 161.699407][ C1] head: 0080000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 161.699425][ C1] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002 [ 161.699436][ C1] page dumped because: kasan: bad access detected [ 161.699449][ C1] page_owner tracks the page as allocated [ 161.699457][ C1] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6071, tgid 6071 (udevd), ts 161000941467 [ 161.699492][ C1] post_alloc_hook+0x1f9/0x250 [ 161.699520][ C1] get_page_from_freelist+0x2591/0x2600 [ 161.699552][ C1] __alloc_frozen_pages_noprof+0x230/0x5c0 [ 161.699585][ C1] allocate_slab+0x7d/0x620 [ 161.699607][ C1] refill_objects+0x2d8/0x350 [ 161.699631][ C1] __pcs_replace_empty_main+0x339/0x690 [ 161.699653][ C1] __kmalloc_noprof+0x54b/0x790 [ 161.699681][ C1] security_inode_init_security+0x102/0x3e0 [ 161.699705][ C1] shmem_mknod+0x1ea/0x340 [ 161.699724][ C1] lookup_open+0xc17/0x1a60 [ 161.699750][ C1] path_openat+0x67c/0x1d60 [ 161.699776][ C1] do_file_open+0x23e/0x4a0 [ 161.699802][ C1] do_sys_openat2+0x115/0x200 [ 161.699821][ C1] __x64_sys_openat+0x138/0x170 [ 161.699841][ C1] do_syscall_64+0x166/0x520 [ 161.699863][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.699883][ C1] page last free pid 6573 tgid 6572 ts 160916342457 stack trace: [ 161.699898][ C1] __free_frozen_pages+0xf8e/0x1070 [ 161.699926][ C1] __slab_free+0x250/0x2a0 [ 161.699956][ C1] qlist_free_all+0x99/0x100 [ 161.699983][ C1] kasan_quarantine_reduce+0x148/0x160 [ 161.700009][ C1] __kasan_slab_alloc+0x22/0x80 [ 161.700039][ C1] kmem_cache_alloc_noprof+0x360/0x690 [ 161.700066][ C1] do_getname+0x2e/0x250 [ 161.700084][ C1] do_sys_openat2+0xcc/0x200 [ 161.700103][ C1] __x64_sys_openat+0x138/0x170 [ 161.700122][ C1] do_syscall_64+0x166/0x520 [ 161.700151][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.700171][ C1] [ 161.700176][ C1] Memory state around the buggy address: [ 161.700189][ C1] ffff888046cea700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 161.700204][ C1] ffff888046cea780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 161.700218][ C1] >ffff888046cea800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 161.700229][ C1] ^ [ 161.700240][ C1] ffff888046cea880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 161.700254][ C1] ffff888046cea900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 161.700265][ C1] ================================================================== [ 161.709457][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 162.392174][ C1] CPU: 1 UID: 0 PID: 30 Comm: ksoftirqd/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 162.401981][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 162.412027][ C1] Call Trace: [ 162.415299][ C1] [ 162.418217][ C1] vpanic+0x56d/0xa60 [ 162.422196][ C1] ? __pfx_vpanic+0x10/0x10 [ 162.426695][ C1] ? __pfx___schedule+0x10/0x10 [ 162.431544][ C1] panic+0xc5/0xd0 [ 162.435255][ C1] ? __pfx_panic+0x10/0x10 [ 162.439664][ C1] ? preempt_schedule_common+0x7f/0xd0 [ 162.445117][ C1] ? lbmIODone+0x130e/0x16b0 [ 162.449709][ C1] check_panic_on_warn+0x89/0xb0 [ 162.454645][ C1] ? lbmIODone+0x130e/0x16b0 [ 162.459260][ C1] end_report+0x73/0x170 [ 162.463587][ C1] ? lbmIODone+0x130e/0x16b0 [ 162.468172][ C1] kasan_report+0x128/0x150 [ 162.472668][ C1] ? lbmIODone+0x130e/0x16b0 [ 162.477270][ C1] lbmIODone+0x130e/0x16b0 [ 162.481677][ C1] ? blkg_put+0x22/0x240 [ 162.485917][ C1] ? blkg_put+0x22/0x240 [ 162.490156][ C1] ? blkg_put+0x18d/0x240 [ 162.494485][ C1] ? bio_endio+0x984/0xac0 [ 162.498934][ C1] blk_update_request+0x57b/0xe50 [ 162.503966][ C1] blk_mq_end_request+0x3e/0x70 [ 162.508820][ C1] blk_done_softirq+0x10a/0x160 [ 162.513704][ C1] handle_softirqs+0x1da/0x6d0 [ 162.518486][ C1] ? smpboot_thread_fn+0x4e/0xa70 [ 162.523512][ C1] run_ksoftirqd+0x53/0x190 [ 162.528108][ C1] smpboot_thread_fn+0x565/0xa70 [ 162.533052][ C1] ? smpboot_thread_fn+0x4e/0xa70 [ 162.538703][ C1] kthread+0x38b/0x470 [ 162.542768][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 162.548228][ C1] ? __pfx_kthread+0x10/0x10 [ 162.552838][ C1] ret_from_fork+0x514/0xb70 [ 162.557422][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 162.562527][ C1] ? __switch_to+0xc89/0x1420 [ 162.567207][ C1] ? __pfx_kthread+0x10/0x10 [ 162.571790][ C1] ret_from_fork_asm+0x1a/0x30 [ 162.576553][ C1] [ 162.579906][ C1] Kernel Offset: disabled [ 162.584235][ C1] Rebooting in 86400 seconds..