Warning: Permanently added '10.128.1.75' (ED25519) to the list of known hosts. 2025/06/28 17:00:15 ignoring optional flag "sandboxArg"="0" 2025/06/28 17:00:16 parsed 1 programs [ 48.655625][ T24] kauditd_printk_skb: 27 callbacks suppressed [ 48.655635][ T24] audit: type=1400 audit(1751130017.310:101): avc: denied { create } for pid=406 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 48.682613][ T24] audit: type=1400 audit(1751130017.310:102): avc: denied { write } for pid=406 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 48.703040][ T24] audit: type=1400 audit(1751130017.310:103): avc: denied { read } for pid=406 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 48.723304][ T24] audit: type=1400 audit(1751130017.340:104): avc: denied { unlink } for pid=406 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 48.749714][ T406] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 49.120201][ T24] audit: type=1400 audit(1751130017.770:105): avc: denied { create } for pid=415 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 49.476615][ T24] audit: type=1401 audit(1751130018.130:106): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 49.591821][ T449] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.599192][ T449] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.606715][ T449] device bridge_slave_0 entered promiscuous mode [ 49.613470][ T449] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.620586][ T449] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.628437][ T449] device bridge_slave_1 entered promiscuous mode [ 49.657113][ T449] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.664594][ T449] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.672492][ T449] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.680043][ T449] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.695918][ T321] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.704087][ T321] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.711416][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 49.719884][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 49.728813][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 49.737480][ T321] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.744791][ T321] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.754073][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 49.762295][ T321] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.769433][ T321] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.780665][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 49.790138][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 49.802173][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 49.813420][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 49.821921][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 49.830437][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 49.838672][ T449] device veth0_vlan entered promiscuous mode [ 49.847662][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 49.856659][ T449] device veth1_macvtap entered promiscuous mode [ 49.871761][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 49.881410][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2025/06/28 17:00:18 executed programs: 0 [ 50.148250][ T467] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.155856][ T467] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.163072][ T467] device bridge_slave_0 entered promiscuous mode [ 50.170086][ T467] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.177287][ T467] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.184650][ T467] device bridge_slave_1 entered promiscuous mode [ 50.217734][ T467] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.224987][ T467] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.233315][ T467] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.240362][ T467] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.255903][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 50.263543][ T321] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.270895][ T321] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.284519][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 50.293366][ T321] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.300542][ T321] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.309066][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 50.317399][ T321] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.324449][ T321] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.335568][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 50.348235][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 50.360546][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 50.370951][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 50.379197][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 50.387035][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 50.400418][ T467] device veth0_vlan entered promiscuous mode [ 50.411448][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 50.420746][ T467] device veth1_macvtap entered promiscuous mode [ 50.430626][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 50.442330][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 50.477820][ T478] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 50.491010][ T478] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 50.502166][ T478] EXT4-fs warning (device loop2): ext4_expand_extra_isize_ea:2815: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 50.515434][ T478] EXT4-fs (loop2): 1 truncate cleaned up [ 50.521083][ T478] EXT4-fs (loop2): mounted filesystem without journal. Opts: nogrpid,min_batch_time=0x0000000000000000,debug_want_extra_isize=0x0000000000000068,nobarrier,nodiscard,quota,,errors=continue [ 50.539847][ T24] audit: type=1400 audit(1751130019.200:107): avc: denied { mount } for pid=477 comm="syz.2.16" name="/" dev="loop2" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 50.557176][ T478] ================================================================== [ 50.561528][ T24] audit: type=1400 audit(1751130019.200:108): avc: denied { write } for pid=477 comm="syz.2.16" name="file2" dev="loop2" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 50.569462][ T478] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x1339/0x36c0 [ 50.569472][ T478] Read of size 18446744073709551540 at addr ffff88811278d870 by task syz.2.16/478 [ 50.569475][ T478] [ 50.569489][ T478] CPU: 0 PID: 478 Comm: syz.2.16 Not tainted 5.10.238-syzkaller-1007487-g59e9a7228857 #0 [ 50.569503][ T478] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 50.591468][ T24] audit: type=1400 audit(1751130019.200:109): avc: denied { open } for pid=477 comm="syz.2.16" name="file2" dev="loop2" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 50.599322][ T478] Call Trace: [ 50.599346][ T478] __dump_stack+0x21/0x24 [ 50.608795][ T24] audit: type=1400 audit(1751130019.200:110): avc: denied { setattr } for pid=477 comm="syz.2.16" name="file1" dev="loop2" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 50.610941][ T478] dump_stack_lvl+0x169/0x1d8 [ 50.687056][ T478] ? show_regs_print_info+0x18/0x18 [ 50.692405][ T478] ? thaw_kernel_threads+0x220/0x220 [ 50.697677][ T478] print_address_description+0x7f/0x2c0 [ 50.703196][ T478] ? ext4_xattr_set_entry+0x1339/0x36c0 [ 50.708901][ T478] kasan_report+0xe2/0x130 [ 50.713292][ T478] ? ext4_xattr_set_entry+0x1339/0x36c0 [ 50.718891][ T478] ? ext4_xattr_set_entry+0x1339/0x36c0 [ 50.724670][ T478] kasan_check_range+0x280/0x290 [ 50.729668][ T478] memmove+0x2d/0x70 [ 50.733566][ T478] ext4_xattr_set_entry+0x1339/0x36c0 [ 50.739096][ T478] ? fscrypt_drop_inode+0xad/0x110 [ 50.744275][ T478] ? ___slab_alloc+0xa6/0x450 [ 50.748922][ T478] ? ext4_xattr_ibody_set+0x360/0x360 [ 50.754263][ T478] ? slab_post_alloc_hook+0x7d/0x2f0 [ 50.759516][ T478] ? ext4_xattr_block_set+0x847/0x2a50 [ 50.764946][ T478] ? __kmalloc_track_caller+0x181/0x320 [ 50.770460][ T478] ? memcpy+0x56/0x70 [ 50.774411][ T478] ext4_xattr_block_set+0x92f/0x2a50 [ 50.779861][ T478] ? __kasan_check_read+0x11/0x20 [ 50.785139][ T478] ? __ext4_xattr_check_block+0x265/0x8e0 [ 50.791032][ T478] ? ext4_xattr_block_find+0x4f0/0x4f0 [ 50.796568][ T478] ? __kasan_check_write+0x14/0x20 [ 50.801740][ T478] ext4_xattr_set_handle+0xba5/0x12a0 [ 50.807195][ T478] ? ext4_xattr_set_entry+0x36c0/0x36c0 [ 50.812842][ T478] ? __kasan_check_read+0x11/0x20 [ 50.817855][ T478] ? __ext4_journal_start_sb+0x2e2/0x490 [ 50.823484][ T478] ext4_xattr_set+0x1ec/0x320 [ 50.828321][ T478] ? ext4_xattr_set_credits+0x290/0x290 [ 50.834209][ T478] ext4_xattr_trusted_set+0x3b/0x50 [ 50.839545][ T478] ? ext4_xattr_trusted_get+0x40/0x40 [ 50.844979][ T478] __vfs_setxattr+0x42a/0x480 [ 50.849719][ T478] __vfs_setxattr_noperm+0x11e/0x4e0 [ 50.855007][ T478] __vfs_setxattr_locked+0x203/0x220 [ 50.860265][ T478] vfs_setxattr+0x8d/0x1c0 [ 50.864655][ T478] setxattr+0x1a9/0x370 [ 50.868783][ T478] ? path_setxattr+0x210/0x210 [ 50.873526][ T478] ? __mnt_want_write+0x1e6/0x260 [ 50.878696][ T478] ? mnt_want_write+0x19d/0x270 [ 50.883517][ T478] path_setxattr+0x110/0x210 [ 50.888790][ T478] ? simple_xattr_list_add+0x120/0x120 [ 50.894312][ T478] ? fpu__clear_all+0x20/0x20 [ 50.898961][ T478] __x64_sys_lsetxattr+0xc2/0xe0 [ 50.904158][ T478] do_syscall_64+0x31/0x40 [ 50.908648][ T478] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 50.914550][ T478] RIP: 0033:0x7fecf8326969 [ 50.918955][ T478] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 50.938544][ T478] RSP: 002b:00007fecf7d97038 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd [ 50.946933][ T478] RAX: ffffffffffffffda RBX: 00007fecf854dfa0 RCX: 00007fecf8326969 [ 50.954878][ T478] RDX: 0000200000000040 RSI: 00002000000000c0 RDI: 0000200000000100 [ 50.963012][ T478] RBP: 00007fecf83a8ab1 R08: 0000000000000000 R09: 0000000000000000 [ 50.970953][ T478] R10: 000000000000fe37 R11: 0000000000000246 R12: 0000000000000000 [ 50.978984][ T478] R13: 0000000000000000 R14: 00007fecf854dfa0 R15: 00007ffc436ef5f8 [ 50.986927][ T478] [ 50.989230][ T478] Allocated by task 0: [ 50.993268][ T478] (stack is not available) [ 50.997648][ T478] [ 50.999952][ T478] The buggy address belongs to the object at ffff88811278d800 [ 50.999952][ T478] which belongs to the cache kmalloc-1k of size 1024 [ 51.014410][ T478] The buggy address is located 112 bytes inside of [ 51.014410][ T478] 1024-byte region [ffff88811278d800, ffff88811278dc00) [ 51.028089][ T478] The buggy address belongs to the page: [ 51.033704][ T478] page:ffffea000449e200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112788 [ 51.044008][ T478] head:ffffea000449e200 order:3 compound_mapcount:0 compound_pincount:0 [ 51.052403][ T478] flags: 0x4000000000010200(slab|head) [ 51.057833][ T478] raw: 4000000000010200 ffffea000449d200 0000000200000002 ffff888100042f00 [ 51.066386][ T478] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 51.075023][ T478] page dumped because: kasan: bad access detected [ 51.081400][ T478] page_owner tracks the page as allocated [ 51.087096][ T478] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 109, ts 4628255880, free_ts 0 [ 51.105118][ T478] prep_new_page+0x179/0x180 [ 51.109679][ T478] get_page_from_freelist+0x2235/0x23d0 [ 51.115279][ T478] __alloc_pages_nodemask+0x268/0x5f0 [ 51.120780][ T478] new_slab+0x84/0x3f0 [ 51.124841][ T478] ___slab_alloc+0x2a6/0x450 [ 51.129494][ T478] __slab_alloc+0x63/0xa0 [ 51.133795][ T478] __kmalloc_track_caller+0x1ef/0x320 [ 51.139132][ T478] __alloc_skb+0xdc/0x520 [ 51.143427][ T478] alloc_uevent_skb+0x85/0x240 [ 51.148200][ T478] kobject_uevent_net_broadcast+0x335/0x5a0 [ 51.154060][ T478] kobject_uevent_env+0x52e/0x700 [ 51.159051][ T478] kobject_synth_uevent+0x520/0xaf0 [ 51.164218][ T478] uevent_store+0x25/0x60 [ 51.168524][ T478] dev_attr_store+0x5e/0x80 [ 51.172993][ T478] sysfs_kf_write+0x129/0x150 [ 51.177638][ T478] kernfs_fop_write_iter+0x2c5/0x400 [ 51.182887][ T478] page_owner free stack trace missing [ 51.188224][ T478] [ 51.190538][ T478] Memory state around the buggy address: [ 51.196283][ T478] ffff88811278d700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 51.205134][ T478] ffff88811278d780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 51.213631][ T478] >ffff88811278d800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 51.221862][ T478] ^ [ 51.229934][ T478] ffff88811278d880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 51.238671][ T478] ffff88811278d900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 51.247100][ T478] ================================================================== [ 51.255329][ T478] Disabling lock debugging due to kernel taint [ 51.358357][ T483] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 51.369589][ T483] EXT4-fs (loop2): 1 truncate cleaned up [ 51.375491][ T483] EXT4-fs (loop2): mounted filesystem without journal. Opts: nogrpid,min_batch_time=0x0000000000000000,debug_want_extra_isize=0x0000000000000068,nobarrier,nodiscard,quota,,errors=continue [ 51.422530][ T467] general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN [ 51.434805][ T467] KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] [ 51.443706][ T467] CPU: 0 PID: 467 Comm: syz-executor Tainted: G B 5.10.238-syzkaller-1007487-g59e9a7228857 #0 [ 51.455548][ T467] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 51.466794][ T467] RIP: 0010:handle_mm_fault+0x375/0x16a0 [ 51.473114][ T467] Code: 81 c6 00 01 00 00 4c 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 39 36 09 00 4d 8b 36 49 83 c6 18 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 48 12 00 00 b8 c0 00 00 00 41 0b 06 eb [ 51.494290][ T467] RSP: 0000:ffffc90000c77bc0 EFLAGS: 00010206 [ 51.500331][ T467] RAX: 0000000000000003 RBX: 00007fecf851c538 RCX: ffff8881161e13c0 [ 51.508382][ T467] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90000c77cb0 [ 51.516331][ T467] RBP: ffffc90000c77df0 R08: dffffc0000000000 R09: ffffc90000c77ca0 [ 51.524298][ T467] R10: fffff5200018ef96 R11: 1ffff9200018ef94 R12: ffff8881161e13c0 [ 51.532594][ T467] R13: dffffc0000000000 R14: 0000000000000018 R15: ffff8881159dbb90 [ 51.540537][ T467] FS: 000055556d0d5500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 51.549718][ T467] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 51.556273][ T467] CR2: 00007fecf851c538 CR3: 0000000127eeb000 CR4: 00000000003506b0 [ 51.564244][ T467] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 51.572203][ T467] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 51.580225][ T467] Call Trace: [ 51.583489][ T467] ? usleep_range+0x120/0x120 [ 51.588129][ T467] ? can_reuse_spf_vma+0xe0/0xe0 [ 51.593038][ T467] ? hrtimer_nanosleep+0x2c8/0x3d0 [ 51.598229][ T467] ? nanosleep_copyout+0x120/0x120 [ 51.603332][ T467] ? kernel_waitid+0x370/0x370 [ 51.608085][ T467] ? __kasan_check_write+0x14/0x20 [ 51.613229][ T467] ? down_read_trylock+0x100/0x150 [ 51.618323][ T467] ? __init_rwsem+0x1c0/0x1c0 [ 51.623338][ T467] ? find_vma+0x30/0x150 [ 51.627546][ T467] do_user_addr_fault+0x5a2/0xc80 [ 51.632537][ T467] ? common_nsleep+0x8f/0xb0 [ 51.637105][ T467] ? do_kern_addr_fault+0x80/0x80 [ 51.642092][ T467] ? __kasan_check_read+0x11/0x20 [ 51.647176][ T467] exc_page_fault+0x5a/0xc0 [ 51.651730][ T467] ? asm_exc_page_fault+0x8/0x30 [ 51.656640][ T467] asm_exc_page_fault+0x1e/0x30 [ 51.661453][ T467] RIP: 0033:0x7fecf831cb80 [ 51.665932][ T467] Code: ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 c9 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 <80> 3d b1 f9 1f 00 00 49 89 ca 74 14 b8 3d 00 00 00 0f 05 48 3d 00 [ 51.686036][ T467] RSP: 002b:00007ffc436ef978 EFLAGS: 00010246 [ 51.692228][ T467] RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000000000 [ 51.700177][ T467] RDX: 0000000040000001 RSI: 00007ffc436ef9bc RDI: 00000000ffffffff [ 51.708122][ T467] RBP: 00007ffc436ef9bc R08: 0000000000000033 R09: 0000000000000000 [ 51.716059][ T467] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000001388 [ 51.724242][ T467] R13: 00000000000927c0 R14: 000000000000c8bc R15: 00007ffc436efa10 [ 51.732211][ T467] Modules linked in: [ 51.736434][ T471] BUG: unable to handle page fault for address: 0000000bf8810e59 [ 51.744324][ T471] #PF: supervisor instruction fetch in kernel mode [ 51.750877][ T471] #PF: error_code(0x0010) - not-present page [ 51.756818][ T471] PGD 117a90067 P4D 117a90067 PUD 0 [ 51.762077][ T471] Oops: 0010 [#2] PREEMPT SMP KASAN [ 51.767327][ T471] CPU: 1 PID: 471 Comm: kworker/1:26 Tainted: G B D 5.10.238-syzkaller-1007487-g59e9a7228857 #0 [ 51.778920][ T471] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 51.789075][ T471] Workqueue: 0x0 (events) [ 51.793654][ T471] RIP: 0010:0xbf8810e59 [ 51.797785][ T471] Code: Unable to access opcode bytes at RIP 0xbf8810e2f. [ 51.805182][ T471] RSP: 0018:ffffc90002f47ca0 EFLAGS: 00010046 [ 51.811293][ T471] RAX: ffff88810024bb40 RBX: ffff8881002ee2c0 RCX: ffffffff812615af [ 51.819557][ T471] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88810024bb40 [ 51.827535][ T471] RBP: ffff8881f7155fc0 R08: dffffc0000000000 R09: ffffed1020049769 [ 51.835515][ T471] R10: ffffed1020049769 R11: 1ffff11020049768 R12: ffff888116d78000 [ 51.843477][ T471] R13: ffffffff8473bf07 R14: ffffc90002f47d98 R15: ffff888116d784d8 [ 51.852321][ T471] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 51.861218][ T471] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 51.867941][ T471] CR2: 0000000bf8810e59 CR3: 0000000117a25000 CR4: 00000000003506a0 [ 51.875885][ T471] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 51.884013][ T471] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 51.892046][ T471] Call Trace: [ 51.895313][ T471] ? release_firmware_map_entry+0x190/0x190 [ 51.901175][ T471] ? process_one_work+0x84f/0xba0 [ 51.906186][ T471] ? wq_worker_sleeping+0x60/0x200 [ 51.911477][ T471] ? schedule+0x13c/0x1d0 [ 51.915859][ T471] ? worker_thread+0xece/0x13b0 [ 51.920675][ T471] ? kthread+0x346/0x3d0 [ 51.924949][ T471] ? worker_clr_flags+0x190/0x190 [ 51.930174][ T471] ? kthread_blkcg+0xd0/0xd0 [ 51.935200][ T471] ? ret_from_fork+0x1f/0x30 [ 51.940758][ T471] Modules linked in: [ 51.945254][ T471] CR2: 0000000bf8810e59 [ 51.949389][ T471] ---[ end trace cd44274e6c276ef2 ]--- [ 51.954830][ T471] RIP: 0010:handle_mm_fault+0x375/0x16a0 [ 51.960850][ T471] Code: 81 c6 00 01 00 00 4c 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 39 36 09 00 4d 8b 36 49 83 c6 18 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 48 12 00 00 b8 c0 00 00 00 41 0b 06 eb [ 51.980988][ T471] RSP: 0000:ffffc90000c77bc0 EFLAGS: 00010206 [ 51.987564][ T471] RAX: 0000000000000003 RBX: 00007fecf851c538 RCX: ffff8881161e13c0 [ 51.995599][ T471] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90000c77cb0 [ 52.003686][ T471] RBP: ffffc90000c77df0 R08: dffffc0000000000 R09: ffffc90000c77ca0 [ 52.012653][ T471] R10: fffff5200018ef96 R11: 1ffff9200018ef94 R12: ffff8881161e13c0 [ 52.020616][ T471] R13: dffffc0000000000 R14: 0000000000000018 R15: ffff8881159dbb90 [ 52.028944][ T471] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 52.037936][ T471] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 52.044650][ T471] CR2: 0000000bf8810e59 CR3: 0000000117a25000 CR4: 00000000003506a0 [ 52.053082][ T471] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 52.061210][ T471] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 52.069168][ T471] Kernel panic - not syncing: Fatal exception [ 53.183612][ T471] Shutting down cpus with NMI [ 53.188667][ T471] Kernel Offset: disabled [ 53.193082][ T471] Rebooting in 86400 seconds..