Warning: Permanently added '10.128.1.126' (ED25519) to the list of known hosts. 2026/06/27 14:42:02 parsed 1 programs [ 81.195325][ T3422] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 82.569542][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.579868][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.587878][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 82.602004][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.610245][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.617890][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 87.344209][ T3590] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 87.353650][ T3590] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 87.364238][ T3590] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 87.375193][ T3590] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 96.046806][ T3590] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.055992][ T3590] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.064997][ T3590] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.074059][ T3590] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.605888][ T11] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 96.673837][ T11] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 96.724259][ T11] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 96.793789][ T11] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2026/06/27 14:42:20 executed programs: 0 [ 101.327710][ T4354] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 101.338352][ T4354] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 101.350400][ T4354] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 101.360221][ T4354] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 108.334255][ T4354] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.345083][ T4354] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.353956][ T4354] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.363712][ T4354] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.788902][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.796788][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.804619][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 108.824478][ T39] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.832408][ T39] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.841902][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready 2026/06/27 14:42:31 executed programs: 2 [ 109.057863][ T4982] loop2: detected capacity change from 0 to 32768 [ 109.069790][ T4982] [ 109.069790][ T4982] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 109.069790][ T4982] [ 109.086746][ T4982] read_mapping_page failed! [ 109.091970][ T4982] ERROR: (device loop2): txCommit: [ 109.091970][ T4982] [ 109.102891][ T4982] read_mapping_page failed! [ 109.108083][ T4982] ERROR: (device loop2): txCommit: [ 109.108083][ T4982] [ 109.116710][ T4982] find_entry called with index = 0 [ 109.123889][ T4982] read_mapping_page failed! [ 109.129228][ T4982] ERROR: (device loop2): txCommit: [ 109.129228][ T4982] [ 109.142284][ T4354] [ 109.142284][ T4354] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 109.142284][ T4354] [ 109.154569][ T4354] [ 109.154569][ T4354] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 109.154569][ T4354] [ 109.324459][ T4984] loop2: detected capacity change from 0 to 32768 [ 109.335260][ T4984] [ 109.335260][ T4984] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 109.335260][ T4984] [ 109.348857][ T4984] read_mapping_page failed! [ 109.353512][ T4984] ERROR: (device loop2): txCommit: [ 109.353512][ T4984] [ 109.362491][ T4984] read_mapping_page failed! [ 109.367115][ T4984] ERROR: (device loop2): txCommit: [ 109.367115][ T4984] [ 109.375418][ T4984] find_entry called with index = 0 [ 109.380822][ T4984] read_mapping_page failed! [ 109.385439][ T4984] ERROR: (device loop2): txCommit: [ 109.385439][ T4984] [ 109.396792][ T4354] [ 109.396792][ T4354] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 109.396792][ T4354] [ 109.408177][ T4354] [ 109.408177][ T4354] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 109.408177][ T4354] [ 109.564455][ T4986] loop2: detected capacity change from 0 to 32768 [ 109.583020][ T4986] [ 109.583020][ T4986] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 109.583020][ T4986] [ 109.597249][ T4986] read_mapping_page failed! [ 109.602459][ T4986] ERROR: (device loop2): txCommit: [ 109.602459][ T4986] [ 109.610879][ T4986] read_mapping_page failed! [ 109.615806][ T4986] ERROR: (device loop2): txCommit: [ 109.615806][ T4986] [ 109.624575][ T4986] find_entry called with index = 0 [ 109.630325][ T4986] read_mapping_page failed! [ 109.635259][ T4986] ERROR: (device loop2): txCommit: [ 109.635259][ T4986] [ 109.649149][ T4354] [ 109.649149][ T4354] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 109.649149][ T4354] [ 109.661484][ T4354] [ 109.661484][ T4354] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 109.661484][ T4354] [ 109.827902][ T4988] loop2: detected capacity change from 0 to 32768 [ 109.844235][ T4988] [ 109.844235][ T4988] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 109.844235][ T4988] [ 109.858875][ T4988] read_mapping_page failed! [ 109.863504][ T4988] ERROR: (device loop2): txCommit: [ 109.863504][ T4988] [ 109.872420][ T4988] read_mapping_page failed! [ 109.878089][ T4988] ERROR: (device loop2): txCommit: [ 109.878089][ T4988] [ 109.888797][ T4988] ================================================================== [ 109.897257][ T4988] BUG: KASAN: use-after-free in dtSplitPage+0x1064/0x30b0 [ 109.904665][ T4988] Read of size 1 at addr ffff8880731352b5 by task syz.2.20/4988 [ 109.912514][ T4988] [ 109.914968][ T4988] CPU: 1 PID: 4988 Comm: syz.2.20 Not tainted syzkaller #0 [ 109.922371][ T4988] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 109.932644][ T4988] Call Trace: [ 109.935965][ T4988] [ 109.939174][ T4988] dump_stack_lvl+0x199/0x25e [ 109.944152][ T4988] ? __lock_acquire+0xb60/0xb60 [ 109.949277][ T4988] ? show_regs_print_info+0x12/0x12 [ 109.954676][ T4988] ? load_image+0x680/0x680 [ 109.959180][ T4988] ? _raw_spin_lock_irqsave+0xae/0xf0 [ 109.965062][ T4988] ? __virt_addr_valid+0x168/0x380 [ 109.970739][ T4988] ? __virt_addr_valid+0x2c3/0x380 [ 109.975959][ T4988] ? dtSplitPage+0x1064/0x30b0 [ 109.980990][ T4988] print_report+0xa8/0x210 [ 109.985515][ T4988] kasan_report+0x10b/0x140 [ 109.990030][ T4988] ? dtSplitPage+0x1064/0x30b0 [ 109.994982][ T4988] dtSplitPage+0x1064/0x30b0 [ 109.999671][ T4988] ? dbAlloc+0x765/0xad0 [ 110.004101][ T4988] dtInsert+0x1010/0x57e0 [ 110.008523][ T4988] ? __kmem_cache_free+0xb6/0x200 [ 110.013549][ T4988] ? UniStrupr+0x2e0/0x2e0 [ 110.017984][ T4988] ? dtSearch+0x1b1d/0x1f30 [ 110.022622][ T4988] jfs_symlink+0x873/0xf80 [ 110.027080][ T4988] ? jfs_unlink+0x9f0/0x9f0 [ 110.031621][ T4988] ? from_kgid+0x14f/0x6a0 [ 110.036075][ T4988] ? make_kgid+0x650/0x650 [ 110.040572][ T4988] ? apparmor_path_symlink+0x1a7/0x230 [ 110.046071][ T4988] ? lookup_one_qstr_excl+0x11c/0x240 [ 110.051504][ T4988] ? generic_permission+0x220/0x510 [ 110.056717][ T4988] ? inode_permission+0xef/0x480 [ 110.061654][ T4988] ? security_inode_symlink+0xb2/0x100 [ 110.067223][ T4988] vfs_symlink+0x245/0x3d0 [ 110.071757][ T4988] do_symlinkat+0x1b6/0x400 [ 110.076289][ T4988] ? vfs_symlink+0x3d0/0x3d0 [ 110.081075][ T4988] ? getname_flags+0x206/0x500 [ 110.085887][ T4988] __x64_sys_symlink+0x7a/0x90 [ 110.090667][ T4988] do_syscall_64+0x4c/0xa0 [ 110.095428][ T4988] ? clear_bhb_loop+0x60/0xb0 [ 110.100183][ T4988] ? clear_bhb_loop+0x60/0xb0 [ 110.104908][ T4988] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 110.111075][ T4988] RIP: 0033:0x7fd2da59a379 [ 110.115599][ T4988] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 110.138533][ T4988] RSP: 002b:00007fd2db50a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000058 [ 110.147063][ T4988] RAX: ffffffffffffffda RBX: 00007fd2da7d5fa0 RCX: 00007fd2da59a379 [ 110.155498][ T4988] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000200000000080 [ 110.163680][ T4988] RBP: 00007fd2da62dd68 R08: 0000000000000000 R09: 0000000000000000 [ 110.172137][ T4988] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 110.181135][ T4988] R13: 00007fd2da7d6038 R14: 00007fd2da7d5fa0 R15: 00007fffbccbcfd8 [ 110.189405][ T4988] [ 110.192432][ T4988] [ 110.194768][ T4988] Allocated by task 4988: [ 110.199095][ T4988] kasan_set_track+0x4b/0x70 [ 110.203722][ T4988] __kasan_slab_alloc+0x6b/0x80 [ 110.208635][ T4988] slab_post_alloc_hook+0x4d/0x400 [ 110.213776][ T4988] kmem_cache_alloc_lru+0x178/0x2a0 [ 110.219193][ T4988] jfs_alloc_inode+0x24/0x60 [ 110.223813][ T4988] new_inode_pseudo+0x5f/0x1c0 [ 110.228714][ T4988] new_inode+0x25/0x1d0 [ 110.232868][ T4988] ialloc+0x48/0x930 [ 110.236759][ T4988] jfs_mkdir+0x1e1/0xb00 [ 110.241129][ T4988] vfs_mkdir+0x386/0x570 [ 110.245403][ T4988] do_mkdirat+0x1d8/0x440 [ 110.249908][ T4988] __x64_sys_mkdir+0x6a/0x80 [ 110.254517][ T4988] do_syscall_64+0x4c/0xa0 [ 110.258945][ T4988] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 110.265170][ T4988] [ 110.267516][ T4988] Freed by task 13: [ 110.271338][ T4988] kasan_set_track+0x4b/0x70 [ 110.276132][ T4988] kasan_save_free_info+0x27/0x40 [ 110.281282][ T4988] ____kasan_slab_free+0x126/0x1f0 [ 110.286489][ T4988] slab_free_freelist_hook+0x133/0x1b0 [ 110.292057][ T4988] kmem_cache_free+0xe3/0x270 [ 110.296837][ T4988] rcu_core+0x830/0x1350 [ 110.301203][ T4988] handle_softirqs+0x19e/0x4f0 [ 110.306340][ T4988] run_ksoftirqd+0x24/0x30 [ 110.310790][ T4988] smpboot_thread_fn+0x44e/0x8b0 [ 110.315741][ T4988] kthread+0x22d/0x290 [ 110.320040][ T4988] ret_from_fork+0x1f/0x30 [ 110.324811][ T4988] [ 110.327135][ T4988] Last potentially related work creation: [ 110.332894][ T4988] kasan_save_stack+0x3a/0x60 [ 110.337584][ T4988] __kasan_record_aux_stack+0xb2/0xc0 [ 110.343056][ T4988] call_rcu+0x137/0x7c0 [ 110.347230][ T4988] evict+0x8e5/0x990 [ 110.351129][ T4988] jfs_mkdir+0x46d/0xb00 [ 110.355372][ T4988] vfs_mkdir+0x386/0x570 [ 110.359627][ T4988] do_mkdirat+0x1d8/0x440 [ 110.364001][ T4988] __x64_sys_mkdir+0x6a/0x80 [ 110.368620][ T4988] do_syscall_64+0x4c/0xa0 [ 110.373051][ T4988] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 110.379207][ T4988] [ 110.381521][ T4988] The buggy address belongs to the object at ffff8880731352b0 [ 110.381521][ T4988] which belongs to the cache jfs_ip of size 2224 [ 110.395731][ T4988] The buggy address is located 5 bytes inside of [ 110.395731][ T4988] 2224-byte region [ffff8880731352b0, ffff888073135b60) [ 110.408942][ T4988] [ 110.411369][ T4988] The buggy address belongs to the physical page: [ 110.418439][ T4988] page:ffffea0001cc4c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x73130 [ 110.429297][ T4988] head:ffffea0001cc4c00 order:3 compound_mapcount:0 compound_pincount:0 [ 110.438333][ T4988] memcg:ffff888065753001 [ 110.442851][ T4988] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 110.450907][ T4988] raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888143efd280 [ 110.460126][ T4988] raw: 0000000000000000 00000000800d000d 00000001ffffffff ffff888065753001 [ 110.469105][ T4988] page dumped because: kasan: bad access detected [ 110.475699][ T4988] page_owner tracks the page as allocated [ 110.481695][ T4988] page last allocated via order 3, migratetype Reclaimable, gfp_mask 0x1d2050(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 4986, tgid 4985 (syz.2.19), ts 109595377747, free_ts 89279899235 [ 110.506997][ T4988] post_alloc_hook+0x260/0x290 [ 110.512159][ T4988] get_page_from_freelist+0x2ce7/0x2e30 [ 110.518083][ T4988] __alloc_pages+0x1ec/0x430 [ 110.522692][ T4988] alloc_slab_page+0x5d/0x180 [ 110.527826][ T4988] new_slab+0x70/0x250 [ 110.532194][ T4988] ___slab_alloc+0x9d2/0xe40 [ 110.537146][ T4988] kmem_cache_alloc_lru+0xfa/0x2a0 [ 110.542434][ T4988] jfs_alloc_inode+0x24/0x60 [ 110.547120][ T4988] iget_locked+0x163/0x840 [ 110.551543][ T4988] jfs_iget+0x20/0x3f0 [ 110.555629][ T4988] jfs_lookup+0x21d/0x420 [ 110.559996][ T4988] __lookup_slow+0x29d/0x3f0 [ 110.564789][ T4988] lookup_slow+0x53/0x70 [ 110.569065][ T4988] walk_component+0x2ad/0x3e0 [ 110.573845][ T4988] path_lookupat+0x148/0x420 [ 110.578447][ T4988] filename_lookup+0x229/0x580 [ 110.583320][ T4988] page last free stack trace: [ 110.588068][ T4988] free_unref_page_prepare+0x821/0x940 [ 110.593807][ T4988] free_unref_page+0x2e/0x3a0 [ 110.598485][ T4988] __unfreeze_partials+0x180/0x1e0 [ 110.603595][ T4988] put_cpu_partial+0x14c/0x1b0 [ 110.608647][ T4988] qlist_free_all+0x76/0xe0 [ 110.613237][ T4988] kasan_quarantine_reduce+0x144/0x160 [ 110.618822][ T4988] __kasan_slab_alloc+0x1e/0x80 [ 110.623882][ T4988] slab_post_alloc_hook+0x4d/0x400 [ 110.629201][ T4988] kmem_cache_alloc+0x181/0x2a0 [ 110.634113][ T4988] mas_alloc_nodes+0x1c5/0x830 [ 110.639000][ T4988] mas_preallocate+0x162/0x3b0 [ 110.643775][ T4988] vma_expand+0x232/0x850 [ 110.648198][ T4988] mmap_region+0xcca/0x1990 [ 110.653150][ T4988] do_mmap+0x9bb/0x10b0 [ 110.657415][ T4988] vm_mmap_pgoff+0x1b9/0x2c0 [ 110.662302][ T4988] ksys_mmap_pgoff+0x30d/0x450 [ 110.667301][ T4988] [ 110.670161][ T4988] Memory state around the buggy address: [ 110.676946][ T4988] ffff888073135180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 110.685175][ T4988] ffff888073135200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 110.694079][ T4988] >ffff888073135280: fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb fb [ 110.703438][ T4988] ^ [ 110.709879][ T4988] ffff888073135300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 110.718646][ T4988] ffff888073135380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 110.727077][ T4988] ================================================================== [ 110.747047][ T4988] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 110.754877][ T4988] Kernel Offset: disabled [ 110.759415][ T4988] Rebooting in 86400 seconds..