Warning: Permanently added '10.128.1.182' (ED25519) to the list of known hosts. 2026/10/08 22:44:31 parsed 1 programs Setting up swapspace version 1, size = 127995904 bytes [ 104.626876][ T4522] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 107.618732][ T756] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.635282][ T756] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.644500][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 107.676473][ T3078] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.686463][ T3078] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.697235][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 109.165017][ T4707] chnl_net:caif_netlink_parms(): no params data found [ 109.201884][ T4707] bridge0: port 1(bridge_slave_0) entered blocking state [ 109.210372][ T4707] bridge0: port 1(bridge_slave_0) entered disabled state [ 109.218589][ T4707] device bridge_slave_0 entered promiscuous mode [ 109.227344][ T4707] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.235442][ T4707] bridge0: port 2(bridge_slave_1) entered disabled state [ 109.244477][ T4707] device bridge_slave_1 entered promiscuous mode [ 109.266643][ T4707] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 109.279254][ T4707] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 109.302878][ T4707] team0: Port device team_slave_0 added [ 109.311483][ T4707] team0: Port device team_slave_1 added [ 109.329849][ T4707] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 109.337869][ T4707] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 109.368435][ T4707] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 109.388196][ T4707] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 109.401371][ T4707] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 109.440747][ T4707] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 109.491149][ T4707] device hsr_slave_0 entered promiscuous mode [ 109.499527][ T4707] device hsr_slave_1 entered promiscuous mode [ 110.076633][ T4707] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 110.092315][ T4707] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 110.108013][ T4707] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 110.120941][ T4707] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 110.258981][ T4707] 8021q: adding VLAN 0 to HW filter on device bond0 [ 110.277894][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 110.291797][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 110.306064][ T4707] 8021q: adding VLAN 0 to HW filter on device team0 [ 110.331816][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 110.344643][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 110.358832][ T3078] bridge0: port 1(bridge_slave_0) entered blocking state [ 110.366403][ T3078] bridge0: port 1(bridge_slave_0) entered forwarding state [ 110.385691][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 110.427959][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 110.438459][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 110.448336][ T3078] bridge0: port 2(bridge_slave_1) entered blocking state [ 110.455596][ T3078] bridge0: port 2(bridge_slave_1) entered forwarding state [ 110.485329][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 110.494748][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 110.510195][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 110.520173][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 110.595025][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 110.609040][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 110.619068][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 110.633524][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 110.643442][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 110.667860][ T4707] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 110.682216][ T4707] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 110.695483][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 110.707298][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 110.949379][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 110.959591][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 110.995090][ T4707] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 111.031801][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 111.055748][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 111.099662][ T756] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 111.110303][ T756] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 111.138169][ T756] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 111.155669][ T756] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 111.169843][ T4707] device veth0_vlan entered promiscuous mode [ 111.195276][ T4707] device veth1_vlan entered promiscuous mode [ 111.224793][ T756] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 111.233650][ T756] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 111.246286][ T756] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 111.256285][ T756] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 111.269311][ T4707] device veth0_macvtap entered promiscuous mode [ 111.281887][ T4707] device veth1_macvtap entered promiscuous mode [ 111.319352][ T4707] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.328173][ T756] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 111.338333][ T756] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 111.348936][ T756] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 111.359992][ T756] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 111.377718][ T4707] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.392100][ T756] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 111.404357][ T756] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 111.419842][ T4707] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.432393][ T4707] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.444646][ T4707] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.460126][ T4707] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 2026/10/08 22:44:42 executed programs: 0 [ 112.634456][ T4814] chnl_net:caif_netlink_parms(): no params data found [ 112.741226][ T4814] bridge0: port 1(bridge_slave_0) entered blocking state [ 112.751212][ T4814] bridge0: port 1(bridge_slave_0) entered disabled state [ 112.762984][ T4814] device bridge_slave_0 entered promiscuous mode [ 112.779956][ T9] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.795867][ T4814] bridge0: port 2(bridge_slave_1) entered blocking state [ 112.803921][ T4814] bridge0: port 2(bridge_slave_1) entered disabled state [ 112.812837][ T4814] device bridge_slave_1 entered promiscuous mode [ 112.843302][ T4814] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 112.855716][ T4814] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 112.884205][ T4814] team0: Port device team_slave_0 added [ 112.894140][ T4814] team0: Port device team_slave_1 added [ 112.920513][ T4814] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 112.927881][ T4814] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 112.957262][ T4814] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 112.972067][ T4814] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 112.983682][ T4814] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 113.013652][ T4814] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 113.054928][ T4814] device hsr_slave_0 entered promiscuous mode [ 113.061946][ T4814] device hsr_slave_1 entered promiscuous mode [ 113.072062][ T4814] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 113.080232][ T4814] Cannot create hsr debugfs directory [ 114.405050][ T13] Bluetooth: hci0: command 0x0409 tx timeout [ 115.602924][ T9] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 116.299977][ T9] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 116.342085][ T9] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 116.497545][ T4701] Bluetooth: hci0: command 0x041b tx timeout [ 117.151414][ T4814] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 117.162233][ T4814] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 117.175495][ T4814] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 117.193370][ T4814] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 117.248611][ T4814] 8021q: adding VLAN 0 to HW filter on device bond0 [ 117.270729][ T756] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 117.279663][ T756] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 117.294551][ T4814] 8021q: adding VLAN 0 to HW filter on device team0 [ 117.306424][ T9] device hsr_slave_0 left promiscuous mode [ 117.317611][ T9] device hsr_slave_1 left promiscuous mode [ 117.326891][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 117.340749][ T9] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 117.357085][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 117.368885][ T9] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 117.382600][ T9] device bridge_slave_1 left promiscuous mode [ 117.390321][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 117.402470][ T9] device bridge_slave_0 left promiscuous mode [ 117.410185][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 117.425414][ T9] device veth1_macvtap left promiscuous mode [ 117.432595][ T9] device veth0_macvtap left promiscuous mode [ 117.440003][ T9] device veth1_vlan left promiscuous mode [ 117.447706][ T9] device veth0_vlan left promiscuous mode [ 117.591764][ T9] team0 (unregistering): Port device team_slave_1 removed [ 117.606785][ T9] team0 (unregistering): Port device team_slave_0 removed [ 117.619984][ T9] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 117.634113][ T9] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 117.691088][ T9] bond0 (unregistering): Released all slaves [ 117.716480][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 117.727372][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 117.736659][ T144] bridge0: port 1(bridge_slave_0) entered blocking state [ 117.744400][ T144] bridge0: port 1(bridge_slave_0) entered forwarding state [ 117.754234][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 117.767985][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 117.780726][ T144] bridge0: port 2(bridge_slave_1) entered blocking state [ 117.792855][ T144] bridge0: port 2(bridge_slave_1) entered forwarding state [ 117.807151][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 117.821692][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 117.834232][ T756] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 117.849595][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 117.878415][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 117.891092][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 117.901213][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 117.911664][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 117.924452][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 117.934903][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 117.947230][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 117.956923][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 117.974123][ T4814] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 118.077950][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 118.087658][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 118.102741][ T4814] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 118.119799][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 118.128627][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 118.152302][ T4814] device veth0_vlan entered promiscuous mode [ 118.167099][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 118.176797][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 118.186551][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 118.196293][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 118.210298][ T4814] device veth1_vlan entered promiscuous mode [ 118.239817][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 118.256375][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 118.267437][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 118.277646][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 118.290831][ T4814] device veth0_macvtap entered promiscuous mode [ 118.302831][ T4814] device veth1_macvtap entered promiscuous mode [ 118.322625][ T4814] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 118.336382][ T4814] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 118.344329][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 118.354429][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 118.366111][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 118.377939][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 118.391081][ T4814] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 118.401395][ T4814] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 118.412151][ T4814] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 118.421360][ T4814] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 118.492475][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 118.505600][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 118.513469][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready 2026/10/08 22:44:48 executed programs: 2 [ 118.537000][ T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 118.546081][ T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 118.554554][ T3078] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 118.576459][ T4261] Bluetooth: hci0: command 0x040f tx timeout [ 118.679488][ T5111] loop0: detected capacity change from 0 to 8192 [ 118.749270][ T5111] REISERFS (device loop0): found reiserfs format "3.6" with non-standard journal [ 118.775077][ T5111] REISERFS (device loop0): using ordered data mode [ 118.781980][ T5111] reiserfs: using flush barriers [ 118.794548][ T5111] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 118.837131][ T5111] REISERFS (device loop0): checking transaction log (loop0) [ 118.992108][ T5111] REISERFS (device loop0): Using tea hash to sort names [ 119.003993][ T5111] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. [ 119.043690][ T5111] REISERFS warning (device loop0): vs-13060 reiserfs_update_sd_size: stat data of object [2 5 0x0 SD] (nlink == 1) not found (pos 2) [ 119.068068][ T5111] REISERFS warning (device loop0): vs-13060 reiserfs_update_sd_size: stat data of object [6 7 0x0 SD] (nlink == 2) not found (pos 1) [ 119.084672][ T5111] REISERFS warning (device loop0): vs-13060 reiserfs_update_sd_size: stat data of object [3 6 0x0 SD] (nlink == 3) not found (pos 1) [ 119.100634][ T5111] REISERFS warning (device loop0): vs-13060 reiserfs_update_sd_size: stat data of object [6 7 0x0 SD] (nlink == 2) not found (pos 1) [ 119.330071][ T5114] loop0: detected capacity change from 0 to 8192 [ 119.391632][ T5114] REISERFS (device loop0): found reiserfs format "3.6" with non-standard journal [ 119.415055][ T5114] REISERFS (device loop0): using ordered data mode [ 119.422641][ T5114] reiserfs: using flush barriers [ 119.449245][ T5114] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 119.481329][ T5114] REISERFS (device loop0): checking transaction log (loop0) [ 119.542417][ T5114] REISERFS (device loop0): Using tea hash to sort names [ 119.551840][ T5114] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. [ 119.566706][ T5114] REISERFS warning (device loop0): vs-13060 reiserfs_update_sd_size: stat data of object [2 5 0x0 SD] (nlink == 1) not found (pos 2) [ 119.588446][ T5114] REISERFS warning (device loop0): vs-13060 reiserfs_update_sd_size: stat data of object [6 7 0x0 SD] (nlink == 2) not found (pos 1) [ 119.606238][ T5114] ================================================================== [ 119.616997][ T5114] BUG: KASAN: use-after-free in search_by_entry_key+0x5ae/0x1380 [ 119.625974][ T5114] Read of size 4 at addr ffff888060027fc4 by task syz.0.18/5114 [ 119.636042][ T5114] [ 119.638613][ T5114] CPU: 1 PID: 5114 Comm: syz.0.18 Not tainted syzkaller #0 [ 119.646933][ T5114] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 119.659101][ T5114] Call Trace: [ 119.662937][ T5114] [ 119.666498][ T5114] dump_stack_lvl+0x188/0x250 [ 119.672229][ T5114] ? show_regs_print_info+0x20/0x20 [ 119.678847][ T5114] ? _printk+0xda/0x130 [ 119.683822][ T5114] ? search_by_entry_key+0x5ae/0x1380 [ 119.690354][ T5114] ? load_image+0x410/0x410 [ 119.695632][ T5114] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 119.702698][ T5114] print_address_description+0x60/0x2d0 [ 119.710182][ T5114] ? search_by_entry_key+0x5ae/0x1380 [ 119.716522][ T5114] kasan_report+0xdf/0x130 [ 119.721293][ T5114] ? search_by_entry_key+0x5ae/0x1380 [ 119.727083][ T5114] search_by_entry_key+0x5ae/0x1380 [ 119.732904][ T5114] reiserfs_find_entry+0x2eb/0x18e0 [ 119.739242][ T5114] ? reiserfs_get_parent+0x2f0/0x2f0 [ 119.745305][ T5114] reiserfs_add_entry+0x698/0xd80 [ 119.750777][ T5114] ? drop_new_inode+0x60/0x60 [ 119.756144][ T5114] ? memcpy+0x3c/0x60 [ 119.760218][ T5114] ? journal_begin+0x2b1/0x350 [ 119.765503][ T5114] ? reiserfs_update_inode_transaction+0x1c/0x120 [ 119.772570][ T5114] reiserfs_mkdir+0x6be/0x920 [ 119.778324][ T5114] ? reiserfs_symlink+0x7a0/0x7a0 [ 119.784338][ T5114] ? lookup_one_len+0x19d/0x2d0 [ 119.789899][ T5114] open_xa_dir+0x5fa/0x690 [ 119.794510][ T5114] ? listxattr_filler+0x400/0x400 [ 119.800126][ T5114] xattr_lookup+0x22/0x2a0 [ 119.804597][ T5114] ? reiserfs_xattr_set_handle+0xd2/0xfd0 [ 119.810767][ T5114] reiserfs_xattr_set_handle+0x10c/0xfd0 [ 119.816615][ T5114] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 119.822903][ T5114] ? chown_one_xattr+0x90/0x90 [ 119.827923][ T5114] ? mutex_unlock+0x10/0x10 [ 119.832792][ T5114] ? aa_get_newest_label+0xf5/0x5a0 [ 119.840563][ T5114] ? journal_begin+0x1f1/0x350 [ 119.845971][ T5114] ? reiserfs_write_unlock+0xa2/0x110 [ 119.852263][ T5114] reiserfs_xattr_set+0x477/0x5b0 [ 119.858582][ T5114] ? reiserfs_get_page+0x400/0x400 [ 119.866554][ T5114] ? xattr_full_name+0x6b/0x80 [ 119.873946][ T5114] ? trusted_set+0x7d/0xe0 [ 119.879145][ T5114] ? trusted_get+0xc0/0xc0 [ 119.885355][ T5114] __vfs_setxattr+0x3d8/0x410 [ 119.892196][ T5114] __vfs_setxattr_noperm+0x126/0x5e0 [ 119.898267][ T5114] vfs_setxattr+0x167/0x2e0 [ 119.902913][ T5114] ? xattr_permission+0x510/0x510 [ 119.908760][ T5114] ? strncpy_from_user+0x1f4/0x350 [ 119.915086][ T5114] setxattr+0x2cb/0x360 [ 119.922075][ T5114] ? path_setxattr+0x290/0x290 [ 119.928699][ T5114] ? sb_start_write+0x112/0x1c0 [ 119.937336][ T5114] ? mnt_want_write_file+0x166/0x200 [ 119.945512][ T5114] __se_sys_fsetxattr+0x15e/0x1d0 [ 119.953173][ T5114] do_syscall_64+0x4c/0xa0 [ 119.961273][ T5114] ? clear_bhb_loop+0x30/0x80 [ 119.969822][ T5114] ? clear_bhb_loop+0x30/0x80 [ 119.976104][ T5114] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 119.987159][ T5114] RIP: 0033:0x7f780c0f0ef9 [ 119.993192][ T5114] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 120.023904][ T5114] RSP: 002b:00007f780b754028 EFLAGS: 00000246 ORIG_RAX: 00000000000000be [ 120.037751][ T5114] RAX: ffffffffffffffda RBX: 00007f780c35bfa0 RCX: 00007f780c0f0ef9 [ 120.051040][ T5114] RDX: 0000000000000000 RSI: 0000200000001700 RDI: 0000000000000004 [ 120.066616][ T5114] RBP: 00007f780c185ee0 R08: 0000000000000003 R09: 0000000000000000 [ 120.080521][ T5114] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 120.092944][ T5114] R13: 00007f780c35c038 R14: 00007f780c35bfa0 R15: 00007ffc992c0c88 [ 120.102741][ T5114] [ 120.106595][ T5114] [ 120.109265][ T5114] The buggy address belongs to the page: [ 120.116211][ T5114] page:ffffea00018009c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x60027 [ 120.127414][ T5114] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 120.136364][ T5114] raw: 00fff00000000000 ffffea0001800a08 ffffea0001800988 0000000000000000 [ 120.147690][ T5114] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 120.161478][ T5114] page dumped because: kasan: bad access detected [ 120.168929][ T5114] page_owner tracks the page as freed [ 120.174978][ T5114] page last allocated via order 0, migratetype Movable, gfp_mask 0x1100dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO), pid 4522, ts 102312097390, free_ts 106768395631 [ 120.202031][ T5114] get_page_from_freelist+0x24f6/0x2670 [ 120.209709][ T5114] __alloc_pages+0x1ee/0x480 [ 120.215747][ T5114] alloc_pages_vma+0x2bc/0x790 [ 120.222719][ T5114] handle_mm_fault+0x23be/0x4440 [ 120.228681][ T5114] do_user_addr_fault+0x494/0xc90 [ 120.239757][ T5114] exc_page_fault+0x60/0x100 [ 120.250331][ T5114] asm_exc_page_fault+0x22/0x30 [ 120.260007][ T5114] page last free stack trace: [ 120.268947][ T5114] free_unref_page_prepare+0x637/0x6c0 [ 120.279444][ T5114] free_unref_page_list+0x119/0x830 [ 120.289111][ T5114] release_pages+0x185f/0x1bd0 [ 120.294875][ T5114] tlb_finish_mmu+0x1b4/0x370 [ 120.300429][ T5114] unmap_region+0x344/0x3b0 [ 120.306413][ T5114] __do_munmap+0xa29/0xe10 [ 120.314368][ T5114] __vm_munmap+0x13f/0x240 [ 120.322230][ T5114] __x64_sys_munmap+0x67/0x70 [ 120.329895][ T5114] do_syscall_64+0x4c/0xa0 [ 120.339304][ T5114] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 120.347857][ T5114] [ 120.351925][ T5114] Memory state around the buggy address: [ 120.360644][ T5114] ffff888060027e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 120.371244][ T5114] ffff888060027f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 120.381007][ T5114] >ffff888060027f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 120.391940][ T5114] ^ [ 120.400644][ T5114] ffff888060028000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 120.412317][ T5114] ffff888060028080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 120.422901][ T5114] ================================================================== [ 120.431856][ T5114] Disabling lock debugging due to kernel taint [ 120.447388][ T5114] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 120.455188][ T5114] CPU: 0 PID: 5114 Comm: syz.0.18 Tainted: G B syzkaller #0 [ 120.464785][ T5114] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 120.476622][ T5114] Call Trace: [ 120.480399][ T5114] [ 120.483326][ T5114] dump_stack_lvl+0x188/0x250 [ 120.488437][ T5114] ? show_regs_print_info+0x20/0x20 [ 120.493739][ T5114] ? load_image+0x410/0x410 [ 120.498574][ T5114] panic+0x2f8/0x850 [ 120.503267][ T5114] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 120.510227][ T5114] ? bpf_jit_dump+0xd0/0xd0 [ 120.517347][ T5114] ? _raw_spin_unlock_irqrestore+0x10d/0x120 [ 120.524006][ T5114] ? _raw_spin_unlock+0x40/0x40 [ 120.528947][ T5114] ? search_by_entry_key+0x5ae/0x1380 [ 120.534923][ T5114] check_panic_on_warn+0x80/0xa0 [ 120.540975][ T5114] ? search_by_entry_key+0x5ae/0x1380 [ 120.548100][ T5114] end_report+0x6d/0xf0 [ 120.552687][ T5114] kasan_report+0x102/0x130 [ 120.558347][ T5114] ? search_by_entry_key+0x5ae/0x1380 [ 120.564186][ T5114] search_by_entry_key+0x5ae/0x1380 [ 120.570060][ T5114] reiserfs_find_entry+0x2eb/0x18e0 [ 120.575754][ T5114] ? reiserfs_get_parent+0x2f0/0x2f0 [ 120.582702][ T5114] reiserfs_add_entry+0x698/0xd80 [ 120.588236][ T5114] ? drop_new_inode+0x60/0x60 [ 120.593202][ T5114] ? memcpy+0x3c/0x60 [ 120.597420][ T5114] ? journal_begin+0x2b1/0x350 [ 120.602589][ T5114] ? reiserfs_update_inode_transaction+0x1c/0x120 [ 120.609199][ T5114] reiserfs_mkdir+0x6be/0x920 [ 120.614170][ T5114] ? reiserfs_symlink+0x7a0/0x7a0 [ 120.620134][ T5114] ? lookup_one_len+0x19d/0x2d0 [ 120.625077][ T5114] open_xa_dir+0x5fa/0x690 [ 120.629491][ T5114] ? listxattr_filler+0x400/0x400 [ 120.635680][ T5114] xattr_lookup+0x22/0x2a0 [ 120.640611][ T5114] ? reiserfs_xattr_set_handle+0xd2/0xfd0 [ 120.645198][ T4700] Bluetooth: hci0: command 0x0419 tx timeout [ 120.647326][ T5114] reiserfs_xattr_set_handle+0x10c/0xfd0 [ 120.660313][ T5114] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 120.669441][ T5114] ? chown_one_xattr+0x90/0x90 [ 120.676386][ T5114] ? mutex_unlock+0x10/0x10 [ 120.682358][ T5114] ? aa_get_newest_label+0xf5/0x5a0 [ 120.689383][ T5114] ? journal_begin+0x1f1/0x350 [ 120.695654][ T5114] ? reiserfs_write_unlock+0xa2/0x110 [ 120.702538][ T5114] reiserfs_xattr_set+0x477/0x5b0 [ 120.708149][ T5114] ? reiserfs_get_page+0x400/0x400 [ 120.714646][ T5114] ? xattr_full_name+0x6b/0x80 [ 120.719583][ T5114] ? trusted_set+0x7d/0xe0 [ 120.724304][ T5114] ? trusted_get+0xc0/0xc0 [ 120.728968][ T5114] __vfs_setxattr+0x3d8/0x410 [ 120.733768][ T5114] __vfs_setxattr_noperm+0x126/0x5e0 [ 120.739430][ T5114] vfs_setxattr+0x167/0x2e0 [ 120.744205][ T5114] ? xattr_permission+0x510/0x510 [ 120.749551][ T5114] ? strncpy_from_user+0x1f4/0x350 [ 120.754756][ T5114] setxattr+0x2cb/0x360 [ 120.759040][ T5114] ? path_setxattr+0x290/0x290 [ 120.763812][ T5114] ? sb_start_write+0x112/0x1c0 [ 120.768752][ T5114] ? mnt_want_write_file+0x166/0x200 [ 120.775003][ T5114] __se_sys_fsetxattr+0x15e/0x1d0 [ 120.780511][ T5114] do_syscall_64+0x4c/0xa0 [ 120.785450][ T5114] ? clear_bhb_loop+0x30/0x80 [ 120.790494][ T5114] ? clear_bhb_loop+0x30/0x80 [ 120.795348][ T5114] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 120.801480][ T5114] RIP: 0033:0x7f780c0f0ef9 [ 120.806058][ T5114] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 120.828603][ T5114] RSP: 002b:00007f780b754028 EFLAGS: 00000246 ORIG_RAX: 00000000000000be [ 120.841250][ T5114] RAX: ffffffffffffffda RBX: 00007f780c35bfa0 RCX: 00007f780c0f0ef9 [ 120.851485][ T5114] RDX: 0000000000000000 RSI: 0000200000001700 RDI: 0000000000000004 [ 120.861883][ T5114] RBP: 00007f780c185ee0 R08: 0000000000000003 R09: 0000000000000000 [ 120.872727][ T5114] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 120.887868][ T5114] R13: 00007f780c35c038 R14: 00007f780c35bfa0 R15: 00007ffc992c0c88 [ 120.896932][ T5114] [ 120.900989][ T5114] Kernel Offset: disabled [ 120.905718][ T5114] Rebooting in 86400 seconds..