Warning: Permanently added '10.128.1.239' (ED25519) to the list of known hosts. 2026/02/18 19:07:45 parsed 1 programs Setting up swapspace version 1, size = 127995904 bytes [ 43.179111][ T24] kauditd_printk_skb: 31 callbacks suppressed [ 43.179120][ T24] audit: type=1400 audit(1771441665.740:105): avc: denied { unlink } for pid=421 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 43.236965][ T24] audit: type=1400 audit(1771441665.790:106): avc: denied { write } for pid=423 comm="mkswap" path="pipe:[15005]" dev="pipefs" ino=15005 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 43.259747][ T421] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 43.671223][ T24] audit: type=1400 audit(1771441666.230:107): avc: denied { create } for pid=431 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 43.768886][ T24] audit: type=1401 audit(1771441666.330:108): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 44.074272][ T462] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.081661][ T462] bridge0: port 1(bridge_slave_0) entered disabled state [ 44.089373][ T462] device bridge_slave_0 entered promiscuous mode [ 44.096263][ T462] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.103452][ T462] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.111236][ T462] device bridge_slave_1 entered promiscuous mode [ 44.167879][ T462] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.176131][ T462] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.183626][ T462] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.191332][ T462] bridge0: port 1(bridge_slave_0) entered forwarding state [ 44.209159][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 44.216895][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 44.224823][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.233963][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 44.242288][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.249427][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 44.257871][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 44.266184][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.273401][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.284464][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 44.293641][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 44.305945][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 44.316748][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 44.324966][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 44.332767][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 44.340848][ T462] device veth0_vlan entered promiscuous mode [ 44.350337][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 44.359512][ T462] device veth1_macvtap entered promiscuous mode [ 44.368020][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 44.391203][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/02/18 19:07:47 executed programs: 0 [ 44.726735][ T486] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.733889][ T486] bridge0: port 1(bridge_slave_0) entered disabled state [ 44.741861][ T486] device bridge_slave_0 entered promiscuous mode [ 44.749004][ T486] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.756201][ T486] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.763588][ T486] device bridge_slave_1 entered promiscuous mode [ 44.805653][ T486] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.812748][ T486] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.820013][ T486] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.827028][ T486] bridge0: port 1(bridge_slave_0) entered forwarding state [ 44.842497][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 44.850340][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 44.857462][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.866557][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 44.874748][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.882154][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 44.891369][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 44.899690][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.906793][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.919400][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 44.938054][ T486] device veth0_vlan entered promiscuous mode [ 44.945336][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 44.954962][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 44.963314][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 44.970911][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 44.978396][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 44.991021][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 45.000602][ T486] device veth1_macvtap entered promiscuous mode [ 45.009326][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 45.019023][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 45.049456][ T491] ====================================================== [ 45.049456][ T491] WARNING: the mand mount option is being deprecated and [ 45.049456][ T491] will be removed in v5.15! [ 45.049456][ T491] ====================================================== [ 45.100574][ T491] EXT4-fs (loop2): Ignoring removed nobh option [ 45.106982][ T491] EXT4-fs (loop2): Ignoring removed bh option [ 45.119552][ T491] EXT4-fs (loop2): mounted filesystem without journal. Opts: resuid=0x0000000000000000,data_err=abort,barrier=0x0000000000000001,dioread_lock,grpjquota=,quota,data_err=ignore,grpquota,nobh,user_xattr,bh,minixdf,,errors=continue [ 45.142223][ T24] audit: type=1400 audit(1771441667.700:109): avc: denied { mount } for pid=490 comm="syz.2.17" name="/" dev="loop2" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 45.143998][ T491] EXT4-fs error (device loop2): ext4_mb_mark_diskspace_used:3358: comm syz.2.17: Allocating blocks 481-513 which overlap fs metadata [ 45.170652][ T24] audit: type=1400 audit(1771441667.700:110): avc: denied { write } for pid=490 comm="syz.2.17" name="/" dev="loop2" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 45.184051][ T486] ================================================================== [ 45.207764][ T486] BUG: KASAN: use-after-free in ext4_ext_remove_space+0x374f/0x4570 [ 45.215921][ T486] Read of size 4 at addr ffff888121dd5c18 by task syz-executor/486 [ 45.224502][ T486] [ 45.226834][ T486] CPU: 0 PID: 486 Comm: syz-executor Not tainted syzkaller #0 [ 45.234302][ T486] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 45.244516][ T486] Call Trace: [ 45.247806][ T486] __dump_stack+0x21/0x24 [ 45.252131][ T486] dump_stack_lvl+0x1a7/0x208 [ 45.256795][ T486] ? show_regs_print_info+0x18/0x18 [ 45.262324][ T486] ? thaw_kernel_threads+0x220/0x220 [ 45.267680][ T486] print_address_description+0x7f/0x2c0 [ 45.273220][ T486] ? ext4_ext_remove_space+0x374f/0x4570 [ 45.278840][ T486] kasan_report+0xe2/0x130 [ 45.283227][ T486] ? __read_extent_tree_block+0x1e8/0x790 [ 45.288941][ T486] ? ext4_ext_remove_space+0x374f/0x4570 [ 45.294547][ T486] __asan_report_load4_noabort+0x14/0x20 [ 45.300152][ T486] ext4_ext_remove_space+0x374f/0x4570 [ 45.305714][ T486] ? __kasan_slab_free+0x11/0x20 [ 45.310640][ T486] ? ext4_es_free_extent+0x3de/0x4c0 [ 45.315902][ T486] ? ext4_es_free_extent+0x3de/0x4c0 [ 45.321334][ T486] ? __es_remove_extent+0xdbf/0x16f0 [ 45.326602][ T486] ? _raw_write_lock+0x94/0xf0 [ 45.331339][ T486] ? ext4_da_release_space+0x19f/0x410 [ 45.337134][ T486] ? ext4_ext_index_trans_blocks+0x100/0x100 [ 45.343191][ T486] ext4_ext_truncate+0x169/0x1f0 [ 45.348459][ T486] ext4_truncate+0xb21/0x12d0 [ 45.353114][ T486] ? __ext4_mark_inode_dirty+0x610/0x610 [ 45.358721][ T486] ext4_evict_inode+0xf5b/0x1770 [ 45.363721][ T486] ? _raw_spin_unlock+0x4d/0x70 [ 45.368730][ T486] ? ext4_inode_is_fast_symlink+0x370/0x370 [ 45.374613][ T486] ? inode_io_list_del_locked+0x1b3/0x210 [ 45.380501][ T486] ? _raw_spin_unlock+0x4d/0x70 [ 45.385330][ T486] ? ext4_inode_is_fast_symlink+0x370/0x370 [ 45.391196][ T486] evict+0x4ae/0x930 [ 45.395071][ T486] ? mode_strip_sgid+0x160/0x160 [ 45.400110][ T486] ? _raw_spin_lock+0x94/0xf0 [ 45.404857][ T486] ? _raw_spin_trylock_bh+0x150/0x150 [ 45.410236][ T486] ? iput+0x291/0x7c0 [ 45.414201][ T486] ? __kasan_check_write+0x14/0x20 [ 45.419293][ T486] iput+0x638/0x7c0 [ 45.423182][ T486] do_unlinkat+0x347/0x680 [ 45.427583][ T486] ? __check_object_size+0x2f4/0x3c0 [ 45.432950][ T486] ? fsnotify_link_count+0x90/0x90 [ 45.438214][ T486] ? getname_flags+0x206/0x500 [ 45.442952][ T486] __x64_sys_unlink+0x49/0x50 [ 45.447737][ T486] do_syscall_64+0x31/0x40 [ 45.452308][ T486] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 45.458359][ T486] RIP: 0033:0x7fe68ca92fa7 [ 45.462861][ T486] Code: 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 57 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 45.482586][ T486] RSP: 002b:00007fffc164a168 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 [ 45.490980][ T486] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe68ca92fa7 [ 45.498929][ T486] RDX: 00007fffc164a190 RSI: 00007fffc164a220 RDI: 00007fffc164a220 [ 45.506879][ T486] RBP: 00007fffc164a220 R08: 00007fffc164b220 R09: 00000000ffffffff [ 45.514826][ T486] R10: 0000000000000100 R11: 0000000000000206 R12: 00007fffc164b310 [ 45.522771][ T486] R13: 00007fe68cafd71f R14: 000000000000b04f R15: 00007fffc164c3e0 [ 45.530830][ T486] [ 45.533138][ T486] The buggy address belongs to the page: [ 45.538769][ T486] page:ffffea0004877540 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x121dd5 [ 45.548988][ T486] flags: 0x4000000000000000() [ 45.553741][ T486] raw: 4000000000000000 ffffea0004877588 ffffea0004877508 0000000000000000 [ 45.562299][ T486] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 45.570861][ T486] page dumped because: kasan: bad access detected [ 45.577257][ T486] page_owner tracks the page as freed [ 45.582699][ T486] page last allocated via order 0, migratetype Movable, gfp_mask 0x100cca(GFP_HIGHUSER_MOVABLE), pid 482, ts 44565974283, free_ts 44701904412 [ 45.597380][ T486] prep_new_page+0x179/0x180 [ 45.601955][ T486] get_page_from_freelist+0x223b/0x23d0 [ 45.607566][ T486] __alloc_pages_nodemask+0x290/0x620 [ 45.612912][ T486] handle_pte_fault+0xf53/0x3750 [ 45.617823][ T486] handle_mm_fault+0xf81/0x1710 [ 45.622645][ T486] do_user_addr_fault+0x5a8/0xc90 [ 45.627744][ T486] exc_page_fault+0x5a/0xc0 [ 45.632226][ T486] asm_exc_page_fault+0x1e/0x30 [ 45.637491][ T486] page last free stack trace: [ 45.642142][ T486] free_unref_page_prepare+0x2b7/0x2d0 [ 45.647592][ T486] free_unref_page_list+0x129/0x9c0 [ 45.652808][ T486] release_pages+0xe52/0xea0 [ 45.657370][ T486] free_pages_and_swap_cache+0x86/0xa0 [ 45.662959][ T486] tlb_finish_mmu+0x17e/0x310 [ 45.667718][ T486] exit_mmap+0x329/0x590 [ 45.671947][ T486] __mmput+0x93/0x2f0 [ 45.675922][ T486] mmput+0x4e/0x150 [ 45.679805][ T486] do_exit+0x9ec/0x2500 [ 45.684131][ T486] do_group_exit+0x141/0x310 [ 45.688888][ T486] get_signal+0xf7d/0x12e0 [ 45.693294][ T486] arch_do_signal_or_restart+0xe2/0x11d0 [ 45.698918][ T486] exit_to_user_mode_loop+0xa2/0xe0 [ 45.704096][ T486] exit_to_user_mode_prepare+0x76/0xa0 [ 45.709539][ T486] syscall_exit_to_user_mode+0x1d/0x40 [ 45.714973][ T486] do_syscall_64+0x3d/0x40 [ 45.719360][ T486] [ 45.721662][ T486] Memory state around the buggy address: [ 45.727263][ T486] ffff888121dd5b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 45.735399][ T486] ffff888121dd5b80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 45.743540][ T486] >ffff888121dd5c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 45.751570][ T486] ^ [ 45.756399][ T486] ffff888121dd5c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 45.764536][ T486] ffff888121dd5d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 45.772688][ T486] ================================================================== [ 45.780811][ T486] Disabling lock debugging due to kernel taint [ 45.793417][ T24] audit: type=1400 audit(1771441667.700:111): avc: denied { add_name } for pid=490 comm="syz.2.17" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 45.814544][ T24] audit: type=1400 audit(1771441667.700:112): avc: denied { create } for pid=490 comm="syz.2.17" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 45.835269][ T24] audit: type=1400 audit(1771441667.700:113): avc: denied { read write } for pid=490 comm="syz.2.17" name="file1" dev="loop2" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 45.858816][ T24] audit: type=1400 audit(1771441667.700:114): avc: denied { open } for pid=490 comm="syz.2.17" path="/0/file1/file1" dev="loop2" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 46.001584][ T496] EXT4-fs (loop2): Ignoring removed nobh option [ 46.008229][ T496] EXT4-fs (loop2): Ignoring removed bh option [ 46.019950][ T496] EXT4-fs (loop2): mounted filesystem without journal. Opts: resuid=0x0000000000000000,data_err=abort,barrier=0x0000000000000001,dioread_lock,grpjquota=,quota,data_err=ignore,grpquota,nobh,user_xattr,bh,minixdf,,errors=continue [ 46.043590][ T496] EXT4-fs error (device loop2): ext4_mb_mark_diskspace_used:3358: comm syz.2.18: Allocating blocks 481-513 which overlap fs metadata [ 46.061597][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 281472864432208, count = 16 [ 46.076682][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 281472864399451, count = 32767 [ 46.092205][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 281472864432208, count = 16 [ 46.107346][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 281472864399451, count = 32767 [ 46.123418][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 281472864432128, count = 16 [ 46.138300][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 281472864399373, count = 32767 [ 46.153509][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 281472855951840, count = 16 [ 46.168447][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 281472855919082, count = 32767 [ 46.183596][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 281472855948096, count = 16 [ 46.290688][ T501] EXT4-fs (loop2): Ignoring removed nobh option [ 46.297083][ T501] EXT4-fs (loop2): Ignoring removed bh option [ 46.309303][ T501] EXT4-fs (loop2): mounted filesystem without journal. Opts: resuid=0x0000000000000000,data_err=abort,barrier=0x0000000000000001,dioread_lock,grpjquota=,quota,data_err=ignore,grpquota,nobh,user_xattr,bh,minixdf,,errors=continue [ 46.332903][ T501] EXT4-fs error (device loop2): ext4_mb_mark_diskspace_used:3358: comm syz.2.19: Allocating blocks 481-513 which overlap fs metadata [ 46.513274][ T506] EXT4-fs (loop2): Ignoring removed nobh option [ 46.519618][ T506] EXT4-fs (loop2): Ignoring removed bh option [ 46.529272][ T506] EXT4-fs (loop2): mounted filesystem without journal. Opts: resuid=0x0000000000000000,data_err=abort,barrier=0x0000000000000001,dioread_lock,grpjquota=,quota,data_err=ignore,grpquota,nobh,user_xattr,bh,minixdf,,errors=continue [ 46.552772][ T506] EXT4-fs error (device loop2): ext4_mb_mark_diskspace_used:3358: comm syz.2.20: Allocating blocks 481-513 which overlap fs metadata [ 46.569266][ T112] device bridge_slave_1 left promiscuous mode [ 46.575716][ T112] bridge0: port 2(bridge_slave_1) entered disabled state [ 46.583224][ T112] device bridge_slave_0 left promiscuous mode [ 46.589859][ T112] bridge0: port 1(bridge_slave_0) entered disabled state [ 46.598031][ T112] device veth1_macvtap left promiscuous mode [ 46.604089][ T112] device veth0_vlan left promiscuous mode [ 46.710329][ T511] EXT4-fs (loop2): Ignoring removed nobh option [ 46.717340][ T511] EXT4-fs (loop2): Ignoring removed bh option [ 46.729469][ T511] EXT4-fs (loop2): mounted filesystem without journal. Opts: resuid=0x0000000000000000,data_err=abort,barrier=0x0000000000000001,dioread_lock,grpjquota=,quota,data_err=ignore,grpquota,nobh,user_xattr,bh,minixdf,,errors=continue [ 46.753392][ T511] EXT4-fs error (device loop2): ext4_mb_mark_diskspace_used:3358: comm syz.2.21: Allocating blocks 481-513 which overlap fs metadata [ 46.875697][ T516] EXT4-fs (loop2): Ignoring removed nobh option [ 46.882110][ T516] EXT4-fs (loop2): Ignoring removed bh option [ 46.899320][ T516] EXT4-fs (loop2): mounted filesystem without journal. Opts: resuid=0x0000000000000000,data_err=abort,barrier=0x0000000000000001,dioread_lock,grpjquota=,quota,data_err=ignore,grpquota,nobh,user_xattr,bh,minixdf,,errors=continue [ 46.928547][ T516] EXT4-fs error (device loop2): ext4_mb_mark_diskspace_used:3358: comm syz.2.22: Allocating blocks 481-513 which overlap fs metadata [ 47.048303][ T521] EXT4-fs (loop2): Ignoring removed nobh option [ 47.054578][ T521] EXT4-fs (loop2): Ignoring removed bh option [ 47.069631][ T521] EXT4-fs (loop2): mounted filesystem without journal. Opts: resuid=0x0000000000000000,data_err=abort,barrier=0x0000000000000001,dioread_lock,grpjquota=,quota,data_err=ignore,grpquota,nobh,user_xattr,bh,minixdf,,errors=continue [ 47.094106][ T521] EXT4-fs error (device loop2): ext4_mb_mark_diskspace_used:3358: comm syz.2.23: Allocating blocks 481-513 which overlap fs metadata [ 47.285880][ T526] EXT4-fs (loop2): Ignoring removed nobh option [ 47.292394][ T526] EXT4-fs (loop2): Ignoring removed bh option [ 47.309614][ T526] EXT4-fs (loop2): mounted filesystem without journal. Opts: resuid=0x0000000000000000,data_err=abort,barrier=0x0000000000000001,dioread_lock,grpjquota=,quota,data_err=ignore,grpquota,nobh,user_xattr,bh,minixdf,,errors=continue [ 47.334447][ T526] EXT4-fs error (device loop2): ext4_mb_mark_diskspace_used:3358: comm syz.2.24: Allocating blocks 481-513 which overlap fs metadata [ 47.461563][ T531] EXT4-fs (loop2): Ignoring removed nobh option [ 47.467946][ T531] EXT4-fs (loop2): Ignoring removed bh option [ 47.479192][ T531] EXT4-fs (loop2): mounted filesystem without journal. Opts: resuid=0x0000000000000000,data_err=abort,barrier=0x0000000000000001,dioread_lock,grpjquota=,quota,data_err=ignore,grpquota,nobh,user_xattr,bh,minixdf,,errors=continue [ 47.502501][ T531] EXT4-fs error (device loop2): ext4_mb_mark_diskspace_used:3358: comm syz.2.25: Allocating blocks 481-513 which overlap fs metadata [ 47.519468][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 0, count = 16 [ 47.533119][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 3, count = 8 [ 47.546512][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 0, count = 16 [ 47.560559][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 0, count = 1 [ 47.574064][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 32736, count = 16 [ 47.588436][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 0, count = 32742 [ 47.602306][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 0, count = 16 [ 47.754247][ T536] EXT4-fs (loop2): Ignoring removed nobh option [ 47.760871][ T536] EXT4-fs (loop2): Ignoring removed bh option [ 47.779426][ T536] EXT4-fs (loop2): mounted filesystem without journal. Opts: resuid=0x0000000000000000,data_err=abort,barrier=0x0000000000000001,dioread_lock,grpjquota=,quota,data_err=ignore,grpquota,nobh,user_xattr,bh,minixdf,,errors=continue [ 47.802952][ T536] EXT4-fs error (device loop2): ext4_mb_mark_diskspace_used:3358: comm syz.2.26: Allocating blocks 481-513 which overlap fs metadata [ 47.909490][ T541] EXT4-fs (loop2): Ignoring removed nobh option [ 47.915901][ T541] EXT4-fs (loop2): Ignoring removed bh option [ 47.929224][ T541] EXT4-fs (loop2): mounted filesystem without journal. Opts: resuid=0x0000000000000000,data_err=abort,barrier=0x0000000000000001,dioread_lock,grpjquota=,quota,data_err=ignore,grpquota,nobh,user_xattr,bh,minixdf,,errors=continue [ 47.952727][ T541] EXT4-fs error (device loop2): ext4_mb_mark_diskspace_used:3358: comm syz.2.27: Allocating blocks 481-513 which overlap fs metadata [ 48.074472][ T546] EXT4-fs (loop2): Ignoring removed nobh option [ 48.081140][ T546] EXT4-fs (loop2): Ignoring removed bh option [ 48.099312][ T546] EXT4-fs (loop2): mounted filesystem without journal. Opts: resuid=0x0000000000000000,data_err=abort,barrier=0x0000000000000001,dioread_lock,grpjquota=,quota,data_err=ignore,grpquota,nobh,user_xattr,bh,minixdf,,errors=continue [ 48.124056][ T546] EXT4-fs error (device loop2): ext4_mb_mark_diskspace_used:3358: comm syz.2.28: Allocating blocks 481-513 which overlap fs metadata [ 48.141617][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 104863294718416, count = 16 [ 48.156373][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 104863294710131, count = 8292 [ 48.171479][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 104863294710128, count = 16 [ 48.186603][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 62012405422992, count = 16 [ 48.201917][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 62012405396790, count = 26214 [ 48.217167][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 62012405396784, count = 16 [ 48.232209][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 51073168087968, count = 16 [ 48.247045][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 51073168062004, count = 25973 [ 48.262043][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 51073168062000, count = 16 [ 50.910902][ T551] EXT4-fs (loop2): Ignoring removed nobh option [ 50.917302][ T551] EXT4-fs (loop2): Ignoring removed bh option [ 50.939276][ T551] EXT4-fs (loop2): mounted filesystem without journal. Opts: resuid=0x0000000000000000,data_err=abort,barrier=0x0000000000000001,dioread_lock,grpjquota=,quota,data_err=ignore,grpquota,nobh,user_xattr,bh,minixdf,,errors=continue [ 50.962856][ T551] EXT4-fs error (device loop2): ext4_mb_mark_diskspace_used:3358: comm syz.2.29: Allocating blocks 481-513 which overlap fs metadata 2026/02/18 19:07:53 executed programs: 15 [ 51.070818][ T556] EXT4-fs (loop2): Ignoring removed nobh option [ 51.077263][ T556] EXT4-fs (loop2): Ignoring removed bh option [ 51.089343][ T556] EXT4-fs (loop2): mounted filesystem without journal. Opts: resuid=0x0000000000000000,data_err=abort,barrier=0x0000000000000001,dioread_lock,grpjquota=,quota,data_err=ignore,grpquota,nobh,user_xattr,bh,minixdf,,errors=continue [ 51.114098][ T556] EXT4-fs error (device loop2): ext4_mb_mark_diskspace_used:3358: comm syz.2.30: Allocating blocks 481-513 which overlap fs metadata [ 51.131163][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 0, count = 0 [ 51.145109][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 0, count = 16 [ 51.159268][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 0, count = 0 [ 51.175569][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 0, count = 16 [ 51.193112][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 0, count = 0 [ 51.207644][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 0, count = 16 [ 51.222587][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 0, count = 0 [ 51.237234][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 0, count = 16 [ 51.251136][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 0, count = 0 [ 53.084819][ T561] EXT4-fs (loop2): Ignoring removed nobh option [ 53.091119][ T561] EXT4-fs (loop2): Ignoring removed bh option [ 53.099130][ T561] EXT4-fs (loop2): mounted filesystem without journal. Opts: resuid=0x0000000000000000,data_err=abort,barrier=0x0000000000000001,dioread_lock,grpjquota=,quota,data_err=ignore,grpquota,nobh,user_xattr,bh,minixdf,,errors=continue [ 53.122729][ T561] EXT4-fs error (device loop2): ext4_mb_mark_diskspace_used:3358: comm syz.2.31: Allocating blocks 481-513 which overlap fs metadata [ 53.140596][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 29758864, count = 0 [ 53.154796][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 77370369081968, count = 16 [ 53.169827][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 77370369069405, count = 12570 [ 53.285119][ T566] EXT4-fs (loop2): Ignoring removed nobh option [ 53.292150][ T566] EXT4-fs (loop2): Ignoring removed bh option [ 53.309558][ T566] EXT4-fs (loop2): mounted filesystem without journal. Opts: resuid=0x0000000000000000,data_err=abort,barrier=0x0000000000000001,dioread_lock,grpjquota=,quota,data_err=ignore,grpquota,nobh,user_xattr,bh,minixdf,,errors=continue [ 53.333196][ T566] EXT4-fs error (device loop2): ext4_mb_mark_diskspace_used:3358: comm syz.2.32: Allocating blocks 481-513 which overlap fs metadata [ 53.350256][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 129108428903632, count = 16 [ 53.365525][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 129108428878693, count = 24950 [ 53.380655][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 129108428878688, count = 16 [ 53.395731][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 130220882908848, count = 16 [ 53.410914][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 130220882883423, count = 25439 [ 53.426121][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 130220882883408, count = 16 [ 53.442627][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 107148536169152, count = 16 [ 53.457663][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 107148536144750, count = 24415 [ 53.472841][ T486] EXT4-fs error (device loop2): ext4_free_blocks:5701: comm syz-executor: Freeing blocks not in datazone - block = 59607220711312, count = 16