Warning: Permanently added '10.128.0.193' (ED25519) to the list of known hosts. 2025/05/25 08:48:24 ignoring optional flag "sandboxArg"="0" 2025/05/25 08:48:25 parsed 1 programs [ 52.849064][ T30] kauditd_printk_skb: 30 callbacks suppressed [ 52.849163][ T30] audit: type=1400 audit(1748162906.621:104): avc: denied { unlink } for pid=383 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 52.892111][ T383] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 53.432206][ T30] audit: type=1400 audit(1748162907.201:105): avc: denied { create } for pid=400 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 53.808416][ T422] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.815650][ T422] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.823278][ T422] device bridge_slave_0 entered promiscuous mode [ 53.830308][ T422] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.837529][ T422] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.845156][ T422] device bridge_slave_1 entered promiscuous mode [ 53.890909][ T422] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.897962][ T422] bridge0: port 2(bridge_slave_1) entered forwarding state [ 53.905256][ T422] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.912323][ T422] bridge0: port 1(bridge_slave_0) entered forwarding state [ 53.931517][ T344] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.938819][ T344] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.946224][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 53.953983][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 53.963374][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 53.971682][ T344] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.978809][ T344] bridge0: port 1(bridge_slave_0) entered forwarding state [ 53.987410][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 53.995892][ T344] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.003113][ T344] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.015080][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 54.024391][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 54.037948][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 54.049962][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 54.058018][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 54.066049][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 54.074624][ T422] device veth0_vlan entered promiscuous mode [ 54.084775][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 54.094088][ T422] device veth1_macvtap entered promiscuous mode [ 54.103592][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 54.113496][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 54.142631][ T422] syz-executor (422) used greatest stack depth: 21728 bytes left [ 54.244916][ T30] audit: type=1401 audit(1748162908.011:106): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" 2025/05/25 08:48:28 executed programs: 0 [ 54.421212][ T30] audit: type=1400 audit(1748162908.191:107): avc: denied { write } for pid=374 comm="syz-execprog" path="pipe:[15935]" dev="pipefs" ino=15935 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 54.475457][ T441] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.482671][ T441] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.490491][ T441] device bridge_slave_0 entered promiscuous mode [ 54.497475][ T441] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.504589][ T441] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.512158][ T441] device bridge_slave_1 entered promiscuous mode [ 54.564865][ T441] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.571960][ T441] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.579297][ T441] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.586456][ T441] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.614385][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 54.623522][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.631478][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.650162][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 54.658933][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.666199][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.674180][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 54.682735][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.689999][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.697941][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 54.707686][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 54.726110][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 54.737753][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 54.746020][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 54.753699][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 54.762464][ T441] device veth0_vlan entered promiscuous mode [ 54.774357][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 54.783902][ T441] device veth1_macvtap entered promiscuous mode [ 54.794793][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 54.809789][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 54.824142][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 54.957893][ T447] loop2: detected capacity change from 0 to 40427 [ 55.008272][ T447] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 55.016101][ T447] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 55.027707][ T447] F2FS-fs (loop2): Found nat_bits in checkpoint [ 55.058847][ T447] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 55.066046][ T447] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 55.073896][ T30] audit: type=1400 audit(1748162908.841:108): avc: denied { mount } for pid=446 comm="syz.2.16" name="/" dev="loop2" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 55.097482][ T30] audit: type=1400 audit(1748162908.861:109): avc: denied { write } for pid=446 comm="syz.2.16" name="/" dev="loop2" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 55.119201][ T30] audit: type=1400 audit(1748162908.861:110): avc: denied { add_name } for pid=446 comm="syz.2.16" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 55.140278][ T30] audit: type=1400 audit(1748162908.861:111): avc: denied { create } for pid=446 comm="syz.2.16" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 55.159149][ T441] ------------[ cut here ]------------ [ 55.160610][ T30] audit: type=1400 audit(1748162908.871:112): avc: denied { read open } for pid=446 comm="syz.2.16" path="/0/file0/bus" dev="loop2" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 55.165555][ T441] WARNING: CPU: 0 PID: 441 at fs/f2fs/inode.c:880 f2fs_evict_inode+0x12b0/0x1560 [ 55.188479][ T30] audit: type=1400 audit(1748162908.871:113): avc: denied { ioctl } for pid=446 comm="syz.2.16" path="/0/file0/bus" dev="loop2" ino=10 ioctlcmd=0xf501 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 55.199483][ T441] Modules linked in: [ 55.226017][ T441] CPU: 0 PID: 441 Comm: syz-executor Not tainted 5.15.184-syzkaller-1080569-g4b77ae0e7f58 #0 [ 55.236330][ T441] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 55.246469][ T441] RIP: 0010:f2fs_evict_inode+0x12b0/0x1560 [ 55.252408][ T441] Code: e9 55 f2 ff ff e8 10 3f 61 ff eb 05 e8 09 3f 61 ff 4c 8b 74 24 28 48 8b 7c 24 18 e8 ba ef 02 00 e9 bc fc ff ff e8 f0 3e 61 ff <0f> 0b 4c 89 f7 be 08 00 00 00 e8 71 b2 9f ff f0 41 80 0e 04 e9 99 [ 55.272146][ T441] RSP: 0018:ffffc90000a878c0 EFLAGS: 00010293 [ 55.278358][ T441] RAX: ffffffff820765f0 RBX: 1ffff92000150f2c RCX: ffff888116573b40 [ 55.286546][ T441] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000 [ 55.295427][ T441] RBP: ffffc90000a87a30 R08: dffffc0000000000 R09: ffffed1025c30125 [ 55.303648][ T441] R10: ffffed1025c30125 R11: 1ffff11025c30124 R12: ffff88812e180920 [ 55.311748][ T441] R13: dffffc0000000000 R14: ffff888117d56078 R15: 0000000000000002 [ 55.319793][ T441] FS: 0000555566f27500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 55.329071][ T441] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 55.335728][ T441] CR2: 0000001b2f45ffff CR3: 000000012bd00000 CR4: 00000000003506a0 [ 55.344176][ T441] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 55.352227][ T441] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 55.360341][ T441] Call Trace: [ 55.363641][ T441] [ 55.366563][ T441] ? inode_wait_for_writeback+0x1b0/0x200 [ 55.372398][ T441] ? f2fs_write_inode+0x850/0x850 [ 55.377456][ T441] ? bit_waitqueue+0x30/0x30 [ 55.382139][ T441] ? locks_free_lock_context+0x42/0x70 [ 55.387881][ T441] ? f2fs_write_inode+0x850/0x850 [ 55.393432][ T441] evict+0x485/0x870 [ 55.397352][ T441] ? proc_nr_inodes+0x310/0x310 [ 55.402565][ T441] ? _raw_spin_lock+0x8e/0xe0 [ 55.407267][ T441] ? _raw_spin_unlock+0x4d/0x70 [ 55.412311][ T441] evict_inodes+0x5de/0x650 [ 55.416838][ T441] ? clear_inode+0x150/0x150 [ 55.421615][ T441] generic_shutdown_super+0x96/0x330 [ 55.427021][ T441] kill_block_super+0x7f/0xf0 [ 55.431790][ T441] kill_f2fs_super+0x2e7/0x390 [ 55.436588][ T441] ? radix_tree_delete_item+0x2c8/0x410 [ 55.442331][ T441] ? f2fs_mount+0x40/0x40 [ 55.446840][ T441] ? unregister_shrinker+0x201/0x290 [ 55.452370][ T441] deactivate_locked_super+0xa0/0x100 [ 55.457773][ T441] deactivate_super+0xaf/0xe0 [ 55.462698][ T441] cleanup_mnt+0x446/0x500 [ 55.467357][ T441] __cleanup_mnt+0x19/0x20 [ 55.471974][ T441] task_work_run+0x127/0x190 [ 55.476588][ T441] exit_to_user_mode_loop+0xd0/0xe0 [ 55.482066][ T441] exit_to_user_mode_prepare+0x5a/0xa0 [ 55.487563][ T441] syscall_exit_to_user_mode+0x1a/0x30 [ 55.493526][ T441] do_syscall_64+0x58/0xa0 [ 55.497998][ T441] ? clear_bhb_loop+0x50/0xa0 [ 55.502803][ T441] ? clear_bhb_loop+0x50/0xa0 [ 55.507511][ T441] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 55.513488][ T441] RIP: 0033:0x7fcbd219e497 [ 55.517959][ T441] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 55.537815][ T441] RSP: 002b:00007ffc84be81c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 55.546577][ T441] RAX: 0000000000000000 RBX: 00007fcbd221f854 RCX: 00007fcbd219e497 [ 55.554661][ T441] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc84be8280 [ 55.562756][ T441] RBP: 00007ffc84be8280 R08: 0000000000000000 R09: 0000000000000000 [ 55.570919][ T441] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffc84be9310 [ 55.579052][ T441] R13: 00007fcbd221f854 R14: 000000000000d73c R15: 00007ffc84be9350 [ 55.587356][ T441] [ 55.590602][ T441] ---[ end trace 7ad9dcacf91b48b3 ]--- [ 55.638417][ T441] ================================================================== [ 55.646632][ T441] BUG: KASAN: use-after-free in _raw_spin_lock+0x81/0xe0 [ 55.653795][ T441] Write of size 4 at addr ffff88812e180698 by task syz-executor/441 [ 55.661911][ T441] [ 55.664241][ T441] CPU: 1 PID: 441 Comm: syz-executor Tainted: G W 5.15.184-syzkaller-1080569-g4b77ae0e7f58 #0 [ 55.675992][ T441] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 55.686070][ T441] Call Trace: [ 55.689439][ T441] [ 55.692360][ T441] __dump_stack+0x21/0x30 [ 55.696706][ T441] dump_stack_lvl+0xee/0x150 [ 55.701290][ T441] ? show_regs_print_info+0x20/0x20 [ 55.706501][ T441] ? load_image+0x3a0/0x3a0 [ 55.711010][ T441] ? finish_task_switch+0x209/0x780 [ 55.716209][ T441] ? __switch_to_asm+0x3a/0x60 [ 55.721079][ T441] print_address_description+0x7f/0x2c0 [ 55.726625][ T441] ? _raw_spin_lock+0x81/0xe0 [ 55.731427][ T441] kasan_report+0xf1/0x140 [ 55.735851][ T441] ? _raw_spin_lock_irqsave+0xb0/0x110 [ 55.741373][ T441] ? _raw_spin_lock+0x81/0xe0 [ 55.746147][ T441] kasan_check_range+0x280/0x290 [ 55.751077][ T441] __kasan_check_write+0x14/0x20 [ 55.756007][ T441] _raw_spin_lock+0x81/0xe0 [ 55.760500][ T441] ? _raw_spin_trylock_bh+0x130/0x130 [ 55.765960][ T441] ? __kasan_check_write+0x14/0x20 [ 55.771082][ T441] ? _raw_spin_lock+0x8e/0xe0 [ 55.775756][ T441] ? _raw_spin_trylock_bh+0x130/0x130 [ 55.781120][ T441] igrab+0x20/0xa0 [ 55.784842][ T441] f2fs_sync_inode_meta+0x153/0x2a0 [ 55.790117][ T441] f2fs_write_checkpoint+0xa7d/0x1f00 [ 55.795485][ T441] ? f2fs_get_sectors_written+0x4e0/0x4e0 [ 55.801192][ T441] ? rwsem_write_trylock+0x130/0x300 [ 55.806489][ T441] ? __kasan_check_read+0x11/0x20 [ 55.811518][ T441] ? wb_wait_for_completion+0x1d8/0x270 [ 55.817100][ T441] f2fs_issue_checkpoint+0x2e5/0x470 [ 55.822465][ T441] ? f2fs_destroy_checkpoint_caches+0x30/0x30 [ 55.828531][ T441] ? try_to_writeback_inodes_sb+0xc0/0xc0 [ 55.834348][ T441] f2fs_sync_fs+0x16f/0x2c0 [ 55.838855][ T441] sync_filesystem+0x1cb/0x240 [ 55.843743][ T441] f2fs_quota_off_umount+0x217/0x230 [ 55.849224][ T441] f2fs_put_super+0xb7/0xc00 [ 55.853828][ T441] ? fsnotify_destroy_marks+0x14f/0x400 [ 55.859472][ T441] ? fsnotify_sb_delete+0x471/0x4e0 [ 55.864671][ T441] ? f2fs_drop_inode+0x980/0x980 [ 55.869607][ T441] ? __fsnotify_vfsmount_delete+0x20/0x20 [ 55.875323][ T441] ? clear_inode+0x150/0x150 [ 55.880065][ T441] ? fscrypt_destroy_keyring+0x27f/0x290 [ 55.885694][ T441] ? f2fs_drop_inode+0x980/0x980 [ 55.890712][ T441] generic_shutdown_super+0x151/0x330 [ 55.896093][ T441] kill_block_super+0x7f/0xf0 [ 55.900864][ T441] kill_f2fs_super+0x2e7/0x390 [ 55.905887][ T441] ? radix_tree_delete_item+0x2c8/0x410 [ 55.911515][ T441] ? f2fs_mount+0x40/0x40 [ 55.915844][ T441] ? unregister_shrinker+0x201/0x290 [ 55.921123][ T441] deactivate_locked_super+0xa0/0x100 [ 55.926490][ T441] deactivate_super+0xaf/0xe0 [ 55.931161][ T441] cleanup_mnt+0x446/0x500 [ 55.935574][ T441] __cleanup_mnt+0x19/0x20 [ 55.939989][ T441] task_work_run+0x127/0x190 [ 55.944571][ T441] exit_to_user_mode_loop+0xd0/0xe0 [ 55.949860][ T441] exit_to_user_mode_prepare+0x5a/0xa0 [ 55.955340][ T441] syscall_exit_to_user_mode+0x1a/0x30 [ 55.960792][ T441] do_syscall_64+0x58/0xa0 [ 55.965315][ T441] ? clear_bhb_loop+0x50/0xa0 [ 55.970139][ T441] ? clear_bhb_loop+0x50/0xa0 [ 55.974824][ T441] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 55.980727][ T441] RIP: 0033:0x7fcbd219e497 [ 55.985225][ T441] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 56.004913][ T441] RSP: 002b:00007ffc84be81c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 56.013320][ T441] RAX: 0000000000000000 RBX: 00007fcbd221f854 RCX: 00007fcbd219e497 [ 56.021285][ T441] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc84be8280 [ 56.029259][ T441] RBP: 00007ffc84be8280 R08: 0000000000000000 R09: 0000000000000000 [ 56.037396][ T441] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffc84be9310 [ 56.045369][ T441] R13: 00007fcbd221f854 R14: 000000000000d73c R15: 00007ffc84be9350 [ 56.053714][ T441] [ 56.056727][ T441] [ 56.059044][ T441] Allocated by task 447: [ 56.063284][ T441] __kasan_slab_alloc+0xbd/0xf0 [ 56.068131][ T441] slab_post_alloc_hook+0x4f/0x2b0 [ 56.073242][ T441] kmem_cache_alloc+0xf7/0x260 [ 56.078100][ T441] f2fs_alloc_inode+0x26/0x330 [ 56.082949][ T441] new_inode_pseudo+0x62/0x210 [ 56.087710][ T441] new_inode+0x28/0x1e0 [ 56.091855][ T441] f2fs_new_inode+0xd2/0x12b0 [ 56.096521][ T441] f2fs_create+0x178/0x15f0 [ 56.101066][ T441] path_openat+0x11ae/0x2f10 [ 56.105649][ T441] do_filp_open+0x1b3/0x3e0 [ 56.110146][ T441] do_sys_openat2+0x14c/0x7b0 [ 56.114829][ T441] __x64_sys_openat+0x136/0x160 [ 56.119680][ T441] x64_sys_call+0x219/0x9a0 [ 56.124176][ T441] do_syscall_64+0x4c/0xa0 [ 56.128596][ T441] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 56.134571][ T441] [ 56.136885][ T441] Freed by task 0: [ 56.140589][ T441] kasan_set_track+0x4a/0x70 [ 56.145176][ T441] kasan_set_free_info+0x23/0x40 [ 56.150101][ T441] ____kasan_slab_free+0x125/0x160 [ 56.155237][ T441] __kasan_slab_free+0x11/0x20 [ 56.159996][ T441] slab_free_freelist_hook+0xc2/0x190 [ 56.165369][ T441] kmem_cache_free+0x100/0x320 [ 56.170126][ T441] f2fs_free_inode+0x24/0x30 [ 56.174710][ T441] i_callback+0x4c/0x70 [ 56.178945][ T441] rcu_do_batch+0x51d/0xba0 [ 56.183540][ T441] rcu_core+0x5e4/0xf80 [ 56.187687][ T441] rcu_core_si+0x9/0x10 [ 56.191884][ T441] handle_softirqs+0x250/0x560 [ 56.196639][ T441] __irq_exit_rcu+0x52/0xf0 [ 56.201132][ T441] irq_exit_rcu+0x9/0x10 [ 56.205380][ T441] sysvec_call_function_single+0xa6/0xc0 [ 56.211003][ T441] asm_sysvec_call_function_single+0x1b/0x20 [ 56.216975][ T441] [ 56.219287][ T441] Last potentially related work creation: [ 56.225083][ T441] kasan_save_stack+0x3a/0x60 [ 56.229847][ T441] __kasan_record_aux_stack+0xd2/0x100 [ 56.235316][ T441] kasan_record_aux_stack_noalloc+0xb/0x10 [ 56.241388][ T441] call_rcu+0xf6/0xf60 [ 56.245448][ T441] evict+0x7da/0x870 [ 56.249340][ T441] evict_inodes+0x5de/0x650 [ 56.253841][ T441] generic_shutdown_super+0x96/0x330 [ 56.259119][ T441] kill_block_super+0x7f/0xf0 [ 56.263875][ T441] kill_f2fs_super+0x2e7/0x390 [ 56.268634][ T441] deactivate_locked_super+0xa0/0x100 [ 56.274189][ T441] deactivate_super+0xaf/0xe0 [ 56.278857][ T441] cleanup_mnt+0x446/0x500 [ 56.283359][ T441] __cleanup_mnt+0x19/0x20 [ 56.287766][ T441] task_work_run+0x127/0x190 [ 56.292349][ T441] exit_to_user_mode_loop+0xd0/0xe0 [ 56.297542][ T441] exit_to_user_mode_prepare+0x5a/0xa0 [ 56.303178][ T441] syscall_exit_to_user_mode+0x1a/0x30 [ 56.308716][ T441] do_syscall_64+0x58/0xa0 [ 56.313127][ T441] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 56.319031][ T441] [ 56.321345][ T441] The buggy address belongs to the object at ffff88812e180610 [ 56.321345][ T441] which belongs to the cache f2fs_inode_cache of size 1424 [ 56.335908][ T441] The buggy address is located 136 bytes inside of [ 56.335908][ T441] 1424-byte region [ffff88812e180610, ffff88812e180ba0) [ 56.349261][ T441] The buggy address belongs to the page: [ 56.355045][ T441] page:ffffea0004b86000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12e180 [ 56.365276][ T441] head:ffffea0004b86000 order:3 compound_mapcount:0 compound_pincount:0 [ 56.373679][ T441] flags: 0x4000000000010200(slab|head|zone=1) [ 56.379851][ T441] raw: 4000000000010200 0000000000000000 dead000000000122 ffff8881003f1e00 [ 56.388515][ T441] raw: 0000000000000000 0000000080150015 00000001ffffffff 0000000000000000 [ 56.397102][ T441] page dumped because: kasan: bad access detected [ 56.403938][ T441] page_owner tracks the page as allocated [ 56.409639][ T441] page last allocated via order 3, migratetype Reclaimable, gfp_mask 0x1d2050(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 447, ts 55096595232, free_ts 0 [ 56.430126][ T441] post_alloc_hook+0x192/0x1b0 [ 56.434895][ T441] prep_new_page+0x1c/0x110 [ 56.439393][ T441] get_page_from_freelist+0x2cc5/0x2d50 [ 56.445030][ T441] __alloc_pages+0x18f/0x440 [ 56.449644][ T441] new_slab+0xa1/0x4d0 [ 56.453707][ T441] ___slab_alloc+0x381/0x810 [ 56.458576][ T441] __slab_alloc+0x49/0x90 [ 56.462896][ T441] kmem_cache_alloc+0x138/0x260 [ 56.467742][ T441] f2fs_alloc_inode+0x26/0x330 [ 56.472500][ T441] new_inode_pseudo+0x62/0x210 [ 56.477366][ T441] new_inode+0x28/0x1e0 [ 56.481511][ T441] f2fs_new_inode+0xd2/0x12b0 [ 56.486286][ T441] f2fs_create+0x178/0x15f0 [ 56.490782][ T441] path_openat+0x11ae/0x2f10 [ 56.495458][ T441] do_filp_open+0x1b3/0x3e0 [ 56.500396][ T441] do_sys_openat2+0x14c/0x7b0 [ 56.505066][ T441] page_owner free stack trace missing [ 56.510449][ T441] [ 56.512763][ T441] Memory state around the buggy address: [ 56.518493][ T441] ffff88812e180580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 56.526717][ T441] ffff88812e180600: fc fc fa fb fb fb fb fb fb fb fb fb fb fb fb fb [ 56.534772][ T441] >ffff88812e180680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 56.542830][ T441] ^ [ 56.547679][ T441] ffff88812e180700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 56.555830][ T441] ffff88812e180780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 56.563884][ T441] ================================================================== [ 56.571937][ T441] Disabling lock debugging due to kernel taint [ 56.729347][ T45] device bridge_slave_1 left promiscuous mode [ 56.735486][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 56.743374][ T45] device bridge_slave_0 left promiscuous mode [ 56.749686][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 56.757852][ T45] device veth1_macvtap left promiscuous mode [ 56.764132][ T45] device veth0_vlan left promiscuous mode