Warning: Permanently added '[localhost]:46412' (ED25519) to the list of known hosts. 2025/12/06 04:52:33 parsed 1 programs syzkaller login: [ 88.692621][ T5324] cgroup: Unknown subsys name 'net' [ 88.765178][ T5324] cgroup: Unknown subsys name 'cpuset' [ 88.771345][ T5324] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 90.355652][ T5324] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 91.873149][ T10] cfg80211: failed to load regulatory.db [ 95.348959][ T5343] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 99.226463][ T5387] chnl_net:caif_netlink_parms(): no params data found [ 99.299214][ T5387] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.305828][ T5387] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.308956][ T5387] bridge_slave_0: entered allmulticast mode [ 99.313939][ T5387] bridge_slave_0: entered promiscuous mode [ 99.319664][ T5387] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.322702][ T5387] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.325472][ T5387] bridge_slave_1: entered allmulticast mode [ 99.329375][ T5387] bridge_slave_1: entered promiscuous mode [ 99.355716][ T5387] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.362460][ T5387] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 99.389919][ T5387] team0: Port device team_slave_0 added [ 99.394533][ T5387] team0: Port device team_slave_1 added [ 99.416650][ T5387] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 99.419660][ T5387] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.431584][ T5387] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 99.438257][ T5387] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 99.441597][ T5387] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.452210][ T5387] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 99.493894][ T5387] hsr_slave_0: entered promiscuous mode [ 99.497318][ T5387] hsr_slave_1: entered promiscuous mode [ 99.658965][ T5387] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 99.668964][ T5387] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 99.675485][ T5387] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 99.682574][ T5387] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 99.714434][ T5387] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.717574][ T5387] bridge0: port 2(bridge_slave_1) entered forwarding state [ 99.721191][ T5387] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.724338][ T5387] bridge0: port 1(bridge_slave_0) entered forwarding state [ 99.783905][ T5387] 8021q: adding VLAN 0 to HW filter on device bond0 [ 99.797033][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.802239][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.813323][ T5387] 8021q: adding VLAN 0 to HW filter on device team0 [ 99.824437][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.827514][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 99.862521][ T4588] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.865623][ T4588] bridge0: port 2(bridge_slave_1) entered forwarding state [ 99.926084][ T5387] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 100.168658][ T5387] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.252870][ T5387] veth0_vlan: entered promiscuous mode [ 100.269225][ T5387] veth1_vlan: entered promiscuous mode [ 100.323876][ T5387] veth0_macvtap: entered promiscuous mode [ 100.329765][ T5387] veth1_macvtap: entered promiscuous mode [ 100.367121][ T5387] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 100.383480][ T5387] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 100.402919][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.432679][ T43] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.436340][ T43] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.440033][ T43] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.699819][ T5411] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 100.703946][ T4681] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 100.709562][ T43] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.714868][ T4681] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 100.718383][ T4681] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 100.722128][ T4681] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 100.820872][ T43] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.914267][ T43] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 101.082335][ T43] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 101.291918][ T3308] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.295298][ T3308] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.358976][ T3308] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.363006][ T3308] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2025/12/06 04:52:49 executed programs: 0 [ 102.839587][ T46] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 102.843917][ T46] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 102.847682][ T46] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 102.852035][ T46] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 102.855422][ T46] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 103.110693][ T43] bridge_slave_1: left allmulticast mode [ 103.113149][ T43] bridge_slave_1: left promiscuous mode [ 103.116433][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.206464][ T43] bridge_slave_0: left allmulticast mode [ 103.208881][ T43] bridge_slave_0: left promiscuous mode [ 103.239365][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.882908][ T43] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 103.891906][ T43] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 103.902511][ T43] bond0 (unregistering): Released all slaves [ 104.025911][ T43] hsr_slave_0: left promiscuous mode [ 104.029276][ T43] hsr_slave_1: left promiscuous mode [ 104.041264][ T43] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 104.044499][ T43] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 104.070532][ T43] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 104.073704][ T43] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 104.103651][ T43] veth1_macvtap: left promiscuous mode [ 104.131521][ T43] veth0_macvtap: left promiscuous mode [ 104.133976][ T43] veth1_vlan: left promiscuous mode [ 104.136276][ T43] veth0_vlan: left promiscuous mode [ 104.764580][ T43] team0 (unregistering): Port device team_slave_1 removed [ 104.787452][ T43] team0 (unregistering): Port device team_slave_0 removed [ 104.903644][ T46] Bluetooth: hci0: command tx timeout [ 105.178213][ T5437] chnl_net:caif_netlink_parms(): no params data found [ 105.393513][ T5437] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.402385][ T5437] bridge0: port 1(bridge_slave_0) entered disabled state [ 105.405619][ T5437] bridge_slave_0: entered allmulticast mode [ 105.419097][ T5437] bridge_slave_0: entered promiscuous mode [ 105.433242][ T5437] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.436428][ T5437] bridge0: port 2(bridge_slave_1) entered disabled state [ 105.456444][ T5437] bridge_slave_1: entered allmulticast mode [ 105.460285][ T5437] bridge_slave_1: entered promiscuous mode [ 105.667954][ T5437] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 105.697063][ T5437] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 105.854488][ T5437] team0: Port device team_slave_0 added [ 105.877177][ T5437] team0: Port device team_slave_1 added [ 105.996911][ T5437] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 105.999921][ T5437] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 106.043493][ T5437] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 106.059257][ T5437] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 106.073400][ T5437] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 106.102346][ T5437] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 106.232428][ T5437] hsr_slave_0: entered promiscuous mode [ 106.240110][ T5437] hsr_slave_1: entered promiscuous mode [ 106.865126][ T5437] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 106.884311][ T5437] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 106.910863][ T5437] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 106.923422][ T5437] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 106.981603][ T46] Bluetooth: hci0: command tx timeout [ 107.082593][ T5437] 8021q: adding VLAN 0 to HW filter on device bond0 [ 107.111093][ T5437] 8021q: adding VLAN 0 to HW filter on device team0 [ 107.120287][ T4588] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.123518][ T4588] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.147645][ T4588] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.150859][ T4588] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.483579][ T5437] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.555525][ T5437] veth0_vlan: entered promiscuous mode [ 107.573729][ T5437] veth1_vlan: entered promiscuous mode [ 107.624663][ T5437] veth0_macvtap: entered promiscuous mode [ 107.645889][ T5437] veth1_macvtap: entered promiscuous mode [ 107.672239][ T5437] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 107.698202][ T5437] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 107.716455][ T3308] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.729075][ T43] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.741215][ T3308] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.745062][ T3308] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.824806][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.827842][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.877917][ T3308] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.882249][ T3308] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2025/12/06 04:52:54 executed programs: 2 [ 107.998912][ T5505] loop0: detected capacity change from 0 to 512 [ 108.075816][ T5505] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 108.113278][ T5505] ext4 filesystem being mounted at /0/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 108.129025][ T26] audit: type=1800 audit(1764996774.725:2): pid=5505 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.17" name="file1" dev="loop0" ino=15 res=0 errno=0 [ 108.142872][ T5505] FAULT_INJECTION: forcing a failure. [ 108.142872][ T5505] name failslab, interval 1, probability 0, space 0, times 1 [ 108.148032][ T5505] CPU: 0 UID: 0 PID: 5505 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 108.148044][ T5505] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 108.148048][ T5505] Call Trace: [ 108.148055][ T5505] [ 108.148060][ T5505] dump_stack_lvl+0x189/0x250 [ 108.148196][ T5505] ? __pfx____ratelimit+0x10/0x10 [ 108.148235][ T5505] ? __pfx_dump_stack_lvl+0x10/0x10 [ 108.148242][ T5505] ? __pfx__printk+0x10/0x10 [ 108.148253][ T5505] ? __pfx___might_resched+0x10/0x10 [ 108.148261][ T5505] ? fs_reclaim_acquire+0x7d/0x100 [ 108.148300][ T5505] should_fail_ex+0x414/0x560 [ 108.148318][ T5505] should_failslab+0xa8/0x100 [ 108.148334][ T5505] __kmalloc_noprof+0xcb/0x800 [ 108.148346][ T5505] ? ext4_find_extent+0x207/0xcc0 [ 108.148362][ T5505] ext4_find_extent+0x207/0xcc0 [ 108.148371][ T5505] ? ext4_es_remove_extent+0x297/0x450 [ 108.148382][ T5505] ext4_swap_extents+0x1f5/0x19a0 [ 108.148391][ T5505] ? kmem_cache_free+0x197/0x620 [ 108.148401][ T5505] ? down_write_nested+0x169/0x200 [ 108.148410][ T5505] ? __pfx_down_write_nested+0x10/0x10 [ 108.148421][ T5505] ? folio_mapping+0x16f/0x1f0 [ 108.148432][ T5505] ? filemap_release_folio+0x234/0x2d0 [ 108.148449][ T5505] ext4_move_extents+0x2a81/0x3830 [ 108.148462][ T5505] ? __lock_acquire+0x6b6/0x2cf0 [ 108.148496][ T5505] ? __pfx_ext4_move_extents+0x10/0x10 [ 108.148514][ T5505] ? rcu_read_lock_any_held+0xb3/0x120 [ 108.148533][ T5505] ? sb_start_write+0x114/0x1c0 [ 108.148544][ T5505] ? mnt_want_write_file+0x164/0x200 [ 108.148555][ T5505] ext4_ioctl+0x2cf9/0x4760 [ 108.148572][ T5505] ? __pfx_ext4_ioctl+0x10/0x10 [ 108.148583][ T5505] ? is_bpf_text_address+0x26/0x2b0 [ 108.148601][ T5505] ? is_bpf_text_address+0x292/0x2b0 [ 108.148613][ T5505] ? is_bpf_text_address+0x26/0x2b0 [ 108.148629][ T5505] ? kernel_text_address+0xa5/0xe0 [ 108.148644][ T5505] ? __kernel_text_address+0xd/0x40 [ 108.148657][ T5505] ? unwind_get_return_address+0x4d/0x90 [ 108.148667][ T5505] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 108.148674][ T5505] ? arch_stack_walk+0xfc/0x150 [ 108.148686][ T5505] ? stack_trace_save+0x9c/0xe0 [ 108.148693][ T5505] ? stack_depot_save_flags+0x40/0x850 [ 108.148701][ T5505] ? format_decode+0xd0/0xe10 [ 108.148711][ T5505] ? kasan_save_track+0x4f/0x80 [ 108.148718][ T5505] ? kasan_save_track+0x3e/0x80 [ 108.148725][ T5505] ? __kasan_save_free_info+0x46/0x50 [ 108.148731][ T5505] ? __kasan_slab_free+0x5c/0x80 [ 108.148738][ T5505] ? kfree+0x1c0/0x660 [ 108.148743][ T5505] ? tomoyo_path_number_perm+0x47a/0x5a0 [ 108.148752][ T5505] ? security_file_ioctl+0xcb/0x2d0 [ 108.148765][ T5505] ? __se_sys_ioctl+0x47/0x170 [ 108.148772][ T5505] ? do_syscall_64+0xfa/0xf80 [ 108.148777][ T5505] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.148790][ T5505] ? file_ioctl+0x22d/0x780 [ 108.148799][ T5505] ? __pfx_file_ioctl+0x10/0x10 [ 108.148812][ T5505] ? kasan_quarantine_put+0xdd/0x220 [ 108.148820][ T5505] ? lockdep_hardirqs_on+0x98/0x140 [ 108.148858][ T5505] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 108.148869][ T5505] ? do_vfs_ioctl+0xb33/0x1430 [ 108.148875][ T5505] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 108.148885][ T5505] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 108.148898][ T5505] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 108.148925][ T5505] ? __fget_files+0x2a/0x420 [ 108.148938][ T5505] ? __fget_files+0x3a0/0x420 [ 108.148947][ T5505] ? __fget_files+0x2a/0x420 [ 108.148957][ T5505] ? bpf_lsm_file_ioctl+0x9/0x20 [ 108.148966][ T5505] ? __pfx_ext4_ioctl+0x10/0x10 [ 108.148975][ T5505] __se_sys_ioctl+0xfc/0x170 [ 108.148987][ T5505] do_syscall_64+0xfa/0xf80 [ 108.148996][ T5505] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.149005][ T5505] ? clear_bhb_loop+0x60/0xb0 [ 108.149018][ T5505] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.149026][ T5505] RIP: 0033:0x7fed9c38f7c9 [ 108.149035][ T5505] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 108.149040][ T5505] RSP: 002b:00007fed9d1f9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 108.149049][ T5505] RAX: ffffffffffffffda RBX: 00007fed9c5e5fa0 RCX: 00007fed9c38f7c9 [ 108.149053][ T5505] RDX: 0000200000000080 RSI: 00000000c028660f RDI: 0000000000000005 [ 108.149058][ T5505] RBP: 00007fed9d1f9090 R08: 0000000000000000 R09: 0000000000000000 [ 108.149062][ T5505] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 108.149065][ T5505] R13: 00007fed9c5e6038 R14: 00007fed9c5e5fa0 R15: 00007fffbb119b38 [ 108.149077][ T5505] [ 108.149522][ T26] audit: type=1800 audit(1764996774.735:3): pid=5505 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.17" name="file2" dev="loop0" ino=16 res=0 errno=0 [ 108.382943][ T5437] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 108.482055][ T5510] loop0: detected capacity change from 0 to 512 [ 108.529091][ T5510] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 108.534214][ T5510] ext4 filesystem being mounted at /1/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 108.543518][ T26] audit: type=1800 audit(1764996775.145:4): pid=5510 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.18" name="file1" dev="loop0" ino=15 res=0 errno=0 [ 108.557403][ T26] audit: type=1800 audit(1764996775.155:5): pid=5510 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.18" name="file2" dev="loop0" ino=16 res=0 errno=0 [ 108.572069][ T5437] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 108.666722][ T5514] loop0: detected capacity change from 0 to 512 [ 108.718245][ T5514] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 108.741162][ T5514] ext4 filesystem being mounted at /2/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 108.754300][ T26] audit: type=1800 audit(1764996775.355:6): pid=5514 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.19" name="file1" dev="loop0" ino=15 res=0 errno=0 [ 108.764458][ T5514] FAULT_INJECTION: forcing a failure. [ 108.764458][ T5514] name failslab, interval 1, probability 0, space 0, times 0 [ 108.770030][ T5514] CPU: 0 UID: 0 PID: 5514 Comm: syz.0.19 Not tainted syzkaller #0 PREEMPT(full) [ 108.770042][ T5514] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 108.770046][ T5514] Call Trace: [ 108.770050][ T5514] [ 108.770055][ T5514] dump_stack_lvl+0x189/0x250 [ 108.770069][ T5514] ? __pfx____ratelimit+0x10/0x10 [ 108.770081][ T5514] ? __pfx_dump_stack_lvl+0x10/0x10 [ 108.770092][ T5514] ? __pfx__printk+0x10/0x10 [ 108.770104][ T5514] ? lockdep_hardirqs_on+0x98/0x140 [ 108.770123][ T5514] ? kmem_cache_free+0x197/0x620 [ 108.770139][ T5514] should_fail_ex+0x414/0x560 [ 108.770155][ T5514] should_failslab+0xa8/0x100 [ 108.770170][ T5514] kmem_cache_alloc_noprof+0x74/0x6f0 [ 108.770181][ T5514] ? __es_insert_extent+0x707/0x1790 [ 108.770197][ T5514] __es_insert_extent+0x707/0x1790 [ 108.770223][ T5514] ext4_es_insert_extent+0x582/0x2ec0 [ 108.770249][ T5514] ? __pfx_ext4_es_insert_extent+0x10/0x10 [ 108.770271][ T5514] ext4_map_query_blocks+0x2ac/0x9f0 [ 108.770291][ T5514] ? __pfx_ext4_map_query_blocks+0x10/0x10 [ 108.770320][ T5514] ? rcu_is_watching+0x15/0xb0 [ 108.770338][ T5514] ? down_read+0x274/0x2e0 [ 108.770348][ T5514] ? ext4_map_blocks+0x32d/0x16f0 [ 108.770362][ T5514] ext4_map_blocks+0x4b8/0x16f0 [ 108.770374][ T5514] ? percpu_ref_get_many+0x19/0x140 [ 108.770397][ T5514] ? __pfx_ext4_map_blocks+0x10/0x10 [ 108.770412][ T5514] ? rcu_is_watching+0x15/0xb0 [ 108.770435][ T5514] _ext4_get_block+0x1fa/0x4c0 [ 108.770451][ T5514] ? __pfx__ext4_get_block+0x10/0x10 [ 108.770466][ T5514] ? _raw_spin_unlock+0x28/0x50 [ 108.770477][ T5514] ? create_empty_buffers+0x465/0x530 [ 108.770488][ T5514] mext_folio_mkwrite+0x188/0x290 [ 108.770508][ T5514] ext4_move_extents+0x2b9a/0x3830 [ 108.770519][ T5514] ? __lock_acquire+0x6b6/0x2cf0 [ 108.770552][ T5514] ? __pfx_ext4_move_extents+0x10/0x10 [ 108.770568][ T5514] ? rcu_read_lock_any_held+0xb3/0x120 [ 108.770590][ T5514] ? sb_start_write+0x114/0x1c0 [ 108.770602][ T5514] ? mnt_want_write_file+0x164/0x200 [ 108.770614][ T5514] ext4_ioctl+0x2cf9/0x4760 [ 108.770631][ T5514] ? __pfx_ext4_ioctl+0x10/0x10 [ 108.770643][ T5514] ? is_bpf_text_address+0x26/0x2b0 [ 108.770661][ T5514] ? is_bpf_text_address+0x292/0x2b0 [ 108.770674][ T5514] ? is_bpf_text_address+0x26/0x2b0 [ 108.770688][ T5514] ? kernel_text_address+0xa5/0xe0 [ 108.770703][ T5514] ? __kernel_text_address+0xd/0x40 [ 108.770715][ T5514] ? unwind_get_return_address+0x4d/0x90 [ 108.770726][ T5514] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 108.770736][ T5514] ? arch_stack_walk+0xfc/0x150 [ 108.770755][ T5514] ? stack_trace_save+0x9c/0xe0 [ 108.770767][ T5514] ? stack_depot_save_flags+0x40/0x850 [ 108.770779][ T5514] ? format_decode+0xd0/0xe10 [ 108.770792][ T5514] ? kasan_save_track+0x4f/0x80 [ 108.770803][ T5514] ? kasan_save_track+0x3e/0x80 [ 108.770820][ T5514] ? __kasan_save_free_info+0x46/0x50 [ 108.770829][ T5514] ? __kasan_slab_free+0x5c/0x80 [ 108.770840][ T5514] ? kfree+0x1c0/0x660 [ 108.770849][ T5514] ? tomoyo_path_number_perm+0x47a/0x5a0 [ 108.770862][ T5514] ? security_file_ioctl+0xcb/0x2d0 [ 108.770874][ T5514] ? __se_sys_ioctl+0x47/0x170 [ 108.770882][ T5514] ? do_syscall_64+0xfa/0xf80 [ 108.770890][ T5514] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.770909][ T5514] ? file_ioctl+0x22d/0x780 [ 108.770922][ T5514] ? __pfx_file_ioctl+0x10/0x10 [ 108.770944][ T5514] ? kasan_quarantine_put+0xdd/0x220 [ 108.770956][ T5514] ? lockdep_hardirqs_on+0x98/0x140 [ 108.770973][ T5514] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 108.770990][ T5514] ? do_vfs_ioctl+0xb33/0x1430 [ 108.771000][ T5514] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 108.771014][ T5514] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 108.771035][ T5514] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 108.771057][ T5514] ? __fget_files+0x2a/0x420 [ 108.771072][ T5514] ? __fget_files+0x3a0/0x420 [ 108.771085][ T5514] ? __fget_files+0x2a/0x420 [ 108.771100][ T5514] ? bpf_lsm_file_ioctl+0x9/0x20 [ 108.771115][ T5514] ? __pfx_ext4_ioctl+0x10/0x10 [ 108.771127][ T5514] __se_sys_ioctl+0xfc/0x170 [ 108.771139][ T5514] do_syscall_64+0xfa/0xf80 [ 108.771149][ T5514] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.771158][ T5514] ? clear_bhb_loop+0x60/0xb0 [ 108.771170][ T5514] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.771180][ T5514] RIP: 0033:0x7fed9c38f7c9 [ 108.771192][ T5514] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 108.771201][ T5514] RSP: 002b:00007fed9d1f9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 108.771213][ T5514] RAX: ffffffffffffffda RBX: 00007fed9c5e5fa0 RCX: 00007fed9c38f7c9 [ 108.771220][ T5514] RDX: 0000200000000080 RSI: 00000000c028660f RDI: 0000000000000005 [ 108.771226][ T5514] RBP: 00007fed9d1f9090 R08: 0000000000000000 R09: 0000000000000000 [ 108.771232][ T5514] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 108.771238][ T5514] R13: 00007fed9c5e6038 R14: 00007fed9c5e5fa0 R15: 00007fffbb119b38 [ 108.771254][ T5514] [ 108.985132][ T26] audit: type=1800 audit(1764996775.355:7): pid=5514 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.19" name="file2" dev="loop0" ino=16 res=0 errno=0 [ 109.014614][ T5437] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 109.061616][ T46] Bluetooth: hci0: command tx timeout [ 109.155726][ T5518] loop0: detected capacity change from 0 to 512 [ 109.229786][ T5518] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 109.253888][ T5518] ext4 filesystem being mounted at /3/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 109.274112][ T26] audit: type=1800 audit(1764996775.875:8): pid=5518 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.20" name="file1" dev="loop0" ino=15 res=0 errno=0 [ 109.291379][ T26] audit: type=1800 audit(1764996775.895:9): pid=5518 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.20" name="file2" dev="loop0" ino=16 res=0 errno=0 [ 109.301740][ T5518] FAULT_INJECTION: forcing a failure. [ 109.301740][ T5518] name failslab, interval 1, probability 0, space 0, times 0 [ 109.307038][ T5518] CPU: 0 UID: 0 PID: 5518 Comm: syz.0.20 Not tainted syzkaller #0 PREEMPT(full) [ 109.307055][ T5518] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 109.307061][ T5518] Call Trace: [ 109.307068][ T5518] [ 109.307074][ T5518] dump_stack_lvl+0x189/0x250 [ 109.307093][ T5518] ? __pfx____ratelimit+0x10/0x10 [ 109.307109][ T5518] ? __pfx_dump_stack_lvl+0x10/0x10 [ 109.307123][ T5518] ? __pfx__printk+0x10/0x10 [ 109.307136][ T5518] ? lockdep_hardirqs_on+0x98/0x140 [ 109.307159][ T5518] ? kmem_cache_free+0x197/0x620 [ 109.307177][ T5518] should_fail_ex+0x414/0x560 [ 109.307196][ T5518] should_failslab+0xa8/0x100 [ 109.307213][ T5518] kmem_cache_alloc_noprof+0x74/0x6f0 [ 109.307227][ T5518] ? __es_insert_extent+0x707/0x1790 [ 109.307247][ T5518] __es_insert_extent+0x707/0x1790 [ 109.307276][ T5518] ext4_es_insert_extent+0x582/0x2ec0 [ 109.307306][ T5518] ? __pfx_ext4_es_insert_extent+0x10/0x10 [ 109.307334][ T5518] ext4_map_query_blocks+0x2ac/0x9f0 [ 109.307357][ T5518] ? __pfx_ext4_map_query_blocks+0x10/0x10 [ 109.307371][ T5518] ? rcu_is_watching+0x15/0xb0 [ 109.307388][ T5518] ? down_read+0x274/0x2e0 [ 109.307398][ T5518] ? ext4_map_blocks+0x32d/0x16f0 [ 109.307414][ T5518] ext4_map_blocks+0x4b8/0x16f0 [ 109.307429][ T5518] ? percpu_ref_get_many+0x19/0x140 [ 109.307455][ T5518] ? __pfx_ext4_map_blocks+0x10/0x10 [ 109.307474][ T5518] ? rcu_is_watching+0x15/0xb0 [ 109.307499][ T5518] _ext4_get_block+0x1fa/0x4c0 [ 109.307517][ T5518] ? __pfx__ext4_get_block+0x10/0x10 [ 109.307535][ T5518] ? _raw_spin_unlock+0x28/0x50 [ 109.307549][ T5518] ? create_empty_buffers+0x465/0x530 [ 109.307567][ T5518] mext_folio_mkwrite+0x188/0x290 [ 109.307588][ T5518] ext4_move_extents+0x2b9a/0x3830 [ 109.307602][ T5518] ? __lock_acquire+0x6b6/0x2cf0 [ 109.307638][ T5518] ? __pfx_ext4_move_extents+0x10/0x10 [ 109.307657][ T5518] ? rcu_read_lock_any_held+0xb3/0x120 [ 109.307683][ T5518] ? sb_start_write+0x114/0x1c0 [ 109.307696][ T5518] ? mnt_want_write_file+0x164/0x200 [ 109.307711][ T5518] ext4_ioctl+0x2cf9/0x4760 [ 109.307745][ T5518] ? __pfx_ext4_ioctl+0x10/0x10 [ 109.307758][ T5518] ? is_bpf_text_address+0x26/0x2b0 [ 109.307778][ T5518] ? is_bpf_text_address+0x292/0x2b0 [ 109.307793][ T5518] ? is_bpf_text_address+0x26/0x2b0 [ 109.307816][ T5518] ? kernel_text_address+0xa5/0xe0 [ 109.307833][ T5518] ? __kernel_text_address+0xd/0x40 [ 109.307848][ T5518] ? unwind_get_return_address+0x4d/0x90 [ 109.307861][ T5518] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 109.307873][ T5518] ? arch_stack_walk+0xfc/0x150 [ 109.307894][ T5518] ? stack_trace_save+0x9c/0xe0 [ 109.307907][ T5518] ? stack_depot_save_flags+0x40/0x850 [ 109.307921][ T5518] ? format_decode+0xd0/0xe10 [ 109.307938][ T5518] ? kasan_save_track+0x4f/0x80 [ 109.307951][ T5518] ? kasan_save_track+0x3e/0x80 [ 109.307962][ T5518] ? __kasan_save_free_info+0x46/0x50 [ 109.307972][ T5518] ? __kasan_slab_free+0x5c/0x80 [ 109.307984][ T5518] ? kfree+0x1c0/0x660 [ 109.307994][ T5518] ? tomoyo_path_number_perm+0x47a/0x5a0 [ 109.308010][ T5518] ? security_file_ioctl+0xcb/0x2d0 [ 109.308023][ T5518] ? __se_sys_ioctl+0x47/0x170 [ 109.308034][ T5518] ? do_syscall_64+0xfa/0xf80 [ 109.308043][ T5518] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.308065][ T5518] ? file_ioctl+0x22d/0x780 [ 109.308080][ T5518] ? __pfx_file_ioctl+0x10/0x10 [ 109.308103][ T5518] ? kasan_quarantine_put+0xdd/0x220 [ 109.308116][ T5518] ? lockdep_hardirqs_on+0x98/0x140 [ 109.308163][ T5518] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 109.308181][ T5518] ? do_vfs_ioctl+0xb33/0x1430 [ 109.308193][ T5518] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 109.308209][ T5518] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 109.308233][ T5518] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 109.308258][ T5518] ? __fget_files+0x2a/0x420 [ 109.308278][ T5518] ? __fget_files+0x3a0/0x420 [ 109.308292][ T5518] ? __fget_files+0x2a/0x420 [ 109.308310][ T5518] ? bpf_lsm_file_ioctl+0x9/0x20 [ 109.308327][ T5518] ? __pfx_ext4_ioctl+0x10/0x10 [ 109.308341][ T5518] __se_sys_ioctl+0xfc/0x170 [ 109.308356][ T5518] do_syscall_64+0xfa/0xf80 [ 109.308368][ T5518] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.308378][ T5518] ? clear_bhb_loop+0x60/0xb0 [ 109.308392][ T5518] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.308403][ T5518] RIP: 0033:0x7fed9c38f7c9 [ 109.308416][ T5518] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 109.308425][ T5518] RSP: 002b:00007fed9d1f9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 109.308438][ T5518] RAX: ffffffffffffffda RBX: 00007fed9c5e5fa0 RCX: 00007fed9c38f7c9 [ 109.308446][ T5518] RDX: 0000200000000080 RSI: 00000000c028660f RDI: 0000000000000005 [ 109.308453][ T5518] RBP: 00007fed9d1f9090 R08: 0000000000000000 R09: 0000000000000000 [ 109.308459][ T5518] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 109.308465][ T5518] R13: 00007fed9c5e6038 R14: 00007fed9c5e5fa0 R15: 00007fffbb119b38 [ 109.308486][ T5518] [ 109.537470][ T5437] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 109.709279][ T5528] loop0: detected capacity change from 0 to 512 [ 109.759052][ T5528] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 109.788940][ T5528] ext4 filesystem being mounted at /7/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 109.796805][ T26] audit: type=1800 audit(1764996776.395:10): pid=5528 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.24" name="file1" dev="loop0" ino=15 res=0 errno=0 [ 109.806786][ T5528] FAULT_INJECTION: forcing a failure. [ 109.806786][ T5528] name failslab, interval 1, probability 0, space 0, times 0 [ 109.814424][ T5528] CPU: 0 UID: 0 PID: 5528 Comm: syz.0.24 Not tainted syzkaller #0 PREEMPT(full) [ 109.814440][ T5528] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 109.814447][ T5528] Call Trace: [ 109.814452][ T5528] [ 109.814457][ T5528] dump_stack_lvl+0x189/0x250 [ 109.814502][ T5528] ? __pfx____ratelimit+0x10/0x10 [ 109.814524][ T5528] ? __pfx_dump_stack_lvl+0x10/0x10 [ 109.814537][ T5528] ? __pfx__printk+0x10/0x10 [ 109.814554][ T5528] ? __pfx___might_resched+0x10/0x10 [ 109.814567][ T5528] ? fs_reclaim_acquire+0x7d/0x100 [ 109.814590][ T5528] should_fail_ex+0x414/0x560 [ 109.814608][ T5528] should_failslab+0xa8/0x100 [ 109.814624][ T5528] __kmalloc_noprof+0xcb/0x800 [ 109.814637][ T5528] ? ext4_find_extent+0x207/0xcc0 [ 109.814654][ T5528] ext4_find_extent+0x207/0xcc0 [ 109.814674][ T5528] ext4_ext_map_blocks+0x278/0x69c0 [ 109.814697][ T5528] ? is_bpf_text_address+0x26/0x2b0 [ 109.814717][ T5528] ? is_bpf_text_address+0x292/0x2b0 [ 109.814735][ T5528] ? kernel_text_address+0xa5/0xe0 [ 109.814756][ T5528] ? __pfx_ext4_ext_map_blocks+0x10/0x10 [ 109.814772][ T5528] ? __lock_acquire+0x6b6/0x2cf0 [ 109.814801][ T5528] ext4_map_query_blocks+0x135/0x9f0 [ 109.814823][ T5528] ? __pfx_ext4_map_query_blocks+0x10/0x10 [ 109.814839][ T5528] ? rcu_is_watching+0x15/0xb0 [ 109.814857][ T5528] ? down_read+0x274/0x2e0 [ 109.814872][ T5528] ? ext4_map_blocks+0x32d/0x16f0 [ 109.814889][ T5528] ext4_map_blocks+0x4b8/0x16f0 [ 109.814902][ T5528] ? percpu_ref_get_many+0x19/0x140 [ 109.814929][ T5528] ? __pfx_ext4_map_blocks+0x10/0x10 [ 109.814947][ T5528] ? rcu_is_watching+0x15/0xb0 [ 109.814972][ T5528] _ext4_get_block+0x1fa/0x4c0 [ 109.814994][ T5528] ? __pfx__ext4_get_block+0x10/0x10 [ 109.815011][ T5528] ? _raw_spin_unlock+0x28/0x50 [ 109.815024][ T5528] ? create_empty_buffers+0x465/0x530 [ 109.815042][ T5528] mext_folio_mkwrite+0x188/0x290 [ 109.815063][ T5528] ext4_move_extents+0x2b9a/0x3830 [ 109.815076][ T5528] ? __lock_acquire+0x6b6/0x2cf0 [ 109.815111][ T5528] ? __pfx_ext4_move_extents+0x10/0x10 [ 109.815130][ T5528] ? rcu_read_lock_any_held+0xb3/0x120 [ 109.815154][ T5528] ? sb_start_write+0x114/0x1c0 [ 109.815167][ T5528] ? mnt_want_write_file+0x164/0x200 [ 109.815181][ T5528] ext4_ioctl+0x2cf9/0x4760 [ 109.815200][ T5528] ? __pfx_ext4_ioctl+0x10/0x10 [ 109.815213][ T5528] ? is_bpf_text_address+0x26/0x2b0 [ 109.815230][ T5528] ? is_bpf_text_address+0x292/0x2b0 [ 109.815245][ T5528] ? is_bpf_text_address+0x26/0x2b0 [ 109.815262][ T5528] ? kernel_text_address+0xa5/0xe0 [ 109.815278][ T5528] ? __kernel_text_address+0xd/0x40 [ 109.815292][ T5528] ? unwind_get_return_address+0x4d/0x90 [ 109.815305][ T5528] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 109.815316][ T5528] ? arch_stack_walk+0xfc/0x150 [ 109.815337][ T5528] ? stack_trace_save+0x9c/0xe0 [ 109.815349][ T5528] ? stack_depot_save_flags+0x40/0x850 [ 109.815363][ T5528] ? format_decode+0xd0/0xe10 [ 109.815379][ T5528] ? kasan_save_track+0x4f/0x80 [ 109.815391][ T5528] ? kasan_save_track+0x3e/0x80 [ 109.815402][ T5528] ? __kasan_save_free_info+0x46/0x50 [ 109.815411][ T5528] ? __kasan_slab_free+0x5c/0x80 [ 109.815423][ T5528] ? kfree+0x1c0/0x660 [ 109.815432][ T5528] ? tomoyo_path_number_perm+0x47a/0x5a0 [ 109.815446][ T5528] ? security_file_ioctl+0xcb/0x2d0 [ 109.815460][ T5528] ? __se_sys_ioctl+0x47/0x170 [ 109.815470][ T5528] ? do_syscall_64+0xfa/0xf80 [ 109.815479][ T5528] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.815501][ T5528] ? file_ioctl+0x22d/0x780 [ 109.815515][ T5528] ? __pfx_file_ioctl+0x10/0x10 [ 109.815538][ T5528] ? kasan_quarantine_put+0xdd/0x220 [ 109.815550][ T5528] ? lockdep_hardirqs_on+0x98/0x140 [ 109.815572][ T5528] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 109.815589][ T5528] ? do_vfs_ioctl+0xb33/0x1430 [ 109.815601][ T5528] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 109.815640][ T5528] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 109.815664][ T5528] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 109.815689][ T5528] ? __fget_files+0x2a/0x420 [ 109.815708][ T5528] ? __fget_files+0x3a0/0x420 [ 109.815722][ T5528] ? __fget_files+0x2a/0x420 [ 109.815738][ T5528] ? bpf_lsm_file_ioctl+0x9/0x20 [ 109.815754][ T5528] ? __pfx_ext4_ioctl+0x10/0x10 [ 109.815767][ T5528] __se_sys_ioctl+0xfc/0x170 [ 109.815782][ T5528] do_syscall_64+0xfa/0xf80 [ 109.815792][ T5528] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.815802][ T5528] ? clear_bhb_loop+0x60/0xb0 [ 109.815816][ T5528] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.815826][ T5528] RIP: 0033:0x7fed9c38f7c9 [ 109.815837][ T5528] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 109.815846][ T5528] RSP: 002b:00007fed9d1f9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 109.815858][ T5528] RAX: ffffffffffffffda RBX: 00007fed9c5e5fa0 RCX: 00007fed9c38f7c9 [ 109.815866][ T5528] RDX: 0000200000000080 RSI: 00000000c028660f RDI: 0000000000000005 [ 109.815873][ T5528] RBP: 00007fed9d1f9090 R08: 0000000000000000 R09: 0000000000000000 [ 109.815879][ T5528] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 109.815885][ T5528] R13: 00007fed9c5e6038 R14: 00007fed9c5e5fa0 R15: 00007fffbb119b38 [ 109.815906][ T5528] [ 109.815995][ T26] audit: type=1800 audit(1764996776.405:11): pid=5528 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.24" name="file2" dev="loop0" ino=16 res=0 errno=0 [ 110.046190][ T5528] ------------[ cut here ]------------ [ 110.049014][ T5528] kernel BUG at fs/ext4/extents.c:5683! [ 110.055037][ T5528] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 110.057889][ T5528] CPU: 0 UID: 0 PID: 5528 Comm: syz.0.24 Not tainted syzkaller #0 PREEMPT(full) [ 110.061782][ T5528] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 110.066292][ T5528] RIP: 0010:ext4_swap_extents+0x196c/0x19a0 [ 110.068880][ T5528] Code: fe c1 38 c1 0f 8c 7e fe ff ff e8 1f 17 b3 ff e9 74 fe ff ff e8 b5 79 4b ff 90 0f 0b e8 ad 79 4b ff 90 0f 0b e8 a5 79 4b ff 90 <0f> 0b e8 9d 79 4b ff 90 0f 0b e8 95 79 4b ff 90 0f 0b e8 8d 79 4b [ 110.077017][ T5528] RSP: 0018:ffffc9000cc0f2c0 EFLAGS: 00010293 [ 110.079620][ T5528] RAX: ffffffff8275e17b RBX: 0000000000000000 RCX: ffff88801fb324c0 [ 110.082941][ T5528] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 110.086315][ T5528] RBP: dffffc0000000000 R08: ffff888042379547 R09: 1ffff1100846f2a8 [ 110.089696][ T5528] R10: dffffc0000000000 R11: ffffed100846f2a9 R12: 0000000000000001 [ 110.093134][ T5528] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001 [ 110.096586][ T5528] FS: 00007fed9d1f96c0(0000) GS:ffff88808d683000(0000) knlGS:0000000000000000 [ 110.100431][ T5528] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 110.103247][ T5528] CR2: 0000001b30863fff CR3: 0000000000731000 CR4: 0000000000352ef0 [ 110.106704][ T5528] Call Trace: [ 110.108302][ T5528] [ 110.109615][ T5528] ? __pfx__ext4_get_block+0x10/0x10 [ 110.111962][ T5528] ? _raw_spin_unlock+0x28/0x50 [ 110.114092][ T5528] ? create_empty_buffers+0x465/0x530 [ 110.116640][ T5528] ? mext_folio_mkwrite+0x207/0x290 [ 110.119002][ T5528] ext4_move_extents+0x2c58/0x3830 [ 110.121275][ T5528] ? __lock_acquire+0x6b6/0x2cf0 [ 110.123482][ T5528] ? __pfx_ext4_move_extents+0x10/0x10 [ 110.125859][ T5528] ? rcu_read_lock_any_held+0xb3/0x120 [ 110.128341][ T5528] ? sb_start_write+0x114/0x1c0 [ 110.130494][ T5528] ? mnt_want_write_file+0x164/0x200 [ 110.132816][ T5528] ext4_ioctl+0x2cf9/0x4760 [ 110.134801][ T5528] ? __pfx_ext4_ioctl+0x10/0x10 [ 110.136956][ T5528] ? is_bpf_text_address+0x26/0x2b0 [ 110.139263][ T5528] ? is_bpf_text_address+0x292/0x2b0 [ 110.141592][ T5528] ? is_bpf_text_address+0x26/0x2b0 [ 110.143871][ T5528] ? kernel_text_address+0xa5/0xe0 [ 110.146116][ T5528] ? __kernel_text_address+0xd/0x40 [ 110.148438][ T5528] ? unwind_get_return_address+0x4d/0x90 [ 110.150928][ T5528] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 110.153572][ T5528] ? arch_stack_walk+0xfc/0x150 [ 110.155663][ T5528] ? stack_trace_save+0x9c/0xe0 [ 110.157856][ T5528] ? stack_depot_save_flags+0x40/0x850 [ 110.160245][ T5528] ? format_decode+0xd0/0xe10 [ 110.162227][ T5528] ? kasan_save_track+0x4f/0x80 [ 110.164296][ T5528] ? kasan_save_track+0x3e/0x80 [ 110.166233][ T5528] ? __kasan_save_free_info+0x46/0x50 [ 110.168466][ T5528] ? __kasan_slab_free+0x5c/0x80 [ 110.170574][ T5528] ? kfree+0x1c0/0x660 [ 110.172362][ T5528] ? tomoyo_path_number_perm+0x47a/0x5a0 [ 110.174652][ T5528] ? security_file_ioctl+0xcb/0x2d0 [ 110.176830][ T5528] ? __se_sys_ioctl+0x47/0x170 [ 110.178827][ T5528] ? do_syscall_64+0xfa/0xf80 [ 110.180894][ T5528] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.183408][ T5528] ? file_ioctl+0x22d/0x780 [ 110.185317][ T5528] ? __pfx_file_ioctl+0x10/0x10 [ 110.187304][ T5528] ? kasan_quarantine_put+0xdd/0x220 [ 110.189518][ T5528] ? lockdep_hardirqs_on+0x98/0x140 [ 110.191693][ T5528] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 110.194076][ T5528] ? do_vfs_ioctl+0xb33/0x1430 [ 110.196228][ T5528] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 110.198572][ T5528] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 110.200788][ T5528] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 110.203264][ T5528] ? __fget_files+0x2a/0x420 [ 110.205338][ T5528] ? __fget_files+0x3a0/0x420 [ 110.207493][ T5528] ? __fget_files+0x2a/0x420 [ 110.210110][ T5528] ? bpf_lsm_file_ioctl+0x9/0x20 [ 110.212239][ T5528] ? __pfx_ext4_ioctl+0x10/0x10 [ 110.214341][ T5528] __se_sys_ioctl+0xfc/0x170 [ 110.216437][ T5528] do_syscall_64+0xfa/0xf80 [ 110.218506][ T5528] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.221099][ T5528] ? clear_bhb_loop+0x60/0xb0 [ 110.223153][ T5528] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.225768][ T5528] RIP: 0033:0x7fed9c38f7c9 [ 110.227784][ T5528] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 110.236183][ T5528] RSP: 002b:00007fed9d1f9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 110.239923][ T5528] RAX: ffffffffffffffda RBX: 00007fed9c5e5fa0 RCX: 00007fed9c38f7c9 [ 110.243355][ T5528] RDX: 0000200000000080 RSI: 00000000c028660f RDI: 0000000000000005 [ 110.246718][ T5528] RBP: 00007fed9d1f9090 R08: 0000000000000000 R09: 0000000000000000 [ 110.250162][ T5528] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 110.253657][ T5528] R13: 00007fed9c5e6038 R14: 00007fed9c5e5fa0 R15: 00007fffbb119b38 [ 110.257083][ T5528] [ 110.258378][ T5528] Modules linked in: [ 110.260441][ T5528] ---[ end trace 0000000000000000 ]--- [ 110.269716][ T5528] RIP: 0010:ext4_swap_extents+0x196c/0x19a0 [ 110.273259][ T5528] Code: fe c1 38 c1 0f 8c 7e fe ff ff e8 1f 17 b3 ff e9 74 fe ff ff e8 b5 79 4b ff 90 0f 0b e8 ad 79 4b ff 90 0f 0b e8 a5 79 4b ff 90 <0f> 0b e8 9d 79 4b ff 90 0f 0b e8 95 79 4b ff 90 0f 0b e8 8d 79 4b [ 110.282192][ T5528] RSP: 0018:ffffc9000cc0f2c0 EFLAGS: 00010293 [ 110.284979][ T5528] RAX: ffffffff8275e17b RBX: 0000000000000000 RCX: ffff88801fb324c0 [ 110.288673][ T5528] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 110.292974][ T5528] RBP: dffffc0000000000 R08: ffff888042379547 R09: 1ffff1100846f2a8 [ 110.296445][ T5528] R10: dffffc0000000000 R11: ffffed100846f2a9 R12: 0000000000000001 [ 110.299952][ T5528] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001 [ 110.303814][ T5528] FS: 00007fed9d1f96c0(0000) GS:ffff88808d683000(0000) knlGS:0000000000000000 [ 110.307578][ T5528] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 110.310277][ T5528] CR2: 0000001b30863fff CR3: 0000000000731000 CR4: 0000000000352ef0 [ 110.314279][ T5528] Kernel panic - not syncing: Fatal exception [ 110.317392][ T5528] Kernel Offset: disabled [ 110.319270][ T5528] Rebooting in 86400 seconds.. VM DIAGNOSIS: 04:52:56 Registers: info registers vcpu 0 CPU#0 RAX=ffffffff96172e68 RBX=0000000000000111 RCX=0000000000000002 RDX=ffffffff960519a8 RSI=ffff888000ed55a0 RDI=0000000000000111 RBP=87224957bc467151 RSP=ffffc9000cbaeef0 R8 =ffffc9000cbaeeb8 R9 =0000000000000020 R10=ffff888000c82558 R11=ffffffff819e9b40 R12=ffffc9000cbaef80 R13=ffffffff9322b518 R14=ffff888000ed4980 R15=0000000000000001 RIP=ffffffff819e46f5 RFL=00000006 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88808d683000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000001b30863fff CR3=0000000000731000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000008001 Opmask01=0000000000000000 Opmask02=000000000000003f Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 00000000ffffffff ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 00000000ffffffff ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fed9c415050 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fed9c41505d ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fed9c415057 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fed9c41506b ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fed9c4150f1 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fed9c4151cf ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fed9c5ba4a8 00007fed9c5ba4a0 00007fed9c5ba498 00007fed9c5ba470 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fed9d11d100 00007fed9c5ba460 00007fed9c5ba478 0000000500060006 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fed9c5ba4b8 00007fed9c5ba4b0 00007fed9c5ba4a8 00007fed9c5ba4a0 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 a2d541f7ffff0000 01e7d75700000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000