Warning: Permanently added '10.128.1.71' (ED25519) to the list of known hosts. 2026/11/14 16:09:26 parsed 1 programs 2026/11/14 16:09:26 serving rpc on tcp://33765 Setting up swapspace version 1, size = 127995904 bytes [ 33.620003][ T30] kauditd_printk_skb: 31 callbacks suppressed [ 33.620064][ T30] audit: type=1400 audit(1794672567.140:105): avc: denied { unlink } for pid=407 comm="syz-executor" name="swap-file" dev="sda1" ino=2027 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 33.670903][ T30] audit: type=1400 audit(1794672567.190:106): avc: denied { write } for pid=410 comm="mkswap" path="pipe:[16506]" dev="pipefs" ino=16506 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 33.693643][ T407] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 34.311860][ T30] audit: type=1400 audit(1794672567.830:107): avc: denied { create } for pid=428 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 34.487839][ T440] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.494918][ T440] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.502942][ T440] device bridge_slave_0 entered promiscuous mode [ 34.511160][ T440] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.518465][ T440] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.526052][ T440] device bridge_slave_1 entered promiscuous mode [ 34.560999][ T440] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.568065][ T440] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.575362][ T440] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.582506][ T440] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.604346][ T338] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.611600][ T338] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.618847][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 34.626759][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 34.636148][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 34.644366][ T338] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.651413][ T338] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.660729][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 34.668969][ T338] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.676026][ T338] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.687599][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 34.696812][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 34.709262][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 34.720232][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 34.728198][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 34.735767][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 34.744337][ T440] device veth0_vlan entered promiscuous mode [ 34.753736][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 34.763020][ T440] device veth1_macvtap entered promiscuous mode [ 34.772011][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 34.781984][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 35.054079][ T30] audit: type=1401 audit(1794672568.570:108): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" 2026/11/14 16:09:28 executed programs: 0 [ 35.313392][ T471] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.320639][ T471] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.327962][ T471] device bridge_slave_0 entered promiscuous mode [ 35.334850][ T471] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.341889][ T471] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.349177][ T471] device bridge_slave_1 entered promiscuous mode [ 35.387543][ T471] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.394599][ T471] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.401873][ T471] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.408911][ T471] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.425753][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 35.434315][ T338] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.441679][ T338] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.455233][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 35.463446][ T338] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.470484][ T338] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.479412][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 35.487596][ T338] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.494644][ T338] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.511810][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 35.520076][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 35.533996][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 35.542205][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 35.555719][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 35.564123][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 35.579106][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 35.587031][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 35.595447][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 35.602969][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 35.613067][ T471] device veth0_vlan entered promiscuous mode [ 35.622516][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 35.630743][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 35.639804][ T471] device veth1_macvtap entered promiscuous mode [ 35.648776][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 35.656641][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 35.665386][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 35.674535][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 35.682921][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 35.708041][ T30] audit: type=1400 audit(1794672569.220:109): avc: denied { read write } for pid=475 comm="syz.2.17" name="control" dev="devtmpfs" ino=262 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 35.718376][ T39] ================================================================== [ 35.739729][ T39] BUG: KASAN: double-free or invalid-free in kfree+0xc4/0x270 [ 35.742435][ T30] audit: type=1400 audit(1794672569.220:110): avc: denied { open } for pid=475 comm="syz.2.17" path="/dev/mapper/control" dev="devtmpfs" ino=262 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 35.747298][ T39] [ 35.747306][ T39] CPU: 1 PID: 39 Comm: kworker/1:1 Not tainted syzkaller #0 [ 35.771524][ T338] Buffer I/O error on dev dm-0, logical block 0, lost async page write [ 35.773485][ T39] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 35.781069][ T30] audit: type=1400 audit(1794672569.220:111): avc: denied { ioctl } for pid=475 comm="syz.2.17" path="/dev/mapper/control" dev="devtmpfs" ino=262 ioctlcmd=0xfd03 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 35.789157][ T39] Workqueue: kcryptd_io/253:0 kcryptd_io_read_work [ 35.830931][ T39] Call Trace: [ 35.834205][ T39] [ 35.837128][ T39] __dump_stack+0x21/0x30 [ 35.841458][ T39] dump_stack_lvl+0x110/0x170 [ 35.846127][ T39] ? show_regs_print_info+0x20/0x20 [ 35.851322][ T39] ? load_image+0x3f0/0x3f0 [ 35.855820][ T39] ? kmem_cache_free+0x100/0x320 [ 35.860765][ T39] print_address_description+0x7f/0x2c0 [ 35.866306][ T39] ? kfree+0xc4/0x270 [ 35.870285][ T39] kasan_report_invalid_free+0x58/0x90 [ 35.875741][ T39] ? kfree+0xc4/0x270 [ 35.879717][ T39] ____kasan_slab_free+0x13d/0x160 [ 35.884825][ T39] __kasan_slab_free+0x11/0x20 [ 35.889579][ T39] slab_free_freelist_hook+0xc2/0x190 [ 35.894980][ T39] ? crypt_dec_pending+0x1dd/0x2a0 [ 35.900090][ T39] kfree+0xc4/0x270 [ 35.903894][ T39] ? crypt_dec_pending+0x1dd/0x2a0 [ 35.909011][ T39] crypt_dec_pending+0x1dd/0x2a0 [ 35.913940][ T39] kcryptd_io_read_work+0x84/0xa0 [ 35.918957][ T39] process_one_work+0x6c8/0xbb0 [ 35.923805][ T39] worker_thread+0xaa0/0x1250 [ 35.928567][ T39] ? __kasan_check_read+0x11/0x20 [ 35.933591][ T39] kthread+0x3f5/0x4f0 [ 35.937657][ T39] ? worker_clr_flags+0x190/0x190 [ 35.942680][ T39] ? kthread_blkcg+0xd0/0xd0 [ 35.947272][ T39] ret_from_fork+0x1f/0x30 [ 35.951683][ T39] [ 35.954697][ T39] [ 35.957010][ T39] Allocated by task 476: [ 35.961247][ T39] __kasan_kmalloc+0xd4/0x100 [ 35.965928][ T39] __kmalloc+0x13d/0x2c0 [ 35.970164][ T39] crypt_map+0x3d1/0xb90 [ 35.974402][ T39] __map_bio+0x139/0x780 [ 35.978639][ T39] __split_and_process_non_flush+0x715/0xa90 [ 35.984615][ T39] dm_submit_bio+0x76a/0x10f0 [ 35.989289][ T39] __submit_bio+0x732/0x900 [ 35.993788][ T39] submit_bio_noacct+0x32a/0x800 [ 35.998718][ T39] submit_bio+0x367/0x620 [ 36.003046][ T39] submit_bh_wbc+0x5b4/0x680 [ 36.007634][ T39] ll_rw_block+0x1ed/0x250 [ 36.012045][ T39] __block_write_begin_int+0x6b6/0x14d0 [ 36.017584][ T39] block_write_begin+0x54/0xd0 [ 36.022340][ T39] blkdev_write_begin+0x3c/0x50 [ 36.027184][ T39] generic_perform_write+0x2b7/0x690 [ 36.032464][ T39] __generic_file_write_iter+0x268/0x490 [ 36.038116][ T39] blkdev_write_iter+0x351/0x550 [ 36.043044][ T39] vfs_write+0x831/0xfd0 [ 36.047280][ T39] __x64_sys_pwrite64+0x194/0x220 [ 36.052300][ T39] x64_sys_call+0xa6/0x9a0 [ 36.056711][ T39] do_syscall_64+0x4c/0xa0 [ 36.061136][ T39] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 36.067026][ T39] [ 36.069344][ T39] Freed by task 476: [ 36.073227][ T39] kasan_set_track+0x4a/0x70 [ 36.077810][ T39] kasan_set_free_info+0x23/0x40 [ 36.082741][ T39] ____kasan_slab_free+0x125/0x160 [ 36.087851][ T39] __kasan_slab_free+0x11/0x20 [ 36.092607][ T39] slab_free_freelist_hook+0xc2/0x190 [ 36.097972][ T39] kfree+0xc4/0x270 [ 36.101775][ T39] crypt_dec_pending+0x1dd/0x2a0 [ 36.106706][ T39] kcryptd_io_read+0x371/0x480 [ 36.111462][ T39] crypt_map+0x4c5/0xb90 [ 36.115709][ T39] __map_bio+0x139/0x780 [ 36.119984][ T39] __split_and_process_non_flush+0x715/0xa90 [ 36.125992][ T39] dm_submit_bio+0x76a/0x10f0 [ 36.130670][ T39] __submit_bio+0x732/0x900 [ 36.135168][ T39] submit_bio_noacct+0x32a/0x800 [ 36.140100][ T39] submit_bio+0x367/0x620 [ 36.144426][ T39] submit_bh_wbc+0x5b4/0x680 [ 36.149074][ T39] ll_rw_block+0x1ed/0x250 [ 36.153485][ T39] __block_write_begin_int+0x6b6/0x14d0 [ 36.159043][ T39] block_write_begin+0x54/0xd0 [ 36.163977][ T39] blkdev_write_begin+0x3c/0x50 [ 36.168909][ T39] generic_perform_write+0x2b7/0x690 [ 36.174212][ T39] __generic_file_write_iter+0x268/0x490 [ 36.179852][ T39] blkdev_write_iter+0x351/0x550 [ 36.184795][ T39] vfs_write+0x831/0xfd0 [ 36.189028][ T39] __x64_sys_pwrite64+0x194/0x220 [ 36.194079][ T39] x64_sys_call+0xa6/0x9a0 [ 36.198497][ T39] do_syscall_64+0x4c/0xa0 [ 36.202919][ T39] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 36.208902][ T39] [ 36.211224][ T39] The buggy address belongs to the object at ffff8881162f9000 [ 36.211224][ T39] which belongs to the cache kmalloc-64 of size 64 [ 36.225098][ T39] The buggy address is located 0 bytes inside of [ 36.225098][ T39] 64-byte region [ffff8881162f9000, ffff8881162f9040) [ 36.238109][ T39] The buggy address belongs to the page: [ 36.243736][ T39] page:ffffea000458be40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1162f9 [ 36.253968][ T39] flags: 0x4000000000000200(slab|zone=1) [ 36.259610][ T39] raw: 4000000000000200 ffffea0004579100 0000000200000002 ffff888100042780 [ 36.268200][ T39] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 36.276787][ T39] page dumped because: kasan: bad access detected [ 36.283188][ T39] page_owner tracks the page as allocated [ 36.288891][ T39] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 110, ts 4626326687, free_ts 0 [ 36.303994][ T39] post_alloc_hook+0x192/0x1b0 [ 36.308759][ T39] prep_new_page+0x1c/0x110 [ 36.313273][ T39] get_page_from_freelist+0x2d42/0x2dd0 [ 36.318902][ T39] __alloc_pages+0x1a2/0x460 [ 36.323495][ T39] new_slab+0xa0/0x4d0 [ 36.327559][ T39] ___slab_alloc+0x3ac/0x840 [ 36.332168][ T39] __slab_alloc+0x49/0x90 [ 36.336491][ T39] kmem_cache_alloc_trace+0x146/0x270 [ 36.341854][ T39] kernfs_fop_open+0x8c0/0xbb0 [ 36.346617][ T39] do_dentry_open+0x82a/0x1010 [ 36.351374][ T39] vfs_open+0x73/0x80 [ 36.355350][ T39] path_openat+0x26e6/0x2f80 [ 36.359939][ T39] do_filp_open+0x1df/0x400 [ 36.364445][ T39] do_sys_openat2+0x15e/0x7f0 [ 36.369127][ T39] __x64_sys_openat+0x136/0x160 [ 36.374063][ T39] x64_sys_call+0x219/0x9a0 [ 36.378572][ T39] page_owner free stack trace missing [ 36.383931][ T39] [ 36.386250][ T39] Memory state around the buggy address: [ 36.391877][ T39] ffff8881162f8f00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 36.399938][ T39] ffff8881162f8f80: fb fb fc fc fb fb fc fc fb fb fc fc fa fb fc fc [ 36.408064][ T39] >ffff8881162f9000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 36.416115][ T39] ^ [ 36.420171][ T39] ffff8881162f9080: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 36.428221][ T39] ffff8881162f9100: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc [ 36.436269][ T39] ================================================================== [ 36.444340][ T39] Disabling lock debugging due to kernel taint [ 36.452402][ T30] audit: type=1400 audit(1794672569.220:112): avc: denied { create } for pid=475 comm="syz.2.17" name="dm0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 36.475974][ T30] audit: type=1400 audit(1794672569.220:113): avc: denied { read write } for pid=475 comm="syz.2.17" name="dm0" dev="tmpfs" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 36.480949][ T39] ================================================================== [ 36.499907][ T30] audit: type=1400 audit(1794672569.220:114): avc: denied { open } for pid=475 comm="syz.2.17" path="/0/dm0" dev="tmpfs" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 36.506210][ T39] BUG: KASAN: use-after-free in crypt_dec_pending+0x275/0x2a0 [ 36.535522][ T39] Write of size 1 at addr ffff88812aba9b72 by task kworker/1:1/39 [ 36.543317][ T39] [ 36.545629][ T39] CPU: 1 PID: 39 Comm: kworker/1:1 Tainted: G B syzkaller #0 [ 36.554392][ T39] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 36.564445][ T39] Workqueue: kcryptd_io/253:0 kcryptd_io_read_work [ 36.570956][ T39] Call Trace: [ 36.574366][ T39] [ 36.577290][ T39] __dump_stack+0x21/0x30 [ 36.581614][ T39] dump_stack_lvl+0x110/0x170 [ 36.586454][ T39] ? show_regs_print_info+0x20/0x20 [ 36.591645][ T39] ? load_image+0x3f0/0x3f0 [ 36.596135][ T39] ? ____kasan_slab_free+0x13d/0x160 [ 36.601497][ T39] print_address_description+0x7f/0x2c0 [ 36.607032][ T39] ? crypt_dec_pending+0x275/0x2a0 [ 36.612138][ T39] kasan_report+0x10f/0x150 [ 36.616628][ T39] ? crypt_dec_pending+0x275/0x2a0 [ 36.621726][ T39] __asan_report_store1_noabort+0x17/0x20 [ 36.627433][ T39] crypt_dec_pending+0x275/0x2a0 [ 36.632371][ T39] kcryptd_io_read_work+0x84/0xa0 [ 36.637380][ T39] process_one_work+0x6c8/0xbb0 [ 36.642218][ T39] worker_thread+0xaa0/0x1250 [ 36.646886][ T39] ? __kasan_check_read+0x11/0x20 [ 36.651896][ T39] kthread+0x3f5/0x4f0 [ 36.655955][ T39] ? worker_clr_flags+0x190/0x190 [ 36.661041][ T39] ? kthread_blkcg+0xd0/0xd0 [ 36.665621][ T39] ret_from_fork+0x1f/0x30 [ 36.670032][ T39] [ 36.673139][ T39] [ 36.675449][ T39] Allocated by task 476: [ 36.679876][ T39] __kasan_slab_alloc+0xb7/0xe0 [ 36.684734][ T39] slab_post_alloc_hook+0x4f/0x2b0 [ 36.689852][ T39] kmem_cache_alloc+0xf7/0x260 [ 36.694623][ T39] mempool_alloc_slab+0x1d/0x30 [ 36.699481][ T39] mempool_alloc+0x167/0x4c0 [ 36.704060][ T39] bio_alloc_bioset+0x124/0x910 [ 36.708900][ T39] dm_submit_bio+0x211/0x10f0 [ 36.713571][ T39] __submit_bio+0x732/0x900 [ 36.718061][ T39] submit_bio_noacct+0x32a/0x800 [ 36.722992][ T39] submit_bio+0x367/0x620 [ 36.727317][ T39] submit_bh_wbc+0x5b4/0x680 [ 36.731899][ T39] ll_rw_block+0x1ed/0x250 [ 36.736301][ T39] __block_write_begin_int+0x6b6/0x14d0 [ 36.741852][ T39] block_write_begin+0x54/0xd0 [ 36.746605][ T39] blkdev_write_begin+0x3c/0x50 [ 36.751451][ T39] generic_perform_write+0x2b7/0x690 [ 36.756725][ T39] __generic_file_write_iter+0x268/0x490 [ 36.762354][ T39] blkdev_write_iter+0x351/0x550 [ 36.767299][ T39] vfs_write+0x831/0xfd0 [ 36.771529][ T39] __x64_sys_pwrite64+0x194/0x220 [ 36.776546][ T39] x64_sys_call+0xa6/0x9a0 [ 36.780970][ T39] do_syscall_64+0x4c/0xa0 [ 36.785397][ T39] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 36.791285][ T39] [ 36.793612][ T39] Freed by task 476: [ 36.797499][ T39] kasan_set_track+0x4a/0x70 [ 36.802082][ T39] kasan_set_free_info+0x23/0x40 [ 36.807005][ T39] ____kasan_slab_free+0x125/0x160 [ 36.812107][ T39] __kasan_slab_free+0x11/0x20 [ 36.816870][ T39] slab_free_freelist_hook+0xc2/0x190 [ 36.822239][ T39] kmem_cache_free+0x100/0x320 [ 36.826992][ T39] mempool_free_slab+0x1d/0x30 [ 36.831749][ T39] mempool_free+0xd5/0x330 [ 36.836238][ T39] bio_free+0x255/0x360 [ 36.840398][ T39] bio_put+0x91/0x610 [ 36.844383][ T39] dm_io_dec_pending+0x314/0xa50 [ 36.849326][ T39] dm_submit_bio+0xc1b/0x10f0 [ 36.854008][ T39] __submit_bio+0x732/0x900 [ 36.858620][ T39] submit_bio_noacct+0x32a/0x800 [ 36.863551][ T39] submit_bio+0x367/0x620 [ 36.867883][ T39] submit_bh_wbc+0x5b4/0x680 [ 36.872464][ T39] ll_rw_block+0x1ed/0x250 [ 36.876874][ T39] __block_write_begin_int+0x6b6/0x14d0 [ 36.882423][ T39] block_write_begin+0x54/0xd0 [ 36.887187][ T39] blkdev_write_begin+0x3c/0x50 [ 36.892023][ T39] generic_perform_write+0x2b7/0x690 [ 36.897305][ T39] __generic_file_write_iter+0x268/0x490 [ 36.902922][ T39] blkdev_write_iter+0x351/0x550 [ 36.907845][ T39] vfs_write+0x831/0xfd0 [ 36.912074][ T39] __x64_sys_pwrite64+0x194/0x220 [ 36.917098][ T39] x64_sys_call+0xa6/0x9a0 [ 36.921594][ T39] do_syscall_64+0x4c/0xa0 [ 36.926005][ T39] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 36.931894][ T39] [ 36.934212][ T39] Last potentially related work creation: [ 36.939934][ T39] kasan_save_stack+0x3a/0x60 [ 36.944602][ T39] __kasan_record_aux_stack+0xd2/0x100 [ 36.950047][ T39] kasan_record_aux_stack_noalloc+0xb/0x10 [ 36.955839][ T39] insert_work+0x51/0x310 [ 36.960162][ T39] __queue_work+0x8e1/0xc60 [ 36.964669][ T39] queue_work_on+0xde/0x150 [ 36.969165][ T39] crypt_map+0x5bf/0xb90 [ 36.973404][ T39] __map_bio+0x139/0x780 [ 36.977643][ T39] __split_and_process_non_flush+0x715/0xa90 [ 36.983616][ T39] dm_submit_bio+0x76a/0x10f0 [ 36.988288][ T39] __submit_bio+0x732/0x900 [ 36.992801][ T39] submit_bio_noacct+0x32a/0x800 [ 36.997739][ T39] submit_bio+0x367/0x620 [ 37.002063][ T39] submit_bh_wbc+0x5b4/0x680 [ 37.006652][ T39] ll_rw_block+0x1ed/0x250 [ 37.011065][ T39] __block_write_begin_int+0x6b6/0x14d0 [ 37.016611][ T39] block_write_begin+0x54/0xd0 [ 37.021369][ T39] blkdev_write_begin+0x3c/0x50 [ 37.026211][ T39] generic_perform_write+0x2b7/0x690 [ 37.031498][ T39] __generic_file_write_iter+0x268/0x490 [ 37.037132][ T39] blkdev_write_iter+0x351/0x550 [ 37.042066][ T39] vfs_write+0x831/0xfd0 [ 37.046301][ T39] __x64_sys_pwrite64+0x194/0x220 [ 37.051327][ T39] x64_sys_call+0xa6/0x9a0 [ 37.055850][ T39] do_syscall_64+0x4c/0xa0 [ 37.060261][ T39] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 37.066151][ T39] [ 37.068465][ T39] The buggy address belongs to the object at ffff88812aba97c0 [ 37.068465][ T39] which belongs to the cache bio-1080 of size 1080 [ 37.082338][ T39] The buggy address is located 946 bytes inside of [ 37.082338][ T39] 1080-byte region [ffff88812aba97c0, ffff88812aba9bf8) [ 37.095694][ T39] The buggy address belongs to the page: [ 37.101317][ T39] page:ffffea0004aaea00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12aba8 [ 37.111547][ T39] head:ffffea0004aaea00 order:2 compound_mapcount:0 compound_pincount:0 [ 37.119980][ T39] flags: 0x4000000000010200(slab|head|zone=1) [ 37.126062][ T39] raw: 4000000000010200 0000000000000000 dead000000000122 ffff88811560ef00 [ 37.134651][ T39] raw: 0000000000000000 00000000800d000d 00000001ffffffff 0000000000000000 [ 37.143221][ T39] page dumped because: kasan: bad access detected [ 37.149713][ T39] page_owner tracks the page as allocated [ 37.155446][ T39] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 476, ts 35713921814, free_ts 34436904398 [ 37.175930][ T39] post_alloc_hook+0x192/0x1b0 [ 37.180696][ T39] prep_new_page+0x1c/0x110 [ 37.185278][ T39] get_page_from_freelist+0x2d42/0x2dd0 [ 37.190822][ T39] __alloc_pages+0x1a2/0x460 [ 37.195424][ T39] new_slab+0xa0/0x4d0 [ 37.199488][ T39] ___slab_alloc+0x3ac/0x840 [ 37.204162][ T39] __slab_alloc+0x49/0x90 [ 37.208486][ T39] kmem_cache_alloc+0x138/0x260 [ 37.213332][ T39] mempool_alloc_slab+0x1d/0x30 [ 37.218179][ T39] mempool_init_node+0x1e3/0x4a0 [ 37.223109][ T39] mempool_init+0x3c/0x50 [ 37.227435][ T39] bioset_init+0x205/0x5f0 [ 37.231844][ T39] bioset_init_from_src+0xb3/0x120 [ 37.237208][ T39] dm_swap_table+0x442/0x610 [ 37.241798][ T39] dev_suspend+0x1e0/0x740 [ 37.246221][ T39] dm_ctl_ioctl+0x8ee/0xca0 [ 37.250719][ T39] page last free stack trace: [ 37.255396][ T39] free_unref_page_prepare+0x5fa/0x600 [ 37.260852][ T39] free_unref_page+0xae/0x540 [ 37.265523][ T39] __free_pages+0x6c/0x100 [ 37.269939][ T39] __vunmap+0x801/0x980 [ 37.274094][ T39] vfree+0x8b/0xc0 [ 37.277807][ T39] kcov_close+0x2b/0x50 [ 37.281955][ T39] __fput+0x22b/0x900 [ 37.286022][ T39] ____fput+0x15/0x20 [ 37.289998][ T39] task_work_run+0x127/0x190 [ 37.294579][ T39] do_exit+0xb70/0x29a0 [ 37.298726][ T39] do_group_exit+0x149/0x310 [ 37.303311][ T39] get_signal+0x64f/0x1430 [ 37.307720][ T39] arch_do_signal_or_restart+0xe2/0x1100 [ 37.313351][ T39] exit_to_user_mode_loop+0xa7/0xe0 [ 37.318541][ T39] exit_to_user_mode_prepare+0x87/0xd0 [ 37.324020][ T39] syscall_exit_to_user_mode+0x1a/0x30 [ 37.329473][ T39] [ 37.331789][ T39] Memory state around the buggy address: [ 37.337512][ T39] ffff88812aba9a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 37.345652][ T39] ffff88812aba9a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 37.353876][ T39] >ffff88812aba9b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 37.361925][ T39] ^ [ 37.369645][ T39] ffff88812aba9b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc [ 37.377699][ T39] ffff88812aba9c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.385750][ T39] ================================================================== [ 37.503439][ T45] device bridge_slave_1 left promiscuous mode [ 37.510763][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.518522][ T45] device bridge_slave_0 left promiscuous mode [ 37.524826][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.532970][ T45] device veth1_macvtap left promiscuous mode [ 37.538995][ T45] device veth0_vlan left promiscuous mode 2026/11/14 16:09:33 executed programs: 158 2026/11/14 16:09:38 executed programs: 422