Warning: Permanently added '10.128.1.142' (ED25519) to the list of known hosts. 2026/04/26 03:21:47 parsed 1 programs [ 131.613786][ T6097] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 132.886616][ T1334] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.886709][ T1334] ieee802154 phy1 wpan1: encryption failed: -22 [ 135.867838][ T6115] bridge0: port 1(bridge_slave_0) entered blocking state [ 135.867961][ T6115] bridge0: port 1(bridge_slave_0) entered disabled state [ 135.868065][ T6115] bridge_slave_0: entered allmulticast mode [ 135.869433][ T6115] bridge_slave_0: entered promiscuous mode [ 135.871982][ T6115] bridge0: port 2(bridge_slave_1) entered blocking state [ 135.872102][ T6115] bridge0: port 2(bridge_slave_1) entered disabled state [ 135.872198][ T6115] bridge_slave_1: entered allmulticast mode [ 135.875928][ T6115] bridge_slave_1: entered promiscuous mode [ 136.010982][ T6115] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 136.013811][ T6115] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 136.152189][ T6115] team0: Port device team_slave_0 added [ 136.154167][ T6115] team0: Port device team_slave_1 added [ 136.278044][ T6115] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 136.278059][ T6115] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 136.278073][ T6115] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 136.279347][ T6115] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 136.279359][ T6115] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 136.279382][ T6115] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 136.441940][ T6115] hsr_slave_0: entered promiscuous mode [ 136.442710][ T6115] hsr_slave_1: entered promiscuous mode [ 138.315694][ T6115] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 138.354261][ T6115] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 138.355409][ T6115] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 138.381007][ T6115] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 138.382158][ T6115] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 138.437330][ T6115] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 138.439489][ T6115] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 138.488640][ T6115] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 138.645308][ T6115] 8021q: adding VLAN 0 to HW filter on device bond0 [ 138.678587][ T6115] 8021q: adding VLAN 0 to HW filter on device team0 [ 138.695739][ T1939] bridge0: port 1(bridge_slave_0) entered blocking state [ 138.695938][ T1939] bridge0: port 1(bridge_slave_0) entered forwarding state [ 138.743599][ T1939] bridge0: port 2(bridge_slave_1) entered blocking state [ 138.743811][ T1939] bridge0: port 2(bridge_slave_1) entered forwarding state [ 139.385704][ T6115] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 139.457901][ T6115] veth0_vlan: entered promiscuous mode [ 139.468027][ T6115] veth1_vlan: entered promiscuous mode [ 139.517224][ T6115] veth0_macvtap: entered promiscuous mode [ 139.524909][ T6115] veth1_macvtap: entered promiscuous mode [ 139.552393][ T6115] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 139.568480][ T6115] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 139.585834][ T1939] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 139.586092][ T1939] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 139.588757][ T215] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 139.588797][ T215] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 140.261377][ T1944] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 140.839047][ T3440] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 140.839068][ T3440] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 140.954328][ T3440] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 140.954348][ T3440] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 141.252069][ T1944] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 142.183169][ T60] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 142.188656][ T60] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 142.193581][ T60] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 142.210934][ T60] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 142.211592][ T60] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 142.301495][ T1944] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 142.641960][ T1944] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 143.956637][ T1944] bridge_slave_1: left allmulticast mode [ 143.956661][ T1944] bridge_slave_1: left promiscuous mode [ 143.956838][ T1944] bridge0: port 2(bridge_slave_1) entered disabled state [ 144.037372][ T1944] bridge_slave_0: left allmulticast mode [ 144.037407][ T1944] bridge_slave_0: left promiscuous mode [ 144.037639][ T1944] bridge0: port 1(bridge_slave_0) entered disabled state [ 144.607024][ T1944] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 144.666845][ T1944] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 144.708264][ T1944] bond0 (unregistering): Released all slaves [ 145.156311][ T1944] hsr_slave_0: left promiscuous mode [ 145.206296][ T1944] hsr_slave_1: left promiscuous mode [ 145.207311][ T1944] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 145.207334][ T1944] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 145.265531][ T1944] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 145.268218][ T1944] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 145.379097][ T1944] veth1_macvtap: left promiscuous mode [ 145.379193][ T1944] veth0_macvtap: left promiscuous mode [ 145.380077][ T1944] veth1_vlan: left promiscuous mode [ 145.380243][ T1944] veth0_vlan: left promiscuous mode [ 145.997504][ T1944] team0 (unregistering): Port device team_slave_1 removed [ 146.036920][ T1944] team0 (unregistering): Port device team_slave_0 removed [ 146.210790][ T5271] 8021q: adding VLAN 0 to HW filter on device eth1 [ 146.826063][ T5271] 8021q: adding VLAN 0 to HW filter on device eth2 [ 148.039031][ T5271] 8021q: adding VLAN 0 to HW filter on device eth3 [ 148.705689][ T5271] 8021q: adding VLAN 0 to HW filter on device eth4 2026/04/26 03:22:08 executed programs: 0 [ 149.057391][ T60] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 149.077316][ T60] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 149.095231][ T60] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 149.104547][ T60] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 149.105636][ T60] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 150.449197][ T6437] bridge0: port 1(bridge_slave_0) entered blocking state [ 150.449322][ T6437] bridge0: port 1(bridge_slave_0) entered disabled state [ 150.449433][ T6437] bridge_slave_0: entered allmulticast mode [ 150.450860][ T6437] bridge_slave_0: entered promiscuous mode [ 150.452827][ T6437] bridge0: port 2(bridge_slave_1) entered blocking state [ 150.452939][ T6437] bridge0: port 2(bridge_slave_1) entered disabled state [ 150.453029][ T6437] bridge_slave_1: entered allmulticast mode [ 150.454384][ T6437] bridge_slave_1: entered promiscuous mode [ 150.642692][ T6437] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 150.655933][ T6437] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 150.918999][ T6437] team0: Port device team_slave_0 added [ 150.922046][ T6437] team0: Port device team_slave_1 added [ 151.078801][ T6437] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 151.078818][ T6437] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 151.078832][ T6437] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 151.080109][ T6437] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 151.080121][ T6437] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 151.080135][ T6437] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 151.196349][ T4926] Bluetooth: hci0: command tx timeout [ 151.547434][ T6437] hsr_slave_0: entered promiscuous mode [ 151.548223][ T6437] hsr_slave_1: entered promiscuous mode [ 153.277011][ T4926] Bluetooth: hci0: command tx timeout [ 153.445060][ T6437] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 153.481662][ T6437] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 153.482886][ T6437] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 153.527150][ T6437] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 153.528197][ T6437] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 153.573554][ T6437] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 153.575831][ T6437] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 153.622061][ T6437] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 153.759285][ T6437] 8021q: adding VLAN 0 to HW filter on device bond0 [ 153.838210][ T6437] 8021q: adding VLAN 0 to HW filter on device team0 [ 153.853086][ T1944] bridge0: port 1(bridge_slave_0) entered blocking state [ 153.853850][ T1944] bridge0: port 1(bridge_slave_0) entered forwarding state [ 153.871095][ T1944] bridge0: port 2(bridge_slave_1) entered blocking state [ 153.871291][ T1944] bridge0: port 2(bridge_slave_1) entered forwarding state [ 154.515016][ T6437] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 154.609798][ T6437] veth0_vlan: entered promiscuous mode [ 154.625138][ T6437] veth1_vlan: entered promiscuous mode [ 154.678864][ T6437] veth0_macvtap: entered promiscuous mode [ 154.685543][ T6437] veth1_macvtap: entered promiscuous mode [ 154.740341][ T6437] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 154.769624][ T6437] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 154.792500][ T215] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 154.792547][ T215] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 154.792579][ T215] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 154.792610][ T215] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 155.165444][ T998] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 155.165465][ T998] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 155.253864][ T1944] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 155.253884][ T1944] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 155.356537][ T4926] Bluetooth: hci0: command tx timeout 2026/04/26 03:22:15 executed programs: 2 [ 155.860705][ T6565] loop0: detected capacity change from 0 to 32768 [ 156.053360][ T6565] [ 156.053360][ T6565] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 156.053360][ T6565] [ 156.069508][ T6565] Bad index:-128 of stbl[1] in dtroot [ 156.069508][ T6565] [ 156.069534][ T6565] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 156.069534][ T6565] [ 156.859016][ T6582] loop0: detected capacity change from 0 to 32768 [ 156.917214][ T6582] [ 156.917214][ T6582] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 156.917214][ T6582] [ 156.943324][ T6582] Bad index:-128 of stbl[1] in dtroot [ 156.943324][ T6582] [ 156.943343][ T6582] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 156.943343][ T6582] [ 157.313516][ T6597] loop0: detected capacity change from 0 to 32768 [ 157.339205][ T6597] [ 157.339205][ T6597] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 157.339205][ T6597] [ 157.339919][ T6597] Bad index:-128 of stbl[1] in dtroot [ 157.339919][ T6597] [ 157.339934][ T6597] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 157.339934][ T6597] [ 157.439064][ T4926] Bluetooth: hci0: command tx timeout [ 157.670824][ T6599] loop0: detected capacity change from 0 to 32768 [ 157.692532][ T6599] [ 157.692532][ T6599] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 157.692532][ T6599] [ 157.698283][ T6599] Bad index:-128 of stbl[1] in dtroot [ 157.698283][ T6599] [ 157.698300][ T6599] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 157.698300][ T6599] [ 158.047465][ T6601] loop0: detected capacity change from 0 to 32768 [ 158.069203][ T6601] [ 158.069203][ T6601] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 158.069203][ T6601] [ 158.070709][ T6601] Bad index:-128 of stbl[1] in dtroot [ 158.070709][ T6601] [ 158.070725][ T6601] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 158.070725][ T6601] [ 158.382411][ T6603] loop0: detected capacity change from 0 to 32768 [ 158.401349][ T6603] [ 158.401349][ T6603] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 158.401349][ T6603] [ 158.402857][ T6603] Bad index:-128 of stbl[1] in dtroot [ 158.402857][ T6603] [ 158.402873][ T6603] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 158.402873][ T6603] [ 158.755301][ T6605] loop0: detected capacity change from 0 to 32768 [ 158.763298][ T6605] [ 158.763298][ T6605] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 158.763298][ T6605] [ 158.763870][ T6605] Bad index:-128 of stbl[1] in dtroot [ 158.763870][ T6605] [ 158.763884][ T6605] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 158.763884][ T6605] [ 159.131414][ T6607] loop0: detected capacity change from 0 to 32768 [ 159.151597][ T6607] [ 159.151597][ T6607] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 159.151597][ T6607] [ 159.167710][ T6607] Bad index:-128 of stbl[1] in dtroot [ 159.167710][ T6607] [ 159.167727][ T6607] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 159.167727][ T6607] [ 159.489158][ T6609] loop0: detected capacity change from 0 to 32768 [ 159.495971][ T6609] [ 159.495971][ T6609] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 159.495971][ T6609] [ 159.518817][ T6609] Bad index:-128 of stbl[1] in dtroot [ 159.518817][ T6609] [ 159.518833][ T6609] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 159.518833][ T6609] [ 159.523174][ C1] ================================================================== [ 159.523188][ C1] BUG: KASAN: slab-use-after-free in lbmIODone+0x1312/0x16c0 [ 159.523219][ C1] Read of size 4 at addr ffff888035cca008 by task ksoftirqd/1/30 [ 159.523235][ C1] [ 159.523260][ C1] CPU: 1 UID: 0 PID: 30 Comm: ksoftirqd/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 159.523282][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 159.523299][ C1] Call Trace: [ 159.523306][ C1] [ 159.523314][ C1] dump_stack_lvl+0xe8/0x150 [ 159.523336][ C1] print_address_description+0x55/0x1e0 [ 159.523358][ C1] ? lbmIODone+0x1312/0x16c0 [ 159.523378][ C1] print_report+0x58/0x70 [ 159.523396][ C1] kasan_report+0x117/0x150 [ 159.523421][ C1] ? lbmIODone+0x1312/0x16c0 [ 159.523446][ C1] lbmIODone+0x1312/0x16c0 [ 159.523467][ C1] ? blkg_put+0x22/0x240 [ 159.523492][ C1] ? blkg_put+0x22/0x240 [ 159.523517][ C1] ? blkg_put+0x18d/0x240 [ 159.523541][ C1] ? bio_endio+0x989/0x9d0 [ 159.523561][ C1] blk_update_request+0x57e/0xe60 [ 159.523588][ C1] blk_mq_end_request+0x3e/0x70 [ 159.523607][ C1] blk_done_softirq+0x10a/0x160 [ 159.523626][ C1] handle_softirqs+0x1de/0x6d0 [ 159.523649][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 159.523668][ C1] run_ksoftirqd+0x52/0x180 [ 159.523689][ C1] smpboot_thread_fn+0x541/0xa50 [ 159.523710][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 159.523733][ C1] kthread+0x388/0x470 [ 159.523754][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 159.523773][ C1] ? __pfx_kthread+0x10/0x10 [ 159.523794][ C1] ret_from_fork+0x514/0xb70 [ 159.523815][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 159.523831][ C1] ? __switch_to+0xc79/0x1410 [ 159.523855][ C1] ? __pfx_kthread+0x10/0x10 [ 159.523876][ C1] ret_from_fork_asm+0x1a/0x30 [ 159.523903][ C1] [ 159.523910][ C1] [ 159.523919][ C1] Allocated by task 6609: [ 159.523934][ C1] kasan_save_track+0x3e/0x80 [ 159.523949][ C1] __kasan_kmalloc+0x93/0xb0 [ 159.523964][ C1] __kmalloc_cache_noprof+0x3a6/0x690 [ 159.523981][ C1] lmLogInit+0x3e5/0x1a00 [ 159.523999][ C1] lmLogOpen+0x4e1/0xfa0 [ 159.524015][ C1] jfs_mount_rw+0xee/0x670 [ 159.524031][ C1] jfs_fill_super+0x754/0xd80 [ 159.524052][ C1] get_tree_bdev_flags+0x431/0x4f0 [ 159.524070][ C1] vfs_get_tree+0x92/0x2a0 [ 159.524086][ C1] do_new_mount+0x341/0xd30 [ 159.524105][ C1] __se_sys_mount+0x31d/0x420 [ 159.524129][ C1] do_syscall_64+0x15f/0xf80 [ 159.524144][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 159.524159][ C1] [ 159.524163][ C1] Freed by task 6609: [ 159.524171][ C1] kasan_save_track+0x3e/0x80 [ 159.524184][ C1] kasan_save_free_info+0x46/0x50 [ 159.524207][ C1] __kasan_slab_free+0x5c/0x80 [ 159.524222][ C1] kfree+0x1c5/0x6c0 [ 159.524236][ C1] lmLogShutdown+0x456/0x850 [ 159.524254][ C1] lmLogClose+0x28a/0x520 [ 159.524269][ C1] jfs_umount+0x2fb/0x3d0 [ 159.524286][ C1] jfs_fill_super+0x9c5/0xd80 [ 159.524306][ C1] get_tree_bdev_flags+0x431/0x4f0 [ 159.524322][ C1] vfs_get_tree+0x92/0x2a0 [ 159.524339][ C1] do_new_mount+0x341/0xd30 [ 159.524363][ C1] __se_sys_mount+0x31d/0x420 [ 159.524387][ C1] do_syscall_64+0x15f/0xf80 [ 159.524400][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 159.524415][ C1] [ 159.524419][ C1] The buggy address belongs to the object at ffff888035cca000 [ 159.524419][ C1] which belongs to the cache kmalloc-256 of size 256 [ 159.524434][ C1] The buggy address is located 8 bytes inside of [ 159.524434][ C1] freed 256-byte region [ffff888035cca000, ffff888035cca100) [ 159.524453][ C1] [ 159.524456][ C1] The buggy address belongs to the physical page: [ 159.524473][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x35cca [ 159.524488][ C1] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 159.524502][ C1] flags: 0x80000000000040(head|node=0|zone=1) [ 159.524521][ C1] page_type: f5(slab) [ 159.524537][ C1] raw: 0080000000000040 ffff88801a00bb40 dead000000000100 dead000000000122 [ 159.524552][ C1] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 159.524568][ C1] head: 0080000000000040 ffff88801a00bb40 dead000000000100 dead000000000122 [ 159.524582][ C1] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 159.524596][ C1] head: 0080000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 159.524609][ C1] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002 [ 159.524616][ C1] page dumped because: kasan: bad access detected [ 159.524628][ C1] page_owner tracks the page as allocated [ 159.524634][ C1] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 19355812055, free_ts 0 [ 159.524662][ C1] post_alloc_hook+0x231/0x280 [ 159.524679][ C1] get_page_from_freelist+0x27c8/0x2840 [ 159.524697][ C1] __alloc_frozen_pages_noprof+0x18d/0x380 [ 159.524714][ C1] allocate_slab+0x77/0x660 [ 159.524732][ C1] refill_objects+0x33c/0x3d0 [ 159.524749][ C1] __pcs_replace_empty_main+0x373/0x720 [ 159.524769][ C1] __kmalloc_node_track_caller_noprof+0x60b/0x7e0 [ 159.524785][ C1] krealloc_node_align_noprof+0x19a/0x390 [ 159.524802][ C1] add_sysfs_param+0xd4/0xb80 [ 159.524816][ C1] kernel_add_sysfs_param+0x7f/0xe0 [ 159.524835][ C1] param_sysfs_builtin+0x199/0x250 [ 159.524853][ C1] param_sysfs_builtin_init+0x23/0x30 [ 159.524873][ C1] do_one_initcall+0x250/0x870 [ 159.524890][ C1] do_initcall_level+0x104/0x190 [ 159.524911][ C1] do_initcalls+0x59/0xa0 [ 159.524939][ C1] kernel_init_freeable+0x2a6/0x3e0 [ 159.524959][ C1] page_owner free stack trace missing [ 159.524966][ C1] [ 159.524970][ C1] Memory state around the buggy address: [ 159.524980][ C1] ffff888035cc9f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 159.524992][ C1] ffff888035cc9f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 159.525004][ C1] >ffff888035cca000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 159.525013][ C1] ^ [ 159.525020][ C1] ffff888035cca080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 159.525032][ C1] ffff888035cca100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 159.525041][ C1] ================================================================== [ 159.525738][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 159.525755][ C1] CPU: 1 UID: 0 PID: 30 Comm: ksoftirqd/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 159.525777][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 159.525788][ C1] Call Trace: [ 159.525795][ C1] [ 159.525803][ C1] vpanic+0x56c/0xa60 [ 159.525829][ C1] ? __pfx_vpanic+0x10/0x10 [ 159.525850][ C1] ? __pfx___schedule+0x10/0x10 [ 159.525878][ C1] panic+0xc5/0xd0 [ 159.525897][ C1] ? __pfx_panic+0x10/0x10 [ 159.525931][ C1] ? preempt_schedule_thunk+0x16/0x30 [ 159.525960][ C1] ? lbmIODone+0x1312/0x16c0 [ 159.525982][ C1] check_panic_on_warn+0x89/0xb0 [ 159.526007][ C1] ? lbmIODone+0x1312/0x16c0 [ 159.526028][ C1] end_report+0x73/0x170 [ 159.526048][ C1] ? lbmIODone+0x1312/0x16c0 [ 159.526069][ C1] kasan_report+0x128/0x150 [ 159.526089][ C1] ? lbmIODone+0x1312/0x16c0 [ 159.526114][ C1] lbmIODone+0x1312/0x16c0 [ 159.526133][ C1] ? blkg_put+0x22/0x240 [ 159.526155][ C1] ? blkg_put+0x22/0x240 [ 159.526177][ C1] ? blkg_put+0x18d/0x240 [ 159.526200][ C1] ? bio_endio+0x989/0x9d0 [ 159.526218][ C1] blk_update_request+0x57e/0xe60 [ 159.526241][ C1] blk_mq_end_request+0x3e/0x70 [ 159.526260][ C1] blk_done_softirq+0x10a/0x160 [ 159.526279][ C1] handle_softirqs+0x1de/0x6d0 [ 159.526301][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 159.526321][ C1] run_ksoftirqd+0x52/0x180 [ 159.526342][ C1] smpboot_thread_fn+0x541/0xa50 [ 159.526363][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 159.526387][ C1] kthread+0x388/0x470 [ 159.526410][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 159.526430][ C1] ? __pfx_kthread+0x10/0x10 [ 159.526453][ C1] ret_from_fork+0x514/0xb70 [ 159.526474][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 159.526493][ C1] ? __switch_to+0xc79/0x1410 [ 159.526518][ C1] ? __pfx_kthread+0x10/0x10 [ 159.526539][ C1] ret_from_fork_asm+0x1a/0x30 [ 159.526566][ C1] [ 159.527091][ C1] Kernel Offset: disabled