[ 137.934295][ T1305] ieee802154 phy0 wpan0: encryption failed: -22
[ 137.937423][ T1305] ieee802154 phy1 wpan1: encryption failed: -22
Warning: Permanently added '[localhost]:10199' (ED25519) to the list of known hosts.
2024/08/30 05:47:06 ignoring optional flag "sandboxArg"="0"
2024/08/30 05:47:07 parsed 1 programs
[ 156.641672][ T5363] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 162.623890][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 162.627333][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 162.680900][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 162.688752][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 166.823036][ T5412] chnl_net:caif_netlink_parms(): no params data found
[ 166.927364][ T5412] bridge0: port 1(bridge_slave_0) entered blocking state
[ 166.930316][ T5412] bridge0: port 1(bridge_slave_0) entered disabled state
[ 166.941805][ T5412] bridge_slave_0: entered allmulticast mode
[ 166.944969][ T5412] bridge_slave_0: entered promiscuous mode
[ 166.952496][ T5412] bridge0: port 2(bridge_slave_1) entered blocking state
[ 166.955353][ T5412] bridge0: port 2(bridge_slave_1) entered disabled state
[ 166.958903][ T5412] bridge_slave_1: entered allmulticast mode
[ 166.981057][ T5412] bridge_slave_1: entered promiscuous mode
[ 167.024268][ T5412] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 167.030636][ T5412] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 167.074411][ T5412] team0: Port device team_slave_0 added
[ 167.092798][ T5412] team0: Port device team_slave_1 added
[ 167.119407][ T5412] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 167.131781][ T5412] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 167.151572][ T5412] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 167.162604][ T5412] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 167.165134][ T5412] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 167.191700][ T5412] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 167.238906][ T5412] hsr_slave_0: entered promiscuous mode
[ 167.252488][ T5412] hsr_slave_1: entered promiscuous mode
[ 168.043831][ T5412] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 168.064235][ T5412] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 168.075260][ T5412] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 168.103752][ T5412] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 168.269615][ T5412] 8021q: adding VLAN 0 to HW filter on device bond0
[ 168.334219][ T5412] 8021q: adding VLAN 0 to HW filter on device team0
[ 168.342827][ T2919] bridge0: port 1(bridge_slave_0) entered blocking state
[ 168.346076][ T2919] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 168.367030][ T11] bridge0: port 2(bridge_slave_1) entered blocking state
[ 168.370214][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 168.827242][ T5412] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 168.947212][ T5412] veth0_vlan: entered promiscuous mode
[ 168.987490][ T5412] veth1_vlan: entered promiscuous mode
[ 169.068216][ T5412] veth0_macvtap: entered promiscuous mode
[ 169.098420][ T5412] veth1_macvtap: entered promiscuous mode
[ 169.142769][ T5412] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 169.172417][ T5412] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 169.192707][ T5412] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 169.215682][ T5412] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 169.218966][ T5412] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 169.233337][ T5412] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 169.564358][ T5172] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 169.570710][ T5172] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 169.575986][ T5172] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 169.582798][ T5172] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 169.585963][ T5172] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 169.588889][ T5172] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 169.656213][ T2919] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 169.808476][ T2919] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2024/08/30 05:47:32 executed programs: 0
[ 171.562499][ T5172] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 171.567045][ T5172] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 171.570566][ T5172] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 171.576313][ T5172] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 171.580233][ T5172] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 171.583674][ T5172] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 172.021255][ T5495] chnl_net:caif_netlink_parms(): no params data found
[ 172.099219][ T2919] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 172.281305][ T5495] bridge0: port 1(bridge_slave_0) entered blocking state
[ 172.292303][ T5495] bridge0: port 1(bridge_slave_0) entered disabled state
[ 172.295165][ T5495] bridge_slave_0: entered allmulticast mode
[ 172.323031][ T5495] bridge_slave_0: entered promiscuous mode
[ 172.328034][ T5495] bridge0: port 2(bridge_slave_1) entered blocking state
[ 172.333607][ T5495] bridge0: port 2(bridge_slave_1) entered disabled state
[ 172.336471][ T5495] bridge_slave_1: entered allmulticast mode
[ 172.363411][ T5495] bridge_slave_1: entered promiscuous mode
[ 172.425386][ T5495] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 172.447111][ T5495] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 172.515763][ T5495] team0: Port device team_slave_0 added
[ 172.520192][ T5495] team0: Port device team_slave_1 added
[ 172.596290][ T5495] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 172.598880][ T5495] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 172.652874][ T5495] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 172.665481][ T5495] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 172.668217][ T5495] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 172.699123][ T5495] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 172.805656][ T5495] hsr_slave_0: entered promiscuous mode
[ 172.808060][ T5495] hsr_slave_1: entered promiscuous mode
[ 172.823087][ T5495] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 172.827565][ T5495] Cannot create hsr debugfs directory
[ 173.614874][ T5172] Bluetooth: hci0: command tx timeout
[ 173.725824][ T2919] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 173.983821][ T2919] bridge_slave_1: left allmulticast mode
[ 173.986245][ T2919] bridge_slave_1: left promiscuous mode
[ 173.989245][ T2919] bridge0: port 2(bridge_slave_1) entered disabled state
[ 174.039507][ T2919] bridge_slave_0: left allmulticast mode
[ 174.051676][ T2919] bridge_slave_0: left promiscuous mode
[ 174.054042][ T2919] bridge0: port 1(bridge_slave_0) entered disabled state
[ 174.839653][ T2919] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 174.878668][ T2919] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 174.885634][ T2919] bond0 (unregistering): Released all slaves
[ 175.059296][ T2919] hsr_slave_0: left promiscuous mode
[ 175.081405][ T2919] hsr_slave_1: left promiscuous mode
[ 175.097420][ T2919] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 175.100318][ T2919] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 175.119395][ T2919] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 175.141633][ T2919] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 175.157985][ T2919] veth1_macvtap: left promiscuous mode
[ 175.160267][ T2919] veth0_macvtap: left promiscuous mode
[ 175.181748][ T2919] veth1_vlan: left promiscuous mode
[ 175.184040][ T2919] veth0_vlan: left promiscuous mode
[ 175.692764][ T5172] Bluetooth: hci0: command tx timeout
[ 176.035160][ T2919] team0 (unregistering): Port device team_slave_1 removed
[ 176.112871][ T2919] team0 (unregistering): Port device team_slave_0 removed
[ 176.800415][ T5495] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 176.834450][ T5495] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 176.887412][ T5495] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 176.913758][ T5495] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 177.495501][ T5495] 8021q: adding VLAN 0 to HW filter on device bond0
[ 177.569331][ T5495] 8021q: adding VLAN 0 to HW filter on device team0
[ 177.613744][ T12] bridge0: port 1(bridge_slave_0) entered blocking state
[ 177.616876][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 177.649173][ T12] bridge0: port 2(bridge_slave_1) entered blocking state
[ 177.652765][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 177.771910][ T5172] Bluetooth: hci0: command tx timeout
[ 178.426273][ T5495] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 178.542561][ T5495] veth0_vlan: entered promiscuous mode
[ 178.576741][ T5495] veth1_vlan: entered promiscuous mode
[ 178.655574][ T5495] veth0_macvtap: entered promiscuous mode
[ 178.687309][ T5495] veth1_macvtap: entered promiscuous mode
[ 178.735699][ T5495] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 178.765838][ T5495] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 178.816886][ T5495] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 178.820655][ T5495] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 178.826823][ T5495] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 178.830246][ T5495] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 179.034448][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 179.037474][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 179.119856][ T2919] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 179.134509][ T2919] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
2024/08/30 05:47:40 executed programs: 2
[ 179.852546][ T5172] Bluetooth: hci0: command tx timeout
[ 179.905021][ T5584] loop0: detected capacity change from 0 to 32768
[ 180.054548][ T5584] JBD2: Ignoring recovery information on journal
[ 180.136543][ T5584] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode.
[ 180.200730][ T24] audit: type=1800 audit(1724996861.119:2): pid=5584 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.15" name="file1" dev="loop0" ino=16946 res=0 errno=0
[ 180.305021][ T5495] ocfs2: Unmounting device (7,0) on (node local)
[ 180.920003][ T5598] loop0: detected capacity change from 0 to 32768
[ 180.959104][ T5598] JBD2: Ignoring recovery information on journal
[ 181.013622][ T5598] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode.
[ 181.036613][ T24] audit: type=1800 audit(1724996861.959:3): pid=5598 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.16" name="file1" dev="loop0" ino=16946 res=0 errno=0
[ 181.067746][ T5495] ocfs2: Unmounting device (7,0) on (node local)
[ 181.677768][ T5602] loop0: detected capacity change from 0 to 32768
[ 181.729222][ T5602] JBD2: Ignoring recovery information on journal
[ 181.773781][ T5602] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode.
[ 181.793147][ T24] audit: type=1800 audit(1724996862.719:4): pid=5602 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.17" name="file1" dev="loop0" ino=16946 res=0 errno=0
[ 181.816997][ T5495] ocfs2: Unmounting device (7,0) on (node local)
[ 182.455317][ T5606] loop0: detected capacity change from 0 to 32768
[ 182.530946][ T5606] JBD2: Ignoring recovery information on journal
[ 182.578146][ T5606] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode.
[ 182.595616][ T24] audit: type=1800 audit(1724996863.519:5): pid=5606 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.18" name="file1" dev="loop0" ino=16946 res=0 errno=0
[ 182.620883][ T5495] ocfs2: Unmounting device (7,0) on (node local)
[ 183.234057][ T5610] loop0: detected capacity change from 0 to 32768
[ 183.268098][ T5610] JBD2: Ignoring recovery information on journal
[ 183.335223][ T5610] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode.
[ 183.361874][ T24] audit: type=1800 audit(1724996864.279:6): pid=5610 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.19" name="file1" dev="loop0" ino=16946 res=0 errno=0
[ 183.386278][ T5495] ocfs2: Unmounting device (7,0) on (node local)
[ 183.972443][ T5614] loop0: detected capacity change from 0 to 32768
[ 184.021632][ T5614] JBD2: Ignoring recovery information on journal
[ 184.053339][ T5614] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode.
[ 184.091075][ T5495] ocfs2: Unmounting device (7,0) on (node local)
[ 184.094959][ T24] audit: type=1800 audit(1724996864.999:7): pid=5614 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.20" name="file1" dev="loop0" ino=16946 res=0 errno=0
[ 184.713076][ T5618] loop0: detected capacity change from 0 to 32768
[ 184.775120][ T5618] JBD2: Ignoring recovery information on journal
[ 184.816312][ T5618] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode.
[ 184.830832][ T24] audit: type=1800 audit(1724996865.749:8): pid=5618 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.21" name="file1" dev="loop0" ino=16946 res=0 errno=0
[ 184.864032][ T5495] ocfs2: Unmounting device (7,0) on (node local)
2024/08/30 05:47:45 executed programs: 9
[ 185.505144][ T5622] loop0: detected capacity change from 0 to 32768
[ 185.546133][ T5622] JBD2: Ignoring recovery information on journal
[ 185.603767][ T5622] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode.
[ 185.610456][ T5622] ==================================================================
[ 185.613687][ T5622] BUG: KASAN: use-after-free in ocfs2_search_dirblock+0x26b/0x830
[ 185.617027][ T5622] Read of size 1 at addr ffff888012612982 by task syz.0.22/5622
[ 185.620965][ T5622]
[ 185.621983][ T5622] CPU: 0 UID: 0 PID: 5622 Comm: syz.0.22 Not tainted 6.11.0-rc5-syzkaller-00176-g20371ba12063 #0
[ 185.626635][ T5622] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 185.631290][ T5622] Call Trace:
[ 185.632720][ T5622]
[ 185.633919][ T5622] dump_stack_lvl+0x241/0x360
[ 185.635883][ T5622] ? __pfx_dump_stack_lvl+0x10/0x10
[ 185.637932][ T5622] ? __pfx__printk+0x10/0x10
[ 185.639709][ T5622] ? _printk+0xd5/0x120
[ 185.641201][ T5622] ? __virt_addr_valid+0x183/0x530
[ 185.642994][ T5622] ? __virt_addr_valid+0x183/0x530
[ 185.645120][ T5622] print_report+0x169/0x550
[ 185.647332][ T5622] ? __virt_addr_valid+0x183/0x530
[ 185.649765][ T5622] ? __virt_addr_valid+0x183/0x530
[ 185.652092][ T5622] ? __virt_addr_valid+0x45f/0x530
[ 185.654176][ T5622] ? __phys_addr+0xba/0x170
[ 185.655935][ T5622] ? ocfs2_search_dirblock+0x26b/0x830
[ 185.658047][ T5622] kasan_report+0x143/0x180
[ 185.659878][ T5622] ? ocfs2_search_dirblock+0x26b/0x830
[ 185.662052][ T5622] ocfs2_search_dirblock+0x26b/0x830
[ 185.664246][ T5622] ? ocfs2_read_inode_block+0x14c/0x1e0
[ 185.666555][ T5622] ? __pfx_ocfs2_search_dirblock+0x10/0x10
[ 185.669283][ T5622] ? validate_chain+0x11e/0x5900
[ 185.671539][ T5622] ocfs2_find_entry+0x1169/0x2780
[ 185.673891][ T5622] ? mark_lock+0x9a/0x350
[ 185.675612][ T5622] ? __lock_acquire+0x137a/0x2040
[ 185.677590][ T5622] ? __pfx_ocfs2_find_entry+0x10/0x10
[ 185.679716][ T5622] ? __pfx_lock_acquire+0x10/0x10
[ 185.681790][ T5622] ? ocfs2_inode_lock_full_nested+0x17b/0x1c10
[ 185.684307][ T5622] ? __pfx_lock_release+0x10/0x10
[ 185.686414][ T5622] ? do_raw_spin_lock+0x14f/0x370
[ 185.688875][ T5622] ? do_raw_spin_unlock+0x58/0x8b0
[ 185.691382][ T5622] ? _raw_spin_unlock+0x28/0x50
[ 185.693420][ T5622] ? ocfs2_inode_lock_full_nested+0xb2f/0x1c10
[ 185.695735][ T5622] ? __pfx_ocfs2_inode_lock_full_nested+0x10/0x10
[ 185.698163][ T5622] ocfs2_find_files_on_disk+0xff/0x360
[ 185.700453][ T5622] ocfs2_lookup_ino_from_name+0xb1/0x1e0
[ 185.702774][ T5622] ? __pfx_ocfs2_lookup_ino_from_name+0x10/0x10
[ 185.705522][ T5622] ocfs2_lookup+0x292/0xa60
[ 185.707591][ T5622] ? __pfx_ocfs2_lookup+0x10/0x10
[ 185.709715][ T5622] ? from_kgid+0x1a7/0x730
[ 185.711446][ T5622] ? make_vfsgid+0x46/0x90
[ 185.713187][ T5622] ? HAS_UNMAPPED_ID+0xf9/0x150
[ 185.715101][ T5622] ? inode_permission+0xff/0x460
[ 185.717238][ T5622] ? __pfx_ocfs2_permission+0x10/0x10
[ 185.719803][ T5622] ? bpf_lsm_inode_create+0x9/0x10
[ 185.722265][ T5622] ? security_inode_create+0xc2/0x110
[ 185.724580][ T5622] ? __pfx_ocfs2_lookup+0x10/0x10
[ 185.726542][ T5622] path_openat+0x11cc/0x3470
[ 185.728335][ T5622] ? __pfx_path_openat+0x10/0x10
[ 185.730320][ T5622] do_filp_open+0x235/0x490
[ 185.732066][ T5622] ? __pfx_do_filp_open+0x10/0x10
[ 185.734124][ T5622] ? _raw_spin_unlock+0x28/0x50
[ 185.736219][ T5622] ? alloc_fd+0x5a1/0x640
[ 185.738115][ T5622] do_sys_openat2+0x13e/0x1d0
[ 185.740152][ T5622] ? __pfx_do_sys_openat2+0x10/0x10
[ 185.742404][ T5622] __x64_sys_openat+0x247/0x2a0
[ 185.744558][ T5622] ? __pfx___x64_sys_openat+0x10/0x10
[ 185.746688][ T5622] ? do_syscall_64+0x100/0x230
[ 185.748467][ T5622] ? do_syscall_64+0xb6/0x230
[ 185.750114][ T5622] do_syscall_64+0xf3/0x230
[ 185.751647][ T5622] ? clear_bhb_loop+0x35/0x90
[ 185.753609][ T5622] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 185.756161][ T5622] RIP: 0033:0x7fb2f9d799b9
[ 185.758298][ T5622] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 185.766116][ T5622] RSP: 002b:00007fb2fac37038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 185.769453][ T5622] RAX: ffffffffffffffda RBX: 00007fb2f9f15f80 RCX: 00007fb2f9d799b9
[ 185.773143][ T5622] RDX: 0000000000105042 RSI: 0000000020000080 RDI: ffffffffffffff9c
[ 185.777062][ T5622] RBP: 00007fb2f9de78d8 R08: 0000000000000000 R09: 0000000000000000
[ 185.781120][ T5622] R10: 00000000000001ff R11: 0000000000000246 R12: 0000000000000000
[ 185.784078][ T5622] R13: 0000000000000000 R14: 00007fb2f9f15f80 R15: 00007ffe1c930d18
[ 185.787067][ T5622]
[ 185.788323][ T5622]
[ 185.789300][ T5622] The buggy address belongs to the physical page:
[ 185.791740][ T5622] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x30 pfn:0x12612
[ 185.795510][ T5622] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 185.799079][ T5622] raw: 00fff00000000000 dead000000000100 dead000000000122 0000000000000000
[ 185.802548][ T5622] raw: 0000000000000030 0000000000000000 00000000ffffffff 0000000000000000
[ 185.805871][ T5622] page dumped because: kasan: bad access detected
[ 185.808352][ T5622] page_owner tracks the page as freed
[ 185.810448][ T5622] page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 5618, tgid 5617 (syz.0.21), ts 184440624784, free_ts 184907464877
[ 185.818375][ T5622] post_alloc_hook+0x1f3/0x230
[ 185.820623][ T5622] get_page_from_freelist+0x2e4c/0x2f10
[ 185.822796][ T5622] __alloc_pages_noprof+0x256/0x6c0
[ 185.824836][ T5622] alloc_pages_mpol_noprof+0x3e8/0x680
[ 185.826966][ T5622] folio_alloc_mpol_noprof+0x36/0x50
[ 185.828892][ T5622] shmem_alloc_and_add_folio+0x2cf/0x14f0
[ 185.831097][ T5622] shmem_get_folio_gfp+0x8dc/0x2370
[ 185.833173][ T5622] shmem_write_begin+0x170/0x4d0
[ 185.835469][ T5622] generic_perform_write+0x399/0x840
[ 185.838239][ T5622] shmem_file_write_iter+0xfc/0x120
[ 185.840786][ T5622] vfs_write+0xa72/0xc90
[ 185.842379][ T5622] ksys_write+0x1a0/0x2c0
[ 185.844005][ T5622] do_syscall_64+0xf3/0x230
[ 185.845748][ T5622] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 185.847936][ T5622] page last free pid 5495 tgid 5495 stack trace:
[ 185.850339][ T5622] free_unref_folios+0x103a/0x1b00
[ 185.852391][ T5622] folios_put_refs+0x76e/0x860
[ 185.854380][ T5622] shmem_undo_range+0x6de/0x1df0
[ 185.856414][ T5622] shmem_evict_inode+0x29b/0xa80
[ 185.858584][ T5622] evict+0x532/0x950
[ 185.860507][ T5622] __dentry_kill+0x20d/0x630
[ 185.862554][ T5622] dput+0x19f/0x2b0
[ 185.864197][ T5622] __fput+0x5f8/0x8a0
[ 185.865765][ T5622] task_work_run+0x24f/0x310
[ 185.867565][ T5622] syscall_exit_to_user_mode+0x168/0x370
[ 185.869780][ T5622] do_syscall_64+0x100/0x230
[ 185.871624][ T5622] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 185.874141][ T5622]
[ 185.875256][ T5622] Memory state around the buggy address:
[ 185.877842][ T5622] ffff888012612880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 185.881328][ T5622] ffff888012612900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 185.884430][ T5622] >ffff888012612980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 185.887522][ T5622] ^
[ 185.889003][ T5622] ffff888012612a00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 185.892341][ T5622] ffff888012612a80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 185.897007][ T5622] ==================================================================
[ 186.232764][ T5622] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 186.236421][ T5622] CPU: 0 UID: 0 PID: 5622 Comm: syz.0.22 Not tainted 6.11.0-rc5-syzkaller-00176-g20371ba12063 #0
[ 186.240848][ T5622] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 186.244978][ T5622] Call Trace:
[ 186.246258][ T5622]
[ 186.247423][ T5622] dump_stack_lvl+0x241/0x360
[ 186.249338][ T5622] ? __pfx_dump_stack_lvl+0x10/0x10
[ 186.251518][ T5622] ? __pfx__printk+0x10/0x10
[ 186.253540][ T5622] ? preempt_schedule+0xe1/0xf0
[ 186.255897][ T5622] ? vscnprintf+0x5d/0x90
[ 186.257876][ T5622] panic+0x349/0x860
[ 186.259520][ T5622] ? check_panic_on_warn+0x21/0xb0
[ 186.261548][ T5622] ? __pfx_panic+0x10/0x10
[ 186.263338][ T5622] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 186.265772][ T5622] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 186.268472][ T5622] ? print_report+0x502/0x550
[ 186.270769][ T5622] check_panic_on_warn+0x86/0xb0
[ 186.273258][ T5622] ? ocfs2_search_dirblock+0x26b/0x830
[ 186.275585][ T5622] end_report+0x77/0x160
[ 186.277208][ T5622] kasan_report+0x154/0x180
[ 186.278956][ T5622] ? ocfs2_search_dirblock+0x26b/0x830
[ 186.281047][ T5622] ocfs2_search_dirblock+0x26b/0x830
[ 186.283115][ T5622] ? ocfs2_read_inode_block+0x14c/0x1e0
[ 186.285310][ T5622] ? __pfx_ocfs2_search_dirblock+0x10/0x10
[ 186.288149][ T5622] ? validate_chain+0x11e/0x5900
[ 186.290888][ T5622] ocfs2_find_entry+0x1169/0x2780
[ 186.293322][ T5622] ? mark_lock+0x9a/0x350
[ 186.295059][ T5622] ? __lock_acquire+0x137a/0x2040
[ 186.297059][ T5622] ? __pfx_ocfs2_find_entry+0x10/0x10
[ 186.299172][ T5622] ? __pfx_lock_acquire+0x10/0x10
[ 186.301169][ T5622] ? ocfs2_inode_lock_full_nested+0x17b/0x1c10
[ 186.303618][ T5622] ? __pfx_lock_release+0x10/0x10
[ 186.305585][ T5622] ? do_raw_spin_lock+0x14f/0x370
[ 186.307738][ T5622] ? do_raw_spin_unlock+0x58/0x8b0
[ 186.310385][ T5622] ? _raw_spin_unlock+0x28/0x50
[ 186.312959][ T5622] ? ocfs2_inode_lock_full_nested+0xb2f/0x1c10
[ 186.315514][ T5622] ? __pfx_ocfs2_inode_lock_full_nested+0x10/0x10
[ 186.317999][ T5622] ocfs2_find_files_on_disk+0xff/0x360
[ 186.320147][ T5622] ocfs2_lookup_ino_from_name+0xb1/0x1e0
[ 186.322397][ T5622] ? __pfx_ocfs2_lookup_ino_from_name+0x10/0x10
[ 186.324810][ T5622] ocfs2_lookup+0x292/0xa60
[ 186.326873][ T5622] ? __pfx_ocfs2_lookup+0x10/0x10
[ 186.329501][ T5622] ? from_kgid+0x1a7/0x730
[ 186.331933][ T5622] ? make_vfsgid+0x46/0x90
[ 186.333775][ T5622] ? HAS_UNMAPPED_ID+0xf9/0x150
[ 186.335657][ T5622] ? inode_permission+0xff/0x460
[ 186.337582][ T5622] ? __pfx_ocfs2_permission+0x10/0x10
[ 186.339649][ T5622] ? bpf_lsm_inode_create+0x9/0x10
[ 186.341715][ T5622] ? security_inode_create+0xc2/0x110
[ 186.344020][ T5622] ? __pfx_ocfs2_lookup+0x10/0x10
[ 186.346400][ T5622] path_openat+0x11cc/0x3470
[ 186.348727][ T5622] ? __pfx_path_openat+0x10/0x10
[ 186.350880][ T5622] do_filp_open+0x235/0x490
[ 186.352695][ T5622] ? __pfx_do_filp_open+0x10/0x10
[ 186.354657][ T5622] ? _raw_spin_unlock+0x28/0x50
[ 186.356537][ T5622] ? alloc_fd+0x5a1/0x640
[ 186.358250][ T5622] do_sys_openat2+0x13e/0x1d0
[ 186.360185][ T5622] ? __pfx_do_sys_openat2+0x10/0x10
[ 186.362372][ T5622] __x64_sys_openat+0x247/0x2a0
[ 186.364910][ T5622] ? __pfx___x64_sys_openat+0x10/0x10
[ 186.367506][ T5622] ? do_syscall_64+0x100/0x230
[ 186.369860][ T5622] ? do_syscall_64+0xb6/0x230
[ 186.371711][ T5622] do_syscall_64+0xf3/0x230
[ 186.373531][ T5622] ? clear_bhb_loop+0x35/0x90
[ 186.375333][ T5622] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 186.377611][ T5622] RIP: 0033:0x7fb2f9d799b9
[ 186.379393][ T5622] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 186.388115][ T5622] RSP: 002b:00007fb2fac37038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 186.391598][ T5622] RAX: ffffffffffffffda RBX: 00007fb2f9f15f80 RCX: 00007fb2f9d799b9
[ 186.394624][ T5622] RDX: 0000000000105042 RSI: 0000000020000080 RDI: ffffffffffffff9c
[ 186.397726][ T5622] RBP: 00007fb2f9de78d8 R08: 0000000000000000 R09: 0000000000000000
[ 186.400937][ T5622] R10: 00000000000001ff R11: 0000000000000246 R12: 0000000000000000
[ 186.404866][ T5622] R13: 0000000000000000 R14: 00007fb2f9f15f80 R15: 00007ffe1c930d18
[ 186.408496][ T5622]
[ 186.409976][ T5622] Kernel Offset: disabled
[ 186.411678][ T5622] Rebooting in 86400 seconds..