[ 487.584260][ T8847] loop4: detected capacity change from 0 to 32768 [ 488.093178][ T8850] loop0: detected capacity change from 0 to 32768 [ 488.176137][ T36] kauditd_printk_skb: 1 callbacks suppressed [ 488.176154][ T36] audit: type=1800 audit(1777987279.182:672): pid=8850 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.0.687" name="file1" dev="loop0" ino=7 res=0 errno=0 [ 488.317344][ T8852] loop1: detected capacity change from 0 to 32768 [ 488.435802][ T36] audit: type=1800 audit(1777987279.442:673): pid=8852 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.1.689" name="file1" dev="loop1" ino=7 res=0 errno=0 [ 488.821748][ T8855] loop3: detected capacity change from 0 to 32768 [ 490.514546][ T165] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 490.722844][ T165] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 490.925120][ T165] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 491.146204][ T165] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 491.757572][ T165] bridge_slave_1: left allmulticast mode [ 491.757617][ T165] bridge_slave_1: left promiscuous mode [ 491.757892][ T165] bridge0: port 2(bridge_slave_1) entered disabled state [ 491.838203][ T165] bridge_slave_0: left allmulticast mode [ 491.838228][ T165] bridge_slave_0: left promiscuous mode [ 491.838423][ T165] bridge0: port 1(bridge_slave_0) entered disabled state [ 492.599241][ T165] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 492.678625][ T165] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 492.720184][ T165] bond0 (unregistering): Released all slaves [ 492.738712][ T5256] 8021q: adding VLAN 0 to HW filter on device eth1 Warning: Permanently added '10.128.1.159' (ED25519) to the list of known hosts. executing program executing program executing program executing program executing program [ 494.488007][ T8897] loop2: detected capacity change from 0 to 32768 [ 494.596866][ T36] audit: type=1800 audit(1777987285.602:674): pid=8897 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor242" name="file1" dev="loop2" ino=7 res=0 errno=0 [ 494.650894][ T8899] loop4: detected capacity change from 0 to 32768 [ 494.692824][ T5256] 8021q: adding VLAN 0 to HW filter on device eth2 [ 494.779719][ T36] audit: type=1800 audit(1777987285.792:675): pid=8899 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor242" name="file1" dev="loop4" ino=7 res=0 errno=0 [ 494.834270][ T8901] loop0: detected capacity change from 0 to 32768 [ 494.974781][ T36] audit: type=1800 audit(1777987285.982:676): pid=8901 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor242" name="file1" dev="loop0" ino=7 res=0 errno=0 [ 495.047239][ T165] hsr_slave_0: left promiscuous mode [ 495.089350][ T165] hsr_slave_1: left promiscuous mode [ 495.090388][ T165] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 495.090413][ T165] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 495.148853][ T165] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 495.148880][ T165] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 495.310952][ T8907] loop3: detected capacity change from 0 to 32768 [ 495.331159][ T165] veth1_macvtap: left promiscuous mode [ 495.331265][ T165] veth0_macvtap: left promiscuous mode [ 495.331496][ T165] veth1_vlan: left promiscuous mode [ 495.331648][ T165] veth0_vlan: left promiscuous mode [ 495.391253][ T36] audit: type=1800 audit(1777987286.392:677): pid=8907 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor242" name="file1" dev="loop3" ino=7 res=0 errno=0 [ 495.446911][ T8904] loop1: detected capacity change from 0 to 32768 [ 495.534596][ T36] audit: type=1800 audit(1777987286.542:678): pid=8904 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor242" name="file1" dev="loop1" ino=7 res=0 errno=0 executing program executing program [ 496.031876][ C0] ================================================================== [ 496.031895][ C0] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0x40/0x60 [ 496.031934][ C0] Read of size 1 at addr ffff88802a964100 by task kworker/u8:7/165 [ 496.031951][ C0] [ 496.031981][ C0] CPU: 0 UID: 0 PID: 165 Comm: kworker/u8:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 496.032008][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 496.032020][ C0] Workqueue: netns cleanup_net [ 496.032053][ C0] Call Trace: [ 496.032061][ C0] [ 496.032069][ C0] dump_stack_lvl+0xe8/0x150 [ 496.032093][ C0] print_address_description+0x55/0x1e0 [ 496.032115][ C0] ? _raw_spin_lock_irqsave+0x40/0x60 [ 496.032133][ C0] print_report+0x58/0x70 [ 496.032151][ C0] kasan_report+0x117/0x150 [ 496.032173][ C0] ? _raw_spin_lock_irqsave+0x40/0x60 [ 496.032192][ C0] ? rt_spin_lock+0x157/0x400 [ 496.032215][ C0] __kasan_check_byte+0x2a/0x40 [ 496.032234][ C0] lock_acquire+0x84/0x350 [ 496.032261][ C0] ? rcu_is_watching+0x15/0xb0 [ 496.032286][ C0] _raw_spin_lock_irqsave+0x40/0x60 [ 496.032305][ C0] ? rt_spin_lock+0x157/0x400 [ 496.032328][ C0] rt_spin_lock+0x157/0x400 [ 496.032351][ C0] ? __pfx_rt_spin_lock+0x10/0x10 [ 496.032379][ C0] __wake_up_common_lock+0x2f/0x1e0 [ 496.032405][ C0] blk_update_request+0x57e/0xe60 [ 496.032439][ C0] blk_mq_end_request+0x3e/0x70 [ 496.032459][ C0] blk_done_softirq+0x10a/0x160 [ 496.032478][ C0] handle_softirqs+0x1de/0x6d0 [ 496.032503][ C0] __local_bh_enable_ip+0x170/0x2b0 [ 496.032522][ C0] ? __fib6_clean_all+0xbd/0x610 [ 496.032544][ C0] __fib6_clean_all+0x4d1/0x610 [ 496.032566][ C0] ? __fib6_clean_all+0xbd/0x610 [ 496.032589][ C0] ? __pfx_fib6_ifdown+0x10/0x10 [ 496.032612][ C0] ? __pfx___fib6_clean_all+0x10/0x10 [ 496.032635][ C0] ? __pfx_fib6_clean_node+0x10/0x10 [ 496.032656][ C0] ? __pfx_fib6_ifdown+0x10/0x10 [ 496.032680][ C0] ? __lock_acquire+0x6b5/0x2cf0 [ 496.032706][ C0] rt6_disable_ip+0x11f/0x750 [ 496.032729][ C0] ? __pfx_rt6_disable_ip+0x10/0x10 [ 496.032749][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 496.032769][ C0] addrconf_ifdown+0x157/0x1aa0 [ 496.032790][ C0] ? lockdep_hardirqs_on+0x7a/0x110 [ 496.032811][ C0] ? tls_dev_event+0x72a/0xeb0 [ 496.032834][ C0] ? __pfx_addrconf_ifdown+0x10/0x10 [ 496.032861][ C0] addrconf_notify+0x1bc/0x1050 [ 496.032886][ C0] notifier_call_chain+0x1ad/0x3d0 [ 496.032913][ C0] netif_close_many+0x2ae/0x420 [ 496.032929][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 496.032950][ C0] ? __pfx_netif_close_many+0x10/0x10 [ 496.032972][ C0] unregister_netdevice_many_notify+0xb50/0x22b0 [ 496.033002][ C0] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 496.033028][ C0] ? unregister_netdevice_queue+0x19b/0x360 [ 496.033050][ C0] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 496.033072][ C0] ? batadv_meshif_destroy_netlink+0x3a3/0x4a0 [ 496.033098][ C0] default_device_exit_batch+0x981/0xa00 [ 496.033121][ C0] ? __pfx_netdev_run_todo+0x10/0x10 [ 496.033144][ C0] ? __pfx_default_device_exit_batch+0x10/0x10 [ 496.033169][ C0] ? __pfx_default_device_exit_batch+0x10/0x10 [ 496.033187][ C0] ops_undo_list+0x52b/0x940 [ 496.033208][ C0] ? rt_spin_unlock+0x160/0x200 [ 496.033232][ C0] ? __pfx_ops_undo_list+0x10/0x10 [ 496.033250][ C0] ? rt_spin_unlock+0x14f/0x200 [ 496.033275][ C0] ? idr_destroy+0x21b/0x2a0 [ 496.033292][ C0] ? rt_spin_unlock+0x160/0x200 [ 496.033321][ C0] cleanup_net+0x56e/0x800 [ 496.033341][ C0] ? __pfx_cleanup_net+0x10/0x10 [ 496.033364][ C0] ? process_scheduled_works+0xa70/0x1860 [ 496.033382][ C0] ? process_scheduled_works+0xa70/0x1860 [ 496.033402][ C0] process_scheduled_works+0xb5d/0x1860 [ 496.033439][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 496.033461][ C0] ? assign_work+0x3d5/0x5e0 [ 496.033482][ C0] worker_thread+0xa53/0xfc0 [ 496.033513][ C0] kthread+0x388/0x470 [ 496.033535][ C0] ? __pfx_worker_thread+0x10/0x10 [ 496.033553][ C0] ? __pfx_kthread+0x10/0x10 [ 496.033575][ C0] ret_from_fork+0x514/0xb70 [ 496.033596][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 496.033615][ C0] ? __switch_to+0xc79/0x1410 [ 496.033646][ C0] ? __pfx_kthread+0x10/0x10 [ 496.033668][ C0] ret_from_fork_asm+0x1a/0x30 [ 496.033697][ C0] [ 496.033704][ C0] [ 496.033713][ C0] Allocated by task 8907: [ 496.033723][ C0] kasan_save_track+0x3e/0x80 [ 496.033738][ C0] __kasan_kmalloc+0x93/0xb0 [ 496.033755][ C0] __kmalloc_cache_noprof+0x3a6/0x690 [ 496.033774][ C0] lmLogOpen+0x2d1/0xfa0 [ 496.033792][ C0] jfs_mount_rw+0xee/0x670 [ 496.033810][ C0] jfs_fill_super+0x754/0xd80 [ 496.033824][ C0] get_tree_bdev_flags+0x431/0x4f0 [ 496.033843][ C0] vfs_get_tree+0x92/0x2a0 [ 496.033860][ C0] do_new_mount+0x341/0xd30 [ 496.033882][ C0] __se_sys_mount+0x31d/0x420 [ 496.033903][ C0] do_syscall_64+0x15f/0xf80 [ 496.033921][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.033937][ C0] [ 496.033941][ C0] Freed by task 8892: [ 496.033949][ C0] kasan_save_track+0x3e/0x80 [ 496.033964][ C0] kasan_save_free_info+0x46/0x50 [ 496.033984][ C0] __kasan_slab_free+0x5c/0x80 [ 496.034001][ C0] kfree+0x1c5/0x6c0 [ 496.034015][ C0] lmLogClose+0x297/0x520 [ 496.034035][ C0] jfs_umount+0x304/0x3e0 [ 496.034052][ C0] jfs_put_super+0x8c/0x190 [ 496.034067][ C0] generic_shutdown_super+0x13d/0x2d0 [ 496.034083][ C0] kill_block_super+0x44/0x90 [ 496.034101][ C0] deactivate_locked_super+0xbc/0x130 [ 496.034116][ C0] cleanup_mnt+0x437/0x4d0 [ 496.034133][ C0] task_work_run+0x1d9/0x270 [ 496.034154][ C0] exit_to_user_mode_loop+0xed/0x480 [ 496.034174][ C0] do_syscall_64+0x33e/0xf80 [ 496.034190][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.034204][ C0] [ 496.034209][ C0] The buggy address belongs to the object at ffff88802a964000 [ 496.034209][ C0] which belongs to the cache kmalloc-2k of size 2048 [ 496.034224][ C0] The buggy address is located 256 bytes inside of [ 496.034224][ C0] freed 2048-byte region [ffff88802a964000, ffff88802a964800) [ 496.034241][ C0] [ 496.034245][ C0] The buggy address belongs to the physical page: [ 496.034258][ C0] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802a961000 pfn:0x2a960 [ 496.034278][ C0] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 496.034292][ C0] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 496.034313][ C0] page_type: f5(slab) [ 496.034331][ C0] raw: 0080000000000240 ffff88801a010000 ffffea0000ebf410 ffffea0001007a10 [ 496.034347][ C0] raw: ffff88802a961000 0000000800080007 00000000f5000000 0000000000000000 [ 496.034364][ C0] head: 0080000000000240 ffff88801a010000 ffffea0000ebf410 ffffea0001007a10 [ 496.034381][ C0] head: ffff88802a961000 0000000800080007 00000000f5000000 0000000000000000 [ 496.034397][ C0] head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 496.034412][ C0] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 496.034422][ C0] page dumped because: kasan: bad access detected [ 496.034440][ C0] page_owner tracks the page as allocated [ 496.034447][ C0] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 11357773279, free_ts 0 [ 496.034479][ C0] post_alloc_hook+0x231/0x280 [ 496.034498][ C0] get_page_from_freelist+0x27c8/0x2840 [ 496.034518][ C0] __alloc_frozen_pages_noprof+0x18d/0x380 [ 496.034539][ C0] allocate_slab+0x77/0x660 [ 496.034561][ C0] refill_objects+0x33c/0x3d0 [ 496.034580][ C0] __pcs_replace_empty_main+0x373/0x720 [ 496.034602][ C0] __kmalloc_cache_noprof+0x44e/0x690 [ 496.034621][ C0] hub_probe+0x571/0x3c30 [ 496.034641][ C0] usb_probe_interface+0x659/0xc70 [ 496.034659][ C0] really_probe+0x267/0xaf0 [ 496.034678][ C0] __driver_probe_device+0x1ef/0x380 [ 496.034695][ C0] driver_probe_device+0x4f/0x240 [ 496.034713][ C0] __device_attach_driver+0x279/0x430 [ 496.034732][ C0] bus_for_each_drv+0x25b/0x2f0 [ 496.034754][ C0] __device_attach+0x2c8/0x450 [ 496.034770][ C0] device_initial_probe+0xa1/0xd0 [ 496.034788][ C0] page_owner free stack trace missing [ 496.034798][ C0] [ 496.034803][ C0] Memory state around the buggy address: [ 496.034813][ C0] ffff88802a964000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 496.034824][ C0] ffff88802a964080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 496.034837][ C0] >ffff88802a964100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 496.034846][ C0] ^ [ 496.034855][ C0] ffff88802a964180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 496.034868][ C0] ffff88802a964200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 496.034877][ C0] ================================================================== [ 496.034891][ C0] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 496.034906][ C0] CPU: 0 UID: 0 PID: 165 Comm: kworker/u8:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 496.034928][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 496.034940][ C0] Workqueue: netns cleanup_net [ 496.034960][ C0] Call Trace: [ 496.034968][ C0] [ 496.034975][ C0] vpanic+0x56c/0xa60 [ 496.034998][ C0] ? __pfx_vpanic+0x10/0x10 [ 496.035023][ C0] panic+0xc5/0xd0 [ 496.035043][ C0] ? __pfx_panic+0x10/0x10 [ 496.035064][ C0] ? _raw_spin_lock_irqsave+0x40/0x60 [ 496.035082][ C0] ? rcu_is_watching+0x15/0xb0 [ 496.035107][ C0] ? _raw_spin_lock_irqsave+0x40/0x60 [ 496.035127][ C0] ? _raw_spin_lock_irqsave+0x40/0x60 [ 496.035146][ C0] check_panic_on_warn+0x89/0xb0 [ 496.035171][ C0] ? _raw_spin_lock_irqsave+0x40/0x60 [ 496.035189][ C0] end_report+0x73/0x170 [ 496.035208][ C0] ? _raw_spin_lock_irqsave+0x40/0x60 [ 496.035227][ C0] kasan_report+0x128/0x150 [ 496.035248][ C0] ? _raw_spin_lock_irqsave+0x40/0x60 [ 496.035269][ C0] ? rt_spin_lock+0x157/0x400 [ 496.035292][ C0] __kasan_check_byte+0x2a/0x40 [ 496.035311][ C0] lock_acquire+0x84/0x350 [ 496.035336][ C0] ? rcu_is_watching+0x15/0xb0 [ 496.035362][ C0] _raw_spin_lock_irqsave+0x40/0x60 [ 496.035381][ C0] ? rt_spin_lock+0x157/0x400 [ 496.035403][ C0] rt_spin_lock+0x157/0x400 [ 496.035438][ C0] ? __pfx_rt_spin_lock+0x10/0x10 [ 496.035466][ C0] __wake_up_common_lock+0x2f/0x1e0 [ 496.035491][ C0] blk_update_request+0x57e/0xe60 [ 496.035517][ C0] blk_mq_end_request+0x3e/0x70 [ 496.035538][ C0] blk_done_softirq+0x10a/0x160 [ 496.035559][ C0] handle_softirqs+0x1de/0x6d0 [ 496.035582][ C0] __local_bh_enable_ip+0x170/0x2b0 [ 496.035601][ C0] ? __fib6_clean_all+0xbd/0x610 [ 496.035623][ C0] __fib6_clean_all+0x4d1/0x610 [ 496.035645][ C0] ? __fib6_clean_all+0xbd/0x610 [ 496.035667][ C0] ? __pfx_fib6_ifdown+0x10/0x10 [ 496.035688][ C0] ? __pfx___fib6_clean_all+0x10/0x10 [ 496.035709][ C0] ? __pfx_fib6_clean_node+0x10/0x10 [ 496.035731][ C0] ? __pfx_fib6_ifdown+0x10/0x10 [ 496.035754][ C0] ? __lock_acquire+0x6b5/0x2cf0 [ 496.035779][ C0] rt6_disable_ip+0x11f/0x750 [ 496.035805][ C0] ? __pfx_rt6_disable_ip+0x10/0x10 [ 496.035828][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 496.035850][ C0] addrconf_ifdown+0x157/0x1aa0 [ 496.035872][ C0] ? lockdep_hardirqs_on+0x7a/0x110 [ 496.035892][ C0] ? tls_dev_event+0x72a/0xeb0 [ 496.035915][ C0] ? __pfx_addrconf_ifdown+0x10/0x10 [ 496.035941][ C0] addrconf_notify+0x1bc/0x1050 [ 496.035966][ C0] notifier_call_chain+0x1ad/0x3d0 [ 496.035993][ C0] netif_close_many+0x2ae/0x420 [ 496.036011][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 496.036032][ C0] ? __pfx_netif_close_many+0x10/0x10 [ 496.036054][ C0] unregister_netdevice_many_notify+0xb50/0x22b0 [ 496.036084][ C0] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 496.036110][ C0] ? unregister_netdevice_queue+0x19b/0x360 [ 496.036135][ C0] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 496.036159][ C0] ? batadv_meshif_destroy_netlink+0x3a3/0x4a0 [ 496.036184][ C0] default_device_exit_batch+0x981/0xa00 [ 496.036207][ C0] ? __pfx_netdev_run_todo+0x10/0x10 [ 496.036231][ C0] ? __pfx_default_device_exit_batch+0x10/0x10 [ 496.036256][ C0] ? __pfx_default_device_exit_batch+0x10/0x10 [ 496.036275][ C0] ops_undo_list+0x52b/0x940 [ 496.036295][ C0] ? rt_spin_unlock+0x160/0x200 [ 496.036319][ C0] ? __pfx_ops_undo_list+0x10/0x10 [ 496.036338][ C0] ? rt_spin_unlock+0x14f/0x200 [ 496.036362][ C0] ? idr_destroy+0x21b/0x2a0 [ 496.036379][ C0] ? rt_spin_unlock+0x160/0x200 [ 496.036403][ C0] cleanup_net+0x56e/0x800 [ 496.036429][ C0] ? __pfx_cleanup_net+0x10/0x10 [ 496.036451][ C0] ? process_scheduled_works+0xa70/0x1860 [ 496.036470][ C0] ? process_scheduled_works+0xa70/0x1860 [ 496.036490][ C0] process_scheduled_works+0xb5d/0x1860 [ 496.036521][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 496.036543][ C0] ? assign_work+0x3d5/0x5e0 [ 496.036563][ C0] worker_thread+0xa53/0xfc0 [ 496.036594][ C0] kthread+0x388/0x470 [ 496.036617][ C0] ? __pfx_worker_thread+0x10/0x10 [ 496.036635][ C0] ? __pfx_kthread+0x10/0x10 [ 496.036657][ C0] ret_from_fork+0x514/0xb70 [ 496.036678][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 496.036697][ C0] ? __switch_to+0xc79/0x1410 [ 496.036723][ C0] ? __pfx_kthread+0x10/0x10 [ 496.036745][ C0] ret_from_fork_asm+0x1a/0x30 [ 496.036773][ C0] [ 496.037633][ C0] Kernel Offset: disabled