Warning: Permanently added '10.128.10.26' (ED25519) to the list of known hosts. 1970/01/01 00:01:06 parsed 1 programs [ 67.892917][ T4452] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS [ 69.633615][ T7] cfg80211: failed to load regulatory.db [ 69.635236][ T2064] ieee802154 phy0 wpan0: encryption failed: -22 [ 69.636245][ T2064] ieee802154 phy1 wpan1: encryption failed: -22 [ 70.544442][ T4572] chnl_net:caif_netlink_parms(): no params data found [ 70.561150][ T4572] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.562953][ T4572] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.564541][ T4572] device bridge_slave_0 entered promiscuous mode [ 70.567260][ T4572] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.568541][ T4572] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.570197][ T4572] device bridge_slave_1 entered promiscuous mode [ 70.578203][ T4572] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.580668][ T4572] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.590437][ T4572] team0: Port device team_slave_0 added [ 70.592433][ T4572] team0: Port device team_slave_1 added [ 70.598579][ T4572] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.599717][ T4572] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 70.607136][ T4572] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.609577][ T4572] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.610754][ T4572] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 70.615363][ T4572] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.662773][ T4572] device hsr_slave_0 entered promiscuous mode [ 70.722028][ T4572] device hsr_slave_1 entered promiscuous mode [ 71.470264][ T4572] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 71.512745][ T4572] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 71.542883][ T4572] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 71.602785][ T4572] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 71.647712][ T4572] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.648891][ T4572] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.650200][ T4572] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.651415][ T4572] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.662356][ T136] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.663922][ T136] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.687409][ T4572] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.692241][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 71.693779][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 71.696664][ T4572] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.699158][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 71.700751][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 71.703944][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.704991][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.709182][ T1816] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 71.710903][ T1816] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 71.713575][ T1816] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.714755][ T1816] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.717637][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 71.720658][ T1816] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 71.724659][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 71.726720][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 71.730680][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 71.733493][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 71.736454][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 71.741071][ T4572] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 71.744658][ T4572] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 71.746973][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 71.748519][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 71.750398][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 71.753045][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 71.756933][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 71.805518][ T4572] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.808607][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 71.809993][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 71.814475][ T1816] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 71.816013][ T1816] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 71.825464][ T1816] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 71.826997][ T1816] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 71.828602][ T1816] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 71.830025][ T1816] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 71.833271][ T4572] device veth0_vlan entered promiscuous mode [ 71.836546][ T4572] device veth1_vlan entered promiscuous mode [ 71.844753][ T1816] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 71.846262][ T1816] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 71.847835][ T1816] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 71.849413][ T1816] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 71.852540][ T4572] device veth0_macvtap entered promiscuous mode [ 71.854962][ T4572] device veth1_macvtap entered promiscuous mode [ 71.860622][ T4572] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.862630][ T1816] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 71.864185][ T1816] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 71.865702][ T1816] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 71.867224][ T1816] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 71.870735][ T4572] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.883569][ T1816] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 71.886628][ T1816] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 71.889338][ T4572] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.890858][ T4572] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.892520][ T4572] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.895913][ T4572] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.977731][ T136] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.979110][ T136] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.980452][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 71.989360][ T136] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.990615][ T136] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.993051][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready 1970/01/01 00:01:12 executed programs: 0 [ 72.671188][ T4814] chnl_net:caif_netlink_parms(): no params data found [ 72.688825][ T4814] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.690179][ T4814] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.692208][ T4814] device bridge_slave_0 entered promiscuous mode [ 72.694589][ T4814] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.695833][ T4814] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.697409][ T4814] device bridge_slave_1 entered promiscuous mode [ 72.706077][ T4814] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.708663][ T4814] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.718518][ T4814] team0: Port device team_slave_0 added [ 72.720363][ T4814] team0: Port device team_slave_1 added [ 72.728093][ T4814] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.729354][ T4814] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.734030][ T4814] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.736460][ T4814] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 72.737552][ T4814] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.742116][ T4814] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.782815][ T4814] device hsr_slave_0 entered promiscuous mode [ 72.822011][ T4814] device hsr_slave_1 entered promiscuous mode [ 72.871733][ T4814] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 72.873064][ T4814] Cannot create hsr debugfs directory [ 72.910390][ T4814] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 74.671592][ T4186] Bluetooth: hci0: command 0x0409 tx timeout [ 75.005133][ T4814] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 76.752033][ T4190] Bluetooth: hci0: command 0x041b tx timeout [ 77.075360][ T4814] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 77.125753][ T4814] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 77.288092][ T4814] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 77.323644][ T4814] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 77.362765][ T4814] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 77.402870][ T4814] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 77.463633][ T4814] 8021q: adding VLAN 0 to HW filter on device bond0 [ 77.467205][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 77.468745][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 77.471227][ T4814] 8021q: adding VLAN 0 to HW filter on device team0 [ 77.473879][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 77.475524][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 77.477028][ T148] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.478182][ T148] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.479599][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 77.482101][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 77.483768][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 77.485231][ T136] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.486428][ T136] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.488857][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 77.491444][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 77.495104][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 77.497160][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 77.498832][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 77.501431][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 77.504843][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 77.507595][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 77.509111][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 77.512365][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 77.513988][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 77.516414][ T4814] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 77.567067][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 77.568406][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 77.572400][ T4814] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.578864][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 77.580531][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 77.586908][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 77.588476][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 77.590100][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 77.591589][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 77.593913][ T4814] device veth0_vlan entered promiscuous mode [ 77.597219][ T4814] device veth1_vlan entered promiscuous mode [ 77.605688][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 77.607256][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 77.608733][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 77.610313][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 77.614043][ T4814] device veth0_macvtap entered promiscuous mode [ 77.616605][ T4814] device veth1_macvtap entered promiscuous mode [ 77.621086][ T4814] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 77.623476][ T4814] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.625640][ T4814] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 77.626969][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 77.628518][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 77.630036][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 77.632236][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 77.634772][ T4814] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 77.636635][ T4814] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.638904][ T4814] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 77.640108][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 77.642513][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 77.645256][ T4814] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.646731][ T4814] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.648254][ T4814] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.649886][ T4814] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.668639][ T136] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.669975][ T136] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.675944][ T1816] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.676130][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 77.677157][ T1816] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.679851][ T1816] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready 1970/01/01 00:01:17 executed programs: 2 [ 77.793630][ T4981] loop0: detected capacity change from 0 to 32768 [ 77.805428][ T4981] [ 77.805428][ T4981] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 77.805428][ T4981] [ 77.810572][ T4981] read_mapping_page failed! [ 77.811359][ T4981] ERROR: (device loop0): txAbort: [ 77.811359][ T4981] [ 77.814521][ T4981] read_mapping_page failed! [ 77.815321][ T4981] ERROR: (device loop0): txAbort: [ 77.815321][ T4981] [ 77.817415][ T4981] read_mapping_page failed! [ 77.818207][ T4981] ERROR: (device loop0): txAbort: [ 77.818207][ T4981] [ 77.820468][ T4981] ================================================================== [ 77.821758][ T4981] BUG: KASAN: slab-out-of-bounds in dtSplitPage+0xd10/0x2928 [ 77.822957][ T4981] Read of size 1 at addr ffff0000de7ec055 by task syz.0.16/4981 [ 77.824229][ T4981] [ 77.824625][ T4981] CPU: 0 PID: 4981 Comm: syz.0.16 Not tainted syzkaller #0 [ 77.825904][ T4981] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 77.827515][ T4981] Call trace: [ 77.828207][ T4981] dump_backtrace+0x0/0x458 [ 77.828963][ T4981] show_stack+0x2c/0x3c [ 77.829660][ T4981] __dump_stack+0x30/0x40 [ 77.830367][ T4981] dump_stack_lvl+0xf4/0x15c [ 77.831110][ T4981] print_address_description+0x78/0x30c [ 77.832086][ T4981] kasan_report+0xec/0x158 [ 77.832848][ T4981] __asan_report_load1_noabort+0x44/0x50 [ 77.833754][ T4981] dtSplitPage+0xd10/0x2928 [ 77.834475][ T4981] dtInsert+0xc44/0x5614 [ 77.835197][ T4981] jfs_mkdir+0x600/0x910 [ 77.835929][ T4981] vfs_mkdir+0x314/0x4d4 [ 77.836645][ T4981] do_mkdirat+0x1c0/0x514 [ 77.837337][ T4981] __arm64_sys_mkdirat+0x90/0xa8 [ 77.838138][ T4981] invoke_syscall+0x98/0x2b0 [ 77.838870][ T4981] el0_svc_common+0x138/0x258 [ 77.839610][ T4981] do_el0_svc+0x58/0x13c [ 77.840317][ T4981] el0_svc+0x78/0x1d0 [ 77.841008][ T4981] el0t_64_sync_handler+0xcc/0xe4 [ 77.841907][ T4981] el0t_64_sync+0x1a0/0x1a4 [ 77.842705][ T4981] [ 77.843097][ T4981] Allocated by task 4981: [ 77.843812][ T4981] __kasan_slab_alloc+0x8c/0xcc [ 77.844676][ T4981] slab_post_alloc_hook+0x74/0x3f8 [ 77.845550][ T4981] kmem_cache_alloc+0x1d8/0x3d4 [ 77.846350][ T4981] jfs_alloc_inode+0x24/0x60 [ 77.847139][ T4981] iget_locked+0x178/0x710 [ 77.847903][ T4981] jfs_iget+0x30/0x3e4 [ 77.848616][ T4981] jfs_lookup+0x1c0/0x378 [ 77.849340][ T4981] __lookup_slow+0x25c/0x39c [ 77.850200][ T4981] lookup_slow+0x5c/0x80 [ 77.850922][ T4981] walk_component+0x2b0/0x3a8 [ 77.851729][ T4981] link_path_walk+0x590/0xbe0 [ 77.852505][ T4981] __filename_parentat+0x1d4/0x548 [ 77.853342][ T4981] do_renameat2+0x240/0xcfc [ 77.854135][ T4981] __arm64_sys_renameat2+0xe0/0xfc [ 77.855014][ T4981] invoke_syscall+0x98/0x2b0 [ 77.855779][ T4981] el0_svc_common+0x138/0x258 [ 77.856634][ T4981] do_el0_svc+0x58/0x13c [ 77.857354][ T4981] el0_svc+0x78/0x1d0 [ 77.857975][ T4981] el0t_64_sync_handler+0xcc/0xe4 [ 77.858793][ T4981] el0t_64_sync+0x1a0/0x1a4 [ 77.859506][ T4981] [ 77.859916][ T4981] The buggy address belongs to the object at ffff0000de7eb780 [ 77.859916][ T4981] which belongs to the cache jfs_ip of size 2240 [ 77.862289][ T4981] The buggy address is located 21 bytes to the right of [ 77.862289][ T4981] 2240-byte region [ffff0000de7eb780, ffff0000de7ec040) [ 77.864642][ T4981] The buggy address belongs to the page: [ 77.865595][ T4981] page:00000000b58d52ac refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11e7e8 [ 77.867350][ T4981] head:00000000b58d52ac order:3 compound_mapcount:0 compound_pincount:0 [ 77.868716][ T4981] memcg:ffff0000cf975101 [ 77.869497][ T4981] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 77.870947][ T4981] raw: 05ffc00000010200 0000000000000000 dead000000000122 ffff0000c68cb500 [ 77.872399][ T4981] raw: 0000000000000000 00000000800d000d 00000001ffffffff ffff0000cf975101 [ 77.873835][ T4981] page dumped because: kasan: bad access detected [ 77.874946][ T4981] [ 77.875337][ T4981] Memory state around the buggy address: [ 77.876288][ T4981] ffff0000de7ebf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 77.877699][ T4981] ffff0000de7ebf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 77.879101][ T4981] >ffff0000de7ec000: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 77.880495][ T4981] ^ [ 77.881661][ T4981] ffff0000de7ec080: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 [ 77.883031][ T4981] ffff0000de7ec100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 77.884521][ T4981] ================================================================== [ 77.885862][ T4981] Disabling lock debugging due to kernel taint [ 77.889336][ T4981] find_entry called with index = 0 [ 77.890243][ T4981] read_mapping_page failed! [ 77.890990][ T4981] ERROR: (device loop0): txAbort: [ 77.890990][ T4981] [ 77.894687][ T148] ERROR: (device loop0): diWrite: ixpxd invalid [ 77.894687][ T148] [ 77.896042][ T148] ERROR: (device loop0): txAbort: [ 77.896042][ T148] [ 77.897233][ T148] jfs_write_inode: jfs_commit_inode failed! [ 77.898529][ T148] [ 77.898529][ T148] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 77.898529][ T148] [ 77.900286][ T148] [ 77.900286][ T148] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 77.900286][ T148] [ 77.902300][ T4814] [ 77.902300][ T4814] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 77.902300][ T4814] [ 77.903990][ T248] [ 77.903990][ T248] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 77.903990][ T248] [ 77.905792][ T4814] [ 77.905792][ T4814] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 77.905792][ T4814] [ 78.038413][ T4983] loop0: detected capacity change from 0 to 32768 [ 78.073050][ T4983] [ 78.073050][ T4983] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 78.073050][ T4983] [ 78.076107][ T4983] read_mapping_page failed! [ 78.076964][ T4983] ERROR: (device loop0): txAbort: [ 78.076964][ T4983] [ 78.078626][ T4983] read_mapping_page failed! [ 78.079451][ T4983] ERROR: (device loop0): txAbort: [ 78.079451][ T4983] [ 78.081055][ T4983] read_mapping_page failed! [ 78.082763][ T4983] ERROR: (device loop0): txAbort: [ 78.082763][ T4983] [ 78.084281][ T4983] find_entry called with index = 0 [ 78.085132][ T4983] read_mapping_page failed! [ 78.085886][ T4983] ERROR: (device loop0): txAbort: [ 78.085886][ T4983] [ 78.089060][ T148] ERROR: (device loop0): diWrite: ixpxd invalid [ 78.089060][ T148] [ 78.090479][ T148] ERROR: (device loop0): txAbort: [ 78.090479][ T148] [ 78.092494][ T148] jfs_write_inode: jfs_commit_inode failed! [ 78.093631][ T148] [ 78.093631][ T148] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 78.093631][ T148] [ 78.095521][ T148] [ 78.095521][ T148] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 78.095521][ T148] [ 78.097584][ T247] [ 78.097584][ T247] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 78.097584][ T247] [ 78.099356][ T4814] [ 78.099356][ T4814] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 78.099356][ T4814] [ 78.101357][ T4814] [ 78.101357][ T4814] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 78.101357][ T4814] [ 78.229245][ T4985] loop0: detected capacity change from 0 to 32768 [ 78.272103][ T4985] [ 78.272103][ T4985] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 78.272103][ T4985] [ 78.275002][ T4985] read_mapping_page failed! [ 78.275781][ T4985] ERROR: (device loop0): txAbort: [ 78.275781][ T4985] [ 78.277428][ T4985] read_mapping_page failed! [ 78.278110][ T4985] ERROR: (device loop0): txAbort: [ 78.278110][ T4985] [ 78.279793][ T4985] read_mapping_page failed! [ 78.280563][ T4985] ERROR: (device loop0): txAbort: [ 78.280563][ T4985] [ 78.282709][ T4985] find_entry called with index = 0 [ 78.283558][ T4985] read_mapping_page failed! [ 78.284366][ T4985] ERROR: (device loop0): txAbort: [ 78.284366][ T4985] [ 78.287650][ T9] ERROR: (device loop0): diWrite: ixpxd invalid [ 78.287650][ T9] [ 78.289042][ T9] ERROR: (device loop0): txAbort: [ 78.289042][ T9] [ 78.290287][ T9] jfs_write_inode: jfs_commit_inode failed! [ 78.291379][ T9] [ 78.291379][ T9] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 78.291379][ T9] [ 78.293389][ T9] [ 78.293389][ T9] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 78.293389][ T9] [ 78.295392][ T248] [ 78.295392][ T248] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 78.295392][ T248] [ 78.297166][ T4814] [ 78.297166][ T4814] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 78.297166][ T4814] [ 78.299126][ T4814] [ 78.299126][ T4814] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 78.299126][ T4814] [ 78.459285][ T4987] loop0: detected capacity change from 0 to 32768 [ 78.502864][ T4987] [ 78.502864][ T4987] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 78.502864][ T4987] [ 78.506642][ T4987] read_mapping_page failed! [ 78.507483][ T4987] ERROR: (device loop0): txAbort: [ 78.507483][ T4987] [ 78.509143][ T4987] read_mapping_page failed! [ 78.509850][ T4987] ERROR: (device loop0): txAbort: [ 78.509850][ T4987] [ 78.511454][ T4987] read_mapping_page failed! [ 78.512565][ T4987] ERROR: (device loop0): txAbort: [ 78.512565][ T4987] [ 78.514219][ T4987] find_entry called with index = 0 [ 78.515079][ T4987] read_mapping_page failed! [ 78.515808][ T4987] ERROR: (device loop0): txAbort: [ 78.515808][ T4987] [ 78.519990][ T9] ERROR: (device loop0): diWrite: ixpxd invalid [ 78.519990][ T9] [ 78.521392][ T9] ERROR: (device loop0): txAbort: [ 78.521392][ T9] [ 78.523142][ T9] jfs_write_inode: jfs_commit_inode failed! [ 78.524226][ T9] [ 78.524226][ T9] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 78.524226][ T9] [ 78.526086][ T9] [ 78.526086][ T9] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 78.526086][ T9] [ 78.528189][ T248] [ 78.528189][ T248] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 78.528189][ T248] [ 78.530073][ T4814] [ 78.530073][ T4814] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 78.530073][ T4814] [ 78.532531][ T4814] [ 78.532531][ T4814] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 78.532531][ T4814] [ 78.659197][ T4989] loop0: detected capacity change from 0 to 32768 [ 78.716754][ T4989] [ 78.716754][ T4989] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 78.716754][ T4989] [ 78.719565][ T4989] read_mapping_page failed! [ 78.720526][ T4989] ERROR: (device loop0): txAbort: [ 78.720526][ T4989] [ 78.722072][ T4989] read_mapping_page failed! [ 78.722790][ T4989] ERROR: (device loop0): txAbort: [ 78.722790][ T4989] [ 78.724320][ T4989] read_mapping_page failed! [ 78.725041][ T4989] ERROR: (device loop0): txAbort: [ 78.725041][ T4989] [ 78.727201][ T4989] find_entry called with index = 0 [ 78.728056][ T4989] read_mapping_page failed! [ 78.728829][ T4989] ERROR: (device loop0): txAbort: [ 78.728829][ T4989] [ 78.732400][ T1816] ERROR: (device loop0): diWrite: ixpxd invalid [ 78.732400][ T1816] [ 78.733939][ T1816] ERROR: (device loop0): txAbort: [ 78.733939][ T1816] [ 78.735202][ T1816] jfs_write_inode: jfs_commit_inode failed! [ 78.736321][ T1816] [ 78.736321][ T1816] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 78.736321][ T1816] [ 78.738055][ T1816] [ 78.738055][ T1816] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 78.738055][ T1816] [ 78.739956][ T4814] [ 78.739956][ T4814] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 78.739956][ T4814] [ 78.743826][ T4814] [ 78.743826][ T4814] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 78.743826][ T4814] [ 78.747424][ T248] Unable to handle kernel paging request at virtual address dfff800000000006 [ 78.748945][ T248] Mem abort info: [ 78.749579][ T248] ESR = 0x0000000096000006 [ 78.750329][ T248] EC = 0x25: DABT (current EL), IL = 32 bits [ 78.751371][ T248] SET = 0, FnV = 0 [ 78.754289][ T248] EA = 0, S1PTW = 0 [ 78.754938][ T248] FSC = 0x06: level 2 translation fault [ 78.755867][ T248] Data abort info: [ 78.756510][ T248] ISV = 0, ISS = 0x00000006 [ 78.757327][ T248] CM = 0, WnR = 0 [ 78.757989][ T248] [dfff800000000006] address between user and kernel address ranges [ 78.759348][ T248] Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP [ 78.760556][ T248] Modules linked in: [ 78.761162][ T248] CPU: 0 PID: 248 Comm: jfsCommit Tainted: G B syzkaller #0 [ 78.762617][ T248] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 78.764317][ T248] pstate: 02400005 (nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 78.765643][ T248] pc : lmLogSync+0xf4/0x8bc [ 78.766429][ T248] lr : lmLogSync+0xe8/0x8bc [ 78.767201][ T248] sp : ffff80001f067b40 [ 78.767907][ T248] x29: ffff80001f067c10 x28: 1ffff00003d33222 x27: dfff800000000000 [ 78.769238][ T248] x26: ffff700003e0cf6c x25: dfff800000000000 x24: ffff80001f067b60 [ 78.770637][ T248] x23: 0000000000000002 x22: ffff0000cb46714c x21: 0000000000000030 [ 78.772015][ T248] x20: ffff0000d94779b0 x19: ffff0000cb467000 x18: 1fffe000341f0596 [ 78.773397][ T248] x17: 1fffe000341f0596 x16: ffff8000082d89ec x15: ffff80001433ed40 [ 78.774849][ T248] x14: ffff60001968ce18 x13: 1fffe0001968ce18 x12: 0000000000ff0100 [ 78.776195][ T248] x11: 0000000000000000 x10: 0000000000000000 x9 : ffff80001af58250 [ 78.777636][ T248] x8 : 0000000000000006 x7 : 2222222222222222 x6 : ffff80001132aa74 [ 78.779050][ T248] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000097dd24c [ 78.780433][ T248] x2 : 0000000000000000 x1 : 0000000000000008 x0 : 0000000000000000 [ 78.781815][ T248] Call trace: [ 78.782360][ T248] lmLogSync+0xf4/0x8bc [ 78.783063][ T248] jfs_syncpt+0x70/0x94 [ 78.783796][ T248] txEnd+0x294/0x500 [ 78.784464][ T248] jfs_lazycommit+0x480/0x9b0 [ 78.785260][ T248] kthread+0x374/0x454 [ 78.785939][ T248] ret_from_fork+0x10/0x20 [ 78.786673][ T248] Code: 97c1a0d4 f94002a8 9100c115 d343fea8 (387b6908) [ 78.787857][ T248] ---[ end trace 47659c0a3877f48e ]--- [ 78.861944][ T4183] Bluetooth: hci0: command 0x040f tx timeout [ 79.033573][ T248] Kernel panic - not syncing: Oops: Fatal exception [ 79.034525][ T248] SMP: stopping secondary CPUs [ 79.035273][ T248] Kernel Offset: disabled [ 79.035929][ T248] CPU features: 0x8,000003c1,7d33ffd9 [ 79.036783][ T248] Memory Limit: none [ 79.284053][ T248] Rebooting in 86400 seconds..