Warning: Permanently added '10.128.0.122' (ED25519) to the list of known hosts. 2026/02/12 20:55:10 parsed 1 programs [ 49.737885][ T23] audit: type=1400 audit(1770929710.270:109): avc: denied { unlink } for pid=389 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 49.797995][ T389] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 50.294754][ T398] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.302038][ T398] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.309534][ T398] device bridge_slave_0 entered promiscuous mode [ 50.320906][ T23] audit: type=1400 audit(1770929710.860:110): avc: denied { create } for pid=431 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 50.333110][ T398] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.348179][ T398] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.355865][ T398] device bridge_slave_1 entered promiscuous mode [ 50.374235][ T23] audit: type=1401 audit(1770929710.910:111): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 50.446438][ T398] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.453561][ T398] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.460998][ T398] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.468044][ T398] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.489545][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 50.499025][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 50.507526][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 50.516295][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 50.533502][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 50.541754][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 50.554706][ T398] device veth0_vlan entered promiscuous mode [ 50.565444][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 50.574290][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 50.582756][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 50.590960][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 50.601691][ T398] device veth1_macvtap entered promiscuous mode [ 50.609387][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 50.623499][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 50.632335][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/02/12 20:55:11 executed programs: 0 [ 50.774363][ T449] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.781757][ T449] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.789429][ T449] device bridge_slave_0 entered promiscuous mode [ 50.796986][ T449] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.804302][ T449] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.811679][ T449] device bridge_slave_1 entered promiscuous mode [ 50.823426][ T445] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.830720][ T445] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.838298][ T445] device bridge_slave_0 entered promiscuous mode [ 50.845843][ T445] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.853421][ T445] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.861150][ T445] device bridge_slave_1 entered promiscuous mode [ 50.889623][ T451] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.896667][ T451] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.904097][ T451] device bridge_slave_0 entered promiscuous mode [ 50.913227][ T451] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.920972][ T451] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.928786][ T451] device bridge_slave_1 entered promiscuous mode [ 50.965386][ T452] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.973556][ T452] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.981037][ T452] device bridge_slave_0 entered promiscuous mode [ 50.991189][ T447] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.998516][ T447] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.005930][ T447] device bridge_slave_0 entered promiscuous mode [ 51.020907][ T452] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.028322][ T452] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.035756][ T452] device bridge_slave_1 entered promiscuous mode [ 51.057340][ T447] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.064419][ T447] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.071916][ T447] device bridge_slave_1 entered promiscuous mode [ 51.135857][ T452] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.143007][ T452] bridge0: port 2(bridge_slave_1) entered forwarding state [ 51.150456][ T452] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.157491][ T452] bridge0: port 1(bridge_slave_0) entered forwarding state [ 51.170215][ T445] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.177450][ T445] bridge0: port 2(bridge_slave_1) entered forwarding state [ 51.184906][ T445] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.192206][ T445] bridge0: port 1(bridge_slave_0) entered forwarding state [ 51.205147][ T421] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.212617][ T421] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.219973][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 51.227508][ T421] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.235188][ T421] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.261448][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 51.270380][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 51.279303][ T421] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.286720][ T421] bridge0: port 1(bridge_slave_0) entered forwarding state [ 51.308608][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 51.317235][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 51.326371][ T421] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.333438][ T421] bridge0: port 2(bridge_slave_1) entered forwarding state [ 51.360608][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 51.369057][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 51.386342][ T452] device veth0_vlan entered promiscuous mode [ 51.413077][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 51.422462][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 51.430810][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 51.438601][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 51.446328][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 51.453952][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 51.461695][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 51.470273][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 51.478693][ T421] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.486152][ T421] bridge0: port 1(bridge_slave_0) entered forwarding state [ 51.493893][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 51.502637][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 51.511284][ T421] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.518946][ T421] bridge0: port 2(bridge_slave_1) entered forwarding state [ 51.526578][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 51.534887][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 51.543312][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 51.551152][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 51.558774][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 51.567129][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 51.575637][ T421] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.582755][ T421] bridge0: port 1(bridge_slave_0) entered forwarding state [ 51.590067][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 51.597950][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 51.605606][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 51.613940][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 51.622735][ T421] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.629959][ T421] bridge0: port 1(bridge_slave_0) entered forwarding state [ 51.637276][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 51.645727][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 51.653983][ T421] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.661245][ T421] bridge0: port 2(bridge_slave_1) entered forwarding state [ 51.669165][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 51.676585][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 51.684300][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 51.693009][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 51.701186][ T421] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.708433][ T421] bridge0: port 1(bridge_slave_0) entered forwarding state [ 51.716156][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 51.724768][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 51.732761][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 51.741081][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 51.749382][ T421] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.756932][ T421] bridge0: port 2(bridge_slave_1) entered forwarding state [ 51.764378][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 51.772745][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 51.780813][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 51.789272][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 51.796983][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 51.805157][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 51.813230][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 51.822185][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 51.840424][ T452] device veth1_macvtap entered promiscuous mode [ 51.859509][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 51.868852][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 51.877723][ T421] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.884880][ T421] bridge0: port 2(bridge_slave_1) entered forwarding state [ 51.893739][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 51.902117][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 51.910333][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 51.918780][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 51.932488][ T451] device veth0_vlan entered promiscuous mode [ 51.942250][ T449] device veth0_vlan entered promiscuous mode [ 51.955486][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 51.964055][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 51.972305][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 51.981786][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 51.990186][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 51.998236][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 52.006299][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 52.014546][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 52.023671][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 52.032858][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 52.043833][ T451] device veth1_macvtap entered promiscuous mode [ 52.053634][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 52.061819][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 52.070199][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 52.078859][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 52.087341][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 52.096042][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 52.109967][ T447] device veth0_vlan entered promiscuous mode [ 52.117995][ T449] device veth1_macvtap entered promiscuous mode [ 52.127393][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 52.135913][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 52.144476][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 52.152246][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 52.159773][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 52.168148][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 52.178272][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 52.196596][ T447] device veth1_macvtap entered promiscuous mode [ 52.204247][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 52.212734][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 52.221403][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 52.230044][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 52.238329][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 52.247343][ T421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 52.266253][ T445] device veth0_vlan entered promiscuous mode [ 52.286218][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 52.309486][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 52.327998][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 52.346333][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 52.358632][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 52.377213][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 52.395899][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 52.414669][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 52.441013][ T445] device veth1_macvtap entered promiscuous mode [ 52.471089][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 52.488712][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 52.496186][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 52.515394][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 52.534010][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 52.558932][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 52.577726][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 52.612148][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 52.628705][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 52.849622][ T313] device bridge_slave_1 left promiscuous mode [ 52.855981][ T313] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.878792][ T313] device bridge_slave_0 left promiscuous mode [ 52.898674][ T313] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.927061][ T313] device veth1_macvtap left promiscuous mode [ 52.938540][ T313] device veth0_vlan left promiscuous mode [ 53.260739][ T472] ====================================================== [ 53.260739][ T472] WARNING: the mand mount option is being deprecated and [ 53.260739][ T472] will be removed in v5.15! [ 53.260739][ T472] ====================================================== [ 53.301488][ T472] F2FS-fs (loop3): invalid crc value [ 53.329960][ T472] F2FS-fs (loop3): Found nat_bits in checkpoint [ 53.386823][ T472] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 53.389248][ T473] F2FS-fs (loop2): invalid crc value [ 53.418547][ T23] audit: type=1400 audit(1770929713.950:112): avc: denied { mount } for pid=470 comm="syz.3.20" name="/" dev="loop3" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 53.472578][ T472] F2FS-fs (loop3): access invalid blkaddr:2147563524 [ 53.473279][ T473] F2FS-fs (loop2): Found nat_bits in checkpoint [ 53.486022][ T472] CPU: 1 PID: 472 Comm: syz.3.20 Not tainted syzkaller #0 [ 53.493847][ T472] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 53.504441][ T472] Call Trace: [ 53.507740][ T472] dump_stack_lvl+0x81/0xac [ 53.512247][ T472] dump_stack+0x10/0x12 [ 53.516526][ T472] f2fs_is_valid_blkaddr.cold+0x2a/0x47 [ 53.522520][ T472] f2fs_iget+0x351e/0x4a00 [ 53.527313][ T472] f2fs_lookup+0x491/0xc20 [ 53.532347][ T472] ? __recover_dot_dentries+0x530/0x530 [ 53.538083][ T472] ? __legitimize_path+0x6c/0x170 [ 53.543244][ T472] __lookup_slow+0x19b/0x3d0 [ 53.548318][ T472] ? page_put_link+0x80/0x80 [ 53.553039][ T472] ? inode_permission.part.0+0xc2/0x320 [ 53.559025][ T472] walk_component+0x3ad/0x710 [ 53.563729][ T472] ? handle_dots.part.0+0x11c0/0x11c0 [ 53.569113][ T472] ? walk_component+0x710/0x710 [ 53.574163][ T472] path_lookupat+0x112/0x6a0 [ 53.579092][ T469] F2FS-fs (loop4): invalid crc value [ 53.579570][ T472] ? _atomic_dec_and_lock+0x19/0xa0 [ 53.590252][ T472] filename_lookup+0x17f/0x510 [ 53.595114][ T472] ? may_linkat+0x200/0x200 [ 53.599711][ T472] ? __check_object_size+0x1df/0x270 [ 53.605131][ T472] ? kmem_cache_alloc+0x17f/0x4f0 [ 53.610446][ T472] ? getname_flags.part.0+0x8c/0x480 [ 53.615918][ T472] user_path_at_empty+0xa2/0xf0 [ 53.620781][ T472] do_sys_truncate.part.0+0x85/0x100 [ 53.626165][ T472] ? vfs_truncate+0x540/0x540 [ 53.630931][ T472] ? __kasan_check_write+0x14/0x20 [ 53.636500][ T472] ? switch_fpu_return+0xbf/0x1b0 [ 53.641711][ T472] __x64_sys_truncate+0x54/0x80 [ 53.647087][ T472] do_syscall_64+0x32/0x50 [ 53.651512][ T472] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 53.657410][ T472] RIP: 0033:0x7f287bf69339 [ 53.662056][ T472] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 53.666709][ T473] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 53.682278][ T472] RSP: 002b:00007f287bdce028 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 53.682286][ T472] RAX: ffffffffffffffda RBX: 00007f287c1a4fa0 RCX: 00007f287bf69339 [ 53.682289][ T472] RDX: 0000000000000000 RSI: 0000000000001c9e RDI: 0000200000000280 [ 53.682291][ T472] RBP: 00007f287bffcd68 R08: 0000000000000000 R09: 0000000000000000 [ 53.682293][ T472] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 53.682296][ T472] R13: 00007f287c1a5038 R14: 00007f287c1a4fa0 R15: 00007ffe73f33f88 [ 53.686189][ T472] F2FS-fs (loop3): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 53.690894][ T469] F2FS-fs (loop4): Found nat_bits in checkpoint [ 53.702584][ T509] F2FS-fs (loop3): access invalid blkaddr:2147563524 [ 53.745984][ T477] F2FS-fs (loop6): invalid crc value [ 53.770959][ T509] CPU: 1 PID: 509 Comm: syz.3.20 Not tainted syzkaller #0 [ 53.771325][ T473] F2FS-fs (loop2): access invalid blkaddr:2147563524 [ 53.778157][ T509] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 53.786955][ T469] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 53.794941][ T509] Call Trace: [ 53.794950][ T509] dump_stack_lvl+0x81/0xac [ 53.794954][ T509] dump_stack+0x10/0x12 [ 53.794959][ T509] f2fs_is_valid_blkaddr.cold+0x2a/0x47 [ 53.794966][ T509] f2fs_iget+0x351e/0x4a00 [ 53.794974][ T509] f2fs_lookup+0x491/0xc20 [ 53.829519][ T509] ? __recover_dot_dentries+0x530/0x530 [ 53.835062][ T509] path_openat+0x1024/0x3950 [ 53.839820][ T509] ? path_lookupat+0x6a0/0x6a0 [ 53.845134][ T509] ? __kasan_check_read+0x11/0x20 [ 53.850677][ T509] ? pagevec_add_and_need_flush+0x216/0x290 [ 53.856813][ T509] ? perf_trace_mm_lru_insertion+0x970/0x970 [ 53.863104][ T509] ? __mod_memcg_lruvec_state+0x118/0x330 [ 53.869087][ T509] ? __mod_node_page_state+0xa6/0x110 [ 53.874564][ T509] do_filp_open+0x193/0x3d0 [ 53.879153][ T509] ? may_open_dev+0xd0/0xd0 [ 53.883643][ T509] ? __check_object_size+0x1df/0x270 [ 53.889049][ T509] ? _raw_spin_unlock+0x41/0x70 [ 53.894150][ T509] do_sys_openat2+0x135/0x810 [ 53.899050][ T509] ? recalc_sigpending+0x7c/0xb0 [ 53.904120][ T509] ? __set_task_blocked+0x8a/0x170 [ 53.909216][ T509] ? build_open_flags+0x490/0x490 [ 53.914747][ T509] ? sigprocmask+0x1ed/0x370 [ 53.919672][ T509] ? __kasan_check_write+0x14/0x20 [ 53.925034][ T509] __x64_sys_openat+0x124/0x200 [ 53.929879][ T509] ? __ia32_sys_open+0x1b0/0x1b0 [ 53.935086][ T509] ? fpregs_assert_state_consistent+0x3f/0x60 [ 53.941408][ T509] ? exit_to_user_mode_prepare+0x36/0x160 [ 53.947128][ T509] do_syscall_64+0x32/0x50 [ 53.951683][ T509] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 53.958048][ T509] RIP: 0033:0x7f287bf69339 [ 53.962474][ T509] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 53.983231][ T509] RSP: 002b:00007f287bdad028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 53.992032][ T509] RAX: ffffffffffffffda RBX: 00007f287c1a5090 RCX: 00007f287bf69339 [ 54.000540][ T509] RDX: 0000000000101000 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 54.008726][ T509] RBP: 00007f287bffcd68 R08: 0000000000000000 R09: 0000000000000000 [ 54.016963][ T509] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 54.024921][ T509] R13: 00007f287c1a5128 R14: 00007f287c1a5090 R15: 00007ffe73f33f88 [ 54.033437][ T473] CPU: 0 PID: 473 Comm: syz.2.19 Not tainted syzkaller #0 [ 54.035244][ T509] F2FS-fs (loop3): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 54.040990][ T473] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 54.040992][ T473] Call Trace: [ 54.041001][ T473] dump_stack_lvl+0x81/0xac [ 54.041005][ T473] dump_stack+0x10/0x12 [ 54.041010][ T473] f2fs_is_valid_blkaddr.cold+0x2a/0x47 [ 54.041018][ T473] f2fs_iget+0x351e/0x4a00 [ 54.041027][ T473] f2fs_lookup+0x491/0xc20 [ 54.057844][ T477] F2FS-fs (loop6): Found nat_bits in checkpoint [ 54.065412][ T473] ? __recover_dot_dentries+0x530/0x530 [ 54.065420][ T473] ? __legitimize_path+0x6c/0x170 [ 54.065424][ T473] __lookup_slow+0x19b/0x3d0 [ 54.065428][ T473] ? page_put_link+0x80/0x80 [ 54.065433][ T473] ? inode_permission.part.0+0xc2/0x320 [ 54.065437][ T473] walk_component+0x3ad/0x710 [ 54.065441][ T473] ? handle_dots.part.0+0x11c0/0x11c0 [ 54.065445][ T473] ? walk_component+0x710/0x710 [ 54.065449][ T473] path_lookupat+0x112/0x6a0 [ 54.065455][ T473] ? _atomic_dec_and_lock+0x19/0xa0 [ 54.065459][ T473] filename_lookup+0x17f/0x510 [ 54.065468][ T473] ? may_linkat+0x200/0x200 [ 54.090215][ T477] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5 [ 54.093423][ T473] ? __check_object_size+0x1df/0x270 [ 54.093435][ T473] ? kmem_cache_alloc+0x17f/0x4f0 [ 54.178955][ T473] ? getname_flags.part.0+0x8c/0x480 [ 54.184303][ T473] user_path_at_empty+0xa2/0xf0 [ 54.189309][ T473] do_sys_truncate.part.0+0x85/0x100 [ 54.194680][ T473] ? vfs_truncate+0x540/0x540 [ 54.199521][ T473] ? __kasan_check_write+0x14/0x20 [ 54.204765][ T473] ? switch_fpu_return+0xbf/0x1b0 [ 54.210043][ T473] __x64_sys_truncate+0x54/0x80 [ 54.214867][ T473] do_syscall_64+0x32/0x50 [ 54.219355][ T473] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 54.225319][ T473] RIP: 0033:0x7f9437c02339 [ 54.229891][ T473] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 54.250482][ T473] RSP: 002b:00007f9437a67028 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 54.259065][ T473] RAX: ffffffffffffffda RBX: 00007f9437e3dfa0 RCX: 00007f9437c02339 [ 54.267549][ T473] RDX: 0000000000000000 RSI: 0000000000001c9e RDI: 0000200000000280 [ 54.276051][ T473] RBP: 00007f9437c95d68 R08: 0000000000000000 R09: 0000000000000000 [ 54.284030][ T473] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 54.292012][ T473] R13: 00007f9437e3e038 R14: 00007f9437e3dfa0 R15: 00007ffff8305dc8 [ 54.300946][ T473] F2FS-fs (loop2): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 54.309391][ T469] F2FS-fs (loop4): access invalid blkaddr:2147563524 [ 54.321004][ T475] F2FS-fs (loop0): invalid crc value [ 54.330605][ T477] F2FS-fs (loop6): access invalid blkaddr:2147563524 [ 54.349314][ T477] CPU: 1 PID: 477 Comm: syz.6.18 Not tainted syzkaller #0 [ 54.356888][ T477] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 54.367114][ T477] Call Trace: [ 54.370403][ T477] dump_stack_lvl+0x81/0xac [ 54.374904][ T477] dump_stack+0x10/0x12 [ 54.379062][ T477] f2fs_is_valid_blkaddr.cold+0x2a/0x47 [ 54.384634][ T477] f2fs_iget+0x351e/0x4a00 [ 54.389212][ T477] f2fs_lookup+0x491/0xc20 [ 54.393718][ T477] ? __recover_dot_dentries+0x530/0x530 [ 54.399339][ T477] ? __legitimize_path+0x6c/0x170 [ 54.404433][ T477] __lookup_slow+0x19b/0x3d0 [ 54.409096][ T477] ? page_put_link+0x80/0x80 [ 54.413754][ T477] ? inode_permission.part.0+0xc2/0x320 [ 54.419454][ T477] walk_component+0x3ad/0x710 [ 54.424115][ T477] ? handle_dots.part.0+0x11c0/0x11c0 [ 54.429466][ T477] ? walk_component+0x710/0x710 [ 54.434301][ T477] path_lookupat+0x112/0x6a0 [ 54.438875][ T477] ? _atomic_dec_and_lock+0x19/0xa0 [ 54.444241][ T477] filename_lookup+0x17f/0x510 [ 54.448567][ T519] F2FS-fs (loop2): access invalid blkaddr:2147563524 [ 54.449174][ T477] ? may_linkat+0x200/0x200 [ 54.449183][ T477] ? __check_object_size+0x1df/0x270 [ 54.449188][ T477] ? kmem_cache_alloc+0x17f/0x4f0 [ 54.449195][ T477] ? getname_flags.part.0+0x8c/0x480 [ 54.476594][ T477] user_path_at_empty+0xa2/0xf0 [ 54.481602][ T477] do_sys_truncate.part.0+0x85/0x100 [ 54.487064][ T477] ? vfs_truncate+0x540/0x540 [ 54.491721][ T477] ? __kasan_check_write+0x14/0x20 [ 54.497082][ T477] ? switch_fpu_return+0xbf/0x1b0 [ 54.502207][ T477] __x64_sys_truncate+0x54/0x80 [ 54.507041][ T477] do_syscall_64+0x32/0x50 [ 54.511611][ T477] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 54.517488][ T477] RIP: 0033:0x7f70ffa50339 [ 54.522012][ T477] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 54.542394][ T477] RSP: 002b:00007f70ff8b5028 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 54.551074][ T477] RAX: ffffffffffffffda RBX: 00007f70ffc8bfa0 RCX: 00007f70ffa50339 [ 54.559205][ T477] RDX: 0000000000000000 RSI: 0000000000001c9e RDI: 0000200000000280 [ 54.567250][ T477] RBP: 00007f70ffae3d68 R08: 0000000000000000 R09: 0000000000000000 [ 54.575398][ T477] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 54.583457][ T477] R13: 00007f70ffc8c038 R14: 00007f70ffc8bfa0 R15: 00007ffef4838dd8 [ 54.591599][ T469] CPU: 0 PID: 469 Comm: syz.4.21 Not tainted syzkaller #0 [ 54.593628][ T477] F2FS-fs (loop6): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 54.598704][ T469] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 54.598706][ T469] Call Trace: [ 54.598716][ T469] dump_stack_lvl+0x81/0xac [ 54.598719][ T469] dump_stack+0x10/0x12 [ 54.598724][ T469] f2fs_is_valid_blkaddr.cold+0x2a/0x47 [ 54.598732][ T469] f2fs_iget+0x351e/0x4a00 [ 54.598738][ T469] f2fs_lookup+0x491/0xc20 [ 54.598743][ T469] ? __recover_dot_dentries+0x530/0x530 [ 54.598750][ T469] ? __legitimize_path+0x6c/0x170 [ 54.598755][ T469] __lookup_slow+0x19b/0x3d0 [ 54.598759][ T469] ? page_put_link+0x80/0x80 [ 54.598764][ T469] ? inode_permission.part.0+0xc2/0x320 [ 54.598768][ T469] walk_component+0x3ad/0x710 [ 54.598773][ T469] ? handle_dots.part.0+0x11c0/0x11c0 [ 54.598777][ T469] ? walk_component+0x710/0x710 [ 54.598782][ T469] path_lookupat+0x112/0x6a0 [ 54.598788][ T469] ? _atomic_dec_and_lock+0x19/0xa0 [ 54.598792][ T469] filename_lookup+0x17f/0x510 [ 54.598796][ T469] ? may_linkat+0x200/0x200 [ 54.598803][ T469] ? __check_object_size+0x1df/0x270 [ 54.598809][ T469] ? kmem_cache_alloc+0x17f/0x4f0 [ 54.598814][ T469] ? getname_flags.part.0+0x8c/0x480 [ 54.598819][ T469] user_path_at_empty+0xa2/0xf0 [ 54.598823][ T469] do_sys_truncate.part.0+0x85/0x100 [ 54.598827][ T469] ? vfs_truncate+0x540/0x540 [ 54.638647][ T525] F2FS-fs (loop6): access invalid blkaddr:2147563524 [ 54.640075][ T469] ? __kasan_check_write+0x14/0x20 [ 54.753061][ T469] ? switch_fpu_return+0xbf/0x1b0 [ 54.758339][ T469] __x64_sys_truncate+0x54/0x80 [ 54.763297][ T469] do_syscall_64+0x32/0x50 [ 54.767787][ T469] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 54.773744][ T469] RIP: 0033:0x7f7ae064e339 [ 54.778237][ T469] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 54.797923][ T469] RSP: 002b:00007f7ae04b3028 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 54.806754][ T469] RAX: ffffffffffffffda RBX: 00007f7ae0889fa0 RCX: 00007f7ae064e339 [ 54.815029][ T469] RDX: 0000000000000000 RSI: 0000000000001c9e RDI: 0000200000000280 [ 54.823542][ T469] RBP: 00007f7ae06e1d68 R08: 0000000000000000 R09: 0000000000000000 [ 54.831598][ T469] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 54.839765][ T469] R13: 00007f7ae088a038 R14: 00007f7ae0889fa0 R15: 00007ffe7c593528 [ 54.848118][ T519] CPU: 1 PID: 519 Comm: syz.2.19 Not tainted syzkaller #0 [ 54.855315][ T519] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 54.865886][ T519] Call Trace: [ 54.869366][ T519] dump_stack_lvl+0x81/0xac [ 54.874055][ T519] dump_stack+0x10/0x12 [ 54.878286][ T519] f2fs_is_valid_blkaddr.cold+0x2a/0x47 [ 54.884105][ T519] f2fs_iget+0x351e/0x4a00 [ 54.888509][ T519] f2fs_lookup+0x491/0xc20 [ 54.892906][ T519] ? __recover_dot_dentries+0x530/0x530 [ 54.898434][ T519] path_openat+0x1024/0x3950 [ 54.903095][ T519] ? path_lookupat+0x6a0/0x6a0 [ 54.907934][ T519] ? __kasan_check_read+0x11/0x20 [ 54.913403][ T519] ? pagevec_add_and_need_flush+0x216/0x290 [ 54.919481][ T519] ? perf_trace_mm_lru_insertion+0x970/0x970 [ 54.925437][ T519] ? __mod_memcg_lruvec_state+0x118/0x330 [ 54.931243][ T519] ? __mod_node_page_state+0xa6/0x110 [ 54.936796][ T519] do_filp_open+0x193/0x3d0 [ 54.941296][ T519] ? may_open_dev+0xd0/0xd0 [ 54.945876][ T519] ? __check_object_size+0x1df/0x270 [ 54.951177][ T519] ? _raw_spin_unlock+0x41/0x70 [ 54.956022][ T519] do_sys_openat2+0x135/0x810 [ 54.960681][ T519] ? recalc_sigpending+0x7c/0xb0 [ 54.965704][ T519] ? __set_task_blocked+0x8a/0x170 [ 54.970903][ T519] ? build_open_flags+0x490/0x490 [ 54.976105][ T519] ? sigprocmask+0x1ed/0x370 [ 54.980674][ T519] ? __kasan_check_write+0x14/0x20 [ 54.985779][ T519] __x64_sys_openat+0x124/0x200 [ 54.990704][ T519] ? __ia32_sys_open+0x1b0/0x1b0 [ 54.995705][ T519] ? fpregs_assert_state_consistent+0x3f/0x60 [ 55.002028][ T519] ? exit_to_user_mode_prepare+0x36/0x160 [ 55.007815][ T519] do_syscall_64+0x32/0x50 [ 55.012298][ T519] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 55.018356][ T519] RIP: 0033:0x7f9437c02339 [ 55.023203][ T519] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 55.043235][ T519] RSP: 002b:00007f9437a46028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 55.052742][ T519] RAX: ffffffffffffffda RBX: 00007f9437e3e090 RCX: 00007f9437c02339 [ 55.062038][ T519] RDX: 0000000000101000 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 55.070840][ T519] RBP: 00007f9437c95d68 R08: 0000000000000000 R09: 0000000000000000 [ 55.081705][ T519] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 55.090200][ T519] R13: 00007f9437e3e128 R14: 00007f9437e3e090 R15: 00007ffff8305dc8 [ 55.099153][ T469] F2FS-fs (loop4): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 55.101004][ T525] CPU: 1 PID: 525 Comm: syz.6.18 Not tainted syzkaller #0 [ 55.113185][ T524] F2FS-fs (loop4): access invalid blkaddr:2147563524 [ 55.120561][ T525] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 55.120563][ T525] Call Trace: [ 55.120573][ T525] dump_stack_lvl+0x81/0xac [ 55.120577][ T525] dump_stack+0x10/0x12 [ 55.120591][ T525] f2fs_is_valid_blkaddr.cold+0x2a/0x47 [ 55.155622][ T525] f2fs_iget+0x351e/0x4a00 [ 55.160137][ T525] f2fs_lookup+0x491/0xc20 [ 55.164882][ T525] ? __recover_dot_dentries+0x530/0x530 [ 55.170520][ T525] path_openat+0x1024/0x3950 [ 55.175094][ T525] ? path_lookupat+0x6a0/0x6a0 [ 55.179933][ T525] ? __kasan_check_read+0x11/0x20 [ 55.185026][ T525] ? pagevec_add_and_need_flush+0x216/0x290 [ 55.191028][ T525] ? perf_trace_mm_lru_insertion+0x970/0x970 [ 55.197165][ T525] ? __mod_memcg_lruvec_state+0x118/0x330 [ 55.202961][ T525] ? __mod_node_page_state+0xa6/0x110 [ 55.208399][ T525] do_filp_open+0x193/0x3d0 [ 55.213225][ T525] ? may_open_dev+0xd0/0xd0 [ 55.217880][ T525] ? __check_object_size+0x1df/0x270 [ 55.223319][ T525] ? _raw_spin_unlock+0x41/0x70 [ 55.228175][ T525] do_sys_openat2+0x135/0x810 [ 55.232935][ T525] ? recalc_sigpending+0x7c/0xb0 [ 55.237890][ T525] ? __set_task_blocked+0x8a/0x170 [ 55.243242][ T525] ? build_open_flags+0x490/0x490 [ 55.248423][ T525] ? sigprocmask+0x1ed/0x370 [ 55.253274][ T525] ? __kasan_check_write+0x14/0x20 [ 55.258831][ T525] __x64_sys_openat+0x124/0x200 [ 55.264298][ T525] ? __ia32_sys_open+0x1b0/0x1b0 [ 55.269331][ T525] ? fpregs_assert_state_consistent+0x3f/0x60 [ 55.275656][ T525] ? exit_to_user_mode_prepare+0x36/0x160 [ 55.281375][ T525] do_syscall_64+0x32/0x50 [ 55.285969][ T525] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 55.292278][ T525] RIP: 0033:0x7f70ffa50339 [ 55.296779][ T525] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 55.317086][ T525] RSP: 002b:00007f70ff894028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 55.325928][ T525] RAX: ffffffffffffffda RBX: 00007f70ffc8c090 RCX: 00007f70ffa50339 [ 55.334089][ T525] RDX: 0000000000101000 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 55.342478][ T525] RBP: 00007f70ffae3d68 R08: 0000000000000000 R09: 0000000000000000 [ 55.351075][ T525] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 55.359719][ T525] R13: 00007f70ffc8c128 R14: 00007f70ffc8c090 R15: 00007ffef4838dd8 [ 55.368893][ T524] CPU: 1 PID: 524 Comm: syz.4.21 Not tainted syzkaller #0 [ 55.368931][ T475] F2FS-fs (loop0): Found nat_bits in checkpoint [ 55.376354][ T524] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 55.376358][ T524] Call Trace: [ 55.376372][ T524] dump_stack_lvl+0x81/0xac [ 55.376376][ T524] dump_stack+0x10/0x12 [ 55.376380][ T524] f2fs_is_valid_blkaddr.cold+0x2a/0x47 [ 55.376387][ T524] f2fs_iget+0x351e/0x4a00 [ 55.376397][ T524] f2fs_lookup+0x491/0xc20 [ 55.403193][ T475] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 55.405482][ T524] ? __recover_dot_dentries+0x530/0x530 [ 55.405493][ T524] path_openat+0x1024/0x3950 [ 55.437877][ T524] ? path_lookupat+0x6a0/0x6a0 [ 55.442620][ T524] ? __kasan_check_read+0x11/0x20 [ 55.447709][ T524] ? pagevec_add_and_need_flush+0x216/0x290 [ 55.453586][ T524] ? perf_trace_mm_lru_insertion+0x970/0x970 [ 55.459846][ T524] ? __mod_memcg_lruvec_state+0x118/0x330 [ 55.465945][ T524] ? __mod_node_page_state+0xa6/0x110 [ 55.471679][ T524] do_filp_open+0x193/0x3d0 [ 55.476520][ T524] ? may_open_dev+0xd0/0xd0 [ 55.481009][ T524] ? __check_object_size+0x1df/0x270 [ 55.486304][ T524] ? _raw_spin_unlock+0x41/0x70 [ 55.491163][ T524] do_sys_openat2+0x135/0x810 [ 55.495934][ T524] ? recalc_sigpending+0x7c/0xb0 [ 55.500857][ T524] ? __set_task_blocked+0x8a/0x170 [ 55.506226][ T524] ? build_open_flags+0x490/0x490 [ 55.511531][ T524] ? sigprocmask+0x1ed/0x370 [ 55.516371][ T524] ? __kasan_check_write+0x14/0x20 [ 55.521481][ T524] __x64_sys_openat+0x124/0x200 [ 55.526581][ T524] ? __ia32_sys_open+0x1b0/0x1b0 [ 55.531594][ T524] ? fpregs_assert_state_consistent+0x3f/0x60 [ 55.537910][ T524] ? exit_to_user_mode_prepare+0x36/0x160 [ 55.543616][ T524] do_syscall_64+0x32/0x50 [ 55.548030][ T524] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 55.554232][ T524] RIP: 0033:0x7f7ae064e339 [ 55.559530][ T524] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 55.579821][ T524] RSP: 002b:00007f7ae0492028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 55.588866][ T524] RAX: ffffffffffffffda RBX: 00007f7ae088a090 RCX: 00007f7ae064e339 [ 55.597403][ T524] RDX: 0000000000101000 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 55.605818][ T524] RBP: 00007f7ae06e1d68 R08: 0000000000000000 R09: 0000000000000000 [ 55.613945][ T524] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 55.621915][ T524] R13: 00007f7ae088a128 R14: 00007f7ae088a090 R15: 00007ffe7c593528 2026/02/12 20:55:16 executed programs: 16 [ 55.727574][ T519] F2FS-fs (loop2): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 55.771223][ T525] F2FS-fs (loop6): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 55.784739][ T524] ================================================================== [ 55.793084][ T524] BUG: KASAN: use-after-free in f2fs_iget+0x4321/0x4a00 [ 55.800103][ T524] Read of size 4 at addr ffff888127033254 by task syz.4.21/524 [ 55.808078][ T524] [ 55.810849][ T524] CPU: 1 PID: 524 Comm: syz.4.21 Not tainted syzkaller #0 [ 55.818437][ T524] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 55.829702][ T524] Call Trace: [ 55.833603][ T524] dump_stack_lvl+0x81/0xac [ 55.838510][ T524] print_address_description.constprop.0+0x24/0x160 [ 55.846004][ T524] ? f2fs_iget+0x4321/0x4a00 [ 55.850797][ T524] kasan_report.cold+0x82/0xdb [ 55.855960][ T524] ? f2fs_iget+0x4321/0x4a00 [ 55.860730][ T524] __asan_report_load4_noabort+0x14/0x20 [ 55.866986][ T524] f2fs_iget+0x4321/0x4a00 [ 55.871414][ T524] f2fs_lookup+0x491/0xc20 [ 55.876031][ T524] ? __recover_dot_dentries+0x530/0x530 [ 55.881936][ T524] path_openat+0x1024/0x3950 [ 55.886871][ T524] ? path_lookupat+0x6a0/0x6a0 [ 55.891631][ T524] ? __kasan_check_read+0x11/0x20 [ 55.897252][ T524] ? pagevec_add_and_need_flush+0x216/0x290 [ 55.903743][ T524] ? perf_trace_mm_lru_insertion+0x970/0x970 [ 55.909737][ T524] ? __mod_memcg_lruvec_state+0x118/0x330 [ 55.915923][ T524] ? __mod_node_page_state+0xa6/0x110 [ 55.921295][ T524] do_filp_open+0x193/0x3d0 [ 55.925785][ T524] ? may_open_dev+0xd0/0xd0 [ 55.930292][ T524] ? __check_object_size+0x1df/0x270 [ 55.935891][ T524] ? _raw_spin_unlock+0x41/0x70 [ 55.940821][ T524] do_sys_openat2+0x135/0x810 [ 55.945495][ T524] ? recalc_sigpending+0x7c/0xb0 [ 55.950455][ T524] ? __set_task_blocked+0x8a/0x170 [ 55.956661][ T524] ? build_open_flags+0x490/0x490 [ 55.961689][ T524] ? sigprocmask+0x1ed/0x370 [ 55.966363][ T524] ? __kasan_check_write+0x14/0x20 [ 55.971494][ T524] __x64_sys_openat+0x124/0x200 [ 55.976420][ T524] ? __ia32_sys_open+0x1b0/0x1b0 [ 55.981476][ T524] ? fpregs_assert_state_consistent+0x3f/0x60 [ 55.987549][ T524] ? exit_to_user_mode_prepare+0x36/0x160 [ 55.993436][ T524] do_syscall_64+0x32/0x50 [ 55.997876][ T524] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 56.004278][ T524] RIP: 0033:0x7f7ae064e339 [ 56.008885][ T524] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 56.030000][ T524] RSP: 002b:00007f7ae0492028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 56.038948][ T524] RAX: ffffffffffffffda RBX: 00007f7ae088a090 RCX: 00007f7ae064e339 [ 56.047260][ T524] RDX: 0000000000101000 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 56.055370][ T524] RBP: 00007f7ae06e1d68 R08: 0000000000000000 R09: 0000000000000000 [ 56.063439][ T524] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 56.071486][ T524] R13: 00007f7ae088a128 R14: 00007f7ae088a090 R15: 00007ffe7c593528 [ 56.079548][ T524] [ 56.081889][ T524] Allocated by task 469: [ 56.086123][ T524] kasan_save_stack+0x26/0x50 [ 56.091042][ T524] __kasan_slab_alloc+0x94/0xc0 [ 56.096106][ T524] kmem_cache_alloc+0x15d/0x4f0 [ 56.101129][ T524] f2fs_init_extent_tree+0x98f/0xdf0 [ 56.106503][ T524] f2fs_iget+0xa75/0x4a00 [ 56.110912][ T524] f2fs_lookup+0x491/0xc20 [ 56.115325][ T524] __lookup_slow+0x19b/0x3d0 [ 56.120127][ T524] walk_component+0x3ad/0x710 [ 56.124881][ T524] path_lookupat+0x112/0x6a0 [ 56.129685][ T524] filename_lookup+0x17f/0x510 [ 56.134476][ T524] user_path_at_empty+0xa2/0xf0 [ 56.139431][ T524] do_sys_truncate.part.0+0x85/0x100 [ 56.144976][ T524] __x64_sys_truncate+0x54/0x80 [ 56.150108][ T524] do_syscall_64+0x32/0x50 [ 56.154627][ T524] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 56.160666][ T524] [ 56.163140][ T524] Freed by task 469: [ 56.167194][ T524] kasan_save_stack+0x26/0x50 [ 56.171937][ T524] kasan_set_track+0x25/0x30 [ 56.176716][ T524] kasan_set_free_info+0x24/0x40 [ 56.181815][ T524] __kasan_slab_free+0x111/0x150 [ 56.186739][ T524] slab_free_freelist_hook+0x9b/0x1a0 [ 56.192087][ T524] kmem_cache_free+0x106/0x440 [ 56.196833][ T524] f2fs_destroy_extent_tree+0x174/0x4b0 [ 56.202366][ T524] f2fs_evict_inode+0x335/0x1680 [ 56.207493][ T524] evict+0x372/0x940 [ 56.211364][ T524] iput.part.0+0x33b/0x640 [ 56.215759][ T524] iput+0x3f/0x50 [ 56.219388][ T524] iget_failed+0x1e/0x30 [ 56.223785][ T524] f2fs_iget+0x22be/0x4a00 [ 56.228443][ T524] f2fs_lookup+0x491/0xc20 [ 56.233274][ T524] __lookup_slow+0x19b/0x3d0 [ 56.238185][ T524] walk_component+0x3ad/0x710 [ 56.242925][ T524] path_lookupat+0x112/0x6a0 [ 56.247755][ T524] filename_lookup+0x17f/0x510 [ 56.253294][ T524] user_path_at_empty+0xa2/0xf0 [ 56.258409][ T524] do_sys_truncate.part.0+0x85/0x100 [ 56.264068][ T524] __x64_sys_truncate+0x54/0x80 [ 56.269035][ T524] do_syscall_64+0x32/0x50 [ 56.273447][ T524] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 56.279685][ T524] [ 56.282085][ T524] The buggy address belongs to the object at ffff888127033230 [ 56.282085][ T524] which belongs to the cache f2fs_extent_tree of size 80 [ 56.297107][ T524] The buggy address is located 36 bytes inside of [ 56.297107][ T524] 80-byte region [ffff888127033230, ffff888127033280) [ 56.311601][ T524] The buggy address belongs to the page: [ 56.317318][ T524] page:ffffea00049c0cc0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x127033 [ 56.327716][ T524] flags: 0x4000000000000200(slab) [ 56.332820][ T524] raw: 4000000000000200 dead000000000100 dead000000000122 ffff888104581500 [ 56.341747][ T524] raw: 0000000000000000 0000000080240024 00000001ffffffff 0000000000000000 [ 56.350495][ T524] page dumped because: kasan: bad access detected [ 56.357060][ T524] page_owner tracks the page as allocated [ 56.362862][ T524] page last allocated via order 0, migratetype Reclaimable, gfp_mask 0x112c50(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 472, ts 53472543803, free_ts 31131627894 [ 56.382629][ T524] get_page_from_freelist+0x1fee/0x2ad0 [ 56.388247][ T524] __alloc_pages_nodemask+0x2ae/0x2530 [ 56.393788][ T524] allocate_slab+0x30f/0x460 [ 56.398609][ T524] ___slab_alloc.constprop.0+0x32b/0x730 [ 56.404450][ T524] kmem_cache_alloc+0x491/0x4f0 [ 56.409457][ T524] f2fs_init_extent_tree+0x98f/0xdf0 [ 56.415001][ T524] f2fs_iget+0xa75/0x4a00 [ 56.419599][ T524] f2fs_lookup+0x491/0xc20 [ 56.424259][ T524] __lookup_slow+0x19b/0x3d0 [ 56.429018][ T524] walk_component+0x3ad/0x710 [ 56.433845][ T524] path_lookupat+0x112/0x6a0 [ 56.438445][ T524] filename_lookup+0x17f/0x510 [ 56.443275][ T524] user_path_at_empty+0xa2/0xf0 [ 56.448189][ T524] do_sys_truncate.part.0+0x85/0x100 [ 56.453559][ T524] __x64_sys_truncate+0x54/0x80 [ 56.458662][ T524] do_syscall_64+0x32/0x50 [ 56.463417][ T524] page last free stack trace: [ 56.468213][ T524] free_pcp_prepare+0x1a7/0x230 [ 56.473231][ T524] free_unref_page_list+0x18a/0xae0 [ 56.478870][ T524] release_pages+0x374/0xb00 [ 56.483745][ T524] free_pages_and_swap_cache+0x180/0x1e0 [ 56.489361][ T524] tlb_flush_mmu+0xbe/0x590 [ 56.493933][ T524] unmap_page_range+0x127b/0x1d60 [ 56.498992][ T524] unmap_vmas+0x1cf/0x390 [ 56.503298][ T524] exit_mmap+0x276/0x520 [ 56.507704][ T524] mmput+0x99/0x430 [ 56.511576][ T524] do_exit+0x873/0x2330 [ 56.515708][ T524] do_group_exit+0xe6/0x290 [ 56.520291][ T524] get_signal+0x353/0x1a10 [ 56.525046][ T524] arch_do_signal_or_restart+0x2c1/0x1b70 [ 56.530860][ T524] exit_to_user_mode_prepare+0x10f/0x160 [ 56.536751][ T524] syscall_exit_to_user_mode+0x27/0x160 [ 56.542387][ T524] do_syscall_64+0x3f/0x50 [ 56.546877][ T524] [ 56.549194][ T524] Memory state around the buggy address: [ 56.555194][ T524] ffff888127033100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 56.563783][ T524] ffff888127033180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 56.573306][ T524] >ffff888127033200: fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb fb [ 56.581915][ T524] ^ [ 56.590203][ T524] ffff888127033280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 56.599300][ T524] ffff888127033300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 56.607916][ T524] ================================================================== [ 56.616506][ T524] Disabling lock debugging due to kernel taint [ 56.625727][ T524] F2FS-fs (loop4): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 56.638505][ T524] ================================================================== [ 56.646678][ T524] BUG: KASAN: double-free or invalid-free in kmem_cache_free+0x106/0x440 [ 56.649684][ T23] audit: type=1400 audit(1770929717.180:113): avc: denied { read } for pid=73 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 56.655650][ T524] [ 56.655658][ T524] CPU: 0 PID: 524 Comm: syz.4.21 Tainted: G B syzkaller #0 [ 56.655660][ T524] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 56.655662][ T524] Call Trace: [ 56.655672][ T524] dump_stack_lvl+0x81/0xac [ 56.655683][ T524] print_address_description.constprop.0+0x24/0x160 [ 56.715554][ T524] ? kmem_cache_free+0x106/0x440 [ 56.720864][ T524] kasan_report_invalid_free+0x56/0x80 [ 56.725997][ T23] audit: type=1400 audit(1770929717.180:114): avc: denied { search } for pid=73 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 56.726510][ T524] ? kmem_cache_free+0x106/0x440 [ 56.753382][ T524] __kasan_slab_free+0x134/0x150 [ 56.758613][ T524] slab_free_freelist_hook+0x9b/0x1a0 [ 56.764048][ T524] ? f2fs_destroy_extent_tree+0x174/0x4b0 [ 56.770079][ T524] kmem_cache_free+0x106/0x440 [ 56.774929][ T524] f2fs_destroy_extent_tree+0x174/0x4b0 [ 56.781018][ T524] f2fs_evict_inode+0x335/0x1680 [ 56.786226][ T524] ? preempt_count_add+0x7a/0x100 [ 56.788382][ T23] audit: type=1400 audit(1770929717.180:115): avc: denied { write } for pid=73 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 56.791583][ T524] ? __inode_wait_for_writeback+0xe7/0x1c0 [ 56.791589][ T524] ? f2fs_write_inode+0x1010/0x1010 [ 56.791594][ T524] ? var_wake_function+0x130/0x130 [ 56.791604][ T524] ? _raw_spin_lock_bh+0x110/0x110 [ 56.835874][ T524] ? vprintk_func+0x5a/0x150 [ 56.840831][ T524] ? _raw_spin_lock_bh+0x110/0x110 [ 56.846040][ T524] evict+0x372/0x940 [ 56.848389][ T23] audit: type=1400 audit(1770929717.180:116): avc: denied { add_name } for pid=73 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 56.850008][ T524] ? new_inode+0x2f0/0x2f0 [ 56.850012][ T524] ? _raw_spin_lock+0x86/0x110 [ 56.850016][ T524] ? _raw_spin_lock_bh+0x110/0x110 [ 56.850021][ T524] ? __kasan_check_read+0x11/0x20 [ 56.850030][ T524] ? f2fs_drop_inode+0x71/0x910 [ 56.896965][ T524] iput.part.0+0x33b/0x640 [ 56.901370][ T524] iput+0x3f/0x50 [ 56.905163][ T524] iget_failed+0x1e/0x30 [ 56.909670][ T524] f2fs_iget+0x22be/0x4a00 [ 56.914086][ T524] f2fs_lookup+0x491/0xc20 [ 56.915301][ T23] audit: type=1400 audit(1770929717.180:117): avc: denied { create } for pid=73 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 56.918487][ T524] ? __recover_dot_dentries+0x530/0x530 [ 56.918493][ T524] path_openat+0x1024/0x3950 [ 56.918498][ T524] ? path_lookupat+0x6a0/0x6a0 [ 56.918503][ T524] ? __kasan_check_read+0x11/0x20 [ 56.918508][ T524] ? pagevec_add_and_need_flush+0x216/0x290 [ 56.918512][ T524] ? perf_trace_mm_lru_insertion+0x970/0x970 [ 56.918521][ T524] ? __mod_memcg_lruvec_state+0x118/0x330 [ 56.958395][ T23] audit: type=1400 audit(1770929717.180:118): avc: denied { append open } for pid=73 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 56.959468][ T524] ? __mod_node_page_state+0xa6/0x110 [ 56.959474][ T524] do_filp_open+0x193/0x3d0 [ 56.959481][ T524] ? may_open_dev+0xd0/0xd0 [ 56.965635][ T23] audit: type=1400 audit(1770929717.180:119): avc: denied { getattr } for pid=73 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 56.971701][ T524] ? __check_object_size+0x1df/0x270 [ 56.971708][ T524] ? _raw_spin_unlock+0x41/0x70 [ 56.971715][ T524] do_sys_openat2+0x135/0x810 [ 56.971722][ T524] ? recalc_sigpending+0x7c/0xb0 [ 56.971726][ T524] ? __set_task_blocked+0x8a/0x170 [ 56.971730][ T524] ? build_open_flags+0x490/0x490 [ 56.971740][ T524] ? sigprocmask+0x1ed/0x370 [ 57.076147][ T524] ? __kasan_check_write+0x14/0x20 [ 57.081359][ T524] __x64_sys_openat+0x124/0x200 [ 57.086218][ T524] ? __ia32_sys_open+0x1b0/0x1b0 [ 57.091171][ T524] ? fpregs_assert_state_consistent+0x3f/0x60 [ 57.097507][ T524] ? exit_to_user_mode_prepare+0x36/0x160 [ 57.103542][ T524] do_syscall_64+0x32/0x50 [ 57.108040][ T524] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 57.113917][ T524] RIP: 0033:0x7f7ae064e339 [ 57.118315][ T524] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 57.138248][ T524] RSP: 002b:00007f7ae0492028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 57.146926][ T524] RAX: ffffffffffffffda RBX: 00007f7ae088a090 RCX: 00007f7ae064e339 [ 57.154894][ T524] RDX: 0000000000101000 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 57.163120][ T524] RBP: 00007f7ae06e1d68 R08: 0000000000000000 R09: 0000000000000000 [ 57.171353][ T524] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 57.180135][ T524] R13: 00007f7ae088a128 R14: 00007f7ae088a090 R15: 00007ffe7c593528 [ 57.188551][ T524] [ 57.191282][ T524] Allocated by task 469: [ 57.195711][ T524] kasan_save_stack+0x26/0x50 [ 57.200472][ T524] __kasan_slab_alloc+0x94/0xc0 [ 57.205415][ T524] kmem_cache_alloc+0x15d/0x4f0 [ 57.210246][ T524] f2fs_init_extent_tree+0x98f/0xdf0 [ 57.215512][ T524] f2fs_iget+0xa75/0x4a00 [ 57.219909][ T524] f2fs_lookup+0x491/0xc20 [ 57.224572][ T524] __lookup_slow+0x19b/0x3d0 [ 57.229495][ T524] walk_component+0x3ad/0x710 [ 57.234323][ T524] path_lookupat+0x112/0x6a0 [ 57.238977][ T524] filename_lookup+0x17f/0x510 [ 57.244073][ T524] user_path_at_empty+0xa2/0xf0 [ 57.249059][ T524] do_sys_truncate.part.0+0x85/0x100 [ 57.254495][ T524] __x64_sys_truncate+0x54/0x80 [ 57.259781][ T524] do_syscall_64+0x32/0x50 [ 57.264391][ T524] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 57.270718][ T524] [ 57.273038][ T524] Freed by task 469: [ 57.276951][ T524] kasan_save_stack+0x26/0x50 [ 57.281825][ T524] kasan_set_track+0x25/0x30 [ 57.286674][ T524] kasan_set_free_info+0x24/0x40 [ 57.291705][ T524] __kasan_slab_free+0x111/0x150 [ 57.296654][ T524] slab_free_freelist_hook+0x9b/0x1a0 [ 57.302043][ T524] kmem_cache_free+0x106/0x440 [ 57.307062][ T524] f2fs_destroy_extent_tree+0x174/0x4b0 [ 57.312677][ T524] f2fs_evict_inode+0x335/0x1680 [ 57.317839][ T524] evict+0x372/0x940 [ 57.322362][ T524] iput.part.0+0x33b/0x640 [ 57.327118][ T524] iput+0x3f/0x50 [ 57.331060][ T524] iget_failed+0x1e/0x30 [ 57.335389][ T524] f2fs_iget+0x22be/0x4a00 [ 57.339885][ T524] f2fs_lookup+0x491/0xc20 [ 57.344636][ T524] __lookup_slow+0x19b/0x3d0 [ 57.349394][ T524] walk_component+0x3ad/0x710 [ 57.354440][ T524] path_lookupat+0x112/0x6a0 [ 57.359493][ T524] filename_lookup+0x17f/0x510 [ 57.364268][ T524] user_path_at_empty+0xa2/0xf0 [ 57.369284][ T524] do_sys_truncate.part.0+0x85/0x100 [ 57.375043][ T524] __x64_sys_truncate+0x54/0x80 [ 57.380006][ T524] do_syscall_64+0x32/0x50 [ 57.384502][ T524] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 57.390375][ T524] [ 57.393315][ T524] The buggy address belongs to the object at ffff888127033230 [ 57.393315][ T524] which belongs to the cache f2fs_extent_tree of size 80 [ 57.408409][ T524] The buggy address is located 0 bytes inside of [ 57.408409][ T524] 80-byte region [ffff888127033230, ffff888127033280) [ 57.421518][ T524] The buggy address belongs to the page: [ 57.427320][ T524] page:ffffea00049c0cc0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x127033 [ 57.437620][ T524] flags: 0x4000000000000200(slab) [ 57.442798][ T524] raw: 4000000000000200 dead000000000100 dead000000000122 ffff888104581500 [ 57.451560][ T524] raw: 0000000000000000 0000000080240024 00000001ffffffff 0000000000000000 [ 57.460212][ T524] page dumped because: kasan: bad access detected [ 57.467038][ T524] page_owner tracks the page as allocated [ 57.473507][ T524] page last allocated via order 0, migratetype Reclaimable, gfp_mask 0x112c50(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 472, ts 53472543803, free_ts 31131627894 [ 57.493142][ T524] get_page_from_freelist+0x1fee/0x2ad0 [ 57.498675][ T524] __alloc_pages_nodemask+0x2ae/0x2530 [ 57.504285][ T524] allocate_slab+0x30f/0x460 [ 57.508959][ T524] ___slab_alloc.constprop.0+0x32b/0x730 [ 57.514706][ T524] kmem_cache_alloc+0x491/0x4f0 [ 57.519631][ T524] f2fs_init_extent_tree+0x98f/0xdf0 [ 57.525085][ T524] f2fs_iget+0xa75/0x4a00 [ 57.529468][ T524] f2fs_lookup+0x491/0xc20 [ 57.534247][ T524] __lookup_slow+0x19b/0x3d0 [ 57.539110][ T524] walk_component+0x3ad/0x710 [ 57.543946][ T524] path_lookupat+0x112/0x6a0 [ 57.548530][ T524] filename_lookup+0x17f/0x510 [ 57.553288][ T524] user_path_at_empty+0xa2/0xf0 [ 57.558137][ T524] do_sys_truncate.part.0+0x85/0x100 [ 57.563498][ T524] __x64_sys_truncate+0x54/0x80 [ 57.568614][ T524] do_syscall_64+0x32/0x50 [ 57.573205][ T524] page last free stack trace: [ 57.577868][ T524] free_pcp_prepare+0x1a7/0x230 [ 57.582981][ T524] free_unref_page_list+0x18a/0xae0 [ 57.588307][ T524] release_pages+0x374/0xb00 [ 57.593170][ T524] free_pages_and_swap_cache+0x180/0x1e0 [ 57.599068][ T524] tlb_flush_mmu+0xbe/0x590 [ 57.603613][ T524] unmap_page_range+0x127b/0x1d60 [ 57.608876][ T524] unmap_vmas+0x1cf/0x390 [ 57.613460][ T524] exit_mmap+0x276/0x520 [ 57.617729][ T524] mmput+0x99/0x430 [ 57.621533][ T524] do_exit+0x873/0x2330 [ 57.625928][ T524] do_group_exit+0xe6/0x290 [ 57.630499][ T524] get_signal+0x353/0x1a10 [ 57.635034][ T524] arch_do_signal_or_restart+0x2c1/0x1b70 [ 57.641130][ T524] exit_to_user_mode_prepare+0x10f/0x160 [ 57.647182][ T524] syscall_exit_to_user_mode+0x27/0x160 [ 57.652824][ T524] do_syscall_64+0x3f/0x50 [ 57.657360][ T524] [ 57.659771][ T524] Memory state around the buggy address: [ 57.665597][ T524] ffff888127033100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.673651][ T524] ffff888127033180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.682213][ T524] >ffff888127033200: fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb fb [ 57.690594][ T524] ^ [ 57.696373][ T524] ffff888127033280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.704655][ T524] ffff888127033300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.712889][ T524] ================================================================== [ 57.860001][ T532] F2FS-fs (loop3): invalid crc value [ 57.867174][ T532] F2FS-fs (loop3): Found nat_bits in checkpoint [ 57.897936][ T530] F2FS-fs (loop0): invalid crc value [ 57.945944][ T532] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 57.958992][ T532] F2FS-fs (loop3): access invalid blkaddr:2147563524 [ 57.968984][ T530] F2FS-fs (loop0): Found nat_bits in checkpoint [ 57.988387][ T532] CPU: 1 PID: 532 Comm: syz.3.22 Tainted: G B syzkaller #0 [ 57.996895][ T532] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 58.007160][ T532] Call Trace: [ 58.010472][ T532] dump_stack_lvl+0x81/0xac [ 58.015112][ T532] dump_stack+0x10/0x12 [ 58.019268][ T532] f2fs_is_valid_blkaddr.cold+0x2a/0x47 [ 58.025425][ T532] f2fs_iget+0x351e/0x4a00 [ 58.029933][ T532] f2fs_lookup+0x491/0xc20 [ 58.034347][ T532] ? __recover_dot_dentries+0x530/0x530 [ 58.039881][ T532] ? __legitimize_path+0x6c/0x170 [ 58.044905][ T532] __lookup_slow+0x19b/0x3d0 [ 58.049485][ T532] ? page_put_link+0x80/0x80 [ 58.054322][ T532] ? inode_permission.part.0+0xc2/0x320 [ 58.059912][ T532] walk_component+0x3ad/0x710 [ 58.064657][ T532] ? handle_dots.part.0+0x11c0/0x11c0 [ 58.070017][ T532] ? walk_component+0x710/0x710 [ 58.074865][ T532] path_lookupat+0x112/0x6a0 [ 58.079542][ T532] ? _atomic_dec_and_lock+0x19/0xa0 [ 58.084729][ T532] filename_lookup+0x17f/0x510 [ 58.089482][ T532] ? may_linkat+0x200/0x200 [ 58.094087][ T532] ? __check_object_size+0x1df/0x270 [ 58.099456][ T532] ? kmem_cache_alloc+0x17f/0x4f0 [ 58.104680][ T532] ? getname_flags.part.0+0x8c/0x480 [ 58.109950][ T532] user_path_at_empty+0xa2/0xf0 [ 58.115061][ T532] do_sys_truncate.part.0+0x85/0x100 [ 58.120329][ T532] ? vfs_truncate+0x540/0x540 [ 58.125003][ T532] ? __kasan_check_write+0x14/0x20 [ 58.130114][ T532] ? switch_fpu_return+0xbf/0x1b0 [ 58.135213][ T532] __x64_sys_truncate+0x54/0x80 [ 58.140139][ T532] do_syscall_64+0x32/0x50 [ 58.144634][ T532] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 58.150599][ T532] RIP: 0033:0x7f287bf69339 [ 58.155195][ T532] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 58.175115][ T532] RSP: 002b:00007f287bdce028 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 58.183605][ T532] RAX: ffffffffffffffda RBX: 00007f287c1a4fa0 RCX: 00007f287bf69339 [ 58.192262][ T532] RDX: 0000000000000000 RSI: 0000000000001c9e RDI: 0000200000000280 [ 58.200223][ T532] RBP: 00007f287bffcd68 R08: 0000000000000000 R09: 0000000000000000 [ 58.208385][ T532] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 58.216520][ T532] R13: 00007f287c1a5038 R14: 00007f287c1a4fa0 R15: 00007ffe73f33f88 [ 58.235371][ T530] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 58.252904][ T530] F2FS-fs (loop0): access invalid blkaddr:2147563524 [ 58.269980][ T530] CPU: 0 PID: 530 Comm: syz.0.23 Tainted: G B syzkaller #0 [ 58.278960][ T530] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 58.290231][ T530] Call Trace: [ 58.293521][ T530] dump_stack_lvl+0x81/0xac [ 58.298043][ T530] dump_stack+0x10/0x12 [ 58.302197][ T530] f2fs_is_valid_blkaddr.cold+0x2a/0x47 [ 58.307825][ T530] f2fs_iget+0x351e/0x4a00 [ 58.312234][ T530] f2fs_lookup+0x491/0xc20 [ 58.316916][ T530] ? __recover_dot_dentries+0x530/0x530 [ 58.322763][ T530] ? __legitimize_path+0x6c/0x170 [ 58.327966][ T530] __lookup_slow+0x19b/0x3d0 [ 58.332632][ T530] ? page_put_link+0x80/0x80 [ 58.337513][ T530] ? inode_permission.part.0+0xc2/0x320 [ 58.343229][ T530] walk_component+0x3ad/0x710 [ 58.348423][ T530] ? handle_dots.part.0+0x11c0/0x11c0 [ 58.353899][ T530] ? walk_component+0x710/0x710 [ 58.359367][ T530] path_lookupat+0x112/0x6a0 [ 58.364911][ T530] ? _atomic_dec_and_lock+0x19/0xa0 [ 58.371187][ T530] filename_lookup+0x17f/0x510 [ 58.376208][ T530] ? may_linkat+0x200/0x200 [ 58.380885][ T530] ? __check_object_size+0x1df/0x270 [ 58.386671][ T530] ? kmem_cache_alloc+0x17f/0x4f0 [ 58.392171][ T530] ? getname_flags.part.0+0x8c/0x480 [ 58.397627][ T530] user_path_at_empty+0xa2/0xf0 [ 58.402480][ T530] do_sys_truncate.part.0+0x85/0x100 [ 58.407753][ T530] ? vfs_truncate+0x540/0x540 [ 58.412502][ T530] ? __kasan_check_write+0x14/0x20 [ 58.417604][ T530] ? switch_fpu_return+0xbf/0x1b0 [ 58.422618][ T530] __x64_sys_truncate+0x54/0x80 [ 58.427462][ T530] do_syscall_64+0x32/0x50 [ 58.432136][ T530] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 58.438191][ T530] RIP: 0033:0x7f1693edf339 [ 58.442777][ T530] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 58.462461][ T530] RSP: 002b:00007f1693d44028 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 58.471351][ T530] RAX: ffffffffffffffda RBX: 00007f169411afa0 RCX: 00007f1693edf339 [ 58.479457][ T530] RDX: 0000000000000000 RSI: 0000000000001c9e RDI: 0000200000000280 [ 58.487880][ T530] RBP: 00007f1693f72d68 R08: 0000000000000000 R09: 0000000000000000 [ 58.495926][ T530] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 58.503980][ T530] R13: 00007f169411b038 R14: 00007f169411afa0 R15: 00007ffc1fc3bd98 [ 58.513166][ T532] F2FS-fs (loop3): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 58.527636][ T530] F2FS-fs (loop0): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 58.540717][ T549] F2FS-fs (loop3): access invalid blkaddr:2147563524 [ 58.548663][ T550] F2FS-fs (loop0): access invalid blkaddr:2147563524 [ 58.555540][ T549] CPU: 0 PID: 549 Comm: syz.3.22 Tainted: G B syzkaller #0 [ 58.564330][ T549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 58.574655][ T549] Call Trace: [ 58.577960][ T549] dump_stack_lvl+0x81/0xac [ 58.582650][ T549] dump_stack+0x10/0x12 [ 58.587398][ T549] f2fs_is_valid_blkaddr.cold+0x2a/0x47 [ 58.593088][ T549] f2fs_iget+0x351e/0x4a00 [ 58.597791][ T549] f2fs_lookup+0x491/0xc20 [ 58.602220][ T549] ? __recover_dot_dentries+0x530/0x530 [ 58.608388][ T549] path_openat+0x1024/0x3950 [ 58.612988][ T549] ? path_lookupat+0x6a0/0x6a0 [ 58.618021][ T549] ? __kasan_check_read+0x11/0x20 [ 58.623140][ T549] ? pagevec_add_and_need_flush+0x216/0x290 [ 58.629347][ T549] ? perf_trace_mm_lru_insertion+0x970/0x970 [ 58.635610][ T549] ? __mod_memcg_lruvec_state+0x118/0x330 [ 58.641529][ T549] ? __mod_node_page_state+0xa6/0x110 [ 58.647458][ T549] do_filp_open+0x193/0x3d0 [ 58.652138][ T549] ? may_open_dev+0xd0/0xd0 [ 58.656738][ T549] ? __check_object_size+0x1df/0x270 [ 58.662263][ T549] ? _raw_spin_unlock+0x41/0x70 [ 58.667273][ T549] do_sys_openat2+0x135/0x810 [ 58.671948][ T549] ? recalc_sigpending+0x7c/0xb0 [ 58.676991][ T549] ? __set_task_blocked+0x8a/0x170 [ 58.682104][ T549] ? build_open_flags+0x490/0x490 [ 58.687137][ T549] ? sigprocmask+0x1ed/0x370 [ 58.691736][ T549] ? __kasan_check_write+0x14/0x20 [ 58.696849][ T549] __x64_sys_openat+0x124/0x200 [ 58.701839][ T549] ? __ia32_sys_open+0x1b0/0x1b0 [ 58.706897][ T549] ? fpregs_assert_state_consistent+0x3f/0x60 [ 58.712986][ T549] ? exit_to_user_mode_prepare+0x36/0x160 [ 58.718814][ T549] do_syscall_64+0x32/0x50 [ 58.723464][ T549] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 58.729554][ T549] RIP: 0033:0x7f287bf69339 [ 58.733968][ T549] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 58.753661][ T549] RSP: 002b:00007f287bdad028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 58.762549][ T549] RAX: ffffffffffffffda RBX: 00007f287c1a5090 RCX: 00007f287bf69339 [ 58.771098][ T549] RDX: 0000000000101000 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 58.779435][ T549] RBP: 00007f287bffcd68 R08: 0000000000000000 R09: 0000000000000000 [ 58.787681][ T549] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 58.796070][ T549] R13: 00007f287c1a5128 R14: 00007f287c1a5090 R15: 00007ffe73f33f88 [ 58.805657][ T550] CPU: 0 PID: 550 Comm: syz.0.23 Tainted: G B syzkaller #0 [ 58.814336][ T550] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 58.825020][ T550] Call Trace: [ 58.828595][ T550] dump_stack_lvl+0x81/0xac [ 58.833195][ T550] dump_stack+0x10/0x12 [ 58.837359][ T550] f2fs_is_valid_blkaddr.cold+0x2a/0x47 [ 58.842995][ T550] f2fs_iget+0x351e/0x4a00 [ 58.847508][ T550] f2fs_lookup+0x491/0xc20 [ 58.851939][ T550] ? __recover_dot_dentries+0x530/0x530 [ 58.857495][ T550] path_openat+0x1024/0x3950 [ 58.862271][ T550] ? path_lookupat+0x6a0/0x6a0 [ 58.867339][ T550] ? __kasan_check_read+0x11/0x20 [ 58.872416][ T550] ? pagevec_add_and_need_flush+0x216/0x290 [ 58.878322][ T550] ? perf_trace_mm_lru_insertion+0x970/0x970 [ 58.884308][ T550] ? __mod_memcg_lruvec_state+0x118/0x330 [ 58.890036][ T550] ? __mod_node_page_state+0xa6/0x110 [ 58.895848][ T550] do_filp_open+0x193/0x3d0 [ 58.900364][ T550] ? may_open_dev+0xd0/0xd0 [ 58.904964][ T550] ? __check_object_size+0x1df/0x270 [ 58.910352][ T550] ? _raw_spin_unlock+0x41/0x70 [ 58.915420][ T550] do_sys_openat2+0x135/0x810 [ 58.920576][ T550] ? recalc_sigpending+0x7c/0xb0 [ 58.925693][ T550] ? __set_task_blocked+0x8a/0x170 [ 58.926827][ T549] F2FS-fs (loop3): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 58.930796][ T550] ? build_open_flags+0x490/0x490 [ 58.930800][ T550] ? sigprocmask+0x1ed/0x370 [ 58.930805][ T550] ? __kasan_check_write+0x14/0x20 [ 58.930810][ T550] __x64_sys_openat+0x124/0x200 [ 58.930818][ T550] ? __ia32_sys_open+0x1b0/0x1b0 [ 58.945224][ T549] ================================================================== [ 58.950400][ T550] ? fpregs_assert_state_consistent+0x3f/0x60 [ 58.955142][ T549] BUG: KASAN: double-free or invalid-free in kmem_cache_free+0x106/0x440 [ 58.960320][ T550] ? exit_to_user_mode_prepare+0x36/0x160 [ 58.965324][ T549] [ 58.970509][ T550] do_syscall_64+0x32/0x50 [ 59.006412][ T550] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 59.012569][ T550] RIP: 0033:0x7f1693edf339 [ 59.017166][ T550] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 59.037629][ T550] RSP: 002b:00007f1693d23028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 59.046647][ T550] RAX: ffffffffffffffda RBX: 00007f169411b090 RCX: 00007f1693edf339 [ 59.054845][ T550] RDX: 0000000000101000 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 59.063275][ T550] RBP: 00007f1693f72d68 R08: 0000000000000000 R09: 0000000000000000 [ 59.071531][ T550] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 59.079496][ T550] R13: 00007f169411b128 R14: 00007f169411b090 R15: 00007ffc1fc3bd98 [ 59.087555][ T549] CPU: 1 PID: 549 Comm: syz.3.22 Tainted: G B syzkaller #0 [ 59.089598][ T550] F2FS-fs (loop0): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 59.096519][ T549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 59.119379][ T549] Call Trace: [ 59.122644][ T549] dump_stack_lvl+0x81/0xac [ 59.127299][ T549] print_address_description.constprop.0+0x24/0x160 [ 59.134041][ T549] ? kmem_cache_free+0x106/0x440 [ 59.139044][ T549] kasan_report_invalid_free+0x56/0x80 [ 59.144646][ T549] ? kmem_cache_free+0x106/0x440 [ 59.149554][ T549] __kasan_slab_free+0x134/0x150 [ 59.154460][ T549] slab_free_freelist_hook+0x9b/0x1a0 [ 59.160070][ T549] ? f2fs_destroy_extent_tree+0x174/0x4b0 [ 59.166059][ T549] kmem_cache_free+0x106/0x440 [ 59.170891][ T549] f2fs_destroy_extent_tree+0x174/0x4b0 [ 59.176470][ T549] f2fs_evict_inode+0x335/0x1680 [ 59.181685][ T549] ? irq_work_queue+0x3c/0x50 [ 59.186483][ T549] ? __inode_wait_for_writeback+0xe7/0x1c0 [ 59.192537][ T549] ? f2fs_write_inode+0x1010/0x1010 [ 59.197800][ T549] ? var_wake_function+0x130/0x130 [ 59.202970][ T549] ? _raw_spin_lock_bh+0x110/0x110 [ 59.208055][ T549] ? vprintk_func+0x5a/0x150 [ 59.212712][ T549] ? _raw_spin_lock_bh+0x110/0x110 [ 59.217794][ T549] evict+0x372/0x940 [ 59.221666][ T549] ? new_inode+0x2f0/0x2f0 [ 59.226410][ T549] ? _raw_spin_lock+0x86/0x110 [ 59.231269][ T549] ? _raw_spin_lock_bh+0x110/0x110 [ 59.236465][ T549] ? __kasan_check_read+0x11/0x20 [ 59.241581][ T549] ? f2fs_drop_inode+0x71/0x910 [ 59.246501][ T549] iput.part.0+0x33b/0x640 [ 59.250892][ T549] iput+0x3f/0x50 [ 59.254568][ T549] iget_failed+0x1e/0x30 [ 59.258894][ T549] f2fs_iget+0x22be/0x4a00 [ 59.263403][ T549] f2fs_lookup+0x491/0xc20 [ 59.267809][ T549] ? __recover_dot_dentries+0x530/0x530 [ 59.273419][ T549] path_openat+0x1024/0x3950 [ 59.278245][ T549] ? path_lookupat+0x6a0/0x6a0 [ 59.283640][ T549] ? __kasan_check_read+0x11/0x20 [ 59.288657][ T549] ? pagevec_add_and_need_flush+0x216/0x290 [ 59.294670][ T549] ? perf_trace_mm_lru_insertion+0x970/0x970 [ 59.300801][ T549] ? __mod_memcg_lruvec_state+0x118/0x330 [ 59.306668][ T549] ? __mod_node_page_state+0xa6/0x110 [ 59.312238][ T549] do_filp_open+0x193/0x3d0 [ 59.316800][ T549] ? may_open_dev+0xd0/0xd0 [ 59.321453][ T549] ? __check_object_size+0x1df/0x270 [ 59.326986][ T549] ? _raw_spin_unlock+0x41/0x70 [ 59.332653][ T549] do_sys_openat2+0x135/0x810 [ 59.337578][ T549] ? recalc_sigpending+0x7c/0xb0 [ 59.343854][ T549] ? __set_task_blocked+0x8a/0x170 [ 59.349423][ T549] ? build_open_flags+0x490/0x490 [ 59.354735][ T549] ? sigprocmask+0x1ed/0x370 [ 59.359345][ T549] ? __kasan_check_write+0x14/0x20 [ 59.364875][ T549] __x64_sys_openat+0x124/0x200 [ 59.370529][ T549] ? __ia32_sys_open+0x1b0/0x1b0 [ 59.376290][ T549] ? fpregs_assert_state_consistent+0x3f/0x60 [ 59.382836][ T549] ? exit_to_user_mode_prepare+0x36/0x160 [ 59.389173][ T549] do_syscall_64+0x32/0x50 [ 59.393686][ T549] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 59.400865][ T549] RIP: 0033:0x7f287bf69339 [ 59.405664][ T549] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 59.426003][ T549] RSP: 002b:00007f287bdad028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 59.435082][ T549] RAX: ffffffffffffffda RBX: 00007f287c1a5090 RCX: 00007f287bf69339 [ 59.443561][ T549] RDX: 0000000000101000 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 59.451974][ T549] RBP: 00007f287bffcd68 R08: 0000000000000000 R09: 0000000000000000 [ 59.460513][ T549] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 59.469193][ T549] R13: 00007f287c1a5128 R14: 00007f287c1a5090 R15: 00007ffe73f33f88 [ 59.477597][ T549] [ 59.480043][ T549] Allocated by task 532: [ 59.484458][ T549] kasan_save_stack+0x26/0x50 [ 59.489121][ T549] __kasan_slab_alloc+0x94/0xc0 [ 59.494071][ T549] kmem_cache_alloc+0x15d/0x4f0 [ 59.498897][ T549] f2fs_init_extent_tree+0x98f/0xdf0 [ 59.504156][ T549] f2fs_iget+0xa75/0x4a00 [ 59.508455][ T549] f2fs_lookup+0x491/0xc20 [ 59.512941][ T549] __lookup_slow+0x19b/0x3d0 [ 59.517673][ T549] walk_component+0x3ad/0x710 [ 59.522501][ T549] path_lookupat+0x112/0x6a0 [ 59.527165][ T549] filename_lookup+0x17f/0x510 [ 59.532316][ T549] user_path_at_empty+0xa2/0xf0 [ 59.537347][ T549] do_sys_truncate.part.0+0x85/0x100 [ 59.542742][ T549] __x64_sys_truncate+0x54/0x80 [ 59.547740][ T549] do_syscall_64+0x32/0x50 [ 59.552143][ T549] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 59.558080][ T549] [ 59.560399][ T549] Freed by task 532: [ 59.564272][ T549] kasan_save_stack+0x26/0x50 [ 59.569467][ T549] kasan_set_track+0x25/0x30 [ 59.574124][ T549] kasan_set_free_info+0x24/0x40 [ 59.579057][ T549] __kasan_slab_free+0x111/0x150 [ 59.584068][ T549] slab_free_freelist_hook+0x9b/0x1a0 [ 59.589513][ T549] kmem_cache_free+0x106/0x440 [ 59.594489][ T549] f2fs_destroy_extent_tree+0x174/0x4b0 [ 59.600407][ T549] f2fs_evict_inode+0x335/0x1680 [ 59.605595][ T549] evict+0x372/0x940 [ 59.609484][ T549] iput.part.0+0x33b/0x640 [ 59.614485][ T549] iput+0x3f/0x50 [ 59.618203][ T549] iget_failed+0x1e/0x30 [ 59.622520][ T549] f2fs_iget+0x22be/0x4a00 [ 59.626926][ T549] f2fs_lookup+0x491/0xc20 [ 59.631426][ T549] __lookup_slow+0x19b/0x3d0 [ 59.636531][ T549] walk_component+0x3ad/0x710 [ 59.641180][ T549] path_lookupat+0x112/0x6a0 [ 59.645825][ T549] filename_lookup+0x17f/0x510 [ 59.650589][ T549] user_path_at_empty+0xa2/0xf0 [ 59.655609][ T549] do_sys_truncate.part.0+0x85/0x100 [ 59.660890][ T549] __x64_sys_truncate+0x54/0x80 [ 59.665888][ T549] do_syscall_64+0x32/0x50 [ 59.670288][ T549] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 59.676247][ T549] [ 59.678566][ T549] The buggy address belongs to the object at ffff88810e2e50e0 [ 59.678566][ T549] which belongs to the cache f2fs_extent_tree of size 80 [ 59.693683][ T549] The buggy address is located 0 bytes inside of [ 59.693683][ T549] 80-byte region [ffff88810e2e50e0, ffff88810e2e5130) [ 59.708108][ T549] The buggy address belongs to the page: [ 59.714196][ T549] page:ffffea000438b940 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10e2e5 [ 59.725030][ T549] flags: 0x4000000000000200(slab) [ 59.730045][ T549] raw: 4000000000000200 dead000000000100 dead000000000122 ffff888104581500 [ 59.738600][ T549] raw: 0000000000000000 0000000080240024 00000001ffffffff 0000000000000000 [ 59.747607][ T549] page dumped because: kasan: bad access detected [ 59.754008][ T549] page_owner tracks the page as allocated [ 59.759828][ T549] page last allocated via order 0, migratetype Reclaimable, gfp_mask 0x112c50(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 509, ts 53702556227, free_ts 52989743503 [ 59.779751][ T549] get_page_from_freelist+0x1fee/0x2ad0 [ 59.785601][ T549] __alloc_pages_nodemask+0x2ae/0x2530 [ 59.791061][ T549] allocate_slab+0x30f/0x460 [ 59.795627][ T549] ___slab_alloc.constprop.0+0x32b/0x730 [ 59.801545][ T549] kmem_cache_alloc+0x491/0x4f0 [ 59.806401][ T549] f2fs_init_extent_tree+0x98f/0xdf0 [ 59.811749][ T549] f2fs_iget+0xa75/0x4a00 [ 59.816585][ T549] f2fs_lookup+0x491/0xc20 [ 59.821245][ T549] path_openat+0x1024/0x3950 [ 59.825965][ T549] do_filp_open+0x193/0x3d0 [ 59.830620][ T549] do_sys_openat2+0x135/0x810 [ 59.835528][ T549] __x64_sys_openat+0x124/0x200 [ 59.840354][ T549] do_syscall_64+0x32/0x50 [ 59.845051][ T549] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 59.851221][ T549] page last free stack trace: [ 59.856439][ T549] free_pcp_prepare+0x1a7/0x230 [ 59.861673][ T549] free_unref_page+0x19/0x270 [ 59.866693][ T549] __free_pages+0xba/0xf0 [ 59.871405][ T549] __free_slab+0xde/0x1d0 [ 59.875977][ T549] discard_slab+0x2b/0x40 [ 59.880544][ T549] unfreeze_partials+0x1e1/0x240 [ 59.885471][ T549] put_cpu_partial+0xce/0x120 [ 59.890221][ T549] __slab_free+0x23f/0x560 [ 59.894788][ T549] ___cache_free+0x255/0x2b0 [ 59.899348][ T549] qlist_free_all+0x71/0x150 [ 59.904095][ T549] kasan_quarantine_reduce+0x15f/0x1c0 [ 59.909682][ T549] __kasan_slab_alloc+0xaa/0xc0 [ 59.914777][ T549] kmem_cache_alloc+0x15d/0x4f0 [ 59.919603][ T549] __alloc_skb+0x41/0x4d0 [ 59.924015][ T549] rtmsg_ifinfo_build_skb+0x70/0x160 [ 59.929273][ T549] rtmsg_ifinfo+0x65/0x110 [ 59.933743][ T549] [ 59.936277][ T549] Memory state around the buggy address: [ 59.941881][ T549] ffff88810e2e4f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 59.950001][ T549] ffff88810e2e5000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fa fb [ 59.958148][ T549] >ffff88810e2e5080: fb fb fb fb fb fb fb fb fc fc fc fc fa fb fb fb [ 59.966217][ T549] ^ [ 59.973947][ T549] ffff88810e2e5100: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc [ 59.982698][ T549] ffff88810e2e5180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 59.990939][ T549] ================================================================== [ 59.999154][ T550] ================================================================== [ 60.007439][ T550] BUG: KASAN: double-free or invalid-free in kmem_cache_free+0x106/0x440 [ 60.015929][ T550] [ 60.018266][ T550] CPU: 0 PID: 550 Comm: syz.0.23 Tainted: G B syzkaller #0 [ 60.027035][ T550] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 60.037367][ T550] Call Trace: [ 60.040643][ T550] dump_stack_lvl+0x81/0xac [ 60.045390][ T550] print_address_description.constprop.0+0x24/0x160 [ 60.051959][ T550] ? kmem_cache_free+0x106/0x440 [ 60.056875][ T550] kasan_report_invalid_free+0x56/0x80 [ 60.062484][ T550] ? kmem_cache_free+0x106/0x440 [ 60.067492][ T550] __kasan_slab_free+0x134/0x150 [ 60.072445][ T550] slab_free_freelist_hook+0x9b/0x1a0 [ 60.077895][ T550] ? f2fs_destroy_extent_tree+0x174/0x4b0 [ 60.083777][ T550] kmem_cache_free+0x106/0x440 [ 60.088526][ T550] f2fs_destroy_extent_tree+0x174/0x4b0 [ 60.094258][ T550] f2fs_evict_inode+0x335/0x1680 [ 60.099183][ T550] ? irq_work_queue+0x3c/0x50 [ 60.103838][ T550] ? __inode_wait_for_writeback+0xe7/0x1c0 [ 60.109625][ T550] ? f2fs_write_inode+0x1010/0x1010 [ 60.114892][ T550] ? var_wake_function+0x130/0x130 [ 60.120118][ T550] ? _raw_spin_lock_bh+0x110/0x110 [ 60.125291][ T550] ? vprintk_func+0x5a/0x150 [ 60.129899][ T550] ? _raw_spin_lock_bh+0x110/0x110 [ 60.135078][ T550] evict+0x372/0x940 [ 60.139050][ T550] ? new_inode+0x2f0/0x2f0 [ 60.143443][ T550] ? _raw_spin_lock+0x86/0x110 [ 60.148273][ T550] ? _raw_spin_lock_bh+0x110/0x110 [ 60.153458][ T550] ? __kasan_check_read+0x11/0x20 [ 60.158546][ T550] ? f2fs_drop_inode+0x71/0x910 [ 60.163472][ T550] iput.part.0+0x33b/0x640 [ 60.168042][ T550] iput+0x3f/0x50 [ 60.171901][ T550] iget_failed+0x1e/0x30 [ 60.176316][ T550] f2fs_iget+0x22be/0x4a00 [ 60.180717][ T550] f2fs_lookup+0x491/0xc20 [ 60.185203][ T550] ? __recover_dot_dentries+0x530/0x530 [ 60.190730][ T550] path_openat+0x1024/0x3950 [ 60.195387][ T550] ? path_lookupat+0x6a0/0x6a0 [ 60.200231][ T550] ? __kasan_check_read+0x11/0x20 [ 60.205235][ T550] ? pagevec_add_and_need_flush+0x216/0x290 [ 60.211124][ T550] ? perf_trace_mm_lru_insertion+0x970/0x970 [ 60.217273][ T550] ? __mod_memcg_lruvec_state+0x118/0x330 [ 60.223186][ T550] ? __mod_node_page_state+0xa6/0x110 [ 60.228694][ T550] do_filp_open+0x193/0x3d0 [ 60.233185][ T550] ? may_open_dev+0xd0/0xd0 [ 60.237940][ T550] ? __check_object_size+0x1df/0x270 [ 60.243295][ T550] ? _raw_spin_unlock+0x41/0x70 [ 60.248223][ T550] do_sys_openat2+0x135/0x810 [ 60.252882][ T550] ? recalc_sigpending+0x7c/0xb0 [ 60.258007][ T550] ? __set_task_blocked+0x8a/0x170 [ 60.263120][ T550] ? build_open_flags+0x490/0x490 [ 60.268384][ T550] ? sigprocmask+0x1ed/0x370 [ 60.273049][ T550] ? __kasan_check_write+0x14/0x20 [ 60.278230][ T550] __x64_sys_openat+0x124/0x200 [ 60.283153][ T550] ? __ia32_sys_open+0x1b0/0x1b0 [ 60.288169][ T550] ? fpregs_assert_state_consistent+0x3f/0x60 [ 60.294430][ T550] ? exit_to_user_mode_prepare+0x36/0x160 [ 60.300215][ T550] do_syscall_64+0x32/0x50 [ 60.304703][ T550] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 60.310670][ T550] RIP: 0033:0x7f1693edf339 [ 60.315246][ T550] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 60.335381][ T550] RSP: 002b:00007f1693d23028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 60.343865][ T550] RAX: ffffffffffffffda RBX: 00007f169411b090 RCX: 00007f1693edf339 [ 60.351816][ T550] RDX: 0000000000101000 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 60.359857][ T550] RBP: 00007f1693f72d68 R08: 0000000000000000 R09: 0000000000000000 [ 60.367970][ T550] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 60.376111][ T550] R13: 00007f169411b128 R14: 00007f169411b090 R15: 00007ffc1fc3bd98 [ 60.384264][ T550] [ 60.386583][ T550] Allocated by task 530: [ 60.390901][ T550] kasan_save_stack+0x26/0x50 [ 60.395664][ T550] __kasan_slab_alloc+0x94/0xc0 [ 60.400493][ T550] kmem_cache_alloc+0x15d/0x4f0 [ 60.405467][ T550] f2fs_init_extent_tree+0x98f/0xdf0 [ 60.410738][ T550] f2fs_iget+0xa75/0x4a00 [ 60.415066][ T550] f2fs_lookup+0x491/0xc20 [ 60.419557][ T550] __lookup_slow+0x19b/0x3d0 [ 60.424211][ T550] walk_component+0x3ad/0x710 [ 60.428967][ T550] path_lookupat+0x112/0x6a0 [ 60.433636][ T550] filename_lookup+0x17f/0x510 [ 60.438464][ T550] user_path_at_empty+0xa2/0xf0 [ 60.443295][ T550] do_sys_truncate.part.0+0x85/0x100 [ 60.448643][ T550] __x64_sys_truncate+0x54/0x80 [ 60.453761][ T550] do_syscall_64+0x32/0x50 [ 60.458244][ T550] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 60.464206][ T550] [ 60.466618][ T550] Freed by task 530: [ 60.470619][ T550] kasan_save_stack+0x26/0x50 [ 60.475282][ T550] kasan_set_track+0x25/0x30 [ 60.479853][ T550] kasan_set_free_info+0x24/0x40 [ 60.484769][ T550] __kasan_slab_free+0x111/0x150 [ 60.489682][ T550] slab_free_freelist_hook+0x9b/0x1a0 [ 60.495071][ T550] kmem_cache_free+0x106/0x440 [ 60.499850][ T550] f2fs_destroy_extent_tree+0x174/0x4b0 [ 60.505385][ T550] f2fs_evict_inode+0x335/0x1680 [ 60.510332][ T550] evict+0x372/0x940 [ 60.514303][ T550] iput.part.0+0x33b/0x640 [ 60.518782][ T550] iput+0x3f/0x50 [ 60.522485][ T550] iget_failed+0x1e/0x30 [ 60.526793][ T550] f2fs_iget+0x22be/0x4a00 [ 60.531288][ T550] f2fs_lookup+0x491/0xc20 [ 60.535679][ T550] __lookup_slow+0x19b/0x3d0 [ 60.540261][ T550] walk_component+0x3ad/0x710 [ 60.545263][ T550] path_lookupat+0x112/0x6a0 [ 60.549847][ T550] filename_lookup+0x17f/0x510 [ 60.554589][ T550] user_path_at_empty+0xa2/0xf0 [ 60.559655][ T550] do_sys_truncate.part.0+0x85/0x100 [ 60.565178][ T550] __x64_sys_truncate+0x54/0x80 [ 60.570096][ T550] do_syscall_64+0x32/0x50 [ 60.574666][ T550] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 60.580583][ T550] [ 60.583061][ T550] The buggy address belongs to the object at ffff888127033000 [ 60.583061][ T550] which belongs to the cache f2fs_extent_tree of size 80 [ 60.597789][ T550] The buggy address is located 0 bytes inside of [ 60.597789][ T550] 80-byte region [ffff888127033000, ffff888127033050) [ 60.611073][ T550] The buggy address belongs to the page: [ 60.616889][ T550] page:ffffea00049c0cc0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x127033 [ 60.627716][ T550] flags: 0x4000000000000200(slab) [ 60.632807][ T550] raw: 4000000000000200 dead000000000100 dead000000000122 ffff888104581500 [ 60.641471][ T550] raw: 0000000000000000 0000000080240024 00000001ffffffff 0000000000000000 [ 60.650031][ T550] page dumped because: kasan: bad access detected [ 60.656594][ T550] page_owner tracks the page as allocated [ 60.662405][ T550] page last allocated via order 0, migratetype Reclaimable, gfp_mask 0x112c50(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 472, ts 53472543803, free_ts 31131627894 [ 60.681502][ T550] get_page_from_freelist+0x1fee/0x2ad0 [ 60.687135][ T550] __alloc_pages_nodemask+0x2ae/0x2530 [ 60.692859][ T550] allocate_slab+0x30f/0x460 [ 60.697794][ T550] ___slab_alloc.constprop.0+0x32b/0x730 [ 60.703508][ T550] kmem_cache_alloc+0x491/0x4f0 [ 60.708479][ T550] f2fs_init_extent_tree+0x98f/0xdf0 [ 60.713760][ T550] f2fs_iget+0xa75/0x4a00 [ 60.718070][ T550] f2fs_lookup+0x491/0xc20 [ 60.722586][ T550] __lookup_slow+0x19b/0x3d0 [ 60.727376][ T550] walk_component+0x3ad/0x710 [ 60.732145][ T550] path_lookupat+0x112/0x6a0 [ 60.736915][ T550] filename_lookup+0x17f/0x510 [ 60.741766][ T550] user_path_at_empty+0xa2/0xf0 [ 60.746610][ T550] do_sys_truncate.part.0+0x85/0x100 [ 60.751886][ T550] __x64_sys_truncate+0x54/0x80 [ 60.756719][ T550] do_syscall_64+0x32/0x50 [ 60.761254][ T550] page last free stack trace: [ 60.766170][ T550] free_pcp_prepare+0x1a7/0x230 [ 60.771085][ T550] free_unref_page_list+0x18a/0xae0 [ 60.776346][ T550] release_pages+0x374/0xb00 [ 60.781149][ T550] free_pages_and_swap_cache+0x180/0x1e0 [ 60.786971][ T550] tlb_flush_mmu+0xbe/0x590 [ 60.791478][ T550] unmap_page_range+0x127b/0x1d60 [ 60.796800][ T550] unmap_vmas+0x1cf/0x390 [ 60.801246][ T550] exit_mmap+0x276/0x520 [ 60.805631][ T550] mmput+0x99/0x430 [ 60.809518][ T550] do_exit+0x873/0x2330 [ 60.813695][ T550] do_group_exit+0xe6/0x290 [ 60.818193][ T550] get_signal+0x353/0x1a10 [ 60.822595][ T550] arch_do_signal_or_restart+0x2c1/0x1b70 [ 60.828292][ T550] exit_to_user_mode_prepare+0x10f/0x160 [ 60.834002][ T550] syscall_exit_to_user_mode+0x27/0x160 [ 60.839703][ T550] do_syscall_64+0x3f/0x50 [ 60.844470][ T550] [ 60.846882][ T550] Memory state around the buggy address: [ 60.852497][ T550] ffff888127032f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc 2026/02/12 20:55:21 executed programs: 20 [ 60.861026][ T550] ffff888127032f80: fc fc fa fb fb fb fc fc fc fc fc fc fc fc fc fc [ 60.869093][ T550] >ffff888127033000: fa fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc [ 60.877136][ T550] ^ [ 60.881180][ T550] ffff888127033080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 60.889220][ T550] ffff888127033100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 60.897588][ T550] ================================================================== [ 61.918919][ T554] F2FS-fs (loop2): invalid crc value [ 61.969090][ T554] F2FS-fs (loop2): Found nat_bits in checkpoint [ 62.058560][ T554] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 62.149939][ T554] F2FS-fs (loop2): access invalid blkaddr:2147563524 [ 62.156934][ T554] CPU: 1 PID: 554 Comm: syz.2.30 Tainted: G B syzkaller #0 [ 62.165611][ T554] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 62.175948][ T554] Call Trace: [ 62.179333][ T554] dump_stack_lvl+0x81/0xac [ 62.184200][ T554] dump_stack+0x10/0x12 [ 62.188620][ T554] f2fs_is_valid_blkaddr.cold+0x2a/0x47 [ 62.194458][ T554] f2fs_iget+0x351e/0x4a00 [ 62.198879][ T554] f2fs_lookup+0x491/0xc20 [ 62.203318][ T554] ? __recover_dot_dentries+0x530/0x530 [ 62.209066][ T554] ? __legitimize_path+0x6c/0x170 [ 62.214285][ T554] __lookup_slow+0x19b/0x3d0 [ 62.219291][ T554] ? page_put_link+0x80/0x80 [ 62.223887][ T554] ? inode_permission.part.0+0xc2/0x320 [ 62.229971][ T554] walk_component+0x3ad/0x710 [ 62.234914][ T554] ? handle_dots.part.0+0x11c0/0x11c0 [ 62.240477][ T554] ? walk_component+0x710/0x710 [ 62.245593][ T554] ? irq_exit_rcu+0x3a/0x170 [ 62.250190][ T554] path_lookupat+0x112/0x6a0 [ 62.254873][ T554] ? _atomic_dec_and_lock+0x19/0xa0 [ 62.258764][ T556] F2FS-fs (loop6): invalid crc value [ 62.260114][ T554] filename_lookup+0x17f/0x510 [ 62.260121][ T554] ? may_linkat+0x200/0x200 [ 62.275002][ T554] ? __check_object_size+0x1df/0x270 [ 62.280300][ T554] ? kmem_cache_alloc+0x17f/0x4f0 [ 62.285325][ T554] ? getname_flags.part.0+0x8c/0x480 [ 62.290717][ T554] user_path_at_empty+0xa2/0xf0 [ 62.295622][ T554] do_sys_truncate.part.0+0x85/0x100 [ 62.300916][ T554] ? vfs_truncate+0x540/0x540 [ 62.305679][ T554] ? __kasan_check_write+0x14/0x20 [ 62.310802][ T554] ? switch_fpu_return+0xbf/0x1b0 [ 62.315827][ T554] __x64_sys_truncate+0x54/0x80 [ 62.320681][ T554] do_syscall_64+0x32/0x50 [ 62.325104][ T554] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 62.331087][ T554] RIP: 0033:0x7f9437c02339 [ 62.335604][ T554] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 62.355580][ T554] RSP: 002b:00007f9437a67028 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 62.364098][ T554] RAX: ffffffffffffffda RBX: 00007f9437e3dfa0 RCX: 00007f9437c02339 [ 62.372451][ T554] RDX: 0000000000000000 RSI: 0000000000001c9e RDI: 0000200000000280 [ 62.380610][ T554] RBP: 00007f9437c95d68 R08: 0000000000000000 R09: 0000000000000000 [ 62.388592][ T554] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 62.396687][ T554] R13: 00007f9437e3e038 R14: 00007f9437e3dfa0 R15: 00007ffff8305dc8 [ 62.405284][ T554] F2FS-fs (loop2): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 62.416451][ T556] F2FS-fs (loop6): Found nat_bits in checkpoint [ 62.449313][ T562] F2FS-fs (loop0): invalid crc value [ 62.454894][ T556] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5 [ 62.455927][ T562] F2FS-fs (loop0): Found nat_bits in checkpoint [ 62.487080][ T562] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 62.520586][ T560] F2FS-fs (loop4): invalid crc value [ 62.527453][ T560] F2FS-fs (loop4): Found nat_bits in checkpoint [ 62.570148][ T562] F2FS-fs (loop0): access invalid blkaddr:2147563524 [ 62.571634][ T561] F2FS-fs (loop3): invalid crc value [ 62.582693][ T556] F2FS-fs (loop6): access invalid blkaddr:2147563524 [ 62.589538][ T562] CPU: 0 PID: 562 Comm: syz.0.28 Tainted: G B syzkaller #0 [ 62.589949][ T560] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 62.598396][ T562] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 62.598398][ T562] Call Trace: [ 62.598407][ T562] dump_stack_lvl+0x81/0xac [ 62.598411][ T562] dump_stack+0x10/0x12 [ 62.598416][ T562] f2fs_is_valid_blkaddr.cold+0x2a/0x47 [ 62.598423][ T562] f2fs_iget+0x351e/0x4a00 [ 62.598430][ T562] f2fs_lookup+0x491/0xc20 [ 62.598435][ T562] ? __recover_dot_dentries+0x530/0x530 [ 62.598443][ T562] ? __legitimize_path+0x6c/0x170 [ 62.598448][ T562] __lookup_slow+0x19b/0x3d0 [ 62.598452][ T562] ? page_put_link+0x80/0x80 [ 62.598456][ T562] ? inode_permission.part.0+0xc2/0x320 [ 62.598461][ T562] walk_component+0x3ad/0x710 [ 62.598466][ T562] ? handle_dots.part.0+0x11c0/0x11c0 [ 62.598469][ T562] ? walk_component+0x710/0x710 [ 62.598477][ T562] path_lookupat+0x112/0x6a0 [ 62.649849][ T560] F2FS-fs (loop4): access invalid blkaddr:2147563524 [ 62.654470][ T562] ? _atomic_dec_and_lock+0x19/0xa0 [ 62.701989][ T562] filename_lookup+0x17f/0x510 [ 62.706838][ T562] ? may_linkat+0x200/0x200 [ 62.711452][ T562] ? __check_object_size+0x1df/0x270 [ 62.717280][ T562] ? kmem_cache_alloc+0x17f/0x4f0 [ 62.722833][ T562] ? getname_flags.part.0+0x8c/0x480 [ 62.728389][ T562] user_path_at_empty+0xa2/0xf0 [ 62.733332][ T562] do_sys_truncate.part.0+0x85/0x100 [ 62.738970][ T562] ? vfs_truncate+0x540/0x540 [ 62.744159][ T562] ? __kasan_check_write+0x14/0x20 [ 62.749661][ T562] ? switch_fpu_return+0xbf/0x1b0 [ 62.754783][ T562] __x64_sys_truncate+0x54/0x80 [ 62.759969][ T562] do_syscall_64+0x32/0x50 [ 62.764669][ T562] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 62.770815][ T562] RIP: 0033:0x7f1693edf339 [ 62.775516][ T562] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 62.795903][ T562] RSP: 002b:00007f1693d44028 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 62.804689][ T562] RAX: ffffffffffffffda RBX: 00007f169411afa0 RCX: 00007f1693edf339 [ 62.812819][ T562] RDX: 0000000000000000 RSI: 0000000000001c9e RDI: 0000200000000280 [ 62.821085][ T562] RBP: 00007f1693f72d68 R08: 0000000000000000 R09: 0000000000000000 [ 62.829475][ T562] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 62.837898][ T562] R13: 00007f169411b038 R14: 00007f169411afa0 R15: 00007ffc1fc3bd98 [ 62.846125][ T556] CPU: 1 PID: 556 Comm: syz.6.29 Tainted: G B syzkaller #0 [ 62.854727][ T556] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 62.855700][ T562] F2FS-fs (loop0): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 62.864989][ T556] Call Trace: [ 62.865005][ T556] dump_stack_lvl+0x81/0xac [ 62.865009][ T556] dump_stack+0x10/0x12 [ 62.865014][ T556] f2fs_is_valid_blkaddr.cold+0x2a/0x47 [ 62.865021][ T556] f2fs_iget+0x351e/0x4a00 [ 62.865027][ T556] f2fs_lookup+0x491/0xc20 [ 62.865031][ T556] ? __recover_dot_dentries+0x530/0x530 [ 62.865038][ T556] ? __legitimize_path+0x6c/0x170 [ 62.865049][ T556] __lookup_slow+0x19b/0x3d0 [ 62.888679][ T585] F2FS-fs (loop0): access invalid blkaddr:2147563524 [ 62.890083][ T556] ? page_put_link+0x80/0x80 [ 62.932353][ T556] ? inode_permission.part.0+0xc2/0x320 [ 62.938050][ T556] walk_component+0x3ad/0x710 [ 62.943010][ T556] ? handle_dots.part.0+0x11c0/0x11c0 [ 62.948393][ T556] ? walk_component+0x710/0x710 [ 62.953330][ T556] path_lookupat+0x112/0x6a0 [ 62.958053][ T556] ? _atomic_dec_and_lock+0x19/0xa0 [ 62.963406][ T556] filename_lookup+0x17f/0x510 [ 62.968340][ T556] ? may_linkat+0x200/0x200 [ 62.972948][ T556] ? __check_object_size+0x1df/0x270 [ 62.978326][ T556] ? kmem_cache_alloc+0x17f/0x4f0 [ 62.983640][ T556] ? getname_flags.part.0+0x8c/0x480 [ 62.988933][ T556] user_path_at_empty+0xa2/0xf0 [ 62.993997][ T556] do_sys_truncate.part.0+0x85/0x100 [ 62.999357][ T556] ? vfs_truncate+0x540/0x540 [ 63.004022][ T556] ? __kasan_check_write+0x14/0x20 [ 63.009117][ T556] ? switch_fpu_return+0xbf/0x1b0 [ 63.014138][ T556] __x64_sys_truncate+0x54/0x80 [ 63.018979][ T556] do_syscall_64+0x32/0x50 [ 63.023473][ T556] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 63.029640][ T556] RIP: 0033:0x7f70ffa50339 [ 63.034216][ T556] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 63.054511][ T556] RSP: 002b:00007f70ff8b5028 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 63.063275][ T556] RAX: ffffffffffffffda RBX: 00007f70ffc8bfa0 RCX: 00007f70ffa50339 [ 63.071905][ T556] RDX: 0000000000000000 RSI: 0000000000001c9e RDI: 0000200000000280 [ 63.080236][ T556] RBP: 00007f70ffae3d68 R08: 0000000000000000 R09: 0000000000000000 [ 63.088628][ T556] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 63.096685][ T556] R13: 00007f70ffc8c038 R14: 00007f70ffc8bfa0 R15: 00007ffef4838dd8 [ 63.105411][ T585] CPU: 0 PID: 585 Comm: syz.0.28 Tainted: G B syzkaller #0 [ 63.114026][ T585] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 63.124173][ T585] Call Trace: [ 63.127469][ T585] dump_stack_lvl+0x81/0xac [ 63.131976][ T585] dump_stack+0x10/0x12 [ 63.136316][ T585] f2fs_is_valid_blkaddr.cold+0x2a/0x47 [ 63.141870][ T585] f2fs_iget+0x351e/0x4a00 [ 63.146366][ T585] f2fs_lookup+0x491/0xc20 [ 63.150770][ T585] ? __recover_dot_dentries+0x530/0x530 [ 63.156814][ T585] path_openat+0x1024/0x3950 [ 63.161417][ T585] ? path_lookupat+0x6a0/0x6a0 [ 63.166184][ T585] ? __kasan_check_read+0x11/0x20 [ 63.171199][ T585] ? pagevec_add_and_need_flush+0x216/0x290 [ 63.177081][ T585] ? perf_trace_mm_lru_insertion+0x970/0x970 [ 63.183253][ T585] ? __mod_memcg_lruvec_state+0x118/0x330 [ 63.189172][ T585] ? __mod_node_page_state+0xa6/0x110 [ 63.194619][ T585] do_filp_open+0x193/0x3d0 [ 63.199217][ T585] ? may_open_dev+0xd0/0xd0 [ 63.203790][ T585] ? __check_object_size+0x1df/0x270 [ 63.209063][ T585] ? _raw_spin_unlock+0x41/0x70 [ 63.214395][ T585] do_sys_openat2+0x135/0x810 [ 63.219070][ T585] ? recalc_sigpending+0x7c/0xb0 [ 63.224253][ T585] ? __set_task_blocked+0x8a/0x170 [ 63.229575][ T585] ? build_open_flags+0x490/0x490 [ 63.234877][ T585] ? sigprocmask+0x1ed/0x370 [ 63.239512][ T585] ? __kasan_check_write+0x14/0x20 [ 63.244792][ T585] __x64_sys_openat+0x124/0x200 [ 63.250123][ T585] ? __ia32_sys_open+0x1b0/0x1b0 [ 63.255592][ T585] ? fpregs_assert_state_consistent+0x3f/0x60 [ 63.261824][ T585] ? exit_to_user_mode_prepare+0x36/0x160 [ 63.268208][ T585] do_syscall_64+0x32/0x50 [ 63.272673][ T585] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 63.278750][ T585] RIP: 0033:0x7f1693edf339 [ 63.283268][ T585] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 63.303123][ T585] RSP: 002b:00007f1693d23028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 63.311527][ T585] RAX: ffffffffffffffda RBX: 00007f169411b090 RCX: 00007f1693edf339 [ 63.319664][ T585] RDX: 0000000000101000 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 63.327631][ T585] RBP: 00007f1693f72d68 R08: 0000000000000000 R09: 0000000000000000 [ 63.335619][ T585] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 63.343840][ T585] R13: 00007f169411b128 R14: 00007f169411b090 R15: 00007ffc1fc3bd98 [ 63.353058][ T585] F2FS-fs (loop0): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 63.353478][ T561] F2FS-fs (loop3): Found nat_bits in checkpoint [ 63.366423][ T556] F2FS-fs (loop6): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 63.378392][ T560] CPU: 1 PID: 560 Comm: syz.4.31 Tainted: G B syzkaller #0 [ 63.393545][ T560] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 63.403795][ T560] Call Trace: [ 63.407159][ T560] dump_stack_lvl+0x81/0xac [ 63.412060][ T560] dump_stack+0x10/0x12 [ 63.416310][ T560] f2fs_is_valid_blkaddr.cold+0x2a/0x47 [ 63.422057][ T560] f2fs_iget+0x351e/0x4a00 [ 63.426473][ T560] f2fs_lookup+0x491/0xc20 [ 63.430905][ T560] ? __recover_dot_dentries+0x530/0x530 [ 63.436647][ T560] ? __legitimize_path+0x6c/0x170 [ 63.441668][ T560] __lookup_slow+0x19b/0x3d0 [ 63.446435][ T560] ? page_put_link+0x80/0x80 [ 63.451066][ T560] ? inode_permission.part.0+0xc2/0x320 [ 63.456784][ T560] walk_component+0x3ad/0x710 [ 63.461461][ T560] ? handle_dots.part.0+0x11c0/0x11c0 [ 63.466837][ T560] ? walk_component+0x710/0x710 [ 63.471792][ T560] ? locks_remove_flock+0x298/0x310 [ 63.477353][ T560] path_lookupat+0x112/0x6a0 [ 63.482041][ T560] ? setup_object.isra.0+0x22/0xd0 [ 63.487627][ T560] filename_lookup+0x17f/0x510 [ 63.492713][ T560] ? may_linkat+0x200/0x200 [ 63.497316][ T560] ? ___slab_alloc.constprop.0+0x32b/0x730 [ 63.503857][ T560] ? __check_object_size+0x1df/0x270 [ 63.510302][ T560] ? kmem_cache_alloc+0x17f/0x4f0 [ 63.515803][ T560] ? getname_flags.part.0+0x8c/0x480 [ 63.521517][ T560] user_path_at_empty+0xa2/0xf0 [ 63.527210][ T560] do_sys_truncate.part.0+0x85/0x100 [ 63.532893][ T560] ? vfs_truncate+0x540/0x540 [ 63.537890][ T560] ? __kasan_check_write+0x14/0x20 [ 63.543186][ T560] ? switch_fpu_return+0xbf/0x1b0 [ 63.548418][ T560] __x64_sys_truncate+0x54/0x80 [ 63.553454][ T560] do_syscall_64+0x32/0x50 [ 63.558153][ T560] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 63.558315][ T561] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 63.564237][ T560] RIP: 0033:0x7f7ae064e339 [ 63.564244][ T560] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 63.564247][ T560] RSP: 002b:00007f7ae04b3028 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 63.564254][ T560] RAX: ffffffffffffffda RBX: 00007f7ae0889fa0 RCX: 00007f7ae064e339 [ 63.564257][ T560] RDX: 0000000000000000 RSI: 0000000000001c9e RDI: 0000200000000280 [ 63.564260][ T560] RBP: 00007f7ae06e1d68 R08: 0000000000000000 R09: 0000000000000000 [ 63.564263][ T560] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 63.564266][ T560] R13: 00007f7ae088a038 R14: 00007f7ae0889fa0 R15: 00007ffe7c593528 [ 63.564757][ T560] F2FS-fs (loop4): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 63.663620][ T587] F2FS-fs (loop4): access invalid blkaddr:2147563524 [ 63.670452][ T587] CPU: 1 PID: 587 Comm: syz.4.31 Tainted: G B syzkaller #0 [ 63.678943][ T587] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 63.683234][ T589] F2FS-fs (loop2): invalid crc value [ 63.689003][ T587] Call Trace: [ 63.689014][ T587] dump_stack_lvl+0x81/0xac [ 63.689017][ T587] dump_stack+0x10/0x12 [ 63.689023][ T587] f2fs_is_valid_blkaddr.cold+0x2a/0x47 [ 63.689030][ T587] f2fs_iget+0x351e/0x4a00 [ 63.689036][ T587] f2fs_lookup+0x491/0xc20 [ 63.689040][ T587] ? __recover_dot_dentries+0x530/0x530 [ 63.689053][ T587] path_openat+0x1024/0x3950 [ 63.707490][ T589] F2FS-fs (loop2): Found nat_bits in checkpoint [ 63.712662][ T587] ? path_lookupat+0x6a0/0x6a0 [ 63.712667][ T587] ? __kasan_check_read+0x11/0x20 [ 63.712673][ T587] ? pagevec_add_and_need_flush+0x216/0x290 [ 63.712678][ T587] ? perf_trace_mm_lru_insertion+0x970/0x970 [ 63.712683][ T587] ? __mod_memcg_lruvec_state+0x118/0x330 [ 63.712688][ T587] ? __mod_node_page_state+0xa6/0x110 [ 63.712696][ T587] do_filp_open+0x193/0x3d0 [ 63.736985][ T589] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 63.738309][ T587] ? may_open_dev+0xd0/0xd0 [ 63.738316][ T587] ? __check_object_size+0x1df/0x270 [ 63.738323][ T587] ? _raw_spin_unlock+0x41/0x70 [ 63.738331][ T587] do_sys_openat2+0x135/0x810 [ 63.804144][ T587] ? recalc_sigpending+0x7c/0xb0 [ 63.809392][ T587] ? __set_task_blocked+0x8a/0x170 [ 63.814587][ T587] ? build_open_flags+0x490/0x490 [ 63.819624][ T587] ? sigprocmask+0x1ed/0x370 [ 63.824274][ T587] ? __kasan_check_write+0x14/0x20 [ 63.829469][ T587] __x64_sys_openat+0x124/0x200 [ 63.834468][ T587] ? __ia32_sys_open+0x1b0/0x1b0 [ 63.839579][ T587] ? fpregs_assert_state_consistent+0x3f/0x60 [ 63.845869][ T587] ? exit_to_user_mode_prepare+0x36/0x160 [ 63.851565][ T587] do_syscall_64+0x32/0x50 [ 63.855961][ T587] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 63.862490][ T587] RIP: 0033:0x7f7ae064e339 [ 63.867595][ T587] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 63.887649][ T587] RSP: 002b:00007f7ae0492028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 63.896044][ T587] RAX: ffffffffffffffda RBX: 00007f7ae088a090 RCX: 00007f7ae064e339 [ 63.904078][ T587] RDX: 0000000000101000 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 63.912204][ T587] RBP: 00007f7ae06e1d68 R08: 0000000000000000 R09: 0000000000000000 [ 63.920629][ T587] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 63.929043][ T587] R13: 00007f7ae088a128 R14: 00007f7ae088a090 R15: 00007ffe7c593528 [ 63.940110][ T587] F2FS-fs (loop4): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 64.000741][ T589] F2FS-fs (loop2): access invalid blkaddr:2147563524 [ 64.007649][ T561] F2FS-fs (loop3): access invalid blkaddr:2147563524 [ 64.007742][ T589] CPU: 0 PID: 589 Comm: syz.2.32 Tainted: G B syzkaller #0 [ 64.023043][ T589] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 64.033380][ T589] Call Trace: [ 64.036836][ T589] dump_stack_lvl+0x81/0xac [ 64.041595][ T589] dump_stack+0x10/0x12 [ 64.046088][ T589] f2fs_is_valid_blkaddr.cold+0x2a/0x47 [ 64.051656][ T589] f2fs_iget+0x351e/0x4a00 [ 64.056233][ T589] f2fs_lookup+0x491/0xc20 [ 64.060723][ T589] ? __recover_dot_dentries+0x530/0x530 [ 64.066399][ T589] ? __legitimize_path+0x6c/0x170 [ 64.071411][ T589] __lookup_slow+0x19b/0x3d0 [ 64.076260][ T589] ? page_put_link+0x80/0x80 [ 64.081272][ T589] ? inode_permission.part.0+0xc2/0x320 [ 64.086906][ T589] walk_component+0x3ad/0x710 [ 64.091665][ T589] ? handle_dots.part.0+0x11c0/0x11c0 [ 64.097138][ T589] ? walk_component+0x710/0x710 [ 64.102255][ T589] path_lookupat+0x112/0x6a0 [ 64.106831][ T589] ? _atomic_dec_and_lock+0x19/0xa0 [ 64.112109][ T589] filename_lookup+0x17f/0x510 [ 64.117051][ T589] ? may_linkat+0x200/0x200 [ 64.121847][ T589] ? __check_object_size+0x1df/0x270 [ 64.127143][ T589] ? kmem_cache_alloc+0x17f/0x4f0 [ 64.132153][ T589] ? getname_flags.part.0+0x8c/0x480 [ 64.137430][ T589] user_path_at_empty+0xa2/0xf0 [ 64.142269][ T589] do_sys_truncate.part.0+0x85/0x100 [ 64.147622][ T589] ? vfs_truncate+0x540/0x540 [ 64.152285][ T589] ? __kasan_check_write+0x14/0x20 [ 64.157512][ T589] ? switch_fpu_return+0xbf/0x1b0 [ 64.162519][ T589] __x64_sys_truncate+0x54/0x80 [ 64.167356][ T589] do_syscall_64+0x32/0x50 [ 64.172212][ T589] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 64.178361][ T589] RIP: 0033:0x7f9437c02339 [ 64.182759][ T589] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 64.202436][ T589] RSP: 002b:00007f9437a67028 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 64.210835][ T589] RAX: ffffffffffffffda RBX: 00007f9437e3dfa0 RCX: 00007f9437c02339 [ 64.218801][ T589] RDX: 0000000000000000 RSI: 0000000000001c9e RDI: 0000200000000280 [ 64.227028][ T589] RBP: 00007f9437c95d68 R08: 0000000000000000 R09: 0000000000000000 [ 64.234997][ T589] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 64.242951][ T589] R13: 00007f9437e3e038 R14: 00007f9437e3dfa0 R15: 00007ffff8305dc8 [ 64.251185][ T561] CPU: 1 PID: 561 Comm: syz.3.27 Tainted: G B syzkaller #0 [ 64.251492][ T589] F2FS-fs (loop2): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 64.260075][ T561] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 64.260077][ T561] Call Trace: [ 64.260086][ T561] dump_stack_lvl+0x81/0xac [ 64.260089][ T561] dump_stack+0x10/0x12 [ 64.260094][ T561] f2fs_is_valid_blkaddr.cold+0x2a/0x47 [ 64.260101][ T561] f2fs_iget+0x351e/0x4a00 [ 64.260108][ T561] f2fs_lookup+0x491/0xc20 [ 64.274203][ T600] F2FS-fs (loop2): access invalid blkaddr:2147563524 [ 64.283159][ T561] ? __recover_dot_dentries+0x530/0x530 [ 64.283167][ T561] ? __legitimize_path+0x6c/0x170 [ 64.283172][ T561] __lookup_slow+0x19b/0x3d0 [ 64.283176][ T561] ? page_put_link+0x80/0x80 [ 64.283180][ T561] ? inode_permission.part.0+0xc2/0x320 [ 64.283184][ T561] walk_component+0x3ad/0x710 [ 64.283189][ T561] ? handle_dots.part.0+0x11c0/0x11c0 [ 64.283193][ T561] ? walk_component+0x710/0x710 [ 64.283197][ T561] path_lookupat+0x112/0x6a0 [ 64.283203][ T561] ? _atomic_dec_and_lock+0x19/0xa0 [ 64.283208][ T561] filename_lookup+0x17f/0x510 [ 64.283211][ T561] ? may_linkat+0x200/0x200 [ 64.283219][ T561] ? __check_object_size+0x1df/0x270 [ 64.283225][ T561] ? kmem_cache_alloc+0x17f/0x4f0 [ 64.283229][ T561] ? getname_flags.part.0+0x8c/0x480 [ 64.283234][ T561] user_path_at_empty+0xa2/0xf0 [ 64.283238][ T561] do_sys_truncate.part.0+0x85/0x100 [ 64.283242][ T561] ? vfs_truncate+0x540/0x540 [ 64.283246][ T561] ? __kasan_check_write+0x14/0x20 [ 64.283252][ T561] ? switch_fpu_return+0xbf/0x1b0 [ 64.283257][ T561] __x64_sys_truncate+0x54/0x80 [ 64.283263][ T561] do_syscall_64+0x32/0x50 [ 64.283268][ T561] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 64.283273][ T561] RIP: 0033:0x7f287bf69339 [ 64.283280][ T561] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 64.283285][ T561] RSP: 002b:00007f287bdce028 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 64.471009][ T561] RAX: ffffffffffffffda RBX: 00007f287c1a4fa0 RCX: 00007f287bf69339 [ 64.479866][ T561] RDX: 0000000000000000 RSI: 0000000000001c9e RDI: 0000200000000280 [ 64.490106][ T561] RBP: 00007f287bffcd68 R08: 0000000000000000 R09: 0000000000000000 [ 64.499359][ T561] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 64.508024][ T561] R13: 00007f287c1a5038 R14: 00007f287c1a4fa0 R15: 00007ffe73f33f88 [ 64.516643][ T561] F2FS-fs (loop3): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 64.517580][ T600] CPU: 1 PID: 600 Comm: syz.2.32 Tainted: G B syzkaller #0 [ 64.538170][ T600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 64.548300][ T600] Call Trace: [ 64.551762][ T600] dump_stack_lvl+0x81/0xac [ 64.556256][ T600] dump_stack+0x10/0x12 [ 64.560687][ T600] f2fs_is_valid_blkaddr.cold+0x2a/0x47 [ 64.566325][ T600] f2fs_iget+0x351e/0x4a00 [ 64.571280][ T600] f2fs_lookup+0x491/0xc20 [ 64.575886][ T600] ? __recover_dot_dentries+0x530/0x530 [ 64.582350][ T600] path_openat+0x1024/0x3950 [ 64.587729][ T600] ? path_lookupat+0x6a0/0x6a0 [ 64.592958][ T600] ? __kasan_check_read+0x11/0x20 [ 64.598608][ T600] ? pagevec_add_and_need_flush+0x216/0x290 [ 64.604677][ T600] ? perf_trace_mm_lru_insertion+0x970/0x970 [ 64.611198][ T600] ? __mod_memcg_lruvec_state+0x118/0x330 [ 64.616908][ T600] ? __mod_node_page_state+0xa6/0x110 [ 64.622294][ T600] do_filp_open+0x193/0x3d0 [ 64.627063][ T600] ? may_open_dev+0xd0/0xd0 [ 64.631707][ T600] ? __check_object_size+0x1df/0x270 [ 64.637162][ T600] ? _raw_spin_unlock+0x41/0x70 [ 64.642196][ T600] do_sys_openat2+0x135/0x810 [ 64.647118][ T600] ? recalc_sigpending+0x7c/0xb0 [ 64.652135][ T600] ? __set_task_blocked+0x8a/0x170 [ 64.657265][ T600] ? build_open_flags+0x490/0x490 [ 64.662367][ T600] ? sigprocmask+0x1ed/0x370 [ 64.667029][ T600] ? __kasan_check_write+0x14/0x20 [ 64.672223][ T600] __x64_sys_openat+0x124/0x200 [ 64.677246][ T600] ? __ia32_sys_open+0x1b0/0x1b0 [ 64.682250][ T600] ? fpregs_assert_state_consistent+0x3f/0x60 [ 64.688852][ T600] ? exit_to_user_mode_prepare+0x36/0x160 [ 64.694817][ T600] do_syscall_64+0x32/0x50 [ 64.699398][ T600] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 64.705281][ T600] RIP: 0033:0x7f9437c02339 [ 64.709687][ T600] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 64.729935][ T600] RSP: 002b:00007f9437a46028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 64.738876][ T600] RAX: ffffffffffffffda RBX: 00007f9437e3e090 RCX: 00007f9437c02339 [ 64.746918][ T600] RDX: 0000000000101000 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 64.754980][ T600] RBP: 00007f9437c95d68 R08: 0000000000000000 R09: 0000000000000000 [ 64.763020][ T600] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 64.771232][ T600] R13: 00007f9437e3e128 R14: 00007f9437e3e090 R15: 00007ffff8305dc8 [ 64.781452][ T600] F2FS-fs (loop2): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 64.808501][ T599] F2FS-fs (loop3): access invalid blkaddr:2147563524 [ 64.815665][ T599] CPU: 1 PID: 599 Comm: syz.3.27 Tainted: G B syzkaller #0 [ 64.824265][ T599] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 64.834499][ T599] Call Trace: [ 64.837789][ T599] dump_stack_lvl+0x81/0xac [ 64.842471][ T599] dump_stack+0x10/0x12 [ 64.846815][ T599] f2fs_is_valid_blkaddr.cold+0x2a/0x47 [ 64.852556][ T599] f2fs_iget+0x351e/0x4a00 [ 64.857089][ T599] f2fs_lookup+0x491/0xc20 [ 64.861774][ T599] ? __recover_dot_dentries+0x530/0x530 [ 64.867593][ T599] path_openat+0x1024/0x3950 [ 64.872192][ T599] ? path_lookupat+0x6a0/0x6a0 [ 64.876947][ T599] ? __kasan_check_read+0x11/0x20 [ 64.881972][ T599] ? pagevec_add_and_need_flush+0x216/0x290 [ 64.887987][ T599] ? perf_trace_mm_lru_insertion+0x970/0x970 [ 64.893961][ T599] ? __mod_memcg_lruvec_state+0x118/0x330 [ 64.899677][ T599] ? __mod_node_page_state+0xa6/0x110 [ 64.905417][ T599] do_filp_open+0x193/0x3d0 [ 64.909924][ T599] ? may_open_dev+0xd0/0xd0 [ 64.914423][ T599] ? __check_object_size+0x1df/0x270 [ 64.919702][ T599] ? _raw_spin_unlock+0x41/0x70 [ 64.924553][ T599] do_sys_openat2+0x135/0x810 [ 64.929315][ T599] ? recalc_sigpending+0x7c/0xb0 [ 64.934433][ T599] ? __set_task_blocked+0x8a/0x170 [ 64.939542][ T599] ? build_open_flags+0x490/0x490 [ 64.944643][ T599] ? sigprocmask+0x1ed/0x370 [ 64.949314][ T599] ? __kasan_check_write+0x14/0x20 [ 64.954600][ T599] __x64_sys_openat+0x124/0x200 [ 64.959644][ T599] ? __ia32_sys_open+0x1b0/0x1b0 [ 64.964623][ T599] ? fpregs_assert_state_consistent+0x3f/0x60 [ 64.970862][ T599] ? exit_to_user_mode_prepare+0x36/0x160 [ 64.976669][ T599] do_syscall_64+0x32/0x50 [ 64.981266][ T599] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 64.987156][ T599] RIP: 0033:0x7f287bf69339 [ 64.991572][ T599] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 65.011662][ T599] RSP: 002b:00007f287bdad028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 65.020270][ T599] RAX: ffffffffffffffda RBX: 00007f287c1a5090 RCX: 00007f287bf69339 [ 65.028621][ T599] RDX: 0000000000101000 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 65.037462][ T599] RBP: 00007f287bffcd68 R08: 0000000000000000 R09: 0000000000000000 [ 65.046135][ T599] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 65.054423][ T599] R13: 00007f287c1a5128 R14: 00007f287c1a5090 R15: 00007ffe73f33f88 [ 65.064882][ T599] F2FS-fs (loop3): sanity_check_inode: inode (ino=8) extent info [14338, 0, 2147549187] is incorrect, run fsck to fix [ 65.646304][ T602] F2FS-fs (loop0): invalid crc value [ 65.727426][ T602] F2FS-fs (loop0): Found nat_bits in checkpoint