./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2057640653
<...>
Warning: Permanently added '10.128.1.96' (ED25519) to the list of known hosts.
execve("./syz-executor2057640653", ["./syz-executor2057640653"], 0x7ffd45828a40 /* 10 vars */) = 0
brk(NULL) = 0x55556466d000
brk(0x55556466dd00) = 0x55556466dd00
arch_prctl(ARCH_SET_FS, 0x55556466d380) = 0
set_tid_address(0x55556466d650) = 5826
set_robust_list(0x55556466d660, 24) = 0
rseq(0x55556466dca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor2057640653", 4096) = 28
getrandom("\x8b\xe3\xc9\x8f\xdc\x29\x15\xe2", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x55556466dd00
brk(0x55556468ed00) = 0x55556468ed00
brk(0x55556468f000) = 0x55556468f000
mprotect(0x7f45bfe40000, 16384, PROT_READ) = 0
mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000
mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000
mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000
mkdir("./syzkaller.ZmRRg2", 0700) = 0
chmod("./syzkaller.ZmRRg2", 0777) = 0
chdir("./syzkaller.ZmRRg2") = 0
mkdir("./0", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556466d650) = 5827
./strace-static-x86_64: Process 5827 attached
[pid 5827] set_robust_list(0x55556466d660, 24) = 0
[pid 5827] chdir("./0") = 0
[pid 5827] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5827] setpgid(0, 0) = 0
[pid 5827] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5827] write(3, "1000", 4) = 4
[pid 5827] close(3) = 0
[pid 5827] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 5827] write(1, "executing program\n", 18) = 18
[pid 5827] memfd_create("syzkaller", 0) = 3
[pid 5827] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f45b7800000
[pid 5827] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
[pid 5827] munmap(0x7f45b7800000, 138412032) = 0
[pid 5827] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5827] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5827] close(3) = 0
[pid 5827] close(4) = 0
[pid 5827] mkdir("./file1", 0777) = 0
[ 89.552605][ T5827] loop0: detected capacity change from 0 to 32768
[ 89.569739][ T5827] =======================================================
[ 89.569739][ T5827] WARNING: The mand mount option has been deprecated and
[ 89.569739][ T5827] and is ignored by this kernel. Remove the mand
[ 89.569739][ T5827] option from the mount to silence this warning.
[ 89.569739][ T5827] =======================================================
[ 89.660570][ T5827] bcachefs (loop0): starting version 1.7: mi_btree_bitmap opts=metadata_checksum=none,data_checksum=none,compression=lz4,fsck,norecovery,nojournal_transaction_names,reconstruct_alloc,no_data_io
[ 89.660570][ T5827] allowing incompatible features above 0.0: (unknown version)
[ 89.660570][ T5827] features: lz4,new_siphash,inline_data,new_extent_overwrite,btree_ptr_v2,new_varint,journal_no_flush,alloc_v2,extents_across_btree_nodes
[ 89.701950][ T5827] bcachefs (loop0): Using encoding defined by superblock: utf8-12.1.0
[ 89.713270][ T5827] bcachefs (loop0): invalid bkey in superblock btree=lru level=1: u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 28f61e078e70b95c written 16 min_key 144115188075855872:0:0 durability: 0 (invalid extent entry 0000000000000000)
[ 89.713295][ T5827] invalid extent entry type (got 7, max 7), deleting
[ 89.742779][ T5827] bcachefs (loop0): recovering from clean shutdown, journal seq 10
[ 89.750897][ T5827] bcachefs (loop0): Doing compatible version upgrade from 1.7: mi_btree_bitmap to 1.28: inode_has_case_insensitive
[ 89.750897][ T5827] running recovery passes: check_allocations,check_extents_to_backpointers,check_inodes
[ 89.773297][ T5827] bcachefs (loop0): dropping and reconstructing all alloc info
[ 89.796366][ T5827] bcachefs (loop0): accounting_read... done
[ 89.803459][ T5827] bcachefs (loop0): alloc_read... done
[pid 5827] mount("/dev/loop0", "./file1", "bcachefs", MS_SYNCHRONOUS|MS_MANDLOCK|MS_NODIRATIME|MS_I_VERSION, "\x61\x63\x6c\x2c\x64\x69\x72\x65\x63\x74\x5f\x69\x6f\x2c\x6e\x6f\x72\x65\x63\x6f\x76\x65\x72\x79\x2c\x66\x73\x63\x6b\x2c\xba\x5c\x75\x72\x6e\x61\x6c\x5f\x88\x70\x2e\xdd\x18\xf6\x99\x5f\x14\xe4\xcf\xf5\xa8\x39\x66\x6c\x75\x73\x68\x5f\x64\x69\x73\x61\x62\x6c\x65\x64\x2c\x6e\x6f\x72\x65\x54\x6f\x76\x65\x72\x79\x2c\x62\x74\x72\x65\x65\x5f\x6e\x6f\x64\x65\x5f\x6d\x65\x6d\x5f\x70\x74\x72\x5f\x6f\x70\x74"...) = 0
[pid 5827] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid 5827] chdir("./file1") = 0
[pid 5827] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5827] ioctl(4, LOOP_CLR_FD) = 0
[ 89.809413][ T5827] bcachefs (loop0): snapshots_read... done
[ 89.815690][ T5827] bcachefs (loop0): Fixed errors, running fsck a second time to verify fs is clean
[ 89.825554][ T5827] bcachefs (loop0): done starting filesystem
[pid 5827] close(4) = 0
[pid 5827] memfd_create("syzkaller", 0) = 4
[pid 5827] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f45b7800000
[pid 5827] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 5827] munmap(0x7f45b7800000, 138412032) = 0
[pid 5827] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5
[pid 5827] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy)
[pid 5827] ioctl(5, LOOP_CLR_FD) = 0
[pid 5827] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy)
[pid 5827] close(5) = 0
[pid 5827] close(4) = 0
[pid 5827] mkdir(".", 0777) = -1 EEXIST (File exists)
[pid 5827] mount(NULL, ".", 0x200000000180, MS_RDONLY|MS_REMOUNT|MS_MANDLOCK|MS_DIRSYNC, "\x6a\x71\x66\x6d\x74\x3d\x76\x66\x73\x6f\x6c\x64\x2c\x65\x72\x72\x6f\x72\x73\x3d\x63\x6f\x6e\x74\x69\x6e\x75\x65\x2c\x75\x73\x72\x71\x75\x6f\x74\x61\x2c\x70\x72\x6a\x71\x75\x6f\x74\x61\x2c\x75\x73\x72\x71\x75\x6f\x74\x61\x2c\x72\x65\x73\x75\x69\x64\x3d\x30\x78\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x65\x65\x30\x30\x2c\x75\x73\x72\x6a\x71\x75\x6f\x74\x61\x3d\x05\x6d\x69\x6e\x5f\x62\x61\x74"...) = 0
[pid 5827] openat(AT_FDCWD, ".", O_RDONLY|O_DIRECTORY) = 4
[pid 5827] mount(NULL, "./file0", "sysfs", 0, NULL) = 0
[pid 5827] openat(0, NULL, O_RDONLY|O_NOFOLLOW|O_NOATIME|__O_TMPFILE, 012) = -1 EINVAL (Invalid argument)
[pid 5827] exit_group(0) = ?
[pid 5827] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5827, si_uid=0, si_status=0, si_utime=2 /* 0.02 s */, si_stime=37 /* 0.37 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x55556466e6f0 /* 4 entries */, 32768) = 112
umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy)
newfstatat(AT_FDCWD, "./0/file1", {st_mode=S_IFDIR|0755, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy)
openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0755, st_size=0, ...}, AT_EMPTY_PATH) = 0
[ 90.180006][ T5826] bcachefs (loop0): hash table key at wrong offset: should be at 8607060773457356477
[ 90.180026][ T5826] u64s 7 type dirent 4096:4330382808765833931:U32_MAX len 0 ver 0: -> 536870912 type unknown, fixing
[ 90.201005][ T5826] ==================================================================
[ 90.209069][ T5826] BUG: KASAN: slab-use-after-free in bch2_str_hash_repair_key+0x2d42/0x3fa0
[ 90.217754][ T5826] Read of size 8 at addr ffff888027ef7128 by task syz-executor205/5826
[ 90.225983][ T5826]
[ 90.228320][ T5826] CPU: 1 UID: 0 PID: 5826 Comm: syz-executor205 Not tainted 6.16.0-rc1-syzkaller #0 PREEMPT(full)
[ 90.228336][ T5826] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
[ 90.228351][ T5826] Call Trace:
[ 90.228360][ T5826]
[ 90.228367][ T5826] dump_stack_lvl+0x189/0x250
[ 90.228389][ T5826] ? __virt_addr_valid+0x1c8/0x5c0
[ 90.228402][ T5826] ? rcu_is_watching+0x15/0xb0
[ 90.228422][ T5826] ? __kasan_check_byte+0x12/0x40
[ 90.228439][ T5826] ? __pfx_dump_stack_lvl+0x10/0x10
[ 90.228459][ T5826] ? rcu_is_watching+0x15/0xb0
[ 90.228479][ T5826] ? lock_release+0x4b/0x3e0
[ 90.228498][ T5826] ? __virt_addr_valid+0x1c8/0x5c0
[ 90.228510][ T5826] ? __virt_addr_valid+0x4a5/0x5c0
[ 90.228524][ T5826] print_report+0xd2/0x2b0
[ 90.228541][ T5826] ? bch2_str_hash_repair_key+0x2d42/0x3fa0
[ 90.228562][ T5826] kasan_report+0x118/0x150
[ 90.228580][ T5826] ? bch2_str_hash_repair_key+0x2d42/0x3fa0
[ 90.228605][ T5826] bch2_str_hash_repair_key+0x2d42/0x3fa0
[ 90.228634][ T5826] ? bch2_str_hash_repair_key+0x573/0x3fa0
[ 90.228655][ T5826] ? kasan_save_track+0x4f/0x80
[ 90.228669][ T5826] ? __kasan_slab_free+0x62/0x70
[ 90.228683][ T5826] ? kfree+0x18e/0x440
[ 90.228697][ T5826] ? bch2_printbuf_exit+0x6f/0xb0
[ 90.228714][ T5826] ? __bch2_fsck_err+0xccb/0xf90
[ 90.228732][ T5826] ? __bch2_str_hash_check_key+0x91a/0xd40
[ 90.228745][ T5826] ? bch2_readdir+0x11cd/0x16f0
[ 90.228758][ T5826] ? bch2_vfs_readdir+0x4d0/0x6c0
[ 90.228771][ T5826] ? iterate_dir+0x5af/0x770
[ 90.228785][ T5826] ? __se_sys_getdents64+0xe4/0x260
[ 90.228804][ T5826] ? __pfx_bch2_str_hash_repair_key+0x10/0x10
[ 90.228834][ T5826] ? kasan_quarantine_put+0xdd/0x220
[ 90.228848][ T5826] ? lockdep_hardirqs_on+0x9c/0x150
[ 90.228876][ T5826] ? bch2_printbuf_exit+0x6f/0xb0
[ 90.228893][ T5826] ? kfree+0x18e/0x440
[ 90.228909][ T5826] ? bch2_printbuf_exit+0x6f/0xb0
[ 90.228927][ T5826] ? __bch2_fsck_err+0xce3/0xf90
[ 90.228951][ T5826] ? bch2_prt_printf+0x5a2/0x740
[ 90.228971][ T5826] ? __pfx_bch2_prt_printf+0x10/0x10
[ 90.228988][ T5826] ? __pfx___bch2_fsck_err+0x10/0x10
[ 90.229031][ T5826] ? bch2_dirent_to_text+0x83a/0xd20
[ 90.229048][ T5826] __bch2_str_hash_check_key+0xa65/0xd40
[ 90.229065][ T5826] ? bch2_readdir+0x489/0x16f0
[ 90.229085][ T5826] ? __asan_memset+0x22/0x50
[ 90.229098][ T5826] ? __pfx___bch2_str_hash_check_key+0x10/0x10
[ 90.229111][ T5826] ? SipHash_End+0x47f/0x550
[ 90.229132][ T5826] ? __pfx___bch2_subvolume_get_snapshot+0x10/0x10
[ 90.229151][ T5826] ? __bch2_subvolume_get_snapshot+0x15c/0x550
[ 90.229167][ T5826] ? bch2_readdir+0x651/0x16f0
[ 90.229183][ T5826] bch2_readdir+0x11cd/0x16f0
[ 90.229205][ T5826] ? __pfx_bch2_readdir+0x10/0x10
[ 90.229231][ T5826] ? bch2_readdir+0x23e/0x16f0
[ 90.229249][ T5826] bch2_vfs_readdir+0x4d0/0x6c0
[ 90.229266][ T5826] ? __pfx_bch2_vfs_readdir+0x10/0x10
[ 90.229281][ T5826] ? __pfx___mutex_lock+0x10/0x10
[ 90.229296][ T5826] ? iterate_dir+0x49f/0x770
[ 90.229311][ T5826] ? down_read_killable+0x1d1/0x350
[ 90.229328][ T5826] iterate_dir+0x5af/0x770
[ 90.229345][ T5826] __se_sys_getdents64+0xe4/0x260
[ 90.229367][ T5826] ? __pfx___se_sys_getdents64+0x10/0x10
[ 90.229383][ T5826] ? __pfx_filldir64+0x10/0x10
[ 90.229405][ T5826] do_syscall_64+0xfa/0x3b0
[ 90.229418][ T5826] ? lockdep_hardirqs_on+0x9c/0x150
[ 90.229439][ T5826] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 90.229453][ T5826] ? clear_bhb_loop+0x60/0xb0
[ 90.229470][ T5826] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 90.229485][ T5826] RIP: 0033:0x7f45bfdee2a3
[ 90.229502][ T5826] Code: c1 66 0f 1f 44 00 00 48 83 c4 08 48 89 ef 5b 5d e9 a2 48 fb ff 66 90 b8 ff ff ff 7f 48 39 c2 48 0f 47 d0 b8 d9 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 c7 c2 b8 ff ff ff f7 d8
[ 90.229518][ T5826] RSP: 002b:00007ffdec01fb88 EFLAGS: 00000293 ORIG_RAX: 00000000000000d9
[ 90.229533][ T5826] RAX: ffffffffffffffda RBX: 0000555564676730 RCX: 00007f45bfdee2a3
[ 90.229544][ T5826] RDX: 0000000000008000 RSI: 0000555564676730 RDI: 0000000000000004
[ 90.229554][ T5826] RBP: 0000555564676704 R08: 0000000000000000 R09: 0000000000000000
[ 90.229563][ T5826] R10: 0000000000001000 R11: 0000000000000293 R12: ffffffffffffffb8
[ 90.229573][ T5826] R13: 0000000000000010 R14: 0000555564676700 R15: 00007ffdec021e00
[ 90.229589][ T5826]
[ 90.229594][ T5826]
[ 90.644597][ T5826] Allocated by task 5826:
[ 90.648930][ T5826] kasan_save_track+0x3e/0x80
[ 90.653618][ T5826] __kasan_kmalloc+0x93/0xb0
[ 90.658217][ T5826] __kmalloc_node_track_caller_noprof+0x271/0x4e0
[ 90.664649][ T5826] krealloc_noprof+0x124/0x340
[ 90.669421][ T5826] __bch2_trans_kmalloc+0x26c/0xc80
[ 90.674637][ T5826] bch2_str_hash_repair_key+0x2a65/0x3fa0
[ 90.680373][ T5826] __bch2_str_hash_check_key+0xa65/0xd40
[ 90.686008][ T5826] bch2_readdir+0x11cd/0x16f0
[ 90.690689][ T5826] bch2_vfs_readdir+0x4d0/0x6c0
[ 90.695545][ T5826] iterate_dir+0x5af/0x770
[ 90.699969][ T5826] __se_sys_getdents64+0xe4/0x260
[ 90.704999][ T5826] do_syscall_64+0xfa/0x3b0
[ 90.709504][ T5826] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 90.715416][ T5826]
[ 90.717741][ T5826] Freed by task 5826:
[ 90.721725][ T5826] kasan_save_track+0x3e/0x80
[ 90.726407][ T5826] kasan_save_free_info+0x46/0x50
[ 90.731449][ T5826] __kasan_slab_free+0x62/0x70
[ 90.736221][ T5826] kfree+0x18e/0x440
[ 90.740128][ T5826] krealloc_noprof+0x1cd/0x340
[ 90.744908][ T5826] __bch2_trans_kmalloc+0x26c/0xc80
[ 90.750124][ T5826] bch2_str_hash_repair_key+0x2a96/0x3fa0
[ 90.755859][ T5826] __bch2_str_hash_check_key+0xa65/0xd40
[ 90.761510][ T5826] bch2_readdir+0x11cd/0x16f0
[ 90.766196][ T5826] bch2_vfs_readdir+0x4d0/0x6c0
[ 90.771051][ T5826] iterate_dir+0x5af/0x770
[ 90.775484][ T5826] __se_sys_getdents64+0xe4/0x260
[ 90.780519][ T5826] do_syscall_64+0xfa/0x3b0
[ 90.785025][ T5826] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 90.790926][ T5826]
[ 90.793250][ T5826] The buggy address belongs to the object at ffff888027ef7100
[ 90.793250][ T5826] which belongs to the cache kmalloc-64 of size 64
[ 90.807136][ T5826] The buggy address is located 40 bytes inside of
[ 90.807136][ T5826] freed 64-byte region [ffff888027ef7100, ffff888027ef7140)
[ 90.820771][ T5826]
[ 90.823118][ T5826] The buggy address belongs to the physical page:
[ 90.829542][ T5826] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x27ef7
[ 90.838315][ T5826] anon flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 90.845877][ T5826] page_type: f5(slab)
[ 90.849864][ T5826] raw: 00fff00000000000 ffff88801a4418c0 ffffea0000a2cb00 dead000000000005
[ 90.858457][ T5826] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[ 90.867048][ T5826] page dumped because: kasan: bad access detected
[ 90.873465][ T5826] page_owner tracks the page as allocated
[ 90.879184][ T5826] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 12, tgid 12 (kworker/u8:0), ts 12002718519, free_ts 11909463502
[ 90.898124][ T5826] post_alloc_hook+0x240/0x2a0
[ 90.902914][ T5826] get_page_from_freelist+0x21d5/0x22b0
[ 90.908490][ T5826] __alloc_frozen_pages_noprof+0x181/0x370
[ 90.914329][ T5826] alloc_pages_mpol+0x232/0x4a0
[ 90.919197][ T5826] allocate_slab+0x8a/0x3b0
[ 90.923718][ T5826] ___slab_alloc+0xbfc/0x1480
[ 90.928407][ T5826] __kmalloc_cache_noprof+0x296/0x3d0
[ 90.933793][ T5826] percpu_ref_init+0xc5/0x360
[ 90.938489][ T5826] blk_alloc_queue+0x419/0x620
[ 90.943271][ T5826] blk_mq_alloc_queue+0x15c/0x290
[ 90.948313][ T5826] scsi_alloc_sdev+0x76d/0xb50
[ 90.953088][ T5826] scsi_probe_and_add_lun+0x1cb/0x4520
[ 90.958557][ T5826] __scsi_scan_target+0x1dd/0xd10
[ 90.963595][ T5826] scsi_scan_host_selected+0x372/0x690
[ 90.969067][ T5826] do_scan_async+0x124/0x760
[ 90.973664][ T5826] async_run_entry_fn+0xa5/0x3f0
[ 90.978615][ T5826] page last free pid 24 tgid 24 stack trace:
[ 90.984590][ T5826] __free_frozen_pages+0xc65/0xe60
[ 90.989719][ T5826] vfree+0x25a/0x400
[ 90.993627][ T5826] delayed_vfree_work+0x55/0x80
[ 90.998496][ T5826] process_scheduled_works+0xade/0x17b0
[ 91.004079][ T5826] worker_thread+0x8a0/0xda0
[ 91.008686][ T5826] kthread+0x70e/0x8a0
[ 91.012760][ T5826] ret_from_fork+0x3fc/0x770
[ 91.017358][ T5826] ret_from_fork_asm+0x1a/0x30
[ 91.022125][ T5826]
[ 91.024447][ T5826] Memory state around the buggy address:
[ 91.030078][ T5826] ffff888027ef7000: 00 00 00 00 00 00 00 06 fc fc fc fc fc fc fc fc
[ 91.038146][ T5826] ffff888027ef7080: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[ 91.046212][ T5826] >ffff888027ef7100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 91.054290][ T5826] ^
[ 91.059753][ T5826] ffff888027ef7180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 91.067815][ T5826] ffff888027ef7200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 91.075875][ T5826] ==================================================================
[ 91.086171][ T5826] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 91.093417][ T5826] CPU: 1 UID: 0 PID: 5826 Comm: syz-executor205 Not tainted 6.16.0-rc1-syzkaller #0 PREEMPT(full)
[ 91.104099][ T5826] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
[ 91.114161][ T5826] Call Trace:
[ 91.117467][ T5826]
[ 91.120410][ T5826] dump_stack_lvl+0x99/0x250
[ 91.125021][ T5826] ? __asan_memcpy+0x40/0x70
[ 91.129616][ T5826] ? __pfx_dump_stack_lvl+0x10/0x10
[ 91.134832][ T5826] ? __pfx__printk+0x10/0x10
[ 91.139438][ T5826] panic+0x2db/0x790
[ 91.143355][ T5826] ? __pfx_panic+0x10/0x10
[ 91.147784][ T5826] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 91.153689][ T5826] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 91.160029][ T5826] ? print_memory_metadata+0x314/0x400
[ 91.165510][ T5826] ? bch2_str_hash_repair_key+0x2d42/0x3fa0
[ 91.171426][ T5826] check_panic_on_warn+0x89/0xb0
[ 91.176385][ T5826] ? bch2_str_hash_repair_key+0x2d42/0x3fa0
[ 91.182297][ T5826] end_report+0x78/0x160
[ 91.186554][ T5826] kasan_report+0x129/0x150
[ 91.191071][ T5826] ? bch2_str_hash_repair_key+0x2d42/0x3fa0
[ 91.196988][ T5826] bch2_str_hash_repair_key+0x2d42/0x3fa0
[ 91.202738][ T5826] ? bch2_str_hash_repair_key+0x573/0x3fa0
[ 91.208563][ T5826] ? kasan_save_track+0x4f/0x80
[ 91.213420][ T5826] ? __kasan_slab_free+0x62/0x70
[ 91.218367][ T5826] ? kfree+0x18e/0x440
[ 91.222446][ T5826] ? bch2_printbuf_exit+0x6f/0xb0
[ 91.227493][ T5826] ? __bch2_fsck_err+0xccb/0xf90
[ 91.232442][ T5826] ? __bch2_str_hash_check_key+0x91a/0xd40
[ 91.238268][ T5826] ? bch2_readdir+0x11cd/0x16f0
[ 91.243125][ T5826] ? bch2_vfs_readdir+0x4d0/0x6c0
[ 91.248158][ T5826] ? iterate_dir+0x5af/0x770
[ 91.252759][ T5826] ? __se_sys_getdents64+0xe4/0x260
[ 91.257972][ T5826] ? __pfx_bch2_str_hash_repair_key+0x10/0x10
[ 91.264067][ T5826] ? kasan_quarantine_put+0xdd/0x220
[ 91.269364][ T5826] ? lockdep_hardirqs_on+0x9c/0x150
[ 91.274581][ T5826] ? bch2_printbuf_exit+0x6f/0xb0
[ 91.279618][ T5826] ? kfree+0x18e/0x440
[ 91.283698][ T5826] ? bch2_printbuf_exit+0x6f/0xb0
[ 91.288739][ T5826] ? __bch2_fsck_err+0xce3/0xf90
[ 91.293696][ T5826] ? bch2_prt_printf+0x5a2/0x740
[ 91.298645][ T5826] ? __pfx_bch2_prt_printf+0x10/0x10
[ 91.303944][ T5826] ? __pfx___bch2_fsck_err+0x10/0x10
[ 91.309248][ T5826] ? bch2_dirent_to_text+0x83a/0xd20
[ 91.314545][ T5826] __bch2_str_hash_check_key+0xa65/0xd40
[ 91.320190][ T5826] ? bch2_readdir+0x489/0x16f0
[ 91.324969][ T5826] ? __asan_memset+0x22/0x50
[ 91.329569][ T5826] ? __pfx___bch2_str_hash_check_key+0x10/0x10
[ 91.335733][ T5826] ? SipHash_End+0x47f/0x550
[ 91.340338][ T5826] ? __pfx___bch2_subvolume_get_snapshot+0x10/0x10
[ 91.346853][ T5826] ? __bch2_subvolume_get_snapshot+0x15c/0x550
[ 91.353015][ T5826] ? bch2_readdir+0x651/0x16f0
[ 91.357785][ T5826] bch2_readdir+0x11cd/0x16f0
[ 91.362483][ T5826] ? __pfx_bch2_readdir+0x10/0x10
[ 91.367547][ T5826] ? bch2_readdir+0x23e/0x16f0
[ 91.372323][ T5826] bch2_vfs_readdir+0x4d0/0x6c0
[ 91.377202][ T5826] ? __pfx_bch2_vfs_readdir+0x10/0x10
[ 91.382598][ T5826] ? __pfx___mutex_lock+0x10/0x10
[ 91.387636][ T5826] ? iterate_dir+0x49f/0x770
[ 91.392250][ T5826] ? down_read_killable+0x1d1/0x350
[ 91.397468][ T5826] iterate_dir+0x5af/0x770
[ 91.401903][ T5826] __se_sys_getdents64+0xe4/0x260
[ 91.406948][ T5826] ? __pfx___se_sys_getdents64+0x10/0x10
[ 91.412595][ T5826] ? __pfx_filldir64+0x10/0x10
[ 91.417380][ T5826] do_syscall_64+0xfa/0x3b0
[ 91.421891][ T5826] ? lockdep_hardirqs_on+0x9c/0x150
[ 91.427111][ T5826] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 91.433188][ T5826] ? clear_bhb_loop+0x60/0xb0
[ 91.437899][ T5826] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 91.443800][ T5826] RIP: 0033:0x7f45bfdee2a3
[ 91.448224][ T5826] Code: c1 66 0f 1f 44 00 00 48 83 c4 08 48 89 ef 5b 5d e9 a2 48 fb ff 66 90 b8 ff ff ff 7f 48 39 c2 48 0f 47 d0 b8 d9 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 c7 c2 b8 ff ff ff f7 d8
[ 91.467846][ T5826] RSP: 002b:00007ffdec01fb88 EFLAGS: 00000293 ORIG_RAX: 00000000000000d9
[ 91.476282][ T5826] RAX: ffffffffffffffda RBX: 0000555564676730 RCX: 00007f45bfdee2a3
[ 91.484256][ T5826] RDX: 0000000000008000 RSI: 0000555564676730 RDI: 0000000000000004
[ 91.492237][ T5826] RBP: 0000555564676704 R08: 0000000000000000 R09: 0000000000000000
[ 91.500230][ T5826] R10: 0000000000001000 R11: 0000000000000293 R12: ffffffffffffffb8
[ 91.508208][ T5826] R13: 0000000000000010 R14: 0000555564676700 R15: 00007ffdec021e00
[ 91.516200][ T5826]
[ 91.519474][ T5826] Kernel Offset: disabled
[ 91.523804][ T5826] Rebooting in 86400 seconds..