Warning: Permanently added '10.128.1.212' (ED25519) to the list of known hosts.
2025/09/24 13:29:35 parsed 1 programs
[ 45.412200][ T28] audit: type=1400 audit(1758720576.284:106): avc: denied { unlink } for pid=400 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t"
[ 45.457646][ T400] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 46.067361][ T28] audit: type=1400 audit(1758720576.934:107): avc: denied { create } for pid=404 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1
[ 46.289718][ T28] audit: type=1401 audit(1758720577.154:108): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768"
[ 46.331455][ T429] bridge0: port 1(bridge_slave_0) entered blocking state
[ 46.338493][ T429] bridge0: port 1(bridge_slave_0) entered disabled state
[ 46.345863][ T429] device bridge_slave_0 entered promiscuous mode
[ 46.352707][ T429] bridge0: port 2(bridge_slave_1) entered blocking state
[ 46.359716][ T429] bridge0: port 2(bridge_slave_1) entered disabled state
[ 46.367139][ T429] device bridge_slave_1 entered promiscuous mode
[ 46.405302][ T429] bridge0: port 2(bridge_slave_1) entered blocking state
[ 46.412359][ T429] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 46.419583][ T429] bridge0: port 1(bridge_slave_0) entered blocking state
[ 46.426611][ T429] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 46.444141][ T342] bridge0: port 1(bridge_slave_0) entered disabled state
[ 46.451480][ T342] bridge0: port 2(bridge_slave_1) entered disabled state
[ 46.458834][ T342] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 46.466309][ T342] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 46.475085][ T342] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 46.483317][ T342] bridge0: port 1(bridge_slave_0) entered blocking state
[ 46.490331][ T342] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 46.499408][ T342] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 46.507650][ T342] bridge0: port 2(bridge_slave_1) entered blocking state
[ 46.514687][ T342] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 46.525992][ T342] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 46.537650][ T342] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 46.547291][ T342] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 46.558675][ T342] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 46.566927][ T342] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 46.574424][ T342] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 46.582458][ T429] device veth0_vlan entered promiscuous mode
[ 46.592000][ T342] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 46.602076][ T429] device veth1_macvtap entered promiscuous mode
[ 46.610754][ T342] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 46.620929][ T342] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
2025/09/24 13:29:38 executed programs: 0
[ 47.158600][ T469] bridge0: port 1(bridge_slave_0) entered blocking state
[ 47.166082][ T469] bridge0: port 1(bridge_slave_0) entered disabled state
[ 47.173573][ T469] device bridge_slave_0 entered promiscuous mode
[ 47.180431][ T469] bridge0: port 2(bridge_slave_1) entered blocking state
[ 47.187482][ T469] bridge0: port 2(bridge_slave_1) entered disabled state
[ 47.195101][ T469] device bridge_slave_1 entered promiscuous mode
[ 47.237015][ T469] bridge0: port 2(bridge_slave_1) entered blocking state
[ 47.244058][ T469] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 47.251286][ T469] bridge0: port 1(bridge_slave_0) entered blocking state
[ 47.258307][ T469] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 47.279094][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 47.287058][ T309] bridge0: port 1(bridge_slave_0) entered disabled state
[ 47.294585][ T309] bridge0: port 2(bridge_slave_1) entered disabled state
[ 47.306525][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 47.314798][ T309] bridge0: port 1(bridge_slave_0) entered blocking state
[ 47.321852][ T309] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 47.330656][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 47.339263][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 47.347480][ T309] bridge0: port 2(bridge_slave_1) entered blocking state
[ 47.354507][ T309] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 47.368295][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 47.376418][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 47.385150][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 47.393370][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 47.405604][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 47.414376][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 47.423159][ T43] device bridge_slave_1 left promiscuous mode
[ 47.429263][ T43] bridge0: port 2(bridge_slave_1) entered disabled state
[ 47.436730][ T43] device bridge_slave_0 left promiscuous mode
[ 47.443134][ T43] bridge0: port 1(bridge_slave_0) entered disabled state
[ 47.450753][ T43] device veth1_macvtap left promiscuous mode
[ 47.456807][ T43] device veth0_vlan left promiscuous mode
[ 47.538376][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 47.546407][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 47.554565][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 47.562057][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 47.570302][ T469] device veth0_vlan entered promiscuous mode
[ 47.579430][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 47.587817][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 47.597270][ T469] device veth1_macvtap entered promiscuous mode
[ 47.605986][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 47.613757][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 47.622155][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 47.631644][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 47.639986][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 47.664200][ T480] loop2: detected capacity change from 0 to 512
[ 47.673988][ T480] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support!
[ 47.687350][ T480] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode
[ 47.698804][ T480] EXT4-fs warning (device loop2): ext4_expand_extra_isize_ea:2818: Unable to expand inode 15. Delete some EAs or run e2fsck.
[ 47.712074][ T480] EXT4-fs (loop2): 1 truncate cleaned up
[ 47.717723][ T480] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback.
[ 47.726968][ T28] audit: type=1400 audit(1758720578.594:109): avc: denied { mount } for pid=479 comm="syz.2.17" name="/" dev="loop2" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1
[ 47.746297][ T480] ==================================================================
[ 47.756290][ T480] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x979/0x21d0
[ 47.764023][ T480] Read of size 18446744073709551572 at addr ffff888109f04850 by task syz.2.17/480
[ 47.773206][ T480]
[ 47.775512][ T480] CPU: 0 PID: 480 Comm: syz.2.17 Not tainted syzkaller #0
[ 47.782602][ T480] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
[ 47.792651][ T480] Call Trace:
[ 47.795914][ T480]
[ 47.798829][ T480] __dump_stack+0x21/0x24
[ 47.803317][ T480] dump_stack_lvl+0xee/0x150
[ 47.807885][ T480] ? __cfi_dump_stack_lvl+0x8/0x8
[ 47.812890][ T480] ? ext4_xattr_block_set+0x9dc/0x3270
[ 47.818333][ T480] ? __ext4_unlink+0x673/0xb00
[ 47.823080][ T480] ? ext4_xattr_set_entry+0x979/0x21d0
[ 47.828627][ T480] print_address_description+0x71/0x200
[ 47.834159][ T480] print_report+0x4a/0x60
[ 47.838471][ T480] kasan_report+0x122/0x150
[ 47.842954][ T480] ? ext4_xattr_set_entry+0x979/0x21d0
[ 47.848393][ T480] ? ext4_xattr_set_entry+0x979/0x21d0
[ 47.853841][ T480] kasan_check_range+0x280/0x290
[ 47.858760][ T480] memmove+0x2d/0x70
[ 47.862630][ T480] ext4_xattr_set_entry+0x979/0x21d0
[ 47.867914][ T480] ext4_xattr_block_set+0xada/0x3270
[ 47.873181][ T480] ? __getblk_gfp+0x3b/0x7d0
[ 47.877751][ T480] ? xattr_find_entry+0x24c/0x300
[ 47.882755][ T480] ? ext4_xattr_block_find+0x310/0x310
[ 47.888196][ T480] ? ext4_xattr_block_find+0x295/0x310
[ 47.893721][ T480] ext4_expand_extra_isize_ea+0xf30/0x1990
[ 47.899512][ T480] __ext4_expand_extra_isize+0x2fe/0x3e0
[ 47.905127][ T480] __ext4_mark_inode_dirty+0x3cf/0x600
[ 47.910567][ T480] __ext4_unlink+0x673/0xb00
[ 47.915150][ T480] ? memcpy+0x56/0x70
[ 47.919111][ T480] ? __cfi___ext4_unlink+0x10/0x10
[ 47.924221][ T480] ? dquot_initialize+0x20/0x20
[ 47.929055][ T480] ? clear_nonspinnable+0x60/0x60
[ 47.934069][ T480] ext4_unlink+0x13a/0x3a0
[ 47.938473][ T480] vfs_unlink+0x39f/0x630
[ 47.942787][ T480] do_unlinkat+0x31f/0x6b0
[ 47.947211][ T480] ? __cfi_do_unlinkat+0x10/0x10
[ 47.952127][ T480] ? getname_flags+0x206/0x500
[ 47.956877][ T480] __x64_sys_unlink+0x49/0x50
[ 47.961545][ T480] x64_sys_call+0x958/0x9a0
[ 47.966059][ T480] do_syscall_64+0x4c/0xa0
[ 47.970540][ T480] ? clear_bhb_loop+0x30/0x80
[ 47.975207][ T480] ? clear_bhb_loop+0x30/0x80
[ 47.979867][ T480] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 47.985741][ T480] RIP: 0033:0x7fe3dbf8ebe9
[ 47.990150][ T480] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 48.009735][ T480] RSP: 002b:00007fe3dcece038 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
[ 48.018134][ T480] RAX: ffffffffffffffda RBX: 00007fe3dc1b5fa0 RCX: 00007fe3dbf8ebe9
[ 48.026085][ T480] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000180
[ 48.034031][ T480] RBP: 00007fe3dc011e19 R08: 0000000000000000 R09: 0000000000000000
[ 48.041982][ T480] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 48.049929][ T480] R13: 00007fe3dc1b6038 R14: 00007fe3dc1b5fa0 R15: 00007ffe8e2ad108
[ 48.057882][ T480]
[ 48.060880][ T480]
[ 48.063181][ T480] Allocated by task 480:
[ 48.067393][ T480] kasan_set_track+0x4b/0x70
[ 48.071964][ T480] kasan_save_alloc_info+0x25/0x30
[ 48.077056][ T480] __kasan_kmalloc+0x95/0xb0
[ 48.081624][ T480] __kmalloc_node_track_caller+0xb1/0x1e0
[ 48.087333][ T480] kmemdup+0x2b/0x60
[ 48.091213][ T480] ext4_xattr_block_set+0x9dc/0x3270
[ 48.096565][ T480] ext4_expand_extra_isize_ea+0xf30/0x1990
[ 48.102351][ T480] __ext4_expand_extra_isize+0x2fe/0x3e0
[ 48.107964][ T480] __ext4_mark_inode_dirty+0x3cf/0x600
[ 48.113398][ T480] __ext4_unlink+0x673/0xb00
[ 48.117975][ T480] ext4_unlink+0x13a/0x3a0
[ 48.122370][ T480] vfs_unlink+0x39f/0x630
[ 48.126676][ T480] do_unlinkat+0x31f/0x6b0
[ 48.131068][ T480] __x64_sys_unlink+0x49/0x50
[ 48.135726][ T480] x64_sys_call+0x958/0x9a0
[ 48.140207][ T480] do_syscall_64+0x4c/0xa0
[ 48.144600][ T480] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 48.150477][ T480]
[ 48.152788][ T480] The buggy address belongs to the object at ffff888109f04800
[ 48.152788][ T480] which belongs to the cache kmalloc-1k of size 1024
[ 48.166816][ T480] The buggy address is located 80 bytes inside of
[ 48.166816][ T480] 1024-byte region [ffff888109f04800, ffff888109f04c00)
[ 48.180064][ T480]
[ 48.182367][ T480] The buggy address belongs to the physical page:
[ 48.188754][ T480] page:ffffea000427c000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109f00
[ 48.199146][ T480] head:ffffea000427c000 order:3 compound_mapcount:0 compound_pincount:0
[ 48.207445][ T480] flags: 0x4000000000010200(slab|head|zone=1)
[ 48.213498][ T480] raw: 4000000000010200 0000000000000000 dead000000000001 ffff888100043080
[ 48.222059][ T480] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[ 48.230621][ T480] page dumped because: kasan: bad access detected
[ 48.237015][ T480] page_owner tracks the page as allocated
[ 48.242703][ T480] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 117, tgid 117 (udevd), ts 5027374308, free_ts 0
[ 48.262390][ T480] post_alloc_hook+0x1f5/0x210
[ 48.267140][ T480] prep_new_page+0x1c/0x110
[ 48.271626][ T480] get_page_from_freelist+0x2c7b/0x2cf0
[ 48.277151][ T480] __alloc_pages+0x1c3/0x450
[ 48.281723][ T480] alloc_slab_page+0x6e/0xf0
[ 48.286469][ T480] new_slab+0x98/0x3d0
[ 48.290518][ T480] ___slab_alloc+0x6bd/0xb20
[ 48.295120][ T480] __slab_alloc+0x5e/0xa0
[ 48.299434][ T480] __kmem_cache_alloc_node+0x203/0x2c0
[ 48.304874][ T480] __kmalloc_node_track_caller+0xa0/0x1e0
[ 48.310577][ T480] __alloc_skb+0x236/0x4b0
[ 48.314975][ T480] netlink_sendmsg+0x626/0xbc0
[ 48.319718][ T480] ____sys_sendmsg+0x5a9/0x990
[ 48.324460][ T480] ___sys_sendmsg+0x21c/0x290
[ 48.329115][ T480] __x64_sys_sendmsg+0x1f0/0x2c0
[ 48.334029][ T480] x64_sys_call+0x171/0x9a0
[ 48.338513][ T480] page_owner free stack trace missing
[ 48.343855][ T480]
[ 48.346158][ T480] Memory state around the buggy address:
[ 48.351763][ T480] ffff888109f04700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 48.359808][ T480] ffff888109f04780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 48.367844][ T480] >ffff888109f04800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 48.375879][ T480] ^
[ 48.382524][ T480] ffff888109f04880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 48.390563][ T480] ffff888109f04900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 48.398603][ T480] ==================================================================
[ 48.413821][ T28] audit: type=1400 audit(1758720578.594:110): avc: denied { setattr } for pid=479 comm="syz.2.17" name="file1" dev="loop2" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1
[ 48.416309][ T480] Disabling lock debugging due to kernel taint
[ 48.436079][ T28] audit: type=1400 audit(1758720578.594:111): avc: denied { write } for pid=479 comm="syz.2.17" name="/" dev="loop2" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1
[ 48.463530][ T28] audit: type=1400 audit(1758720578.594:112): avc: denied { add_name } for pid=479 comm="syz.2.17" name="file2" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1
[ 48.465624][ T469] EXT4-fs (loop2): unmounting filesystem.
[ 48.489641][ T28] audit: type=1400 audit(1758720578.594:113): avc: denied { create } for pid=479 comm="syz.2.17" name="file2" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1
[ 48.509706][ T28] audit: type=1400 audit(1758720578.594:114): avc: denied { write } for pid=479 comm="syz.2.17" name="file2" dev="loop2" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1
[ 48.531712][ T28] audit: type=1400 audit(1758720578.594:115): avc: denied { open } for pid=479 comm="syz.2.17" path="/0/file2/file2" dev="loop2" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1
[ 48.543912][ T484] loop2: detected capacity change from 0 to 512
[ 48.561222][ T484] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode
[ 48.574079][ T484] EXT4-fs (loop2): 1 truncate cleaned up
[ 48.579757][ T484] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback.
[ 48.597118][ T103] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN
[ 48.608858][ T103] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
[ 48.617254][ T103] CPU: 0 PID: 103 Comm: udevd Tainted: G B syzkaller #0
[ 48.625554][ T103] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
[ 48.635589][ T103] RIP: 0010:rb_insert_color+0xa6/0x6e0
[ 48.641042][ T103] Code: 4c 8b 3b 41 f6 c7 01 0f 85 11 06 00 00 4c 89 75 b8 4c 89 65 d0 4d 8d 67 08 4d 89 e5 49 c1 ed 03 48 b8 00 00 00 00 00 fc ff df <41> 80 7c 05 00 00 74 08 4c 89 e7 e8 ea ad cf fc 4d 8b 34 24 49 39
[ 48.660717][ T103] RSP: 0018:ffffc90000997900 EFLAGS: 00010002
[ 48.666776][ T103] RAX: dffffc0000000000 RBX: ffffc90000b17700 RCX: dffffc0000000000
[ 48.674722][ T103] RDX: 0000000000000000 RSI: ffff8881f7029da0 RDI: ffffc90000997ac0
[ 48.682668][ T103] RBP: ffffc90000997958 R08: dffffc0000000000 R09: ffffc90000997ac8
[ 48.690641][ T103] R10: fffff52000132f5b R11: 1ffff92000132f59 R12: 0000000000000008
[ 48.698602][ T103] R13: 0000000000000001 R14: 1ffff92000162ee0 R15: 0000000000000000
[ 48.706552][ T103] FS: 00007f159b145880(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
[ 48.715459][ T103] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 48.722018][ T103] CR2: 00007f159a877000 CR3: 000000010b14d000 CR4: 00000000003506b0
[ 48.730005][ T103] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 48.738039][ T103] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 48.745994][ T103] Call Trace:
[ 48.749251][ T103]
[ 48.752164][ T103] timerqueue_add+0x20e/0x230
[ 48.756820][ T103] enqueue_hrtimer+0xc9/0x240
[ 48.761476][ T103] hrtimer_start_range_ns+0xa69/0xc10
[ 48.766840][ T103] schedule_hrtimeout_range_clock+0x165/0x2e0
[ 48.772884][ T103] ? __cfi_schedule_hrtimeout_range_clock+0x10/0x10
[ 48.779450][ T103] ? _raw_write_lock_irq+0x8f/0xe0
[ 48.784538][ T103] ? __cfi_hrtimer_wakeup+0x10/0x10
[ 48.789716][ T103] ? _raw_write_lock_irq+0x8f/0xe0
[ 48.794802][ T103] ? __cfi__raw_write_lock_irq+0x10/0x10
[ 48.800413][ T103] ? ep_done_scan+0x382/0x3a0
[ 48.805084][ T103] schedule_hrtimeout_range+0x28/0x30
[ 48.810463][ T103] do_epoll_wait+0x1520/0x1670
[ 48.815209][ T103] ? ep_destroy_wakeup_source+0x50/0x50
[ 48.820741][ T103] ? slab_free_freelist_hook+0xc2/0x190
[ 48.826338][ T103] ? __cfi_ep_autoremove_wake_function+0x10/0x10
[ 48.832663][ T103] __x64_sys_epoll_wait+0x1bb/0x200
[ 48.837851][ T103] ? __cfi___x64_sys_epoll_wait+0x10/0x10
[ 48.843545][ T103] ? fpregs_assert_state_consistent+0xb1/0xe0
[ 48.849593][ T103] x64_sys_call+0x82b/0x9a0
[ 48.854079][ T103] do_syscall_64+0x4c/0xa0
[ 48.858485][ T103] ? clear_bhb_loop+0x30/0x80
[ 48.863136][ T103] ? clear_bhb_loop+0x30/0x80
[ 48.867795][ T103] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 48.873662][ T103] RIP: 0033:0x7f159aaa7407
[ 48.878052][ T103] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 48.897635][ T103] RSP: 002b:00007ffc39750c60 EFLAGS: 00000202 ORIG_RAX: 00000000000000e8
[ 48.906023][ T103] RAX: ffffffffffffffda RBX: 00007f159b145880 RCX: 00007f159aaa7407
[ 48.913972][ T103] RDX: 0000000000000008 RSI: 00007ffc39750dc0 RDI: 000000000000000b
[ 48.921921][ T103] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 48.929868][ T103] R10: 0000000000000bb8 R11: 0000000000000202 R12: 0000000000000000
[ 48.937831][ T103] R13: 00005574be059100 R14: 0000000000000000 R15: 0000000000000000
[ 48.945782][ T103]
[ 48.948776][ T103] Modules linked in:
[ 48.952674][ T103] ---[ end trace 0000000000000000 ]---
[ 48.952701][ C1] general protection fault, probably for non-canonical address 0xdffffc0000000160: 0000 [#2] PREEMPT SMP KASAN
[ 48.958110][ T103] RIP: 0010:rb_insert_color+0xa6/0x6e0
[ 48.969899][ C1] KASAN: null-ptr-deref in range [0x0000000000000b00-0x0000000000000b07]
[ 48.975326][ T103] Code: 4c 8b 3b 41 f6 c7 01 0f 85 11 06 00 00 4c 89 75 b8 4c 89 65 d0 4d 8d 67 08 4d 89 e5 49 c1 ed 03 48 b8 00 00 00 00 00 fc ff df <41> 80 7c 05 00 00 74 08 4c 89 e7 e8 ea ad cf fc 4d 8b 34 24 49 39
[ 48.983708][ C1] CPU: 1 PID: 484 Comm: syz.2.18 Tainted: G B D syzkaller #0
[ 49.003286][ T103] RSP: 0018:ffffc90000997900 EFLAGS: 00010002
[ 49.011843][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
[ 49.011854][ C1] RIP: 0010:update_curr+0x70/0x5e0
[ 49.017889][ T103] RAX: dffffc0000000000 RBX: ffffc90000b17700 RCX: dffffc0000000000
[ 49.027919][ C1] Code: b3 30 01 00 00 4c 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 0f 8f 66 00 bb 00 0b 00 00 49 03 1e 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 f1 8e 66 00 4c 89 7d c8 4d 85 ff
[ 49.033002][ T103] RDX: 0000000000000000 RSI: ffff8881f7029da0 RDI: ffffc90000997ac0
[ 49.040956][ C1] RSP: 0018:ffffc900001b0af8 EFLAGS: 00010006
[ 49.060536][ T103] RBP: ffffc90000997958 R08: dffffc0000000000 R09: ffffc90000997ac8
[ 49.068486][ C1]
[ 49.068493][ C1] RAX: 0000000000000160 RBX: 0000000000000b00 RCX: 1ffff92000036178
[ 49.074524][ T103] R10: fffff52000132f5b R11: 1ffff92000132f59 R12: 0000000000000008
[ 49.082469][ C1] RDX: 0000000000000000 RSI: ffff88810a5da880 RDI: ffff88810b053800
[ 49.084772][ T103] R13: 0000000000000001 R14: 1ffff92000162ee0 R15: 0000000000000000
[ 49.092718][ C1] RBP: ffffc900001b0b50 R08: ffffffff8796a048 R09: ffffffff8796a058
[ 49.100663][ T103] FS: 00007f159b145880(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
[ 49.108609][ C1] R10: 0000000000000000 R11: ffffffff814ee400 R12: 1ffff1102160a708
[ 49.116591][ T103] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 49.124543][ C1] R13: dffffc0000000000 R14: ffff88810b053930 R15: 0000000000000000
[ 49.133445][ T103] CR2: 00007f159a877000 CR3: 000000010b14d000 CR4: 00000000003506b0
[ 49.141399][ C1] FS: 00007fe3dcece6c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
[ 49.147959][ T103] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 49.155904][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 49.163854][ T103] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 49.172757][ C1] CR2: 000020000000f000 CR3: 000000011d701000 CR4: 00000000003506a0
[ 49.180707][ T103] Kernel panic - not syncing: Fatal exception
[ 49.187273][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 49.187283][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 49.187293][ C1] Call Trace:
[ 49.187298][ C1]
[ 49.187307][ C1] task_tick_fair+0xe4/0x8a0
[ 49.187327][ C1] ? __cfi_task_tick_fair+0x10/0x10
[ 49.187341][ C1] ? _raw_spin_lock+0x8e/0xe0
[ 49.187356][ C1] ? update_rq_clock+0x536/0x5c0
[ 49.187371][ C1] scheduler_tick+0x163/0x480
[ 49.187391][ C1] update_process_times+0x17c/0x1b0
[ 49.187409][ C1] tick_sched_timer+0x17c/0x240
[ 49.187429][ C1] ? __cfi_tick_sched_timer+0x10/0x10
[ 49.187448][ C1] __hrtimer_run_queues+0x3cd/0x9f0
[ 49.187472][ C1] ? hrtimer_interrupt+0x8c0/0x8c0
[ 49.187491][ C1] ? ktime_get_update_offsets_now+0x30c/0x320
[ 49.187510][ C1] hrtimer_interrupt+0x3c7/0x8c0
[ 49.187534][ C1] __sysvec_apic_timer_interrupt+0x11e/0x440
[ 49.187555][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0
[ 49.187575][ C1]
[ 49.187579][ C1]
[ 49.187583][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[ 49.187602][ C1] RIP: 0010:__memmove+0x19c/0x1a0
[ 49.187619][ C1] Code: fa 02 72 16 66 44 8b 1e 66 44 8b 54 16 fe 66 44 89 1f 66 44 89 54 17 fe eb 0c 48 83 fa 01 72 06 44 8a 1e 44 88 1f c3 48 89 d1 a4 c3 00 eb 2e 0f 1f 00 49 89 f9 48 89 d1 83 e2 07 48 c1 e9 03
[ 49.187631][ C1] RSP: 0018:ffffc90000d47640 EFLAGS: 00010286
[ 49.187644][ C1] RAX: ffff88810a7b7070 RBX: ffffffffffffffd4 RCX: ffffffffff6dd946
[ 49.187655][ C1] RDX: ffffffffffffffd4 RSI: ffff88810b0d96de RDI: ffff88810b0d96fe
[ 49.187666][ C1] RBP: ffffc90000d47670 R08: ffff88810a7b7024 R09: 0000000000000001
[ 49.187676][ C1] R10: 0000000000000000 R11: 0000000000000080 R12: 0000000000000000
[ 49.187684][ C1] R13: ffffffff81f8a5b9 R14: ffff88810a7b7050 R15: ffff88810a7b7070
[ 49.187695][ C1] ? ext4_xattr_set_entry+0x979/0x21d0
[ 49.187717][ C1] ? memmove+0x56/0x70
[ 49.187731][ C1] ext4_xattr_set_entry+0x979/0x21d0
[ 49.187753][ C1] ext4_xattr_block_set+0xada/0x3270
[ 49.187773][ C1] ? __getblk_gfp+0x3b/0x7d0
[ 49.187790][ C1] ? xattr_find_entry+0x24c/0x300
[ 49.187809][ C1] ? ext4_xattr_block_find+0x310/0x310
[ 49.187829][ C1] ? ext4_xattr_block_find+0x295/0x310
[ 49.187853][ C1] ext4_expand_extra_isize_ea+0xf30/0x1990
[ 49.187879][ C1] __ext4_expand_extra_isize+0x2fe/0x3e0
[ 49.187900][ C1] __ext4_mark_inode_dirty+0x3cf/0x600
[ 49.187917][ C1] __ext4_unlink+0x673/0xb00
[ 49.187935][ C1] ? memcpy+0x56/0x70
[ 49.187948][ C1] ? __cfi___ext4_unlink+0x10/0x10
[ 49.187967][ C1] ? dquot_initialize+0x20/0x20
[ 49.187985][ C1] ? clear_nonspinnable+0x60/0x60
[ 49.188008][ C1] ext4_unlink+0x13a/0x3a0
[ 49.188026][ C1] vfs_unlink+0x39f/0x630
[ 49.188045][ C1] do_unlinkat+0x31f/0x6b0
[ 49.188062][ C1] ? __cfi_do_unlinkat+0x10/0x10
[ 49.188079][ C1] ? getname_flags+0x206/0x500
[ 49.188101][ C1] __x64_sys_unlink+0x49/0x50
[ 49.188118][ C1] x64_sys_call+0x958/0x9a0
[ 49.188135][ C1] do_syscall_64+0x4c/0xa0
[ 49.188149][ C1] ? clear_bhb_loop+0x30/0x80
[ 49.188166][ C1] ? clear_bhb_loop+0x30/0x80
[ 49.188185][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 49.188202][ C1] RIP: 0033:0x7fe3dbf8ebe9
[ 49.188215][ C1] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 49.188225][ C1] RSP: 002b:00007fe3dcece038 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
[ 49.188239][ C1] RAX: ffffffffffffffda RBX: 00007fe3dc1b5fa0 RCX: 00007fe3dbf8ebe9
[ 49.188249][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000180
[ 49.188258][ C1] RBP: 00007fe3dc011e19 R08: 0000000000000000 R09: 0000000000000000
[ 49.188267][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 49.188275][ C1] R13: 00007fe3dc1b6038 R14: 00007fe3dc1b5fa0 R15: 00007ffe8e2ad108
[ 49.188288][ C1]
[ 49.188292][ C1] Modules linked in:
[ 49.196244][ C1] ---[ end trace 0000000000000000 ]---
[ 49.196251][ C1] RIP: 0010:rb_insert_color+0xa6/0x6e0
[ 49.196272][ C1] Code: 4c 8b 3b 41 f6 c7 01 0f 85 11 06 00 00 4c 89 75 b8 4c 89 65 d0 4d 8d 67 08 4d 89 e5 49 c1 ed 03 48 b8 00 00 00 00 00 fc ff df <41> 80 7c 05 00 00 74 08 4c 89 e7 e8 ea ad cf fc 4d 8b 34 24 49 39
[ 49.196283][ C1] RSP: 0018:ffffc90000997900 EFLAGS: 00010002
[ 49.196294][ C1] RAX: dffffc0000000000 RBX: ffffc90000b17700 RCX: dffffc0000000000
[ 49.196305][ C1] RDX: 0000000000000000 RSI: ffff8881f7029da0 RDI: ffffc90000997ac0
[ 49.196315][ C1] RBP: ffffc90000997958 R08: dffffc0000000000 R09: ffffc90000997ac8
[ 49.196325][ C1] R10: fffff52000132f5b R11: 1ffff92000132f59 R12: 0000000000000008
[ 49.196335][ C1] R13: 0000000000000001 R14: 1ffff92000162ee0 R15: 0000000000000000
[ 49.196344][ C1] FS: 00007fe3dcece6c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
[ 49.196369][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 49.196379][ C1] CR2: 000020000000f000 CR3: 000000011d701000 CR4: 00000000003506a0
[ 49.196392][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 49.196400][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 50.296111][ T103] Shutting down cpus with NMI
[ 50.818285][ T103] Kernel Offset: disabled
[ 50.822595][ T103] Rebooting in 86400 seconds..