[ 137.939413][ T1304] ieee802154 phy0 wpan0: encryption failed: -22
[ 137.942042][ T1304] ieee802154 phy1 wpan1: encryption failed: -22
Warning: Permanently added '[localhost]:17318' (ED25519) to the list of known hosts.
2024/09/04 23:25:42 ignoring optional flag "sandboxArg"="0"
2024/09/04 23:25:43 parsed 1 programs
[ 159.077017][ T5377] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 164.536415][ T48] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 164.540906][ T48] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 164.544423][ T48] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 164.547942][ T48] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 164.551112][ T48] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 164.553902][ T48] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 165.909542][ T5414] chnl_net:caif_netlink_parms(): no params data found
[ 165.957275][ T5414] bridge0: port 1(bridge_slave_0) entered blocking state
[ 165.960110][ T5414] bridge0: port 1(bridge_slave_0) entered disabled state
[ 165.962829][ T5414] bridge_slave_0: entered allmulticast mode
[ 165.966113][ T5414] bridge_slave_0: entered promiscuous mode
[ 165.971829][ T5414] bridge0: port 2(bridge_slave_1) entered blocking state
[ 165.974625][ T5414] bridge0: port 2(bridge_slave_1) entered disabled state
[ 165.977796][ T5414] bridge_slave_1: entered allmulticast mode
[ 165.980956][ T5414] bridge_slave_1: entered promiscuous mode
[ 166.000280][ T5414] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 166.006168][ T5414] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 166.028898][ T5414] team0: Port device team_slave_0 added
[ 166.033847][ T5414] team0: Port device team_slave_1 added
[ 166.050883][ T5414] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 166.053724][ T5414] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 166.063937][ T5414] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 166.070776][ T5414] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 166.073198][ T5414] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 166.083503][ T5414] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 166.113369][ T5414] hsr_slave_0: entered promiscuous mode
[ 166.116486][ T5414] hsr_slave_1: entered promiscuous mode
[ 166.615321][ T5414] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 166.630086][ T5414] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 166.635011][ T5414] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 166.657651][ T5414] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 166.684869][ T5414] bridge0: port 2(bridge_slave_1) entered blocking state
[ 166.687664][ T5414] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 166.690502][ T5414] bridge0: port 1(bridge_slave_0) entered blocking state
[ 166.693110][ T5414] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 166.803035][ T5414] 8021q: adding VLAN 0 to HW filter on device bond0
[ 166.820839][ T1083] bridge0: port 1(bridge_slave_0) entered disabled state
[ 166.828160][ T1083] bridge0: port 2(bridge_slave_1) entered disabled state
[ 166.845710][ T5414] 8021q: adding VLAN 0 to HW filter on device team0
[ 166.861828][ T1083] bridge0: port 1(bridge_slave_0) entered blocking state
[ 166.864454][ T1083] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 166.888647][ T1083] bridge0: port 2(bridge_slave_1) entered blocking state
[ 166.891390][ T1083] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 167.171634][ T5414] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 167.234324][ T5414] veth0_vlan: entered promiscuous mode
[ 167.250885][ T5414] veth1_vlan: entered promiscuous mode
[ 167.290187][ T5414] veth0_macvtap: entered promiscuous mode
[ 167.309124][ T5414] veth1_macvtap: entered promiscuous mode
[ 167.338728][ T5414] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 167.370498][ T5414] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 167.378924][ T5414] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 167.382424][ T5414] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 167.385787][ T5414] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 167.403925][ T5414] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 167.709512][ T126] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 167.879847][ T126] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 167.968455][ T126] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 168.081823][ T126] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 169.358151][ T1034] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 169.361269][ T1034] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 169.409468][ T1083] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 169.413123][ T1083] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 172.224372][ T126] bridge_slave_1: left allmulticast mode
[ 172.226598][ T126] bridge_slave_1: left promiscuous mode
[ 172.238205][ T126] bridge0: port 2(bridge_slave_1) entered disabled state
[ 172.247859][ T126] bridge_slave_0: left allmulticast mode
[ 172.250044][ T126] bridge_slave_0: left promiscuous mode
[ 172.252292][ T126] bridge0: port 1(bridge_slave_0) entered disabled state
[ 172.982651][ T126] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 172.989333][ T126] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 172.999051][ T126] bond0 (unregistering): Released all slaves
[ 173.129910][ T126] hsr_slave_0: left promiscuous mode
[ 173.138758][ T126] hsr_slave_1: left promiscuous mode
[ 173.147743][ T126] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 173.150561][ T126] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 173.170607][ T126] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 173.173214][ T126] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 173.208148][ T126] veth1_macvtap: left promiscuous mode
[ 173.210941][ T126] veth0_macvtap: left promiscuous mode
[ 173.213106][ T126] veth1_vlan: left promiscuous mode
[ 173.215168][ T126] veth0_vlan: left promiscuous mode
[ 174.018002][ T126] team0 (unregistering): Port device team_slave_1 removed
[ 174.078668][ T126] team0 (unregistering): Port device team_slave_0 removed
2024/09/04 23:26:05 executed programs: 0
[ 174.613646][ T4534] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 174.624870][ T4534] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 174.628908][ T4534] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 174.632560][ T4534] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 174.636277][ T4534] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 174.639791][ T4534] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 175.343403][ T5567] chnl_net:caif_netlink_parms(): no params data found
[ 175.486726][ T5567] bridge0: port 1(bridge_slave_0) entered blocking state
[ 175.512575][ T5567] bridge0: port 1(bridge_slave_0) entered disabled state
[ 175.515517][ T5567] bridge_slave_0: entered allmulticast mode
[ 175.526202][ T5567] bridge_slave_0: entered promiscuous mode
[ 175.544471][ T5567] bridge0: port 2(bridge_slave_1) entered blocking state
[ 175.553130][ T5567] bridge0: port 2(bridge_slave_1) entered disabled state
[ 175.556770][ T5567] bridge_slave_1: entered allmulticast mode
[ 175.576733][ T5567] bridge_slave_1: entered promiscuous mode
[ 175.681041][ T5567] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 175.759886][ T5567] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 175.871316][ T5567] team0: Port device team_slave_0 added
[ 175.875375][ T5567] team0: Port device team_slave_1 added
[ 175.941133][ T5567] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 175.943886][ T5567] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 175.967231][ T5567] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 175.999378][ T5567] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 176.001985][ T5567] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 176.034364][ T5567] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 176.108478][ T5567] hsr_slave_0: entered promiscuous mode
[ 176.118190][ T5567] hsr_slave_1: entered promiscuous mode
[ 176.487920][ T5567] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 176.491916][ T5567] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 176.496773][ T5567] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 176.511489][ T5567] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 176.574104][ T5567] 8021q: adding VLAN 0 to HW filter on device bond0
[ 176.589793][ T5567] 8021q: adding VLAN 0 to HW filter on device team0
[ 176.598909][ T12] bridge0: port 1(bridge_slave_0) entered blocking state
[ 176.601712][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 176.618925][ T12] bridge0: port 2(bridge_slave_1) entered blocking state
[ 176.621569][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 176.657444][ T4534] Bluetooth: hci0: command tx timeout
[ 176.760200][ T5567] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 176.793226][ T5567] veth0_vlan: entered promiscuous mode
[ 176.803913][ T5567] veth1_vlan: entered promiscuous mode
[ 176.829608][ T5567] veth0_macvtap: entered promiscuous mode
[ 176.835430][ T5567] veth1_macvtap: entered promiscuous mode
[ 176.849906][ T5567] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 176.859459][ T5567] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 176.865876][ T5567] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 176.871259][ T5567] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 176.874467][ T5567] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 176.879922][ T5567] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 176.941432][ T41] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 176.944378][ T41] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 176.970220][ T126] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 176.973247][ T126] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 177.334574][ T5609] loop0: detected capacity change from 0 to 32768
[ 177.342378][ T5609] =======================================================
[ 177.342378][ T5609] WARNING: The mand mount option has been deprecated and
[ 177.342378][ T5609] and is ignored by this kernel. Remove the mand
[ 177.342378][ T5609] option from the mount to silence this warning.
[ 177.342378][ T5609] =======================================================
[ 177.383867][ T5609] JBD2: Ignoring recovery information on journal
[ 177.413424][ T5609] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode.
[ 177.441669][ T24] audit: type=1804 audit(1725492368.146:2): pid=5609 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.15" name="/newroot/0/file1/bus" dev="loop0" ino=17058 res=1 errno=0
[ 177.449889][ T5609] OCFS2: ERROR (device loop0): int ocfs2_validate_gd_self(struct super_block *, struct buffer_head *, int): Group descriptor #0 has bad signature
[ 177.459798][ T5609] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted.
[ 177.463586][ T5609] OCFS2: File system is now read-only.
[ 177.465672][ T5609] (syz.0.15,5609,0):ocfs2_search_chain:1814 ERROR: status = -30
[ 177.471593][ T5609] (syz.0.15,5609,0):ocfs2_search_chain:1926 ERROR: status = -30
[ 177.476081][ T5609] (syz.0.15,5609,0):ocfs2_claim_suballoc_bits:1995 ERROR: status = -30
[ 177.480755][ T5609] (syz.0.15,5609,0):ocfs2_claim_suballoc_bits:2038 ERROR: status = -30
[ 177.483725][ T5609] (syz.0.15,5609,0):ocfs2_claim_metadata:2063 ERROR: status = -30
[ 177.486745][ T5609] (syz.0.15,5609,0):ocfs2_claim_metadata:2076 ERROR: status = -30
[ 177.490725][ T5609] (syz.0.15,5609,0):ocfs2_create_refcount_tree:594 ERROR: status = -30
[ 177.494158][ T5609] (syz.0.15,5609,0):ocfs2_reflink_remap_blocks:4636 ERROR: status = -30
[ 177.499394][ T5609] (syz.0.15,5609,0):ocfs2_remap_file_range:2731 ERROR: status = -30
[ 177.533405][ T5567] ocfs2: Unmounting device (7,0) on (node local)
[ 177.948080][ T5613] loop0: detected capacity change from 0 to 32768
[ 177.986505][ T5613] JBD2: Ignoring recovery information on journal
[ 178.025978][ T5613] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode.
[ 178.036995][ T24] audit: type=1804 audit(1725492368.746:3): pid=5613 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.16" name="/newroot/1/file1/bus" dev="loop0" ino=17058 res=1 errno=0
[ 178.049247][ T5613] OCFS2: ERROR (device loop0): int ocfs2_validate_gd_self(struct super_block *, struct buffer_head *, int): Group descriptor #0 has bad signature
[ 178.055169][ T5613] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted.
[ 178.059529][ T5613] OCFS2: File system is now read-only.
[ 178.061630][ T5613] (syz.0.16,5613,0):ocfs2_search_chain:1814 ERROR: status = -30
[ 178.064435][ T5613] (syz.0.16,5613,0):ocfs2_search_chain:1926 ERROR: status = -30
[ 178.069677][ T5613] (syz.0.16,5613,0):ocfs2_claim_suballoc_bits:1995 ERROR: status = -30
[ 178.072756][ T5613] (syz.0.16,5613,0):ocfs2_claim_suballoc_bits:2038 ERROR: status = -30
[ 178.075902][ T5613] (syz.0.16,5613,0):ocfs2_claim_metadata:2063 ERROR: status = -30
[ 178.081020][ T5613] (syz.0.16,5613,0):ocfs2_claim_metadata:2076 ERROR: status = -30
[ 178.084023][ T5613] (syz.0.16,5613,0):ocfs2_create_refcount_tree:594 ERROR: status = -30
[ 178.090805][ T5613] (syz.0.16,5613,0):ocfs2_reflink_remap_blocks:4636 ERROR: status = -30
[ 178.093881][ T5613] (syz.0.16,5613,0):ocfs2_remap_file_range:2731 ERROR: status = -30
[ 178.120520][ T5567] ocfs2: Unmounting device (7,0) on (node local)
[ 178.737080][ T4534] Bluetooth: hci0: command tx timeout
[ 178.790125][ T5617] loop0: detected capacity change from 0 to 32768
[ 178.845423][ T5617] JBD2: Ignoring recovery information on journal
[ 178.909162][ T5617] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode.
[ 178.940700][ T5617] ==================================================================
[ 178.943882][ T5617] BUG: KASAN: slab-use-after-free in ocfs2_claim_suballoc_bits+0x10d3/0x2570
[ 178.947210][ T5617] Read of size 4 at addr ffff8880419f9000 by task syz.0.17/5617
[ 178.951058][ T5617]
[ 178.952026][ T5617] CPU: 0 UID: 0 PID: 5617 Comm: syz.0.17 Not tainted 6.11.0-rc6-syzkaller-gc763c4339688 #0
[ 178.955921][ T5617] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 178.960131][ T5617] Call Trace:
[ 178.961455][ T5617]
[ 178.962622][ T5617] dump_stack_lvl+0x241/0x360
[ 178.964554][ T5617] ? __pfx_dump_stack_lvl+0x10/0x10
[ 178.966649][ T5617] ? __pfx__printk+0x10/0x10
[ 178.968523][ T5617] ? _printk+0xd5/0x120
[ 178.970189][ T5617] ? __virt_addr_valid+0x183/0x530
[ 178.972243][ T5617] ? __virt_addr_valid+0x183/0x530
[ 178.974271][ T5617] print_report+0x169/0x550
[ 178.976091][ T5617] ? __virt_addr_valid+0x183/0x530
[ 178.978134][ T5617] ? __virt_addr_valid+0x183/0x530
[ 178.980153][ T5617] ? __virt_addr_valid+0x45f/0x530
[ 178.982136][ T5617] ? __phys_addr+0xba/0x170
[ 178.983933][ T5617] ? ocfs2_claim_suballoc_bits+0x10d3/0x2570
[ 178.986267][ T5617] kasan_report+0x143/0x180
[ 178.988025][ T5617] ? ocfs2_claim_suballoc_bits+0x10d3/0x2570
[ 178.990343][ T5617] ocfs2_claim_suballoc_bits+0x10d3/0x2570
[ 178.992712][ T5617] ? __pfx_lock_release+0x10/0x10
[ 178.994754][ T5617] ? __pfx_ocfs2_claim_suballoc_bits+0x10/0x10
[ 178.997157][ T5617] ? jbd2_write_access_granted+0x71/0x310
[ 178.999337][ T5617] ? __mutex_lock+0x2ef/0xd70
[ 179.001200][ T5617] ? __mutex_unlock_slowpath+0x21d/0x750
[ 179.003377][ T5617] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 179.005710][ T5617] ? jbd2_write_access_granted+0x71/0x310
[ 179.007938][ T5617] ? jbd2_write_access_granted+0x2f8/0x310
[ 179.010249][ T5617] ? jbd2_write_access_granted+0x71/0x310
[ 179.012465][ T5617] ocfs2_claim_metadata+0x16d/0x580
[ 179.014490][ T5617] ? jbd2__journal_start+0x3b8/0x5d0
[ 179.016563][ T5617] ? __pfx_ocfs2_claim_metadata+0x10/0x10
[ 179.018744][ T5617] ? __lock_acquire+0x137a/0x2040
[ 179.020749][ T5617] ? __pfx_ocfs2_start_trans+0x10/0x10
[ 179.023039][ T5617] ? ocfs2_metadata_cache_get_super+0x43/0x80
[ 179.025540][ T5617] ? ocfs2_inode_cache_get_super+0xd/0x40
[ 179.027729][ T5617] ocfs2_create_refcount_tree+0x699/0x15f0
[ 179.029985][ T5617] ? __pfx_ocfs2_create_refcount_tree+0x10/0x10
[ 179.032322][ T5617] ? __pfx_lock_release+0x10/0x10
[ 179.034231][ T5617] ? xas_find+0x213/0x960
[ 179.035932][ T5617] ? find_get_entries+0x19a/0x8c0
[ 179.037832][ T5617] ? find_get_entries+0x67c/0x8c0
[ 179.039787][ T5617] ? find_get_entries+0x19a/0x8c0
[ 179.041725][ T5617] ? __pfx_find_get_entries+0x10/0x10
[ 179.043792][ T5617] ocfs2_reflink_remap_blocks+0x2f6/0x1f30
[ 179.046076][ T5617] ? __pfx_ocfs2_reflink_remap_blocks+0x10/0x10
[ 179.048563][ T5617] ? __pfx_truncate_inode_pages_range+0x10/0x10
[ 179.051075][ T5617] ? down_write+0x18c/0x220
[ 179.052982][ T5617] ? __pfx_down_write+0x10/0x10
[ 179.055073][ T5617] ? generic_remap_file_range_prep+0x3e/0x60
[ 179.057589][ T5617] ocfs2_remap_file_range+0x600/0x8e0
[ 179.059748][ T5617] ? __pfx_ocfs2_remap_file_range+0x10/0x10
[ 179.062046][ T5617] ? rcu_read_lock_any_held+0xb7/0x160
[ 179.064155][ T5617] ? __pfx_rcu_read_lock_any_held+0x10/0x10
[ 179.066468][ T5617] ? __pfx_ocfs2_remap_file_range+0x10/0x10
[ 179.068800][ T5617] vfs_copy_file_range+0xc1f/0x1530
[ 179.070859][ T5617] ? __pfx_vfs_copy_file_range+0x10/0x10
[ 179.073043][ T5617] ? __fget_files+0x3f6/0x470
[ 179.074861][ T5617] ? __might_fault+0xc6/0x120
[ 179.076717][ T5617] __se_sys_copy_file_range+0x3f2/0x5d0
[ 179.078899][ T5617] ? __pfx___se_sys_copy_file_range+0x10/0x10
[ 179.081358][ T5617] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 179.084062][ T5617] ? do_syscall_64+0x100/0x230
[ 179.086135][ T5617] ? __x64_sys_copy_file_range+0x21/0xf0
[ 179.088447][ T5617] do_syscall_64+0xf3/0x230
[ 179.090211][ T5617] ? clear_bhb_loop+0x35/0x90
[ 179.092015][ T5617] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 179.094258][ T5617] RIP: 0033:0x7f3092f79e79
[ 179.096034][ T5617] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 179.103463][ T5617] RSP: 002b:00007f3093d48038 EFLAGS: 00000246 ORIG_RAX: 0000000000000146
[ 179.106611][ T5617] RAX: ffffffffffffffda RBX: 00007f3093115f80 RCX: 00007f3092f79e79
[ 179.109730][ T5617] RDX: 0000000000000004 RSI: 0000000000000000 RDI: 0000000000000006
[ 179.112784][ T5617] RBP: 00007f3092fe7916 R08: 0000000000000006 R09: 0000000000000000
[ 179.115830][ T5617] R10: 00000000200000c0 R11: 0000000000000246 R12: 0000000000000000
[ 179.118965][ T5617] R13: 0000000000000000 R14: 00007f3093115f80 R15: 00007ffd61883338
[ 179.122038][ T5617]
[ 179.123276][ T5617]
[ 179.124231][ T5617] Allocated by task 12:
[ 179.125834][ T5617] kasan_save_track+0x3f/0x80
[ 179.127677][ T5617] __kasan_slab_alloc+0x66/0x80
[ 179.129569][ T5617] kmem_cache_alloc_node_noprof+0x16b/0x320
[ 179.131862][ T5617] __alloc_skb+0x1c3/0x440
[ 179.133598][ T5617] ndisc_alloc_skb+0xed/0x2c0
[ 179.135432][ T5617] ndisc_ns_create+0x221/0x770
[ 179.137300][ T5617] ndisc_send_ns+0xaf/0x160
[ 179.139090][ T5617] addrconf_dad_work+0xb45/0x16f0
[ 179.141070][ T5617] process_scheduled_works+0xa2c/0x1830
[ 179.143256][ T5617] worker_thread+0x86d/0xd10
[ 179.145057][ T5617] kthread+0x2f0/0x390
[ 179.146620][ T5617] ret_from_fork+0x4b/0x80
[ 179.148381][ T5617] ret_from_fork_asm+0x1a/0x30
[ 179.150255][ T5617]
[ 179.151262][ T5617] Freed by task 12:
[ 179.152757][ T5617] kasan_save_track+0x3f/0x80
[ 179.154561][ T5617] kasan_save_free_info+0x40/0x50
[ 179.156548][ T5617] poison_slab_object+0xe0/0x150
[ 179.158459][ T5617] __kasan_slab_free+0x37/0x60
[ 179.160350][ T5617] kmem_cache_free+0x145/0x350
[ 179.162205][ T5617] ip6_mc_input+0xa1f/0xc30
[ 179.163968][ T5617] NF_HOOK+0x3a4/0x450
[ 179.165499][ T5617] __netif_receive_skb+0x1ea/0x650
[ 179.167466][ T5617] process_backlog+0x662/0x15b0
[ 179.169322][ T5617] __napi_poll+0xcb/0x490
[ 179.170997][ T5617] net_rx_action+0x89b/0x1240
[ 179.172852][ T5617] handle_softirqs+0x2c4/0x970
[ 179.174703][ T5617] do_softirq+0x11b/0x1e0
[ 179.176409][ T5617] __local_bh_enable_ip+0x1bb/0x200
[ 179.178412][ T5617] __dev_queue_xmit+0x1763/0x3e90
[ 179.180394][ T5617] ip6_finish_output2+0x1001/0x1730
[ 179.182367][ T5617] ip6_finish_output+0x41e/0x810
[ 179.184256][ T5617] ndisc_send_skb+0xab2/0x1380
[ 179.186097][ T5617] ndisc_send_ns+0xcc/0x160
[ 179.187881][ T5617] addrconf_dad_work+0xb45/0x16f0
[ 179.189838][ T5617] process_scheduled_works+0xa2c/0x1830
[ 179.191970][ T5617] worker_thread+0x86d/0xd10
[ 179.193751][ T5617] kthread+0x2f0/0x390
[ 179.195314][ T5617] ret_from_fork+0x4b/0x80
[ 179.197052][ T5617] ret_from_fork_asm+0x1a/0x30
[ 179.198939][ T5617]
[ 179.199868][ T5617] The buggy address belongs to the object at ffff8880419f9000
[ 179.199868][ T5617] which belongs to the cache skbuff_head_cache of size 240
[ 179.205292][ T5617] The buggy address is located 0 bytes inside of
[ 179.205292][ T5617] freed 240-byte region [ffff8880419f9000, ffff8880419f90f0)
[ 179.210444][ T5617]
[ 179.211391][ T5617] The buggy address belongs to the physical page:
[ 179.213799][ T5617] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x419f9
[ 179.217187][ T5617] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 179.219967][ T5617] page_type: 0xfdffffff(slab)
[ 179.221792][ T5617] raw: 04fff00000000000 ffff88801bf97640 dead000000000122 0000000000000000
[ 179.225082][ T5617] raw: 0000000000000000 00000000000c000c 00000001fdffffff 0000000000000000
[ 179.228337][ T5617] page dumped because: kasan: bad access detected
[ 179.230785][ T5617] page_owner tracks the page as allocated
[ 179.233089][ T5617] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x152820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 12, tgid 12 (kworker/u4:1), ts 177617732461, free_ts 177578752701
[ 179.240949][ T5617] post_alloc_hook+0x1f3/0x230
[ 179.242881][ T5617] get_page_from_freelist+0x2e4c/0x2f10
[ 179.245389][ T5617] __alloc_pages_noprof+0x256/0x6c0
[ 179.247868][ T5617] alloc_slab_page+0x5f/0x120
[ 179.249902][ T5617] allocate_slab+0x5a/0x2f0
[ 179.251684][ T5617] ___slab_alloc+0xcd1/0x14b0
[ 179.253507][ T5617] __slab_alloc+0x58/0xa0
[ 179.255184][ T5617] kmem_cache_alloc_node_noprof+0x1fe/0x320
[ 179.257471][ T5617] __alloc_skb+0x1c3/0x440
[ 179.259257][ T5617] ndisc_alloc_skb+0xed/0x2c0
[ 179.261121][ T5617] ndisc_ns_create+0x221/0x770
[ 179.262968][ T5617] ndisc_send_ns+0xaf/0x160
[ 179.264737][ T5617] addrconf_dad_work+0xb45/0x16f0
[ 179.266631][ T5617] process_scheduled_works+0xa2c/0x1830
[ 179.268740][ T5617] worker_thread+0x86d/0xd10
[ 179.270534][ T5617] kthread+0x2f0/0x390
[ 179.272118][ T5617] page last free pid 4596 tgid 4596 stack trace:
[ 179.274447][ T5617] free_unref_page+0xd22/0xea0
[ 179.276216][ T5617] __slab_free+0x31b/0x3d0
[ 179.277943][ T5617] qlist_free_all+0x9e/0x140
[ 179.279749][ T5617] kasan_quarantine_reduce+0x14f/0x170
[ 179.281826][ T5617] __kasan_slab_alloc+0x23/0x80
[ 179.283686][ T5617] kmem_cache_alloc_noprof+0x135/0x2a0
[ 179.285768][ T5617] getname_flags+0xb7/0x540
[ 179.287535][ T5617] do_sys_openat2+0xd2/0x1d0
[ 179.289318][ T5617] __x64_sys_openat+0x247/0x2a0
[ 179.291281][ T5617] do_syscall_64+0xf3/0x230
[ 179.293072][ T5617] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 179.295347][ T5617]
[ 179.296269][ T5617] Memory state around the buggy address:
[ 179.298362][ T5617] ffff8880419f8f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 179.301394][ T5617] ffff8880419f8f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 179.304469][ T5617] >ffff8880419f9000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 179.307545][ T5617] ^
[ 179.309124][ T5617] ffff8880419f9080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 179.312226][ T5617] ffff8880419f9100: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 179.315158][ T5617] ==================================================================
[ 179.319067][ T24] audit: type=1804 audit(1725492369.656:4): pid=5617 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.17" name="/newroot/2/file1/bus" dev="loop0" ino=17058 res=1 errno=0
[ 179.817262][ T5617] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 179.821429][ T5617] CPU: 0 UID: 0 PID: 5617 Comm: syz.0.17 Not tainted 6.11.0-rc6-syzkaller-gc763c4339688 #0
[ 179.825266][ T5617] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 179.829943][ T5617] Call Trace:
[ 179.831241][ T5617]
[ 179.832642][ T5617] dump_stack_lvl+0x241/0x360
[ 179.834478][ T5617] ? __pfx_dump_stack_lvl+0x10/0x10
[ 179.837374][ T5617] ? __pfx__printk+0x10/0x10
[ 179.839791][ T5617] ? preempt_schedule+0xe1/0xf0
[ 179.841863][ T5617] ? vscnprintf+0x5d/0x90
[ 179.844024][ T5617] panic+0x349/0x860
[ 179.845983][ T5617] ? check_panic_on_warn+0x21/0xb0
[ 179.847668][ T5617] ? __pfx_panic+0x10/0x10
[ 179.849219][ T5617] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 179.851546][ T5617] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 179.854148][ T5617] ? print_report+0x502/0x550
[ 179.856090][ T5617] check_panic_on_warn+0x86/0xb0
[ 179.858254][ T5617] ? ocfs2_claim_suballoc_bits+0x10d3/0x2570
[ 179.861427][ T5617] end_report+0x77/0x160
[ 179.863449][ T5617] kasan_report+0x154/0x180
[ 179.865317][ T5617] ? ocfs2_claim_suballoc_bits+0x10d3/0x2570
[ 179.867603][ T5617] ocfs2_claim_suballoc_bits+0x10d3/0x2570
[ 179.869960][ T5617] ? __pfx_lock_release+0x10/0x10
[ 179.872046][ T5617] ? __pfx_ocfs2_claim_suballoc_bits+0x10/0x10
[ 179.874385][ T5617] ? jbd2_write_access_granted+0x71/0x310
[ 179.876573][ T5617] ? __mutex_lock+0x2ef/0xd70
[ 179.878423][ T5617] ? __mutex_unlock_slowpath+0x21d/0x750
[ 179.880882][ T5617] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 179.883722][ T5617] ? jbd2_write_access_granted+0x71/0x310
[ 179.887054][ T5617] ? jbd2_write_access_granted+0x2f8/0x310
[ 179.889324][ T5617] ? jbd2_write_access_granted+0x71/0x310
[ 179.891654][ T5617] ocfs2_claim_metadata+0x16d/0x580
[ 179.893739][ T5617] ? jbd2__journal_start+0x3b8/0x5d0
[ 179.895755][ T5617] ? __pfx_ocfs2_claim_metadata+0x10/0x10
[ 179.897981][ T5617] ? __lock_acquire+0x137a/0x2040
[ 179.899953][ T5617] ? __pfx_ocfs2_start_trans+0x10/0x10
[ 179.902044][ T5617] ? ocfs2_metadata_cache_get_super+0x43/0x80
[ 179.904395][ T5617] ? ocfs2_inode_cache_get_super+0xd/0x40
[ 179.906541][ T5617] ocfs2_create_refcount_tree+0x699/0x15f0
[ 179.908813][ T5617] ? __pfx_ocfs2_create_refcount_tree+0x10/0x10
[ 179.911122][ T5617] ? __pfx_lock_release+0x10/0x10
[ 179.913005][ T5617] ? xas_find+0x213/0x960
[ 179.914606][ T5617] ? find_get_entries+0x19a/0x8c0
[ 179.916498][ T5617] ? find_get_entries+0x67c/0x8c0
[ 179.918504][ T5617] ? find_get_entries+0x19a/0x8c0
[ 179.920485][ T5617] ? __pfx_find_get_entries+0x10/0x10
[ 179.922513][ T5617] ocfs2_reflink_remap_blocks+0x2f6/0x1f30
[ 179.924795][ T5617] ? __pfx_ocfs2_reflink_remap_blocks+0x10/0x10
[ 179.927145][ T5617] ? __pfx_truncate_inode_pages_range+0x10/0x10
[ 179.929512][ T5617] ? down_write+0x18c/0x220
[ 179.931334][ T5617] ? __pfx_down_write+0x10/0x10
[ 179.933177][ T5617] ? generic_remap_file_range_prep+0x3e/0x60
[ 179.935484][ T5617] ocfs2_remap_file_range+0x600/0x8e0
[ 179.937518][ T5617] ? __pfx_ocfs2_remap_file_range+0x10/0x10
[ 179.939678][ T5617] ? rcu_read_lock_any_held+0xb7/0x160
[ 179.941733][ T5617] ? __pfx_rcu_read_lock_any_held+0x10/0x10
[ 179.943977][ T5617] ? __pfx_ocfs2_remap_file_range+0x10/0x10
[ 179.946240][ T5617] vfs_copy_file_range+0xc1f/0x1530
[ 179.948237][ T5617] ? __pfx_vfs_copy_file_range+0x10/0x10
[ 179.950332][ T5617] ? __fget_files+0x3f6/0x470
[ 179.952165][ T5617] ? __might_fault+0xc6/0x120
[ 179.953959][ T5617] __se_sys_copy_file_range+0x3f2/0x5d0
[ 179.955993][ T5617] ? __pfx___se_sys_copy_file_range+0x10/0x10
[ 179.958067][ T5617] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 179.960399][ T5617] ? do_syscall_64+0x100/0x230
[ 179.962194][ T5617] ? __x64_sys_copy_file_range+0x21/0xf0
[ 179.964288][ T5617] do_syscall_64+0xf3/0x230
[ 179.966013][ T5617] ? clear_bhb_loop+0x35/0x90
[ 179.967833][ T5617] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 179.970075][ T5617] RIP: 0033:0x7f3092f79e79
[ 179.971790][ T5617] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 179.978588][ T5617] RSP: 002b:00007f3093d48038 EFLAGS: 00000246 ORIG_RAX: 0000000000000146
[ 179.981466][ T5617] RAX: ffffffffffffffda RBX: 00007f3093115f80 RCX: 00007f3092f79e79
[ 179.984255][ T5617] RDX: 0000000000000004 RSI: 0000000000000000 RDI: 0000000000000006
[ 179.987180][ T5617] RBP: 00007f3092fe7916 R08: 0000000000000006 R09: 0000000000000000
[ 179.989991][ T5617] R10: 00000000200000c0 R11: 0000000000000246 R12: 0000000000000000
[ 179.992897][ T5617] R13: 0000000000000000 R14: 00007f3093115f80 R15: 00007ffd61883338
[ 179.995866][ T5617]
[ 179.997188][ T5617] Kernel Offset: disabled
[ 179.998675][ T5617] Rebooting in 86400 seconds..