Warning: Permanently added '10.128.1.121' (ED25519) to the list of known hosts. 2026/11/04 22:47:19 parsed 1 programs Setting up swapspace version 1, size = 127995904 bytes [ 132.067942][ T6021] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 133.218576][ T1335] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.221993][ T1335] ieee802154 phy1 wpan1: encryption failed: -22 [ 135.880449][ T6062] bridge0: port 1(bridge_slave_0) entered blocking state [ 135.880603][ T6062] bridge0: port 1(bridge_slave_0) entered disabled state [ 135.880707][ T6062] bridge_slave_0: entered allmulticast mode [ 135.882042][ T6062] bridge_slave_0: entered promiscuous mode [ 135.883901][ T6062] bridge0: port 2(bridge_slave_1) entered blocking state [ 135.884033][ T6062] bridge0: port 2(bridge_slave_1) entered disabled state [ 135.884128][ T6062] bridge_slave_1: entered allmulticast mode [ 135.885455][ T6062] bridge_slave_1: entered promiscuous mode [ 136.023482][ T6062] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 136.027034][ T6062] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 136.142893][ T6062] team0: Port device team_slave_0 added [ 136.144901][ T6062] team0: Port device team_slave_1 added [ 136.280994][ T6062] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 136.281011][ T6062] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 136.281029][ T6062] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 136.282316][ T6062] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 136.282330][ T6062] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 136.282349][ T6062] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 136.464734][ T6062] hsr_slave_0: entered promiscuous mode [ 136.465514][ T6062] hsr_slave_1: entered promiscuous mode [ 138.532914][ T6062] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 138.573412][ T6062] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 138.574435][ T6062] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 138.622653][ T6062] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 138.624054][ T6062] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 138.673271][ T6062] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 138.674697][ T6062] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 138.721959][ T6062] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 138.856081][ T6062] 8021q: adding VLAN 0 to HW filter on device bond0 [ 138.887916][ T6062] 8021q: adding VLAN 0 to HW filter on device team0 [ 138.902526][ T1025] bridge0: port 1(bridge_slave_0) entered blocking state [ 138.902674][ T1025] bridge0: port 1(bridge_slave_0) entered forwarding state [ 138.948146][ T1806] bridge0: port 2(bridge_slave_1) entered blocking state [ 138.948268][ T1806] bridge0: port 2(bridge_slave_1) entered forwarding state [ 139.517797][ T6062] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 139.615994][ T6062] veth0_vlan: entered promiscuous mode [ 139.637149][ T6062] veth1_vlan: entered promiscuous mode [ 139.696062][ T6062] veth0_macvtap: entered promiscuous mode [ 139.713517][ T6062] veth1_macvtap: entered promiscuous mode [ 139.750980][ T6062] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 139.780083][ T6062] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 139.829082][ T1025] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 139.829127][ T1025] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 139.829160][ T1025] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 139.829193][ T1025] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 140.754997][ T95] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 141.208296][ T95] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 142.127454][ T95] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 142.544164][ T95] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 143.013998][ T4919] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 143.036218][ T4919] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 143.038723][ T4919] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 143.050738][ T4919] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 143.055431][ T4919] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 143.253732][ T95] bridge_slave_1: left allmulticast mode [ 143.253768][ T95] bridge_slave_1: left promiscuous mode [ 143.254363][ T95] bridge0: port 2(bridge_slave_1) entered disabled state [ 143.431079][ T95] bridge_slave_0: left allmulticast mode [ 143.431114][ T95] bridge_slave_0: left promiscuous mode [ 143.431349][ T95] bridge0: port 1(bridge_slave_0) entered disabled state [ 144.320184][ T95] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 144.390816][ T95] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 144.431266][ T95] bond0 (unregistering): Released all slaves [ 144.899112][ T95] hsr_slave_0: left promiscuous mode [ 144.940963][ T95] hsr_slave_1: left promiscuous mode [ 144.943667][ T95] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 144.943695][ T95] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 144.970514][ T95] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 144.970543][ T95] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 145.070538][ T95] veth1_macvtap: left promiscuous mode [ 145.070696][ T95] veth0_macvtap: left promiscuous mode [ 145.071072][ T95] veth1_vlan: left promiscuous mode [ 145.071256][ T95] veth0_vlan: left promiscuous mode [ 145.689609][ T95] team0 (unregistering): Port device team_slave_1 removed [ 145.729648][ T95] team0 (unregistering): Port device team_slave_0 removed [ 145.884069][ T5265] 8021q: adding VLAN 0 to HW filter on device eth1 [ 146.138704][ T1806] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 146.138726][ T1806] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 146.221228][ T1035] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 146.221263][ T1035] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 146.657783][ T5265] 8021q: adding VLAN 0 to HW filter on device eth3 [ 147.461704][ T5265] 8021q: adding VLAN 0 to HW filter on device eth4 [ 148.176736][ T5265] 8021q: adding VLAN 0 to HW filter on device eth2 2026/11/04 22:47:43 executed programs: 0 [ 150.988113][ T4919] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 150.998322][ T4919] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 151.023722][ T4919] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 151.024775][ T4919] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 151.025492][ T4919] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 152.173206][ T6413] bridge0: port 1(bridge_slave_0) entered blocking state [ 152.173346][ T6413] bridge0: port 1(bridge_slave_0) entered disabled state [ 152.173459][ T6413] bridge_slave_0: entered allmulticast mode [ 152.174766][ T6413] bridge_slave_0: entered promiscuous mode [ 152.176628][ T6413] bridge0: port 2(bridge_slave_1) entered blocking state [ 152.176754][ T6413] bridge0: port 2(bridge_slave_1) entered disabled state [ 152.176848][ T6413] bridge_slave_1: entered allmulticast mode [ 152.178106][ T6413] bridge_slave_1: entered promiscuous mode [ 152.383634][ T6413] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 152.386114][ T6413] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 152.582058][ T6413] team0: Port device team_slave_0 added [ 152.584082][ T6413] team0: Port device team_slave_1 added [ 152.741115][ T6413] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 152.741133][ T6413] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 152.741149][ T6413] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 152.742448][ T6413] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 152.742462][ T6413] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 152.742485][ T6413] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 152.944590][ T6413] hsr_slave_0: entered promiscuous mode [ 152.945321][ T6413] hsr_slave_1: entered promiscuous mode [ 153.119251][ T4919] Bluetooth: hci0: command tx timeout [ 155.199628][ T4919] Bluetooth: hci0: command tx timeout [ 155.287292][ T6413] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 155.317676][ T6413] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 155.327286][ T6413] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 155.354226][ T6413] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 155.355877][ T6413] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 155.403345][ T6413] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 155.406997][ T6413] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 155.436969][ T6413] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 155.586724][ T6413] 8021q: adding VLAN 0 to HW filter on device bond0 [ 155.624056][ T6413] 8021q: adding VLAN 0 to HW filter on device team0 [ 155.644021][ T95] bridge0: port 1(bridge_slave_0) entered blocking state [ 155.644157][ T95] bridge0: port 1(bridge_slave_0) entered forwarding state [ 155.680058][ T3376] bridge0: port 2(bridge_slave_1) entered blocking state [ 155.680191][ T3376] bridge0: port 2(bridge_slave_1) entered forwarding state [ 156.304350][ T6413] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 156.416407][ T6413] veth0_vlan: entered promiscuous mode [ 156.435747][ T6413] veth1_vlan: entered promiscuous mode [ 156.492209][ T6413] veth0_macvtap: entered promiscuous mode [ 156.509563][ T6413] veth1_macvtap: entered promiscuous mode [ 156.534537][ T6413] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 156.555454][ T6413] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 156.931048][ T95] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 156.931097][ T95] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 156.931132][ T95] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 156.931165][ T95] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 157.016002][ T95] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 157.016025][ T95] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 157.105144][ T3376] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 157.105168][ T3376] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 157.279235][ T4919] Bluetooth: hci0: command tx timeout 2026/11/04 22:47:49 executed programs: 2 [ 157.696612][ T6550] loop0: detected capacity change from 0 to 32768 [ 157.911194][ T6550] Bad index:0 in slot in dtroot [ 157.911194][ T6550] [ 157.911218][ T6550] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 157.911218][ T6550] [ 157.911496][ T6550] ERROR: (device loop0): remounting filesystem as read-only [ 158.630387][ T6570] loop0: detected capacity change from 0 to 32768 [ 158.663494][ T6570] Bad index:0 in slot in dtroot [ 158.663494][ T6570] [ 158.663514][ T6570] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 158.663514][ T6570] [ 158.663776][ T6570] ERROR: (device loop0): remounting filesystem as read-only [ 159.333977][ T6577] loop0: detected capacity change from 0 to 32768 [ 159.347139][ T6577] Bad index:0 in slot in dtroot [ 159.347139][ T6577] [ 159.347155][ T6577] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 159.347155][ T6577] [ 159.347431][ T6577] ERROR: (device loop0): remounting filesystem as read-only [ 159.362233][ T4919] Bluetooth: hci0: command tx timeout [ 160.190379][ T6580] loop0: detected capacity change from 0 to 32768 [ 160.206111][ T6580] Bad index:0 in slot in dtroot [ 160.206111][ T6580] [ 160.206128][ T6580] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 160.206128][ T6580] [ 160.206411][ T6580] ERROR: (device loop0): remounting filesystem as read-only [ 161.040608][ T6583] loop0: detected capacity change from 0 to 32768 [ 161.086744][ T6583] Bad index:0 in slot in dtroot [ 161.086744][ T6583] [ 161.086762][ T6583] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 161.086762][ T6583] [ 161.087019][ T6583] ERROR: (device loop0): remounting filesystem as read-only [ 161.898555][ T6586] loop0: detected capacity change from 0 to 32768 [ 161.923186][ T6586] Bad index:0 in slot in dtroot [ 161.923186][ T6586] [ 161.923209][ T6586] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 161.923209][ T6586] [ 161.923463][ T6586] ERROR: (device loop0): remounting filesystem as read-only 2026/11/04 22:47:54 executed programs: 8 [ 162.752375][ T6589] loop0: detected capacity change from 0 to 32768 [ 162.763013][ T6589] Bad index:0 in slot in dtroot [ 162.763013][ T6589] [ 162.763030][ T6589] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 162.763030][ T6589] [ 162.763304][ T6589] ERROR: (device loop0): remounting filesystem as read-only [ 163.601265][ T6592] loop0: detected capacity change from 0 to 32768 [ 163.627764][ T6592] Bad index:0 in slot in dtroot [ 163.627764][ T6592] [ 163.627783][ T6592] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 163.627783][ T6592] [ 163.628189][ T6592] ERROR: (device loop0): remounting filesystem as read-only [ 164.451574][ T6595] loop0: detected capacity change from 0 to 32768 [ 164.482241][ T6595] Bad index:0 in slot in dtroot [ 164.482241][ T6595] [ 164.482260][ T6595] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 164.482260][ T6595] [ 164.482493][ T6595] ERROR: (device loop0): remounting filesystem as read-only [ 165.308691][ T6598] loop0: detected capacity change from 0 to 32768 [ 165.337607][ T6598] Bad index:0 in slot in dtroot [ 165.337607][ T6598] [ 165.337626][ T6598] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 165.337626][ T6598] [ 165.337891][ T6598] ERROR: (device loop0): remounting filesystem as read-only [ 166.152726][ T6601] loop0: detected capacity change from 0 to 32768 [ 166.162482][ T6601] Bad index:0 in slot in dtroot [ 166.162482][ T6601] [ 166.162499][ T6601] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 166.162499][ T6601] [ 166.162769][ T6601] ERROR: (device loop0): remounting filesystem as read-only [ 167.018074][ T6604] loop0: detected capacity change from 0 to 32768 [ 167.044092][ T6604] Bad index:0 in slot in dtroot [ 167.044092][ T6604] [ 167.044110][ T6604] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 167.044110][ T6604] [ 167.044416][ T6604] ERROR: (device loop0): remounting filesystem as read-only 2026/11/04 22:48:00 executed programs: 14 [ 167.885860][ T6607] loop0: detected capacity change from 0 to 32768 [ 167.898308][ T6607] Bad index:0 in slot in dtroot [ 167.898308][ T6607] [ 167.898327][ T6607] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 167.898327][ T6607] [ 167.898647][ T6607] ERROR: (device loop0): remounting filesystem as read-only [ 168.718645][ T6610] loop0: detected capacity change from 0 to 32768 [ 168.752135][ T6610] Bad index:0 in slot in dtroot [ 168.752135][ T6610] [ 168.752153][ ** replaying previous printk message ** [ 168.752153][ T6610] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 168.752153][ T6610] [ 168.752422][ T6610] ERROR: (device loop0): remounting filesystem as read-only [ 168.759681][ T1035] ================================================================== [ 168.759695][ T1035] BUG: KASAN: use-after-free in copy_folio_from_iter_atomic+0xbef/0x1a80 [ 168.759723][ T1035] Read of size 4096 at addr ffff888042e8a000 by task kworker/u8:8/1035 [ 168.759738][ T1035] [ 168.759769][ T1035] CPU: 0 UID: 0 PID: 1035 Comm: kworker/u8:8 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 168.759790][ T1035] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 168.759801][ T1035] Workqueue: loop0 loop_workfn [ 168.759835][ T1035] Call Trace: [ 168.759842][ T1035] [ 168.759850][ T1035] dump_stack_lvl+0xe8/0x150 [ 168.759879][ T1035] print_address_description+0x55/0x1e0 [ 168.759906][ T1035] ? copy_folio_from_iter_atomic+0xbef/0x1a80 [ 168.759925][ T1035] print_report+0x58/0x70 [ 168.759949][ T1035] kasan_report+0x117/0x150 [ 168.759969][ T1035] ? irqentry_exit+0x2a0/0x9b0 [ 168.759989][ T1035] ? copy_folio_from_iter_atomic+0xbef/0x1a80 [ 168.760014][ T1035] kasan_check_range+0x264/0x2c0 [ 168.760033][ T1035] ? copy_folio_from_iter_atomic+0xbef/0x1a80 [ 168.760062][ T1035] __asan_memcpy+0x29/0x70 [ 168.760087][ T1035] copy_folio_from_iter_atomic+0xbef/0x1a80 [ 168.760117][ T1035] ? __pfx_copy_folio_from_iter_atomic+0x10/0x10 [ 168.760137][ T1035] ? ktime_get_coarse_real_ts64_mg+0x59/0x1e0 [ 168.760160][ T1035] ? shmem_write_begin+0x1ce/0x320 [ 168.760185][ T1035] generic_perform_write+0x5a8/0x8a0 [ 168.760211][ T1035] ? __pfx_generic_perform_write+0x10/0x10 [ 168.760232][ T1035] ? rt_mutex_post_schedule+0x49/0xf0 [ 168.760254][ T1035] ? generic_write_checks_count+0x426/0x530 [ 168.760278][ T1035] ? file_update_time_flags+0x2db/0x450 [ 168.760298][ T1035] shmem_file_write_iter+0xfb/0x120 [ 168.760329][ T1035] lo_rw_aio+0xe1b/0x1100 [ 168.760358][ T1035] ? __pfx_lo_rw_aio+0x10/0x10 [ 168.760382][ T1035] ? kthread_associate_blkcg+0x4c0/0x660 [ 168.760404][ T1035] ? rt_spin_unlock+0x165/0x200 [ 168.760429][ T1035] loop_process_work+0x638/0x11d0 [ 168.760458][ T1035] ? __pfx_loop_process_work+0x10/0x10 [ 168.760479][ T1035] ? look_up_lock_class+0x57/0x110 [ 168.760497][ T1035] ? register_lock_class+0x31/0x2e0 [ 168.760524][ T1035] ? __lock_acquire+0x747/0x2de0 [ 168.760553][ T1035] ? do_raw_spin_lock+0x12b/0x2f0 [ 168.760579][ T1035] ? lock_acquire+0x115/0x350 [ 168.760606][ T1035] ? rcu_is_watching+0x16/0xb0 [ 168.760626][ T1035] ? process_scheduled_works+0x97a/0x1630 [ 168.760651][ T1035] process_scheduled_works+0xc3d/0x1630 [ 168.760689][ T1035] ? __pfx_process_scheduled_works+0x10/0x10 [ 168.760716][ T1035] ? assign_work+0x3cf/0x5d0 [ 168.760742][ T1035] worker_thread+0xa47/0xfb0 [ 168.760769][ T1035] kthread+0x38b/0x470 [ 168.760788][ T1035] ? __pfx_worker_thread+0x10/0x10 [ 168.760804][ T1035] ? __pfx_kthread+0x10/0x10 [ 168.760822][ T1035] ret_from_fork+0x514/0xb70 [ 168.760844][ T1035] ? __pfx_ret_from_fork+0x10/0x10 [ 168.760863][ T1035] ? __switch_to+0xc78/0x1410 [ 168.760881][ T1035] ? __pfx_kthread+0x10/0x10 [ 168.760901][ T1035] ret_from_fork_asm+0x1a/0x30 [ 168.760926][ T1035] [ 168.760932][ T1035] [ 168.760936][ T1035] The buggy address belongs to the physical page: [ 168.760959][ T1035] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888042e8a8c0 pfn:0x42e8a [ 168.760980][ T1035] flags: 0x80000000000000(node=0|zone=1) [ 168.761003][ T1035] raw: 0080000000000000 ffffea0000cf5588 ffffea0000d718c8 0000000000000000 [ 168.761017][ T1035] raw: ffff888042e8a8c0 0000000000000000 00000000ffffffff 0000000000000000 [ 168.761026][ T1035] page dumped because: kasan: bad access detected [ 168.761043][ T1035] page_owner tracks the page as freed [ 168.761049][ T1035] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xdc0(GFP_KERNEL|__GFP_ZERO), pid 6610, tgid 6609 (syz.0.30), ts 168749907543 [ 168.761074][ T1035] post_alloc_hook+0x1f9/0x250 [ 168.761099][ T1035] get_page_from_freelist+0x258b/0x2600 [ 168.761116][ T1035] __alloc_frozen_pages_noprof+0x227/0x440 [ 168.761133][ T1035] alloc_pages_mpol+0xd4/0x280 [ 168.761151][ T1035] alloc_pages_noprof+0xd2/0x2f0 [ 168.761170][ T1035] lmLogInit+0x357/0x1a20 [ 168.761192][ T1035] lmLogOpen+0x4e3/0xf90 [ 168.761213][ T1035] jfs_mount_rw+0xf3/0x670 [ 168.761234][ T1035] jfs_fill_super+0x769/0xda0 [ 168.761250][ T1035] get_tree_bdev_flags+0x436/0x500 [ 168.761265][ T1035] vfs_get_tree+0x92/0x2a0 [ 168.761279][ T1035] do_new_mount+0x325/0xb00 [ 168.761299][ T1035] __se_sys_mount+0x31d/0x420 [ 168.761319][ T1035] do_syscall_64+0x166/0x520 [ 168.761336][ T1035] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 168.761351][ T1035] page last free pid 6610 tgid 6609 ts 168758797242 stack trace: [ 168.761364][ T1035] __free_frozen_pages+0xf8a/0x1060 [ 168.761387][ T1035] lmLogShutdown+0x44e/0x850 [ 168.761410][ T1035] lmLogClose+0x28c/0x530 [ 168.761432][ T1035] jfs_umount+0x2da/0x3b0 [ 168.761452][ T1035] jfs_fill_super+0x9ed/0xda0 [ 168.761468][ T1035] get_tree_bdev_flags+0x436/0x500 [ 168.761483][ T1035] vfs_get_tree+0x92/0x2a0 [ 168.761497][ T1035] do_new_mount+0x325/0xb00 [ 168.761516][ T1035] __se_sys_mount+0x31d/0x420 [ 168.761537][ T1035] do_syscall_64+0x166/0x520 [ 168.761553][ T1035] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 168.761568][ T1035] [ 168.761572][ T1035] Memory state around the buggy address: [ 168.761581][ T1035] ffff888042e89f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 168.761592][ T1035] ffff888042e89f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 168.761603][ T1035] >ffff888042e8a000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 168.761611][ T1035] ^ [ 168.761619][ T1035] ffff888042e8a080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 168.761630][ T1035] ffff888042e8a100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 168.761638][ T1035] ================================================================== [ 168.767275][ T1035] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 169.365699][ T1035] CPU: 0 UID: 0 PID: 1035 Comm: kworker/u8:8 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 169.375690][ T1035] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 169.385749][ T1035] Workqueue: loop0 loop_workfn [ 169.390611][ T1035] Call Trace: [ 169.393887][ T1035] [ 169.396813][ T1035] vpanic+0x26f/0x710 [ 169.400932][ T1035] panic+0xc5/0xd0 [ 169.404750][ T1035] ? __pfx_panic+0x10/0x10 [ 169.409170][ T1035] ? preempt_schedule_thunk+0x16/0x40 [ 169.414721][ T1035] ? copy_folio_from_iter_atomic+0xbef/0x1a80 [ 169.420879][ T1035] ? preempt_schedule_thunk+0x16/0x40 [ 169.426351][ T1035] ? copy_folio_from_iter_atomic+0xbef/0x1a80 [ 169.432532][ T1035] check_panic_on_warn+0x89/0xb0 [ 169.437595][ T1035] ? copy_folio_from_iter_atomic+0xbef/0x1a80 [ 169.443784][ T1035] end_report+0x73/0x170 [ 169.448260][ T1035] ? copy_folio_from_iter_atomic+0xbef/0x1a80 [ 169.454358][ T1035] kasan_report+0x128/0x150 [ 169.458856][ T1035] ? irqentry_exit+0x2a0/0x9b0 [ 169.463667][ T1035] ? copy_folio_from_iter_atomic+0xbef/0x1a80 [ 169.470438][ T1035] kasan_check_range+0x264/0x2c0 [ 169.475485][ T1035] ? copy_folio_from_iter_atomic+0xbef/0x1a80 [ 169.481608][ T1035] __asan_memcpy+0x29/0x70 [ 169.486031][ T1035] copy_folio_from_iter_atomic+0xbef/0x1a80 [ 169.492015][ T1035] ? __pfx_copy_folio_from_iter_atomic+0x10/0x10 [ 169.498357][ T1035] ? ktime_get_coarse_real_ts64_mg+0x59/0x1e0 [ 169.504465][ T1035] ? shmem_write_begin+0x1ce/0x320 [ 169.509714][ T1035] generic_perform_write+0x5a8/0x8a0 [ 169.515197][ T1035] ? __pfx_generic_perform_write+0x10/0x10 [ 169.521010][ T1035] ? rt_mutex_post_schedule+0x49/0xf0 [ 169.526384][ T1035] ? generic_write_checks_count+0x426/0x530 [ 169.532281][ T1035] ? file_update_time_flags+0x2db/0x450 [ 169.537825][ T1035] shmem_file_write_iter+0xfb/0x120 [ 169.543037][ T1035] lo_rw_aio+0xe1b/0x1100 [ 169.547458][ T1035] ? __pfx_lo_rw_aio+0x10/0x10 [ 169.552220][ T1035] ? kthread_associate_blkcg+0x4c0/0x660 [ 169.557851][ T1035] ? rt_spin_unlock+0x165/0x200 [ 169.562962][ T1035] loop_process_work+0x638/0x11d0 [ 169.567992][ T1035] ? __pfx_loop_process_work+0x10/0x10 [ 169.573458][ T1035] ? look_up_lock_class+0x57/0x110 [ 169.578607][ T1035] ? register_lock_class+0x31/0x2e0 [ 169.583906][ T1035] ? __lock_acquire+0x747/0x2de0 [ 169.588852][ T1035] ? do_raw_spin_lock+0x12b/0x2f0 [ 169.593964][ T1035] ? lock_acquire+0x115/0x350 [ 169.598994][ T1035] ? rcu_is_watching+0x16/0xb0 [ 169.603784][ T1035] ? process_scheduled_works+0x97a/0x1630 [ 169.609544][ T1035] process_scheduled_works+0xc3d/0x1630 [ 169.615104][ T1035] ? __pfx_process_scheduled_works+0x10/0x10 [ 169.621355][ T1035] ? assign_work+0x3cf/0x5d0 [ 169.625954][ T1035] worker_thread+0xa47/0xfb0 [ 169.630573][ T1035] kthread+0x38b/0x470 [ 169.634672][ T1035] ? __pfx_worker_thread+0x10/0x10 [ 169.639859][ T1035] ? __pfx_kthread+0x10/0x10 [ 169.644454][ T1035] ret_from_fork+0x514/0xb70 [ 169.649040][ T1035] ? __pfx_ret_from_fork+0x10/0x10 [ 169.654252][ T1035] ? __switch_to+0xc78/0x1410 [ 169.658937][ T1035] ? __pfx_kthread+0x10/0x10 [ 169.663552][ T1035] ret_from_fork_asm+0x1a/0x30 [ 169.668519][ T1035] [ 169.672124][ T1035] Kernel Offset: disabled [ 169.676481][ T1035] Rebooting in 86400 seconds..