[ 421.239569][ T1356] Bluetooth: hci0: command tx timeout [ 423.319725][ T1356] Bluetooth: hci0: command tx timeout [ 424.810239][ T2418] syz-executor (2418) used greatest stack depth: 23728 bytes left [ 424.871242][ T615] bond0 (unregistering): Released all slaves Warning: Permanently added '10.128.1.211' (ED25519) to the list of known hosts. executing program executing program executing program executing program executing program executing program [ 426.215073][ T30] audit: type=1400 audit(1763518462.408:113): avc: denied { mounton } for pid=9936 comm="syz-executor194" path="/root/file0" dev="afs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=dir permissive=1 executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 441.330127][T11338] ================================================================== [ 441.338180][T11338] BUG: KASAN: slab-use-after-free in afs_dynroot_readdir+0x843/0xc20 [ 441.346227][T11338] Read of size 4 at addr ffff888179332148 by task syz-executor194/11338 [ 441.354512][T11338] [ 441.356819][T11338] CPU: 1 UID: 0 PID: 11338 Comm: syz-executor194 Not tainted syzkaller #0 PREEMPT(none) [ 441.356828][T11338] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 441.356834][T11338] Call Trace: [ 441.356838][T11338] [ 441.356841][T11338] dump_stack_lvl+0x5a/0x90 [ 441.356852][T11338] print_report+0xcd/0x630 [ 441.356857][T11338] ? __virt_addr_valid+0x206/0x310 [ 441.356864][T11338] ? afs_dynroot_readdir+0x843/0xc20 [ 441.356870][T11338] kasan_report+0xe0/0x110 [ 441.356873][T11338] ? afs_dynroot_readdir+0x843/0xc20 [ 441.356878][T11338] afs_dynroot_readdir+0x843/0xc20 [ 441.356883][T11338] ? down_read_killable+0x1d2/0x380 [ 441.356893][T11338] ? __pfx_afs_dynroot_readdir+0x10/0x10 [ 441.356897][T11338] ? __pfx_css_rstat_updated+0x10/0x10 [ 441.356905][T11338] ? selinux_file_permission+0x377/0x4e0 [ 441.356911][T11338] iterate_dir+0x1a2/0x530 [ 441.356917][T11338] __x64_sys_getdents64+0x127/0x210 [ 441.356921][T11338] ? __pfx___x64_sys_getdents64+0x10/0x10 [ 441.356926][T11338] ? __pfx_filldir64+0x10/0x10 [ 441.356930][T11338] ? do_user_addr_fault+0x42c/0x8f0 [ 441.356935][T11338] do_syscall_64+0x6d/0x340 [ 441.356940][T11338] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 441.356944][T11338] RIP: 0033:0x7fa522f4eab9 [ 441.356952][T11338] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 441.356955][T11338] RSP: 002b:00007ffe4793dee8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9 [ 441.356962][T11338] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007fa522f4eab9 [ 441.356964][T11338] RDX: 0000000000000055 RSI: 00002000000007c0 RDI: 0000000000000003 [ 441.356967][T11338] RBP: 000000000006bbc7 R08: 0000000000000006 R09: 0000000000000006 [ 441.356969][T11338] R10: 0000000000000006 R11: 0000000000000246 R12: 00007ffe4793defc [ 441.356971][T11338] R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001 [ 441.356975][T11338] [ 441.356976][T11338] [ 441.551678][T11338] Allocated by task 11335: [ 441.556052][T11338] kasan_save_stack+0x33/0x60 [ 441.560701][T11338] kasan_save_track+0x14/0x30 [ 441.565335][T11338] __kasan_kmalloc+0xaa/0xb0 [ 441.569881][T11338] afs_lookup_cell+0x61b/0x1700 [ 441.574708][T11338] afs_dynroot_lookup+0x2d4/0xa40 [ 441.579700][T11338] __lookup_slow+0x208/0x3c0 [ 441.584265][T11338] walk_component+0x2ae/0x500 [ 441.588914][T11338] path_lookupat+0xfa/0x610 [ 441.593419][T11338] filename_lookup+0x1d1/0x560 [ 441.598153][T11338] do_linkat+0xef/0x4c0 [ 441.602294][T11338] __x64_sys_link+0x78/0xa0 [ 441.606822][T11338] do_syscall_64+0x6d/0x340 [ 441.611291][T11338] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 441.617150][T11338] [ 441.619445][T11338] Freed by task 11338: [ 441.623508][T11338] kasan_save_stack+0x33/0x60 [ 441.628147][T11338] kasan_save_track+0x14/0x30 [ 441.632782][T11338] __kasan_save_free_info+0x3b/0x60 [ 441.637956][T11338] __kasan_slab_free+0x5f/0x80 [ 441.642679][T11338] kfree+0x278/0x610 [ 441.646562][T11338] afs_cell_destroy+0x235/0x3f0 [ 441.651372][T11338] rcu_core+0xb22/0x1460 [ 441.655583][T11338] handle_softirqs+0x1ac/0x660 [ 441.660305][T11338] __irq_exit_rcu+0xe1/0x140 [ 441.664856][T11338] sysvec_apic_timer_interrupt+0x90/0xb0 [ 441.670453][T11338] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 441.676398][T11338] [ 441.678688][T11338] Last potentially related work creation: [ 441.684364][T11338] kasan_save_stack+0x33/0x60 [ 441.689020][T11338] kasan_record_aux_stack+0xa7/0xc0 [ 441.694185][T11338] __call_rcu_common.constprop.0+0x99/0x740 [ 441.700044][T11338] process_one_work+0x81f/0x16b0 [ 441.704941][T11338] worker_thread+0x6dd/0x11e0 [ 441.709577][T11338] kthread+0x35d/0x6a0 [ 441.713604][T11338] ret_from_fork+0x2be/0x350 [ 441.718159][T11338] ret_from_fork_asm+0x1a/0x30 [ 441.722904][T11338] [ 441.725210][T11338] Second to last potentially related work creation: [ 441.731763][T11338] kasan_save_stack+0x33/0x60 [ 441.736400][T11338] kasan_record_aux_stack+0xa7/0xc0 [ 441.741656][T11338] insert_work+0x2d/0x270 [ 441.745968][T11338] __queue_work+0x5cd/0xc20 [ 441.750430][T11338] queue_work_on+0x6b/0x80 [ 441.754901][T11338] afs_manage_cell_work+0x8da/0x1840 [ 441.760146][T11338] process_one_work+0x81f/0x16b0 [ 441.765043][T11338] worker_thread+0x6dd/0x11e0 [ 441.769680][T11338] kthread+0x35d/0x6a0 [ 441.773718][T11338] ret_from_fork+0x2be/0x350 [ 441.778269][T11338] ret_from_fork_asm+0x1a/0x30 [ 441.782990][T11338] [ 441.785289][T11338] The buggy address belongs to the object at ffff888179332000 [ 441.785289][T11338] which belongs to the cache kmalloc-1k of size 1024 [ 441.799462][T11338] The buggy address is located 328 bytes inside of [ 441.799462][T11338] freed 1024-byte region [ffff888179332000, ffff888179332400) [ 441.813412][T11338] [ 441.815702][T11338] The buggy address belongs to the physical page: [ 441.822080][T11338] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x179330 [ 441.830884][T11338] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 441.839339][T11338] anon flags: 0x100000000000040(head|node=0|zone=2) [ 441.845893][T11338] page_type: f5(slab) [ 441.849861][T11338] raw: 0100000000000040 ffff888100041dc0 0000000000000000 0000000000000001 [ 441.858400][T11338] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 441.866941][T11338] head: 0100000000000040 ffff888100041dc0 0000000000000000 0000000000000001 [ 441.875570][T11338] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 441.884198][T11338] head: 0100000000000003 ffffea0005e4cc01 00000000ffffffff 00000000ffffffff [ 441.892825][T11338] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 441.901452][T11338] page dumped because: kasan: bad access detected [ 441.907834][T11338] page_owner tracks the page as allocated [ 441.913513][T11338] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 9142, tgid 9142 (kworker/u8:0), ts 417755404210, free_ts 417750015932 [ 441.935011][T11338] post_alloc_hook+0x15b/0x1e0 [ 441.939741][T11338] get_page_from_freelist+0xf46/0x45f0 [ 441.945158][T11338] __alloc_frozen_pages_noprof+0x20c/0x470 [ 441.950925][T11338] alloc_pages_mpol+0x135/0x400 [ 441.955734][T11338] allocate_slab+0x214/0x300 [ 441.960283][T11338] ___slab_alloc+0xb68/0x14b0 [ 441.964916][T11338] __slab_alloc.constprop.0+0x5a/0xc0 [ 441.970246][T11338] __kmalloc_noprof+0x4d8/0x810 [ 441.975054][T11338] load_elf_phdrs+0xd4/0x190 [ 441.979604][T11338] load_elf_binary+0xf53/0x4760 [ 441.984410][T11338] bprm_execve+0x720/0x10d0 [ 441.988869][T11338] kernel_execve+0x246/0x2e0 [ 441.993422][T11338] call_usermodehelper_exec_async+0x231/0x440 [ 441.999450][T11338] ret_from_fork+0x2be/0x350 [ 442.004019][T11338] ret_from_fork_asm+0x1a/0x30 [ 442.008744][T11338] page last free pid 9141 tgid 9141 stack trace: [ 442.015035][T11338] __free_frozen_pages+0x810/0x1170 [ 442.020196][T11338] qlist_free_all+0x4d/0x120 [ 442.024773][T11338] kasan_quarantine_reduce+0x184/0x1b0 [ 442.030196][T11338] __kasan_slab_alloc+0x69/0x90 [ 442.035005][T11338] kmem_cache_alloc_noprof+0x20b/0x6d0 [ 442.040428][T11338] getname_flags.part.0+0x47/0x480 [ 442.045499][T11338] do_sys_openat2+0xaa/0x170 [ 442.050056][T11338] __x64_sys_openat+0x133/0x1d0 [ 442.054865][T11338] do_syscall_64+0x6d/0x340 [ 442.059394][T11338] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 442.065255][T11338] [ 442.067545][T11338] Memory state around the buggy address: [ 442.073138][T11338] ffff888179332000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 442.081157][T11338] ffff888179332080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 442.089178][T11338] >ffff888179332100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 442.097202][T11338] ^ [ 442.103575][T11338] ffff888179332180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 442.111597][T11338] ffff888179332200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 442.119616][T11338] ================================================================== [ 442.127733][T11338] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 442.135218][T11338] Kernel Offset: disabled [ 442.139558][T11338] Rebooting in 86400 seconds..