Warning: Permanently added '[localhost]:12407' (ED25519) to the list of known hosts. 2024/09/04 23:53:31 ignoring optional flag "sandboxArg"="0" 2024/09/04 23:53:32 parsed 1 programs [ 137.541858][ T5379] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 137.834629][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 137.837450][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 141.807344][ T48] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 141.811164][ T48] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 141.817461][ T48] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 141.821254][ T48] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 141.824966][ T48] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 141.827963][ T48] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 142.189476][ T1032] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 142.193953][ T1032] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 142.222664][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 142.225801][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 142.958856][ T5418] chnl_net:caif_netlink_parms(): no params data found [ 143.017735][ T5418] bridge0: port 1(bridge_slave_0) entered blocking state [ 143.020632][ T5418] bridge0: port 1(bridge_slave_0) entered disabled state [ 143.024714][ T5418] bridge_slave_0: entered allmulticast mode [ 143.028129][ T5418] bridge_slave_0: entered promiscuous mode [ 143.032358][ T5418] bridge0: port 2(bridge_slave_1) entered blocking state [ 143.035144][ T5418] bridge0: port 2(bridge_slave_1) entered disabled state [ 143.037928][ T5418] bridge_slave_1: entered allmulticast mode [ 143.042749][ T5418] bridge_slave_1: entered promiscuous mode [ 143.063413][ T5418] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 143.069410][ T5418] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 143.094487][ T5418] team0: Port device team_slave_0 added [ 143.099626][ T5418] team0: Port device team_slave_1 added [ 143.117944][ T5418] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 143.120659][ T5418] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 143.141182][ T5418] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 143.147888][ T5418] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 143.150449][ T5418] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 143.161341][ T5418] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 143.190583][ T5418] hsr_slave_0: entered promiscuous mode [ 143.194314][ T5418] hsr_slave_1: entered promiscuous mode [ 143.960728][ T5418] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 143.985320][ T5418] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 144.005065][ T5418] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 144.034814][ T5418] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 144.225998][ T5418] 8021q: adding VLAN 0 to HW filter on device bond0 [ 144.260710][ T5418] 8021q: adding VLAN 0 to HW filter on device team0 [ 144.301909][ T1030] bridge0: port 1(bridge_slave_0) entered blocking state [ 144.304731][ T1030] bridge0: port 1(bridge_slave_0) entered forwarding state [ 144.324721][ T1030] bridge0: port 2(bridge_slave_1) entered blocking state [ 144.327547][ T1030] bridge0: port 2(bridge_slave_1) entered forwarding state [ 144.693290][ T5418] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 144.765578][ T5418] veth0_vlan: entered promiscuous mode [ 144.783183][ T5418] veth1_vlan: entered promiscuous mode [ 144.807792][ T5418] veth0_macvtap: entered promiscuous mode [ 144.846438][ T5418] veth1_macvtap: entered promiscuous mode [ 144.859603][ T5418] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 144.886899][ T5418] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 144.906469][ T5418] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 144.909599][ T5418] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 144.931930][ T5418] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 144.935807][ T5418] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 145.278877][ T1032] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 145.444664][ T1032] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 145.573789][ T1032] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 145.720304][ T1032] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 149.622034][ T1032] bridge_slave_1: left allmulticast mode [ 149.624321][ T1032] bridge_slave_1: left promiscuous mode [ 149.626512][ T1032] bridge0: port 2(bridge_slave_1) entered disabled state [ 149.664963][ T1032] bridge_slave_0: left allmulticast mode [ 149.667190][ T1032] bridge_slave_0: left promiscuous mode [ 149.670063][ T1032] bridge0: port 1(bridge_slave_0) entered disabled state [ 150.342333][ T1032] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 150.347462][ T1032] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 150.354228][ T1032] bond0 (unregistering): Released all slaves [ 150.474009][ T1032] hsr_slave_0: left promiscuous mode [ 150.486161][ T1032] hsr_slave_1: left promiscuous mode [ 150.488968][ T1032] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 150.502664][ T1032] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 150.513432][ T1032] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 150.516501][ T1032] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 150.566148][ T1032] veth1_macvtap: left promiscuous mode [ 150.568431][ T1032] veth0_macvtap: left promiscuous mode [ 150.570712][ T1032] veth1_vlan: left promiscuous mode [ 150.593349][ T1032] veth0_vlan: left promiscuous mode [ 151.466764][ T1032] team0 (unregistering): Port device team_slave_1 removed [ 151.533923][ T1032] team0 (unregistering): Port device team_slave_0 removed 2024/09/04 23:53:58 executed programs: 0 [ 153.445450][ T4533] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 153.449399][ T4533] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 153.453347][ T4533] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 153.457146][ T4533] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 153.460385][ T4533] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 153.463879][ T4533] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 153.870906][ T5570] chnl_net:caif_netlink_parms(): no params data found [ 153.991042][ T5570] bridge0: port 1(bridge_slave_0) entered blocking state [ 154.004949][ T5570] bridge0: port 1(bridge_slave_0) entered disabled state [ 154.007675][ T5570] bridge_slave_0: entered allmulticast mode [ 154.032765][ T5570] bridge_slave_0: entered promiscuous mode [ 154.036888][ T5570] bridge0: port 2(bridge_slave_1) entered blocking state [ 154.039647][ T5570] bridge0: port 2(bridge_slave_1) entered disabled state [ 154.042884][ T5570] bridge_slave_1: entered allmulticast mode [ 154.052978][ T5570] bridge_slave_1: entered promiscuous mode [ 154.090080][ T5570] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 154.123253][ T5570] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 154.182923][ T5570] team0: Port device team_slave_0 added [ 154.194864][ T5570] team0: Port device team_slave_1 added [ 154.243719][ T5570] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 154.246279][ T5570] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 154.281943][ T5570] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 154.302335][ T5570] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 154.305044][ T5570] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 154.342568][ T5570] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 154.415282][ T5570] hsr_slave_0: entered promiscuous mode [ 154.432598][ T5570] hsr_slave_1: entered promiscuous mode [ 154.994247][ T5570] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 155.005015][ T5570] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 155.024621][ T5570] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 155.043910][ T5570] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 155.235272][ T5570] 8021q: adding VLAN 0 to HW filter on device bond0 [ 155.260801][ T5570] 8021q: adding VLAN 0 to HW filter on device team0 [ 155.293429][ T1030] bridge0: port 1(bridge_slave_0) entered blocking state [ 155.296086][ T1030] bridge0: port 1(bridge_slave_0) entered forwarding state [ 155.300083][ T1030] bridge0: port 2(bridge_slave_1) entered blocking state [ 155.302854][ T1030] bridge0: port 2(bridge_slave_1) entered forwarding state [ 155.395030][ T5570] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 155.515107][ T4533] Bluetooth: hci0: command tx timeout [ 155.745522][ T5570] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 155.814003][ T5570] veth0_vlan: entered promiscuous mode [ 155.834448][ T5570] veth1_vlan: entered promiscuous mode [ 155.906899][ T5570] veth0_macvtap: entered promiscuous mode [ 155.925865][ T5570] veth1_macvtap: entered promiscuous mode [ 155.950503][ T5570] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 155.971124][ T5570] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 156.000704][ T5570] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 156.012728][ T5570] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 156.016145][ T5570] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 156.019493][ T5570] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 156.137352][ T1030] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 156.141034][ T1030] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 156.205244][ T1075] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 156.208328][ T1075] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 156.748283][ T5613] loop0: detected capacity change from 0 to 32768 [ 156.772656][ T5613] ======================================================= [ 156.772656][ T5613] WARNING: The mand mount option has been deprecated and [ 156.772656][ T5613] and is ignored by this kernel. Remove the mand [ 156.772656][ T5613] option from the mount to silence this warning. [ 156.772656][ T5613] ======================================================= [ 156.882034][ T5613] JBD2: Ignoring recovery information on journal [ 156.932253][ T5613] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 156.970316][ T24] audit: type=1804 audit(1725494042.468:2): pid=5613 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.15" name="/newroot/0/file1/bus" dev="loop0" ino=17058 res=1 errno=0 [ 156.992651][ T5613] ================================================================== [ 156.995803][ T5613] BUG: KASAN: slab-out-of-bounds in ocfs2_claim_suballoc_bits+0x1099/0x2570 [ 156.999219][ T5613] Read of size 4 at addr ffff88803fbac1d0 by task syz.0.15/5613 [ 157.002901][ T5613] [ 157.003869][ T5613] CPU: 0 UID: 0 PID: 5613 Comm: syz.0.15 Not tainted 6.11.0-rc6-syzkaller-gc763c4339688 #0 [ 157.007698][ T5613] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 157.011828][ T5613] Call Trace: [ 157.013171][ T5613] [ 157.014341][ T5613] dump_stack_lvl+0x241/0x360 [ 157.016241][ T5613] ? __pfx_dump_stack_lvl+0x10/0x10 [ 157.018272][ T5613] ? __pfx__printk+0x10/0x10 [ 157.020105][ T5613] ? _printk+0xd5/0x120 [ 157.021753][ T5613] ? __virt_addr_valid+0x183/0x530 [ 157.023764][ T5613] ? __virt_addr_valid+0x183/0x530 [ 157.025718][ T5613] print_report+0x169/0x550 [ 157.027541][ T5613] ? __virt_addr_valid+0x183/0x530 [ 157.029536][ T5613] ? __virt_addr_valid+0x183/0x530 [ 157.031543][ T5613] ? __virt_addr_valid+0x45f/0x530 [ 157.033532][ T5613] ? __phys_addr+0xba/0x170 [ 157.035291][ T5613] ? ocfs2_claim_suballoc_bits+0x1099/0x2570 [ 157.037627][ T5613] kasan_report+0x143/0x180 [ 157.039417][ T5613] ? ocfs2_claim_suballoc_bits+0x1099/0x2570 [ 157.041750][ T5613] ocfs2_claim_suballoc_bits+0x1099/0x2570 [ 157.044033][ T5613] ? __pfx_lock_release+0x10/0x10 [ 157.045981][ T5613] ? __pfx_ocfs2_claim_suballoc_bits+0x10/0x10 [ 157.048141][ T5613] ? jbd2_write_access_granted+0x71/0x310 [ 157.050147][ T5613] ? __mutex_lock+0x2ef/0xd70 [ 157.051920][ T5613] ? __mutex_unlock_slowpath+0x21d/0x750 [ 157.054040][ T5613] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 157.056362][ T5613] ? jbd2_write_access_granted+0x71/0x310 [ 157.058546][ T5613] ? jbd2_write_access_granted+0x2f8/0x310 [ 157.060827][ T5613] ? jbd2_write_access_granted+0x71/0x310 [ 157.063028][ T5613] ocfs2_claim_metadata+0x16d/0x580 [ 157.065057][ T5613] ? jbd2__journal_start+0x3b8/0x5d0 [ 157.067097][ T5613] ? __pfx_ocfs2_claim_metadata+0x10/0x10 [ 157.069313][ T5613] ? __lock_acquire+0x137a/0x2040 [ 157.071268][ T5613] ? __pfx_ocfs2_start_trans+0x10/0x10 [ 157.073380][ T5613] ? ocfs2_metadata_cache_get_super+0x43/0x80 [ 157.075767][ T5613] ? ocfs2_inode_cache_get_super+0xd/0x40 [ 157.077957][ T5613] ocfs2_create_refcount_tree+0x699/0x15f0 [ 157.080268][ T5613] ? __pfx_ocfs2_create_refcount_tree+0x10/0x10 [ 157.082690][ T5613] ? __pfx_lock_release+0x10/0x10 [ 157.084639][ T5613] ? xas_find+0x213/0x960 [ 157.086308][ T5613] ? find_get_entries+0x19a/0x8c0 [ 157.088243][ T5613] ? find_get_entries+0x67c/0x8c0 [ 157.090198][ T5613] ? find_get_entries+0x19a/0x8c0 [ 157.092154][ T5613] ? __pfx_find_get_entries+0x10/0x10 [ 157.094212][ T5613] ocfs2_reflink_remap_blocks+0x2f6/0x1f30 [ 157.096496][ T5613] ? __pfx_ocfs2_reflink_remap_blocks+0x10/0x10 [ 157.098978][ T5613] ? __pfx_truncate_inode_pages_range+0x10/0x10 [ 157.101456][ T5613] ? down_write+0x18c/0x220 [ 157.103166][ T5613] ? __pfx_down_write+0x10/0x10 [ 157.105068][ T5613] ? generic_remap_file_range_prep+0x3e/0x60 [ 157.107358][ T5613] ocfs2_remap_file_range+0x600/0x8e0 [ 157.109546][ T5613] ? __pfx_ocfs2_remap_file_range+0x10/0x10 [ 157.111894][ T5613] ? rcu_read_lock_any_held+0xb7/0x160 [ 157.114056][ T5613] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 157.116359][ T5613] ? __pfx_ocfs2_remap_file_range+0x10/0x10 [ 157.118676][ T5613] vfs_copy_file_range+0xc1f/0x1530 [ 157.120721][ T5613] ? __pfx_vfs_copy_file_range+0x10/0x10 [ 157.122921][ T5613] ? __fget_files+0x3f6/0x470 [ 157.124766][ T5613] ? __might_fault+0xc6/0x120 [ 157.126584][ T5613] __se_sys_copy_file_range+0x3f2/0x5d0 [ 157.128676][ T5613] ? __pfx___se_sys_copy_file_range+0x10/0x10 [ 157.131017][ T5613] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 157.133489][ T5613] ? do_syscall_64+0x100/0x230 [ 157.135354][ T5613] ? __x64_sys_copy_file_range+0x21/0xf0 [ 157.137592][ T5613] do_syscall_64+0xf3/0x230 [ 157.139371][ T5613] ? clear_bhb_loop+0x35/0x90 [ 157.141227][ T5613] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 157.143508][ T5613] RIP: 0033:0x7f7f21d79e79 [ 157.145274][ T5613] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 157.152634][ T5613] RSP: 002b:00007f7f22bbf038 EFLAGS: 00000246 ORIG_RAX: 0000000000000146 [ 157.155888][ T5613] RAX: ffffffffffffffda RBX: 00007f7f21f15f80 RCX: 00007f7f21d79e79 [ 157.158949][ T5613] RDX: 0000000000000004 RSI: 0000000000000000 RDI: 0000000000000006 [ 157.162007][ T5613] RBP: 00007f7f21de7916 R08: 0000000000000006 R09: 0000000000000000 [ 157.165047][ T5613] R10: 00000000200000c0 R11: 0000000000000246 R12: 0000000000000000 [ 157.168134][ T5613] R13: 0000000000000000 R14: 00007f7f21f15f80 R15: 00007ffdfe2ff708 [ 157.171178][ T5613] [ 157.172392][ T5613] [ 157.173332][ T5613] Allocated by task 4792: [ 157.175023][ T5613] kasan_save_track+0x3f/0x80 [ 157.176861][ T5613] __kasan_slab_alloc+0x66/0x80 [ 157.178760][ T5613] kmem_cache_alloc_noprof+0x135/0x2a0 [ 157.180898][ T5613] alloc_empty_file+0x9e/0x1d0 [ 157.182756][ T5613] path_openat+0x105/0x3470 [ 157.184570][ T5613] do_filp_open+0x235/0x490 [ 157.186336][ T5613] alloc_bprm+0x171/0xda0 [ 157.188005][ T5613] do_execveat_common+0x18c/0x6f0 [ 157.189984][ T5613] __x64_sys_execve+0x92/0xb0 [ 157.191824][ T5613] do_syscall_64+0xf3/0x230 [ 157.193584][ T5613] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 157.195886][ T5613] [ 157.196790][ T5613] The buggy address belongs to the object at ffff88803fbac000 [ 157.196790][ T5613] which belongs to the cache filp of size 464 [ 157.201874][ T5613] The buggy address is located 0 bytes to the right of [ 157.201874][ T5613] allocated 464-byte region [ffff88803fbac000, ffff88803fbac1d0) [ 157.207292][ T5613] [ 157.208248][ T5613] The buggy address belongs to the physical page: [ 157.210725][ T5613] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3fbac [ 157.214110][ T5613] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 157.217442][ T5613] memcg:ffff88803d8c6881 [ 157.219106][ T5613] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 157.222079][ T5613] page_type: 0xfdffffff(slab) [ 157.223921][ T5613] raw: 04fff00000000040 ffff88801be91b40 ffffea0000d57900 dead000000000004 [ 157.227166][ T5613] raw: 0000000000000000 00000000000c000c 00000001fdffffff ffff88803d8c6881 [ 157.230349][ T5613] head: 04fff00000000040 ffff88801be91b40 ffffea0000d57900 dead000000000004 [ 157.233398][ T5613] head: 0000000000000000 00000000000c000c 00000001fdffffff ffff88803d8c6881 [ 157.236497][ T5613] head: 04fff00000000001 ffffea0000feeb01 ffffffffffffffff 0000000000000000 [ 157.239590][ T5613] head: ffff888000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 157.242931][ T5613] page dumped because: kasan: bad access detected [ 157.245305][ T5613] page_owner tracks the page as allocated [ 157.247319][ T5613] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4736, tgid 4736 (v4l_id), ts 47406042927, free_ts 47386534276 [ 157.255171][ T5613] post_alloc_hook+0x1f3/0x230 [ 157.256951][ T5613] get_page_from_freelist+0x2e4c/0x2f10 [ 157.258932][ T5613] __alloc_pages_noprof+0x256/0x6c0 [ 157.260880][ T5613] alloc_slab_page+0x5f/0x120 [ 157.262683][ T5613] allocate_slab+0x5a/0x2f0 [ 157.264477][ T5613] ___slab_alloc+0xcd1/0x14b0 [ 157.266280][ T5613] __slab_alloc+0x58/0xa0 [ 157.267983][ T5613] kmem_cache_alloc_noprof+0x1c1/0x2a0 [ 157.270076][ T5613] alloc_empty_file+0x9e/0x1d0 [ 157.272002][ T5613] path_openat+0x105/0x3470 [ 157.273800][ T5613] do_filp_open+0x235/0x490 [ 157.275556][ T5613] do_sys_openat2+0x13e/0x1d0 [ 157.277370][ T5613] __x64_sys_openat+0x247/0x2a0 [ 157.279253][ T5613] do_syscall_64+0xf3/0x230 [ 157.281042][ T5613] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 157.283302][ T5613] page last free pid 4731 tgid 4731 stack trace: [ 157.285750][ T5613] free_unref_page+0xd22/0xea0 [ 157.287678][ T5613] __mmdrop+0xb9/0x3d0 [ 157.289279][ T5613] finish_task_switch+0x304/0x870 [ 157.291228][ T5613] __schedule+0x1808/0x4a60 [ 157.293067][ T5613] preempt_schedule_common+0x84/0xd0 [ 157.295097][ T5613] preempt_schedule+0xe1/0xf0 [ 157.296937][ T5613] preempt_schedule_thunk+0x1a/0x30 [ 157.298955][ T5613] _raw_spin_unlock_irqrestore+0x130/0x140 [ 157.301276][ T5613] __wake_up_common_lock+0x18c/0x1e0 [ 157.303350][ T5613] pipe_write+0x128d/0x1a40 [ 157.305145][ T5613] vfs_write+0xa72/0xc90 [ 157.306807][ T5613] ksys_write+0x1a0/0x2c0 [ 157.308511][ T5613] do_syscall_64+0xf3/0x230 [ 157.310270][ T5613] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 157.312630][ T5613] [ 157.313574][ T5613] Memory state around the buggy address: [ 157.315756][ T5613] ffff88803fbac080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 157.318812][ T5613] ffff88803fbac100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 157.321895][ T5613] >ffff88803fbac180: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc [ 157.324969][ T5613] ^ [ 157.327496][ T5613] ffff88803fbac200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 157.330624][ T5613] ffff88803fbac280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 157.333668][ T5613] ================================================================== [ 157.622246][ T4533] Bluetooth: hci0: command tx timeout [ 157.742657][ T5613] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 157.745324][ T5613] CPU: 0 UID: 0 PID: 5613 Comm: syz.0.15 Not tainted 6.11.0-rc6-syzkaller-gc763c4339688 #0 [ 157.748974][ T5613] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 157.752994][ T5613] Call Trace: [ 157.754310][ T5613] [ 157.755461][ T5613] dump_stack_lvl+0x241/0x360 [ 157.757213][ T5613] ? __pfx_dump_stack_lvl+0x10/0x10 [ 157.759182][ T5613] ? __pfx__printk+0x10/0x10 [ 157.761029][ T5613] ? preempt_schedule+0xe1/0xf0 [ 157.762928][ T5613] ? vscnprintf+0x5d/0x90 [ 157.764626][ T5613] panic+0x349/0x860 [ 157.766171][ T5613] ? check_panic_on_warn+0x21/0xb0 [ 157.768192][ T5613] ? __pfx_panic+0x10/0x10 [ 157.769933][ T5613] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 157.772161][ T5613] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 157.774544][ T5613] ? print_report+0x502/0x550 [ 157.776398][ T5613] check_panic_on_warn+0x86/0xb0 [ 157.778376][ T5613] ? ocfs2_claim_suballoc_bits+0x1099/0x2570 [ 157.780686][ T5613] end_report+0x77/0x160 [ 157.782262][ T5613] kasan_report+0x154/0x180 [ 157.784025][ T5613] ? ocfs2_claim_suballoc_bits+0x1099/0x2570 [ 157.786250][ T5613] ocfs2_claim_suballoc_bits+0x1099/0x2570 [ 157.788464][ T5613] ? __pfx_lock_release+0x10/0x10 [ 157.790439][ T5613] ? __pfx_ocfs2_claim_suballoc_bits+0x10/0x10 [ 157.792860][ T5613] ? jbd2_write_access_granted+0x71/0x310 [ 157.795450][ T5613] ? __mutex_lock+0x2ef/0xd70 [ 157.797639][ T5613] ? __mutex_unlock_slowpath+0x21d/0x750 [ 157.800138][ T5613] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 157.802720][ T5613] ? jbd2_write_access_granted+0x71/0x310 [ 157.805321][ T5613] ? jbd2_write_access_granted+0x2f8/0x310 [ 157.807907][ T5613] ? jbd2_write_access_granted+0x71/0x310 [ 157.810204][ T5613] ocfs2_claim_metadata+0x16d/0x580 [ 157.812266][ T5613] ? jbd2__journal_start+0x3b8/0x5d0 [ 157.814229][ T5613] ? __pfx_ocfs2_claim_metadata+0x10/0x10 [ 157.816317][ T5613] ? __lock_acquire+0x137a/0x2040 [ 157.818231][ T5613] ? __pfx_ocfs2_start_trans+0x10/0x10 [ 157.820368][ T5613] ? ocfs2_metadata_cache_get_super+0x43/0x80 [ 157.822683][ T5613] ? ocfs2_inode_cache_get_super+0xd/0x40 [ 157.824912][ T5613] ocfs2_create_refcount_tree+0x699/0x15f0 [ 157.827084][ T5613] ? __pfx_ocfs2_create_refcount_tree+0x10/0x10 [ 157.829558][ T5613] ? __pfx_lock_release+0x10/0x10 [ 157.831484][ T5613] ? xas_find+0x213/0x960 [ 157.833128][ T5613] ? find_get_entries+0x19a/0x8c0 [ 157.835038][ T5613] ? find_get_entries+0x67c/0x8c0 [ 157.836960][ T5613] ? find_get_entries+0x19a/0x8c0 [ 157.838869][ T5613] ? __pfx_find_get_entries+0x10/0x10 [ 157.840944][ T5613] ocfs2_reflink_remap_blocks+0x2f6/0x1f30 [ 157.843123][ T5613] ? __pfx_ocfs2_reflink_remap_blocks+0x10/0x10 [ 157.845443][ T5613] ? __pfx_truncate_inode_pages_range+0x10/0x10 [ 157.847792][ T5613] ? down_write+0x18c/0x220 [ 157.849571][ T5613] ? __pfx_down_write+0x10/0x10 [ 157.851370][ T5613] ? generic_remap_file_range_prep+0x3e/0x60 [ 157.853546][ T5613] ocfs2_remap_file_range+0x600/0x8e0 [ 157.855500][ T5613] ? __pfx_ocfs2_remap_file_range+0x10/0x10 [ 157.857751][ T5613] ? rcu_read_lock_any_held+0xb7/0x160 [ 157.859868][ T5613] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 157.861981][ T5613] ? __pfx_ocfs2_remap_file_range+0x10/0x10 [ 157.864340][ T5613] vfs_copy_file_range+0xc1f/0x1530 [ 157.866407][ T5613] ? __pfx_vfs_copy_file_range+0x10/0x10 [ 157.868569][ T5613] ? __fget_files+0x3f6/0x470 [ 157.870352][ T5613] ? __might_fault+0xc6/0x120 [ 157.872135][ T5613] __se_sys_copy_file_range+0x3f2/0x5d0 [ 157.874209][ T5613] ? __pfx___se_sys_copy_file_range+0x10/0x10 [ 157.876527][ T5613] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 157.878903][ T5613] ? do_syscall_64+0x100/0x230 [ 157.880790][ T5613] ? __x64_sys_copy_file_range+0x21/0xf0 [ 157.882887][ T5613] do_syscall_64+0xf3/0x230 [ 157.884749][ T5613] ? clear_bhb_loop+0x35/0x90 [ 157.886548][ T5613] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 157.888846][ T5613] RIP: 0033:0x7f7f21d79e79 [ 157.890556][ T5613] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 157.897699][ T5613] RSP: 002b:00007f7f22bbf038 EFLAGS: 00000246 ORIG_RAX: 0000000000000146 [ 157.900774][ T5613] RAX: ffffffffffffffda RBX: 00007f7f21f15f80 RCX: 00007f7f21d79e79 [ 157.903767][ T5613] RDX: 0000000000000004 RSI: 0000000000000000 RDI: 0000000000000006 [ 157.906742][ T5613] RBP: 00007f7f21de7916 R08: 0000000000000006 R09: 0000000000000000 [ 157.909691][ T5613] R10: 00000000200000c0 R11: 0000000000000246 R12: 0000000000000000 [ 157.912604][ T5613] R13: 0000000000000000 R14: 00007f7f21f15f80 R15: 00007ffdfe2ff708 [ 157.915637][ T5613] [ 157.917078][ T5613] Kernel Offset: disabled [ 157.918680][ T5613] Rebooting in 86400 seconds..