Warning: Permanently added '10.128.0.2' (ED25519) to the list of known hosts. 2026/01/17 08:07:36 parsed 1 programs [ 45.454180][ T24] kauditd_printk_skb: 30 callbacks suppressed [ 45.454193][ T24] audit: type=1400 audit(1768637257.670:104): avc: denied { unlink } for pid=409 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 45.609619][ T409] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 46.060193][ T24] audit: type=1400 audit(1768637258.280:105): avc: denied { create } for pid=418 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 46.238030][ T24] audit: type=1401 audit(1768637258.460:106): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 46.417526][ T441] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.424590][ T441] bridge0: port 1(bridge_slave_0) entered disabled state [ 46.432586][ T441] device bridge_slave_0 entered promiscuous mode [ 46.440126][ T441] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.447233][ T441] bridge0: port 2(bridge_slave_1) entered disabled state [ 46.454580][ T441] device bridge_slave_1 entered promiscuous mode [ 46.490170][ T441] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.497381][ T441] bridge0: port 2(bridge_slave_1) entered forwarding state [ 46.504752][ T441] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.511989][ T441] bridge0: port 1(bridge_slave_0) entered forwarding state [ 46.531128][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 46.538808][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 46.546644][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 46.555507][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 46.563868][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.571026][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 46.580480][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 46.588660][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.595925][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 46.608271][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 46.618346][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 46.633833][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 46.644661][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 46.653223][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 46.660999][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 46.669463][ T441] device veth0_vlan entered promiscuous mode [ 46.679764][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 46.689278][ T441] device veth1_macvtap entered promiscuous mode [ 46.698837][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 46.708870][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/01/17 08:07:39 executed programs: 0 [ 47.091285][ T24] audit: type=1400 audit(1768637259.310:107): avc: denied { write } for pid=401 comm="syz-execprog" path="pipe:[14963]" dev="pipefs" ino=14963 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 47.154456][ T467] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.161808][ T467] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.169460][ T467] device bridge_slave_0 entered promiscuous mode [ 47.176619][ T467] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.183750][ T467] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.191485][ T467] device bridge_slave_1 entered promiscuous mode [ 47.237187][ T467] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.244250][ T467] bridge0: port 2(bridge_slave_1) entered forwarding state [ 47.251659][ T467] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.258836][ T467] bridge0: port 1(bridge_slave_0) entered forwarding state [ 47.282531][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 47.290433][ T308] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.298492][ T308] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.315299][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 47.324291][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 47.333446][ T308] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.340540][ T308] bridge0: port 1(bridge_slave_0) entered forwarding state [ 47.348626][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 47.357884][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 47.366157][ T308] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.373221][ T308] bridge0: port 2(bridge_slave_1) entered forwarding state [ 47.380786][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 47.389437][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 47.397638][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 47.405763][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 47.424253][ T467] device veth0_vlan entered promiscuous mode [ 47.431281][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 47.440385][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 47.448988][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 47.457239][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 47.465725][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 47.473223][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 47.486465][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 47.494741][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 47.504328][ T467] device veth1_macvtap entered promiscuous mode [ 47.513402][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 47.521280][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 47.529883][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 47.539762][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 47.548156][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 47.707164][ T473] F2FS-fs (loop2): fault_injection options not supported [ 47.716025][ T473] F2FS-fs (loop2): invalid crc value [ 47.723050][ T473] F2FS-fs (loop2): Found nat_bits in checkpoint [ 47.757283][ T473] F2FS-fs (loop2): Start checkpoint disabled! [ 47.764430][ T473] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 47.772442][ T24] audit: type=1400 audit(1768637259.990:108): avc: denied { mount } for pid=472 comm="syz.2.16" name="/" dev="loop2" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 47.805181][ T24] audit: type=1400 audit(1768637259.990:109): avc: denied { write } for pid=472 comm="syz.2.16" name="/" dev="loop2" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 47.827218][ T24] audit: type=1400 audit(1768637259.990:110): avc: denied { add_name } for pid=472 comm="syz.2.16" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 47.848495][ T24] audit: type=1400 audit(1768637259.990:111): avc: denied { create } for pid=472 comm="syz.2.16" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 47.869475][ T24] audit: type=1400 audit(1768637260.000:112): avc: denied { write open } for pid=472 comm="syz.2.16" path="/0/file0/file0" dev="loop2" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 47.892636][ T24] audit: type=1400 audit(1768637260.000:113): avc: denied { ioctl } for pid=472 comm="syz.2.16" path="/0/file0/file0" dev="loop2" ino=10 ioctlcmd=0xf50d scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 47.917255][ T473] ------------[ cut here ]------------ [ 47.922884][ T473] WARNING: CPU: 0 PID: 473 at fs/f2fs/segment.c:2582 new_curseg+0xe4f/0x1880 [ 47.931821][ T473] Modules linked in: [ 47.935954][ T473] CPU: 0 PID: 473 Comm: syz.2.16 Not tainted syzkaller #0 [ 47.943077][ T473] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 47.953271][ T473] RIP: 0010:new_curseg+0xe4f/0x1880 [ 47.958524][ T473] Code: 0b 4c 8b bd 30 ff ff ff 4c 89 ff be 08 00 00 00 e8 66 d0 91 ff f0 41 80 0f 04 41 b5 01 45 89 f7 e9 4d fb ff ff e8 f1 51 57 ff <0f> 0b 4c 8b a5 30 ff ff ff 4c 89 e7 be 08 00 00 00 e8 3b d0 91 ff [ 47.978205][ T473] RSP: 0018:ffffc90000d27718 EFLAGS: 00010293 [ 47.984288][ T473] RAX: ffffffff820d625f RBX: ffff888113b52658 RCX: ffff88811769a780 [ 47.992337][ T473] RDX: 0000000000000000 RSI: 0000000000000018 RDI: 0000000000000018 [ 48.000464][ T473] RBP: ffffc90000d27808 R08: 0000000000000003 R09: 0000000000000004 [ 48.008608][ T473] R10: dffffc0000000000 R11: fffff520001a4ed4 R12: 0000000000000018 [ 48.016720][ T473] R13: 1ffff1102276a4cb R14: 0000000000000018 R15: 000000000000000a [ 48.024712][ T473] FS: 00007fcf839a76c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 48.033686][ T473] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 48.040382][ T473] CR2: 00007f2e82575000 CR3: 000000012aafd000 CR4: 00000000003506b0 [ 48.048609][ T473] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 48.056738][ T473] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 48.064740][ T473] Call Trace: [ 48.068110][ T473] __allocate_new_segment+0x13d/0x810 [ 48.073530][ T473] f2fs_allocate_new_section+0x1f3/0x290 [ 48.079302][ T473] ? new_curseg+0x1880/0x1880 [ 48.084013][ T473] ? __kasan_check_write+0x14/0x20 [ 48.089177][ T473] ? down_read_trylock+0x106/0x160 [ 48.094395][ T473] ? __init_rwsem+0x1c0/0x1c0 [ 48.099156][ T473] ? has_not_enough_free_secs+0x3d7/0x8a0 [ 48.104889][ T473] expand_inode_data+0x5f7/0x9a0 [ 48.109885][ T473] ? f2fs_insert_range+0x5d0/0x5d0 [ 48.115119][ T473] ? inode_dio_wait+0x25a/0x2d0 [ 48.120012][ T473] ? file_update_time+0x3d7/0x440 [ 48.125151][ T473] ? inode_owner_or_capable+0x140/0x140 [ 48.130771][ T473] f2fs_fallocate+0x42b/0x7e0 [ 48.135494][ T473] vfs_fallocate+0x4b4/0x590 [ 48.140309][ T473] do_vfs_ioctl+0x1154/0x14c0 [ 48.145004][ T473] ? __ia32_compat_sys_ioctl+0x8e0/0x8e0 [ 48.150700][ T473] ? has_cap_mac_admin+0x370/0x370 [ 48.155905][ T473] ? kmem_cache_free+0x100/0x2d0 [ 48.160972][ T473] ? selinux_file_ioctl+0x3a0/0x4d0 [ 48.166214][ T473] ? putname+0xfe/0x150 [ 48.170392][ T473] ? selinux_file_alloc_security+0x120/0x120 [ 48.176511][ T473] ? do_sys_openat2+0x68e/0x750 [ 48.181366][ T473] ? __fget_files+0x2c4/0x320 [ 48.186157][ T473] ? security_file_ioctl+0x84/0xa0 [ 48.191280][ T473] __se_sys_ioctl+0x9f/0x1a0 [ 48.195947][ T473] __x64_sys_ioctl+0x7b/0x90 [ 48.200557][ T473] do_syscall_64+0x31/0x40 [ 48.204975][ T473] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 48.210927][ T473] RIP: 0033:0x7fcf83f3f8f9 [ 48.215365][ T473] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 48.235115][ T473] RSP: 002b:00007fcf839a7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 48.243621][ T473] RAX: ffffffffffffffda RBX: 00007fcf8416dfa0 RCX: 00007fcf83f3f8f9 [ 48.251784][ T473] RDX: 00002000000000c0 RSI: 0000000040305828 RDI: 0000000000000005 [ 48.260238][ T473] RBP: 00007fcf83fd11bc R08: 0000000000000000 R09: 0000000000000000 [ 48.268379][ T473] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 48.276420][ T473] R13: 0000000000000000 R14: 00007fcf8416dfa0 R15: 00007ffc576a51e8 [ 48.284402][ T473] ---[ end trace 7f4446a1961f83ca ]--- [ 48.289999][ T473] ------------[ cut here ]------------ [ 48.295481][ T473] WARNING: CPU: 0 PID: 473 at fs/f2fs/segment.c:2636 new_curseg+0x14a6/0x1880 [ 48.304364][ T473] Modules linked in: [ 48.308420][ T473] CPU: 0 PID: 473 Comm: syz.2.16 Tainted: G W syzkaller #0 [ 48.316958][ T473] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 48.327598][ T473] RIP: 0010:new_curseg+0x14a6/0x1880 [ 48.332902][ T473] Code: ff e8 be 4b 57 ff 0f 0b 4c 8b 75 d0 49 8d 7e 78 be 08 00 00 00 e8 0a ca 91 ff f0 41 80 4e 78 04 e9 d4 ed ff ff e8 9a 4b 57 ff <0f> 0b 48 8b 5d d0 48 8d 7b 78 be 08 00 00 00 e8 e6 c9 91 ff f0 80 [ 48.352688][ T473] RSP: 0018:ffffc90000d27718 EFLAGS: 00010293 [ 48.358883][ T473] RAX: ffffffff820d68b6 RBX: ffff88810ccbb801 RCX: ffff88811769a780 [ 48.367015][ T473] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 [ 48.375076][ T473] RBP: ffffc90000d27808 R08: ffff88810ccbb8c7 R09: 1ffff11021997718 [ 48.383133][ T473] R10: dffffc0000000000 R11: ffffed1021997719 R12: 0000000000000000 [ 48.391186][ T473] R13: 0000000000000018 R14: 0000000000000001 R15: 0000000000000018 [ 48.399206][ T473] FS: 00007fcf839a76c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 48.408340][ T473] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 48.415100][ T473] CR2: 00007f2e82575000 CR3: 000000012aafd000 CR4: 00000000003506b0 [ 48.423199][ T473] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 48.431246][ T473] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 48.439265][ T473] Call Trace: [ 48.442583][ T473] __allocate_new_segment+0x13d/0x810 [ 48.448101][ T473] f2fs_allocate_new_section+0x1f3/0x290 [ 48.453744][ T473] ? new_curseg+0x1880/0x1880 [ 48.458496][ T473] ? __kasan_check_write+0x14/0x20 [ 48.463648][ T473] ? down_read_trylock+0x106/0x160 [ 48.468811][ T473] ? __init_rwsem+0x1c0/0x1c0 [ 48.473514][ T473] ? has_not_enough_free_secs+0x3d7/0x8a0 [ 48.479282][ T473] expand_inode_data+0x5f7/0x9a0 [ 48.484236][ T473] ? f2fs_insert_range+0x5d0/0x5d0 [ 48.489416][ T473] ? inode_dio_wait+0x25a/0x2d0 [ 48.494283][ T473] ? file_update_time+0x3d7/0x440 [ 48.499390][ T473] ? inode_owner_or_capable+0x140/0x140 [ 48.504956][ T473] f2fs_fallocate+0x42b/0x7e0 [ 48.509690][ T473] vfs_fallocate+0x4b4/0x590 [ 48.514449][ T473] do_vfs_ioctl+0x1154/0x14c0 [ 48.519211][ T473] ? __ia32_compat_sys_ioctl+0x8e0/0x8e0 [ 48.525141][ T473] ? has_cap_mac_admin+0x370/0x370 [ 48.530338][ T473] ? kmem_cache_free+0x100/0x2d0 [ 48.535443][ T473] ? selinux_file_ioctl+0x3a0/0x4d0 [ 48.540746][ T473] ? putname+0xfe/0x150 [ 48.544939][ T473] ? selinux_file_alloc_security+0x120/0x120 [ 48.551219][ T473] ? do_sys_openat2+0x68e/0x750 [ 48.556150][ T473] ? __fget_files+0x2c4/0x320 [ 48.560839][ T473] ? security_file_ioctl+0x84/0xa0 [ 48.566003][ T473] __se_sys_ioctl+0x9f/0x1a0 [ 48.570620][ T473] __x64_sys_ioctl+0x7b/0x90 [ 48.575225][ T473] do_syscall_64+0x31/0x40 [ 48.579769][ T473] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 48.585718][ T473] RIP: 0033:0x7fcf83f3f8f9 [ 48.590145][ T473] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 48.609833][ T473] RSP: 002b:00007fcf839a7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 48.618321][ T473] RAX: ffffffffffffffda RBX: 00007fcf8416dfa0 RCX: 00007fcf83f3f8f9 [ 48.626359][ T473] RDX: 00002000000000c0 RSI: 0000000040305828 RDI: 0000000000000005 [ 48.634354][ T473] RBP: 00007fcf83fd11bc R08: 0000000000000000 R09: 0000000000000000 [ 48.642390][ T473] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 48.650651][ T473] R13: 0000000000000000 R14: 00007fcf8416dfa0 R15: 00007ffc576a51e8 [ 48.658927][ T473] ---[ end trace 7f4446a1961f83cb ]--- [ 48.672205][ T473] ================================================================== [ 48.680423][ T473] BUG: KASAN: slab-out-of-bounds in reset_curseg+0x4dd/0x560 [ 48.687910][ T473] Read of size 4 at addr ffff888117509bc0 by task syz.2.16/473 [ 48.695459][ T473] [ 48.697854][ T473] CPU: 0 PID: 473 Comm: syz.2.16 Tainted: G W syzkaller #0 [ 48.706526][ T473] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 48.716666][ T473] Call Trace: [ 48.719962][ T473] __dump_stack+0x21/0x24 [ 48.724290][ T473] dump_stack_lvl+0x1a7/0x208 [ 48.728964][ T473] ? show_regs_print_info+0x18/0x18 [ 48.734169][ T473] ? thaw_kernel_threads+0x220/0x220 [ 48.739474][ T473] print_address_description+0x7f/0x2c0 [ 48.745014][ T473] ? reset_curseg+0x4dd/0x560 [ 48.749692][ T473] kasan_report+0xe2/0x130 [ 48.754103][ T473] ? reset_curseg+0x4dd/0x560 [ 48.758777][ T473] __asan_report_load4_noabort+0x14/0x20 [ 48.764422][ T473] reset_curseg+0x4dd/0x560 [ 48.768941][ T473] new_curseg+0x12e8/0x1880 [ 48.773453][ T473] __allocate_new_segment+0x13d/0x810 [ 48.778915][ T473] f2fs_allocate_new_section+0x1f3/0x290 [ 48.784578][ T473] ? new_curseg+0x1880/0x1880 [ 48.789269][ T473] ? __kasan_check_write+0x14/0x20 [ 48.794396][ T473] ? down_read_trylock+0x106/0x160 [ 48.799511][ T473] ? __init_rwsem+0x1c0/0x1c0 [ 48.804188][ T473] ? has_not_enough_free_secs+0x3d7/0x8a0 [ 48.809902][ T473] expand_inode_data+0x5f7/0x9a0 [ 48.814868][ T473] ? f2fs_insert_range+0x5d0/0x5d0 [ 48.819974][ T473] ? inode_dio_wait+0x25a/0x2d0 [ 48.824819][ T473] ? file_update_time+0x3d7/0x440 [ 48.829985][ T473] ? inode_owner_or_capable+0x140/0x140 [ 48.835672][ T473] f2fs_fallocate+0x42b/0x7e0 [ 48.840353][ T473] vfs_fallocate+0x4b4/0x590 [ 48.844956][ T473] do_vfs_ioctl+0x1154/0x14c0 [ 48.849653][ T473] ? __ia32_compat_sys_ioctl+0x8e0/0x8e0 [ 48.855284][ T473] ? has_cap_mac_admin+0x370/0x370 [ 48.860391][ T473] ? kmem_cache_free+0x100/0x2d0 [ 48.865333][ T473] ? selinux_file_ioctl+0x3a0/0x4d0 [ 48.870526][ T473] ? putname+0xfe/0x150 [ 48.874678][ T473] ? selinux_file_alloc_security+0x120/0x120 [ 48.880667][ T473] ? do_sys_openat2+0x68e/0x750 [ 48.885621][ T473] ? __fget_files+0x2c4/0x320 [ 48.890386][ T473] ? security_file_ioctl+0x84/0xa0 [ 48.895496][ T473] __se_sys_ioctl+0x9f/0x1a0 [ 48.900082][ T473] __x64_sys_ioctl+0x7b/0x90 [ 48.904687][ T473] do_syscall_64+0x31/0x40 [ 48.909099][ T473] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 48.914988][ T473] RIP: 0033:0x7fcf83f3f8f9 [ 48.919416][ T473] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 48.939020][ T473] RSP: 002b:00007fcf839a7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 48.947454][ T473] RAX: ffffffffffffffda RBX: 00007fcf8416dfa0 RCX: 00007fcf83f3f8f9 [ 48.955509][ T473] RDX: 00002000000000c0 RSI: 0000000040305828 RDI: 0000000000000005 [ 48.963495][ T473] RBP: 00007fcf83fd11bc R08: 0000000000000000 R09: 0000000000000000 [ 48.971473][ T473] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 48.979449][ T473] R13: 0000000000000000 R14: 00007fcf8416dfa0 R15: 00007ffc576a51e8 [ 48.987519][ T473] [ 48.989852][ T473] Allocated by task 473: [ 48.994125][ T473] __kasan_kmalloc+0xda/0x110 [ 48.998818][ T473] __kmalloc+0x1a4/0x330 [ 49.003062][ T473] kvmalloc_node+0x88/0x130 [ 49.007579][ T473] f2fs_build_segment_manager+0xdba/0x4900 [ 49.013385][ T473] f2fs_fill_super+0x4a4a/0x72e0 [ 49.018427][ T473] mount_bdev+0x28b/0x3a0 [ 49.022768][ T473] f2fs_mount+0x34/0x40 [ 49.026945][ T473] legacy_get_tree+0xed/0x190 [ 49.031623][ T473] vfs_get_tree+0x89/0x260 [ 49.036090][ T473] do_new_mount+0x25a/0xa20 [ 49.040612][ T473] path_mount+0x585/0xc90 [ 49.044951][ T473] __se_sys_mount+0x320/0x390 [ 49.049637][ T473] __x64_sys_mount+0xbf/0xd0 [ 49.054237][ T473] do_syscall_64+0x31/0x40 [ 49.058657][ T473] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 49.064558][ T473] [ 49.066902][ T473] The buggy address belongs to the object at ffff888117509800 [ 49.066902][ T473] which belongs to the cache kmalloc-1k of size 1024 [ 49.080962][ T473] The buggy address is located 960 bytes inside of [ 49.080962][ T473] 1024-byte region [ffff888117509800, ffff888117509c00) [ 49.094323][ T473] The buggy address belongs to the page: [ 49.099985][ T473] page:ffffea00045d4200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x117508 [ 49.110222][ T473] head:ffffea00045d4200 order:3 compound_mapcount:0 compound_pincount:0 [ 49.118993][ T473] flags: 0x4000000000010200(slab|head) [ 49.124461][ T473] raw: 4000000000010200 ffffea00045cf600 0000000300000003 ffff888100042f00 [ 49.133050][ T473] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 49.141632][ T473] page dumped because: kasan: bad access detected [ 49.148042][ T473] page_owner tracks the page as allocated [ 49.153768][ T473] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 95, ts 6065390657, free_ts 0 [ 49.171747][ T473] prep_new_page+0x179/0x180 [ 49.176346][ T473] get_page_from_freelist+0x223b/0x23d0 [ 49.181897][ T473] __alloc_pages_nodemask+0x290/0x620 [ 49.187359][ T473] new_slab+0x84/0x3f0 [ 49.191550][ T473] ___slab_alloc+0x2a6/0x450 [ 49.196163][ T473] __slab_alloc+0x63/0xa0 [ 49.200503][ T473] __kmalloc_track_caller+0x1ec/0x320 [ 49.205880][ T473] __alloc_skb+0xdc/0x520 [ 49.210469][ T473] netlink_sendmsg+0x605/0xb50 [ 49.215247][ T473] ____sys_sendmsg+0x5b7/0x8f0 [ 49.220366][ T473] ___sys_sendmsg+0x236/0x2e0 [ 49.225056][ T473] __x64_sys_sendmsg+0x1f9/0x2c0 [ 49.230274][ T473] do_syscall_64+0x31/0x40 [ 49.234692][ T473] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 49.240580][ T473] page_owner free stack trace missing [ 49.245952][ T473] [ 49.248305][ T473] Memory state around the buggy address: [ 49.253950][ T473] ffff888117509a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 49.262099][ T473] ffff888117509b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 49.270161][ T473] >ffff888117509b80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 49.278226][ T473] ^ [ 49.284464][ T473] ffff888117509c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 49.292524][ T473] ffff888117509c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 49.300764][ T473] ================================================================== [ 49.308850][ T473] Disabling lock debugging due to kernel taint [ 49.316779][ T473] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN [ 49.328592][ T473] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 49.337036][ T473] CPU: 0 PID: 473 Comm: syz.2.16 Tainted: G B W syzkaller #0 [ 49.345558][ T473] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 49.355656][ T473] RIP: 0010:update_sit_entry+0x3eb/0xf50 [ 49.361326][ T473] Code: 89 45 a8 49 01 c5 41 f6 d7 41 80 e7 07 44 89 f9 41 bf 01 00 00 00 41 d3 e7 4d 89 ee 49 c1 ee 03 48 b8 00 00 00 00 00 fc ff df <41> 0f b6 04 06 84 c0 0f 85 a5 08 00 00 41 0f b6 5d 00 44 89 f8 41 [ 49.381062][ T473] RSP: 0018:ffffc90000d27330 EFLAGS: 00010246 [ 49.387240][ T473] RAX: dffffc0000000000 RBX: ffff888117509bc8 RCX: 0000000000000007 [ 49.395401][ T473] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888117509bc8 [ 49.403385][ T473] RBP: ffffc90000d273b0 R08: ffff88811769a780 R09: 0000000000000003 [ 49.411363][ T473] R10: 00000000ffffffff R11: 0000000000000000 R12: 0000000000004000 [ 49.419345][ T473] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000080 [ 49.427327][ T473] FS: 00007fcf839a76c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 49.436267][ T473] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 49.442860][ T473] CR2: 00007f2e82575000 CR3: 000000012aafd000 CR4: 00000000003506b0 [ 49.450845][ T473] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 49.458910][ T473] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 49.467248][ T473] Call Trace: [ 49.470557][ T473] ? __asan_report_store8_noabort+0x17/0x20 [ 49.476459][ T473] f2fs_allocate_data_block+0x159c/0x3a20 [ 49.482187][ T473] ? _raw_spin_trylock_bh+0x150/0x150 [ 49.487561][ T473] ? __dquot_alloc_space+0x2bd/0xb80 [ 49.492942][ T473] ? _raw_spin_unlock+0x4d/0x70 [ 49.497812][ T473] ? f2fs_inode_dirtied+0x26b/0x2a0 [ 49.503591][ T473] ? f2fs_io_type_to_rw_hint+0x1e0/0x1e0 [ 49.509320][ T473] ? f2fs_mark_inode_dirty_sync+0x110/0x140 [ 49.515304][ T473] ? inc_valid_block_count+0x562/0xa90 [ 49.520771][ T473] __allocate_data_block+0x553/0x9d0 [ 49.526162][ T473] ? f2fs_map_blocks+0x35a0/0x35a0 [ 49.531282][ T473] f2fs_map_blocks+0xda4/0x35a0 [ 49.536165][ T473] ? __kasan_check_write+0x14/0x20 [ 49.541382][ T473] ? f2fs_do_map_lock+0x2e0/0x2e0 [ 49.546407][ T473] ? __kasan_check_write+0x14/0x20 [ 49.551523][ T473] ? down_read_trylock+0x106/0x160 [ 49.556728][ T473] expand_inode_data+0x626/0x9a0 [ 49.561686][ T473] ? f2fs_insert_range+0x5d0/0x5d0 [ 49.566980][ T473] ? inode_dio_wait+0x25a/0x2d0 [ 49.571850][ T473] ? file_update_time+0x3d7/0x440 [ 49.576885][ T473] ? inode_owner_or_capable+0x140/0x140 [ 49.582526][ T473] f2fs_fallocate+0x42b/0x7e0 [ 49.587240][ T473] vfs_fallocate+0x4b4/0x590 [ 49.591894][ T473] do_vfs_ioctl+0x1154/0x14c0 [ 49.596662][ T473] ? __ia32_compat_sys_ioctl+0x8e0/0x8e0 [ 49.602304][ T473] ? has_cap_mac_admin+0x370/0x370 [ 49.607421][ T473] ? kmem_cache_free+0x100/0x2d0 [ 49.612371][ T473] ? selinux_file_ioctl+0x3a0/0x4d0 [ 49.617575][ T473] ? putname+0xfe/0x150 [ 49.621767][ T473] ? selinux_file_alloc_security+0x120/0x120 [ 49.627775][ T473] ? do_sys_openat2+0x68e/0x750 [ 49.632652][ T473] ? __fget_files+0x2c4/0x320 [ 49.637463][ T473] ? security_file_ioctl+0x84/0xa0 [ 49.642750][ T473] __se_sys_ioctl+0x9f/0x1a0 [ 49.647356][ T473] __x64_sys_ioctl+0x7b/0x90 [ 49.652127][ T473] do_syscall_64+0x31/0x40 [ 49.656589][ T473] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 49.662504][ T473] RIP: 0033:0x7fcf83f3f8f9 [ 49.666928][ T473] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 49.686721][ T473] RSP: 002b:00007fcf839a7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 49.695139][ T473] RAX: ffffffffffffffda RBX: 00007fcf8416dfa0 RCX: 00007fcf83f3f8f9 [ 49.703303][ T473] RDX: 00002000000000c0 RSI: 0000000040305828 RDI: 0000000000000005 [ 49.711287][ T473] RBP: 00007fcf83fd11bc R08: 0000000000000000 R09: 0000000000000000 [ 49.719258][ T473] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 49.727244][ T473] R13: 0000000000000000 R14: 00007fcf8416dfa0 R15: 00007ffc576a51e8 [ 49.735326][ T473] Modules linked in: [ 49.740902][ T473] ---[ end trace 7f4446a1961f83cc ]--- [ 49.747106][ T473] RIP: 0010:update_sit_entry+0x3eb/0xf50 [ 49.753193][ T473] Code: 89 45 a8 49 01 c5 41 f6 d7 41 80 e7 07 44 89 f9 41 bf 01 00 00 00 41 d3 e7 4d 89 ee 49 c1 ee 03 48 b8 00 00 00 00 00 fc ff df <41> 0f b6 04 06 84 c0 0f 85 a5 08 00 00 41 0f b6 5d 00 44 89 f8 41 [ 49.773294][ T473] RSP: 0018:ffffc90000d27330 EFLAGS: 00010246 [ 49.779557][ T473] RAX: dffffc0000000000 RBX: ffff888117509bc8 RCX: 0000000000000007 [ 49.787711][ T473] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888117509bc8 [ 49.795938][ T473] RBP: ffffc90000d273b0 R08: ffff88811769a780 R09: 0000000000000003 [ 49.805783][ T473] R10: 00000000ffffffff R11: 0000000000000000 R12: 0000000000004000 [ 49.813878][ T473] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000080 [ 49.822442][ T473] FS: 00007fcf839a76c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 49.831529][ T473] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 49.838346][ T473] CR2: 00007f2e82575000 CR3: 000000012aafd000 CR4: 00000000003506b0 [ 49.846418][ T473] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 49.854414][ T473] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 49.862461][ T473] Kernel panic - not syncing: Fatal exception [ 49.868795][ T473] Kernel Offset: disabled [ 49.873221][ T473] Rebooting in 86400 seconds..