Warning: Permanently added '[localhost]:62229' (ED25519) to the list of known hosts. 2025/09/19 14:05:38 parsed 1 programs [ 138.063296][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 138.066280][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 138.450765][ T5598] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 142.835868][ T4707] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 142.841675][ T4707] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 142.845405][ T4707] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 142.852971][ T4707] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 142.856862][ T4707] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 146.144923][ T5670] chnl_net:caif_netlink_parms(): no params data found [ 146.211721][ T5670] bridge0: port 1(bridge_slave_0) entered blocking state [ 146.215341][ T5670] bridge0: port 1(bridge_slave_0) entered disabled state [ 146.218642][ T5670] bridge_slave_0: entered allmulticast mode [ 146.223003][ T5670] bridge_slave_0: entered promiscuous mode [ 146.228612][ T5670] bridge0: port 2(bridge_slave_1) entered blocking state [ 146.233486][ T5670] bridge0: port 2(bridge_slave_1) entered disabled state [ 146.236753][ T5670] bridge_slave_1: entered allmulticast mode [ 146.241288][ T5670] bridge_slave_1: entered promiscuous mode [ 146.266343][ T5670] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 146.275346][ T5670] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 146.300271][ T5670] team0: Port device team_slave_0 added [ 146.305741][ T5670] team0: Port device team_slave_1 added [ 146.327580][ T5670] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 146.332204][ T5670] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 146.344125][ T5670] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 146.353308][ T5670] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 146.356231][ T5670] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 146.367399][ T5670] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 146.404116][ T5670] hsr_slave_0: entered promiscuous mode [ 146.407275][ T5670] hsr_slave_1: entered promiscuous mode [ 146.952115][ T5670] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 146.970590][ T5670] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 146.980807][ T5670] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 146.995469][ T5670] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 147.053989][ T5670] bridge0: port 2(bridge_slave_1) entered blocking state [ 147.057038][ T5670] bridge0: port 2(bridge_slave_1) entered forwarding state [ 147.060564][ T5670] bridge0: port 1(bridge_slave_0) entered blocking state [ 147.063733][ T5670] bridge0: port 1(bridge_slave_0) entered forwarding state [ 147.102700][ T71] bridge0: port 1(bridge_slave_0) entered disabled state [ 147.106654][ T71] bridge0: port 2(bridge_slave_1) entered disabled state [ 147.195274][ T5670] 8021q: adding VLAN 0 to HW filter on device bond0 [ 147.232271][ T5670] 8021q: adding VLAN 0 to HW filter on device team0 [ 147.281664][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 147.285077][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 147.290901][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 147.294334][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 147.673085][ T5670] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 147.745763][ T5670] veth0_vlan: entered promiscuous mode [ 147.766723][ T5670] veth1_vlan: entered promiscuous mode [ 147.833036][ T5670] veth0_macvtap: entered promiscuous mode [ 147.838335][ T5670] veth1_macvtap: entered promiscuous mode [ 147.879166][ T5670] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 147.907379][ T5670] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 147.962569][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 147.970709][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 147.974634][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 147.978518][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 148.243339][ T1056] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 148.351524][ T1056] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 148.436865][ T1056] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 148.581630][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 148.585628][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 148.657279][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 148.665088][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 149.381499][ T1056] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2025/09/19 14:05:54 executed programs: 0 [ 149.794252][ T45] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 149.798940][ T45] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 149.803891][ T45] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 149.808699][ T45] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 149.814181][ T45] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 150.237252][ T5738] chnl_net:caif_netlink_parms(): no params data found [ 150.503618][ T5738] bridge0: port 1(bridge_slave_0) entered blocking state [ 150.507899][ T5738] bridge0: port 1(bridge_slave_0) entered disabled state [ 150.521298][ T5738] bridge_slave_0: entered allmulticast mode [ 150.543298][ T5738] bridge_slave_0: entered promiscuous mode [ 150.570181][ T5738] bridge0: port 2(bridge_slave_1) entered blocking state [ 150.573960][ T5738] bridge0: port 2(bridge_slave_1) entered disabled state [ 150.577218][ T5738] bridge_slave_1: entered allmulticast mode [ 150.603632][ T5738] bridge_slave_1: entered promiscuous mode [ 150.717882][ T5738] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 150.791304][ T5738] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 150.917215][ T1056] bridge_slave_1: left allmulticast mode [ 150.920830][ T1056] bridge_slave_1: left promiscuous mode [ 150.923650][ T1056] bridge0: port 2(bridge_slave_1) entered disabled state [ 150.934007][ T1056] bridge_slave_0: left allmulticast mode [ 150.937610][ T1056] bridge_slave_0: left promiscuous mode [ 150.950909][ T1056] bridge0: port 1(bridge_slave_0) entered disabled state [ 151.318759][ T1056] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 151.324606][ T1056] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 151.332090][ T1056] bond0 (unregistering): Released all slaves [ 151.342452][ T5738] team0: Port device team_slave_0 added [ 151.372007][ T5738] team0: Port device team_slave_1 added [ 151.456920][ T1056] hsr_slave_0: left promiscuous mode [ 151.461066][ T1056] hsr_slave_1: left promiscuous mode [ 151.466942][ T1056] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 151.482043][ T1056] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 151.490706][ T1056] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 151.494994][ T1056] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 151.515864][ T1056] veth1_macvtap: left promiscuous mode [ 151.518330][ T1056] veth0_macvtap: left promiscuous mode [ 151.531786][ T1056] veth1_vlan: left promiscuous mode [ 151.534443][ T1056] veth0_vlan: left promiscuous mode [ 151.900658][ T4707] Bluetooth: hci0: command tx timeout [ 152.220500][ T1056] team0 (unregistering): Port device team_slave_1 removed [ 152.260938][ T1056] team0 (unregistering): Port device team_slave_0 removed [ 152.580414][ T5738] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 152.583903][ T5738] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 152.617315][ T5738] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 152.636751][ T5738] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 152.648181][ T5738] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 152.667812][ T5738] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 152.796743][ T5738] hsr_slave_0: entered promiscuous mode [ 152.810748][ T5738] hsr_slave_1: entered promiscuous mode [ 153.622756][ T5738] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 153.637998][ T5738] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 153.655308][ T5738] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 153.676223][ T5738] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 153.828784][ T5738] 8021q: adding VLAN 0 to HW filter on device bond0 [ 153.864148][ T5738] 8021q: adding VLAN 0 to HW filter on device team0 [ 153.887110][ T71] bridge0: port 1(bridge_slave_0) entered blocking state [ 153.891338][ T71] bridge0: port 1(bridge_slave_0) entered forwarding state [ 153.910134][ T71] bridge0: port 2(bridge_slave_1) entered blocking state [ 153.913395][ T71] bridge0: port 2(bridge_slave_1) entered forwarding state [ 153.979625][ T4707] Bluetooth: hci0: command tx timeout [ 154.276509][ T5738] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 154.360573][ T5738] veth0_vlan: entered promiscuous mode [ 154.382148][ T5738] veth1_vlan: entered promiscuous mode [ 154.432455][ T5738] veth0_macvtap: entered promiscuous mode [ 154.451212][ T5738] veth1_macvtap: entered promiscuous mode [ 154.481514][ T5738] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 154.498791][ T5738] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 154.514566][ T43] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 154.522075][ T43] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 154.532815][ T43] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 154.536600][ T43] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 154.602787][ T71] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 154.606666][ T71] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 154.642054][ T71] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 154.645534][ T71] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 154.798415][ T5805] loop0: detected capacity change from 0 to 16384 [ 154.948884][ T5805] bcachefs (loop0): starting version 1.13: inode_has_child_snapshots opts=metadata_checksum=none,data_checksum=none [ 154.948901][ T5805] features: new_siphash,inline_data,new_extent_overwrite,btree_ptr_v2,new_varint,journal_no_flush,alloc_v2,extents_across_btree_nodes [ 154.990250][ T5805] bcachefs (loop0): Using encoding defined by superblock: utf8-12.1.0 [ 154.995262][ T5805] bcachefs (loop0): invalid bkey in superblock btree=accounting level=1: u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 2964fe5219fc11c5 written 16 min_key 347136:0:0 durability: 0 (invalid extent entry 0000000000017200) [ 154.995299][ T5805] invalid extent entry type (got 9, max 7), deleting [ 155.033984][ T5805] bcachefs (loop0): recovering from clean shutdown, journal seq 15 [ 155.041980][ T5805] bcachefs (loop0): Doing compatible version upgrade from 1.13: inode_has_child_snapshots to 1.28: inode_has_case_insensitive [ 155.041980][ T5805] running recovery passes: check_allocations,check_extents_to_backpointers,check_inodes [ 155.189861][ T5805] ================================================================== [ 155.193635][ T5805] BUG: KASAN: use-after-free in string+0x231/0x2b0 [ 155.196761][ T5805] Read of size 1 at addr ffff888011a834f7 by task syz.0.17/5805 [ 155.204589][ T5805] [ 155.205685][ T5805] CPU: 0 UID: 0 PID: 5805 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 155.205702][ T5805] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 155.205709][ T5805] Call Trace: [ 155.205717][ T5805] [ 155.205723][ T5805] dump_stack_lvl+0x189/0x250 [ 155.205740][ T5805] ? __kasan_check_byte+0x12/0x40 [ 155.205807][ T5805] ? __pfx_dump_stack_lvl+0x10/0x10 [ 155.205819][ T5805] ? lock_release+0x4b/0x3e0 [ 155.205835][ T5805] ? __virt_addr_valid+0x4a5/0x5c0 [ 155.205850][ T5805] print_report+0xca/0x240 [ 155.205863][ T5805] ? string+0x231/0x2b0 [ 155.205876][ T5805] kasan_report+0x118/0x150 [ 155.205889][ T5805] ? number+0xd18/0xf60 [ 155.205902][ T5805] ? string+0x231/0x2b0 [ 155.205915][ T5805] string+0x231/0x2b0 [ 155.205929][ T5805] vsnprintf+0x739/0xf00 [ 155.205944][ T5805] bch2_prt_printf+0x1c6/0x740 [ 155.205961][ T5805] ? __pfx_bch2_prt_printf+0x10/0x10 [ 155.205973][ T5805] ? __pfx_bch2_prt_printf+0x10/0x10 [ 155.205985][ T5805] bch2_dirent_to_text+0x2bd/0xd20 [ 155.206004][ T5805] ? bch2_bkey_val_to_text+0xe4/0x150 [ 155.206019][ T5805] __bch2_bkey_fsck_err+0x3f7/0x540 [ 155.206032][ T5805] ? kernel_text_address+0xa5/0xe0 [ 155.206047][ T5805] ? __pfx___bch2_bkey_fsck_err+0x10/0x10 [ 155.206059][ T5805] ? do_raw_spin_lock+0x121/0x290 [ 155.206074][ T5805] bch2_dirent_validate+0x7b3/0xfb0 [ 155.206092][ T5805] ? __pfx_bch2_dirent_validate+0x10/0x10 [ 155.206107][ T5805] ? __free_frozen_pages+0x65e/0xd30 [ 155.206122][ T5805] ? __pfx_bch2_dirent_validate+0x10/0x10 [ 155.206137][ T5805] bch2_bkey_val_validate+0x202/0x3e0 [ 155.206152][ T5805] ? __pfx_bch2_bkey_val_validate+0x10/0x10 [ 155.206165][ T5805] ? __asan_memset+0x22/0x50 [ 155.206175][ T5805] ? __bch2_bkey_unpack_key+0x98b/0xe10 [ 155.206188][ T5805] bch2_btree_node_read_done+0x4051/0x5550 [ 155.206221][ T5805] ? __pfx_bch2_btree_node_read_done+0x10/0x10 [ 155.206237][ T5805] ? bch2_extent_ptr_to_text+0x5a/0x890 [ 155.206253][ T5805] ? bch2_bkey_ptrs_to_text+0x1161/0x1310 [ 155.206264][ T5805] ? bch2_printbuf_make_room+0xdb/0x360 [ 155.206279][ T5805] ? enumerated_ref_put+0xbe/0x270 [ 155.206295][ T5805] btree_node_read_work+0x40e/0xe60 [ 155.206313][ T5805] ? __pfx_btree_node_read_work+0x10/0x10 [ 155.206328][ T5805] ? bch2_latency_acct+0x436/0x520 [ 155.206341][ T5805] ? __pfx_bch2_latency_acct+0x10/0x10 [ 155.206351][ T5805] ? bio_associate_blkg+0x6d/0x230 [ 155.206369][ T5805] bch2_btree_node_read+0x887/0x2a00 [ 155.206387][ T5805] ? bch2_btree_node_hash_insert+0x88/0xc0 [ 155.206399][ T5805] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 155.206412][ T5805] ? __pfx_bch2_btree_node_read+0x10/0x10 [ 155.206427][ T5805] ? bch2_trans_unlock+0x8a/0x580 [ 155.206449][ T5805] ? bch2_trans_unlock+0x491/0x580 [ 155.206463][ T5805] bch2_btree_root_read+0x5f0/0x760 [ 155.206480][ T5805] ? __pfx_bch2_btree_root_read+0x10/0x10 [ 155.206498][ T5805] ? bch2_current_has_btree_trans+0x169/0x1a0 [ 155.206511][ T5805] read_btree_roots+0x2c6/0x840 [ 155.206524][ T5805] ? __pfx_read_btree_roots+0x10/0x10 [ 155.206537][ T5805] bch2_fs_recovery+0x261f/0x3a50 [ 155.206552][ T5805] ? __pfx_bch2_fs_recovery+0x10/0x10 [ 155.206564][ T5805] ? __lock_acquire+0xab9/0xd20 [ 155.206583][ T5805] ? __mutex_trylock_common+0x153/0x260 [ 155.206596][ T5805] ? __pfx___mutex_trylock_common+0x10/0x10 [ 155.206608][ T5805] ? rcu_is_watching+0x15/0xb0 [ 155.206621][ T5805] ? __lock_acquire+0xab9/0xd20 [ 155.206639][ T5805] ? bch2_fs_start+0xa0f/0xda0 [ 155.206652][ T5805] ? up_write+0x1c4/0x420 [ 155.206663][ T5805] ? bch2_fs_start+0x5e7/0xda0 [ 155.206675][ T5805] bch2_fs_start+0xaaf/0xda0 [ 155.206686][ T5805] ? bch2_fs_start+0x5e7/0xda0 [ 155.206698][ T5805] ? __pfx_bch2_fs_start+0x10/0x10 [ 155.206714][ T5805] ? sget+0x267/0x620 [ 155.206726][ T5805] bch2_fs_get_tree+0xb39/0x1520 [ 155.206743][ T5805] ? __pfx_bch2_fs_get_tree+0x10/0x10 [ 155.206760][ T5805] ? __pfx_vfs_parse_comma_sep+0x10/0x10 [ 155.206780][ T5805] vfs_get_tree+0x92/0x2b0 [ 155.206793][ T5805] do_new_mount+0x2a2/0x9e0 [ 155.206809][ T5805] ? ns_capable+0x8a/0xf0 [ 155.206820][ T5805] ? __pfx_do_new_mount+0x10/0x10 [ 155.206833][ T5805] ? path_mount+0x61c/0xfe0 [ 155.206845][ T5805] ? user_path_at+0x44/0x60 [ 155.206857][ T5805] __se_sys_mount+0x317/0x410 [ 155.206873][ T5805] ? __pfx___se_sys_mount+0x10/0x10 [ 155.206889][ T5805] ? do_syscall_64+0xbe/0x3b0 [ 155.206901][ T5805] ? __x64_sys_mount+0x20/0xc0 [ 155.206915][ T5805] do_syscall_64+0xfa/0x3b0 [ 155.206925][ T5805] ? lockdep_hardirqs_on+0x9c/0x150 [ 155.206934][ T5805] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.206945][ T5805] ? clear_bhb_loop+0x60/0xb0 [ 155.206957][ T5805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.206967][ T5805] RIP: 0033:0x7f34d959038a [ 155.206978][ T5805] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 155.206986][ T5805] RSP: 002b:00007f34da340e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 155.206998][ T5805] RAX: ffffffffffffffda RBX: 00007f34da340ef0 RCX: 00007f34d959038a [ 155.207005][ T5805] RDX: 0000200000000040 RSI: 0000200000004940 RDI: 00007f34da340eb0 [ 155.207012][ T5805] RBP: 0000200000000040 R08: 00007f34da340ef0 R09: 0000000000004000 [ 155.207019][ T5805] R10: 0000000000004000 R11: 0000000000000246 R12: 0000200000004940 [ 155.207025][ T5805] R13: 00007f34da340eb0 R14: 000000000000496e R15: 0000200000000000 [ 155.207035][ T5805] [ 155.207039][ T5805] [ 155.450359][ T5805] The buggy address belongs to the physical page: [ 155.453450][ T5805] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11a83 [ 155.458056][ T5805] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 155.461199][ T5805] raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000 [ 155.464946][ T5805] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 155.468678][ T5805] page dumped because: kasan: bad access detected [ 155.471523][ T5805] page_owner tracks the page as freed [ 155.473877][ T5805] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4768, tgid 4768 (udevd), ts 35303978812, free_ts 35730139877 [ 155.485608][ T5805] post_alloc_hook+0x240/0x2a0 [ 155.487721][ T5805] get_page_from_freelist+0x21e4/0x22c0 [ 155.490153][ T5805] __alloc_frozen_pages_noprof+0x181/0x370 [ 155.492676][ T5805] alloc_pages_mpol+0x232/0x4a0 [ 155.494755][ T5805] allocate_slab+0x8a/0x370 [ 155.496792][ T5805] ___slab_alloc+0xbeb/0x1420 [ 155.498822][ T5805] kmem_cache_alloc_noprof+0x283/0x3c0 [ 155.501418][ T5805] getname_flags+0xb8/0x540 [ 155.504043][ T5805] do_sys_openat2+0xbc/0x1c0 [ 155.506556][ T5805] __x64_sys_openat+0x138/0x170 [ 155.508865][ T5805] do_syscall_64+0xfa/0x3b0 [ 155.510807][ T5805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.513370][ T5805] page last free pid 4763 tgid 4763 stack trace: [ 155.516140][ T5805] __free_frozen_pages+0xbc4/0xd30 [ 155.518484][ T5805] __put_partials+0x156/0x1a0 [ 155.520650][ T5805] put_cpu_partial+0x17c/0x250 [ 155.522858][ T5805] __slab_free+0x2d5/0x3c0 [ 155.525075][ T5805] qlist_free_all+0x97/0x140 [ 155.527406][ T5805] kasan_quarantine_reduce+0x148/0x160 [ 155.530014][ T5805] __kasan_slab_alloc+0x22/0x80 [ 155.532110][ T5805] kmem_cache_alloc_noprof+0x1c1/0x3c0 [ 155.534440][ T5805] getname_flags+0xb8/0x540 [ 155.536423][ T5805] do_sys_openat2+0xbc/0x1c0 [ 155.538309][ T5805] __x64_sys_openat+0x138/0x170 [ 155.540360][ T5805] do_syscall_64+0xfa/0x3b0 [ 155.542565][ T5805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.545413][ T5805] [ 155.546582][ T5805] Memory state around the buggy address: [ 155.549300][ T5805] ffff888011a83380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 155.552911][ T5805] ffff888011a83400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 155.556429][ T5805] >ffff888011a83480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 155.560005][ T5805] ^ [ 155.564038][ T5805] ffff888011a83500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 155.567730][ T5805] ffff888011a83580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 155.571158][ T5805] ================================================================== [ 155.634630][ T5805] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 155.638407][ T5805] CPU: 0 UID: 0 PID: 5805 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 155.642527][ T5805] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 155.647123][ T5805] Call Trace: [ 155.648544][ T5805] [ 155.649916][ T5805] dump_stack_lvl+0x99/0x250 [ 155.652202][ T5805] ? __asan_memcpy+0x40/0x70 [ 155.655192][ T5805] ? __pfx_dump_stack_lvl+0x10/0x10 [ 155.658092][ T5805] ? __pfx__printk+0x10/0x10 [ 155.660124][ T5805] vpanic+0x281/0x750 [ 155.662418][ T5805] ? preempt_schedule+0xae/0xc0 [ 155.664620][ T5805] ? __pfx_vpanic+0x10/0x10 [ 155.666559][ T5805] ? preempt_schedule_common+0x83/0xd0 [ 155.668946][ T5805] ? preempt_schedule+0xae/0xc0 [ 155.671300][ T5805] ? __pfx_preempt_schedule+0x10/0x10 [ 155.674010][ T5805] panic+0xb9/0xc0 [ 155.675923][ T5805] ? __pfx_panic+0x10/0x10 [ 155.678522][ T5805] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 155.681696][ T5805] ? string+0x231/0x2b0 [ 155.683985][ T5805] check_panic_on_warn+0x89/0xb0 [ 155.686883][ T5805] ? string+0x231/0x2b0 [ 155.689707][ T5805] end_report+0x78/0x160 [ 155.692309][ T5805] kasan_report+0x129/0x150 [ 155.694920][ T5805] ? number+0xd18/0xf60 [ 155.696867][ T5805] ? string+0x231/0x2b0 [ 155.699094][ T5805] string+0x231/0x2b0 [ 155.701647][ T5805] vsnprintf+0x739/0xf00 [ 155.704269][ T5805] bch2_prt_printf+0x1c6/0x740 [ 155.707128][ T5805] ? __pfx_bch2_prt_printf+0x10/0x10 [ 155.709846][ T5805] ? __pfx_bch2_prt_printf+0x10/0x10 [ 155.712282][ T5805] bch2_dirent_to_text+0x2bd/0xd20 [ 155.714619][ T5805] ? bch2_bkey_val_to_text+0xe4/0x150 [ 155.717035][ T5805] __bch2_bkey_fsck_err+0x3f7/0x540 [ 155.719265][ T5805] ? kernel_text_address+0xa5/0xe0 [ 155.721824][ T5805] ? __pfx___bch2_bkey_fsck_err+0x10/0x10 [ 155.724833][ T5805] ? do_raw_spin_lock+0x121/0x290 [ 155.726984][ T5805] bch2_dirent_validate+0x7b3/0xfb0 [ 155.729464][ T5805] ? __pfx_bch2_dirent_validate+0x10/0x10 [ 155.732057][ T5805] ? __free_frozen_pages+0x65e/0xd30 [ 155.734478][ T5805] ? __pfx_bch2_dirent_validate+0x10/0x10 [ 155.736974][ T5805] bch2_bkey_val_validate+0x202/0x3e0 [ 155.740306][ T5805] ? __pfx_bch2_bkey_val_validate+0x10/0x10 [ 155.743920][ T5805] ? __asan_memset+0x22/0x50 [ 155.746040][ T5805] ? __bch2_bkey_unpack_key+0x98b/0xe10 [ 155.748537][ T5805] bch2_btree_node_read_done+0x4051/0x5550 [ 155.751044][ T5805] ? __pfx_bch2_btree_node_read_done+0x10/0x10 [ 155.754230][ T5805] ? bch2_extent_ptr_to_text+0x5a/0x890 [ 155.756825][ T5805] ? bch2_bkey_ptrs_to_text+0x1161/0x1310 [ 155.759302][ T5805] ? bch2_printbuf_make_room+0xdb/0x360 [ 155.761764][ T5805] ? enumerated_ref_put+0xbe/0x270 [ 155.763891][ T5805] btree_node_read_work+0x40e/0xe60 [ 155.766255][ T5805] ? __pfx_btree_node_read_work+0x10/0x10 [ 155.769843][ T5805] ? bch2_latency_acct+0x436/0x520 [ 155.772382][ T5805] ? __pfx_bch2_latency_acct+0x10/0x10 [ 155.774837][ T5805] ? bio_associate_blkg+0x6d/0x230 [ 155.777133][ T5805] bch2_btree_node_read+0x887/0x2a00 [ 155.779457][ T5805] ? bch2_btree_node_hash_insert+0x88/0xc0 [ 155.782136][ T5805] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 155.784938][ T5805] ? __pfx_bch2_btree_node_read+0x10/0x10 [ 155.787889][ T5805] ? bch2_trans_unlock+0x8a/0x580 [ 155.790101][ T5805] ? bch2_trans_unlock+0x491/0x580 [ 155.792574][ T5805] bch2_btree_root_read+0x5f0/0x760 [ 155.794959][ T5805] ? __pfx_bch2_btree_root_read+0x10/0x10 [ 155.797722][ T5805] ? bch2_current_has_btree_trans+0x169/0x1a0 [ 155.801172][ T5805] read_btree_roots+0x2c6/0x840 [ 155.803879][ T5805] ? __pfx_read_btree_roots+0x10/0x10 [ 155.806474][ T5805] bch2_fs_recovery+0x261f/0x3a50 [ 155.808707][ T5805] ? __pfx_bch2_fs_recovery+0x10/0x10 [ 155.811118][ T5805] ? __lock_acquire+0xab9/0xd20 [ 155.813354][ T5805] ? __mutex_trylock_common+0x153/0x260 [ 155.815736][ T5805] ? __pfx___mutex_trylock_common+0x10/0x10 [ 155.818341][ T5805] ? rcu_is_watching+0x15/0xb0 [ 155.820563][ T5805] ? __lock_acquire+0xab9/0xd20 [ 155.823279][ T5805] ? bch2_fs_start+0xa0f/0xda0 [ 155.826000][ T5805] ? up_write+0x1c4/0x420 [ 155.828013][ T5805] ? bch2_fs_start+0x5e7/0xda0 [ 155.830254][ T5805] bch2_fs_start+0xaaf/0xda0 [ 155.832384][ T5805] ? bch2_fs_start+0x5e7/0xda0 [ 155.834575][ T5805] ? __pfx_bch2_fs_start+0x10/0x10 [ 155.837147][ T5805] ? sget+0x267/0x620 [ 155.839504][ T5805] bch2_fs_get_tree+0xb39/0x1520 [ 155.842738][ T5805] ? __pfx_bch2_fs_get_tree+0x10/0x10 [ 155.845092][ T5805] ? __pfx_vfs_parse_comma_sep+0x10/0x10 [ 155.847513][ T5805] vfs_get_tree+0x92/0x2b0 [ 155.849539][ T5805] do_new_mount+0x2a2/0x9e0 [ 155.851650][ T5805] ? ns_capable+0x8a/0xf0 [ 155.853595][ T5805] ? __pfx_do_new_mount+0x10/0x10 [ 155.855829][ T5805] ? path_mount+0x61c/0xfe0 [ 155.858171][ T5805] ? user_path_at+0x44/0x60 [ 155.861297][ T5805] __se_sys_mount+0x317/0x410 [ 155.863618][ T5805] ? __pfx___se_sys_mount+0x10/0x10 [ 155.866272][ T5805] ? do_syscall_64+0xbe/0x3b0 [ 155.868241][ T5805] ? __x64_sys_mount+0x20/0xc0 [ 155.870332][ T5805] do_syscall_64+0xfa/0x3b0 [ 155.872433][ T5805] ? lockdep_hardirqs_on+0x9c/0x150 [ 155.874646][ T5805] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.877412][ T5805] ? clear_bhb_loop+0x60/0xb0 [ 155.879855][ T5805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.882780][ T5805] RIP: 0033:0x7f34d959038a [ 155.884826][ T5805] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 155.893720][ T5805] RSP: 002b:00007f34da340e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 155.897807][ T5805] RAX: ffffffffffffffda RBX: 00007f34da340ef0 RCX: 00007f34d959038a [ 155.901812][ T5805] RDX: 0000200000000040 RSI: 0000200000004940 RDI: 00007f34da340eb0 [ 155.905531][ T5805] RBP: 0000200000000040 R08: 00007f34da340ef0 R09: 0000000000004000 [ 155.909023][ T5805] R10: 0000000000004000 R11: 0000000000000246 R12: 0000200000004940 [ 155.913561][ T5805] R13: 00007f34da340eb0 R14: 000000000000496e R15: 0000200000000000 [ 155.918295][ T5805] [ 155.920644][ T5805] Kernel Offset: disabled [ 155.923061][ T5805] Rebooting in 86400 seconds..