Warning: Permanently added '[localhost]:19001' (ED25519) to the list of known hosts.
2025/12/22 04:06:44 parsed 1 programs
syzkaller login: [ 84.332807][ T5327] cgroup: Unknown subsys name 'net'
[ 84.425798][ T5327] cgroup: Unknown subsys name 'cpuset'
[ 84.432811][ T5327] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 86.138679][ T5327] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 86.635819][ T80] ODEBUG: Out of memory. ODEBUG disabled
[ 91.127357][ T5339] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 91.837490][ T1353] cfg80211: failed to load regulatory.db
[ 95.146564][ T5395] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 95.150367][ T5395] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 95.159221][ T5395] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 95.162738][ T5395] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 95.166546][ T5395] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 95.802717][ T4363] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 95.806469][ T4363] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 95.897551][ T2681] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 95.901013][ T2681] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 97.304774][ T5411] chnl_net:caif_netlink_parms(): no params data found
[ 97.455092][ T5411] bridge0: port 1(bridge_slave_0) entered blocking state
[ 97.458719][ T5411] bridge0: port 1(bridge_slave_0) entered disabled state
[ 97.472070][ T5411] bridge_slave_0: entered allmulticast mode
[ 97.475659][ T5411] bridge_slave_0: entered promiscuous mode
[ 97.482325][ T5411] bridge0: port 2(bridge_slave_1) entered blocking state
[ 97.492139][ T5411] bridge0: port 2(bridge_slave_1) entered disabled state
[ 97.495344][ T5411] bridge_slave_1: entered allmulticast mode
[ 97.502662][ T5411] bridge_slave_1: entered promiscuous mode
[ 97.553912][ T5411] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 97.559766][ T5411] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 97.605363][ T5411] team0: Port device team_slave_0 added
[ 97.613218][ T5411] team0: Port device team_slave_1 added
[ 97.655737][ T5411] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 97.662077][ T5411] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 97.692081][ T5411] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 97.697110][ T5411] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 97.700261][ T5411] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 97.722209][ T5411] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 97.797684][ T5411] hsr_slave_0: entered promiscuous mode
[ 97.812251][ T5411] hsr_slave_1: entered promiscuous mode
[ 98.028743][ T5411] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 98.037728][ T5411] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 98.044194][ T5411] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 98.051189][ T5411] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 98.119300][ T5411] 8021q: adding VLAN 0 to HW filter on device bond0
[ 98.135618][ T5411] 8021q: adding VLAN 0 to HW filter on device team0
[ 98.146645][ T45] bridge0: port 1(bridge_slave_0) entered blocking state
[ 98.150185][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 98.161335][ T45] bridge0: port 2(bridge_slave_1) entered blocking state
[ 98.164508][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 98.320177][ T5411] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 98.356500][ T5411] veth0_vlan: entered promiscuous mode
[ 98.363960][ T5411] veth1_vlan: entered promiscuous mode
[ 98.395000][ T5411] veth0_macvtap: entered promiscuous mode
[ 98.400761][ T5411] veth1_macvtap: entered promiscuous mode
[ 98.419081][ T5411] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 98.430074][ T5411] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 98.440768][ T4363] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 98.449485][ T4363] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 98.466420][ T4363] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 98.470345][ T4363] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 98.753736][ T45] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 98.866000][ T45] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 98.945694][ T45] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 98.994119][ T45] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2025/12/22 04:07:02 executed programs: 0
[ 100.145677][ T47] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 100.149814][ T47] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 100.159154][ T47] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 100.164679][ T47] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 100.168128][ T47] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 100.298775][ T5441] chnl_net:caif_netlink_parms(): no params data found
[ 100.446395][ T5441] bridge0: port 1(bridge_slave_0) entered blocking state
[ 100.449445][ T5441] bridge0: port 1(bridge_slave_0) entered disabled state
[ 100.452952][ T5441] bridge_slave_0: entered allmulticast mode
[ 100.465113][ T5441] bridge_slave_0: entered promiscuous mode
[ 100.473644][ T5441] bridge0: port 2(bridge_slave_1) entered blocking state
[ 100.476490][ T5441] bridge0: port 2(bridge_slave_1) entered disabled state
[ 100.479540][ T5441] bridge_slave_1: entered allmulticast mode
[ 100.493032][ T5441] bridge_slave_1: entered promiscuous mode
[ 100.535018][ T5441] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 100.544961][ T5441] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 100.568539][ T5441] team0: Port device team_slave_0 added
[ 100.573818][ T5441] team0: Port device team_slave_1 added
[ 100.595275][ T5441] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 100.598429][ T5441] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 100.609981][ T5441] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 100.617165][ T5441] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 100.620189][ T5441] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 100.635090][ T5441] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 100.670077][ T5441] hsr_slave_0: entered promiscuous mode
[ 100.673615][ T5441] hsr_slave_1: entered promiscuous mode
[ 100.676648][ T5441] debugfs: 'hsr0' already exists in 'hsr'
[ 100.680038][ T5441] Cannot create hsr debugfs directory
[ 101.365447][ T45] bridge_slave_1: left allmulticast mode
[ 101.368177][ T45] bridge_slave_1: left promiscuous mode
[ 101.371153][ T45] bridge0: port 2(bridge_slave_1) entered disabled state
[ 101.386310][ T45] bridge_slave_0: left allmulticast mode
[ 101.388566][ T45] bridge_slave_0: left promiscuous mode
[ 101.390948][ T45] bridge0: port 1(bridge_slave_0) entered disabled state
[ 101.752953][ T45] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 101.759181][ T45] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 101.765582][ T45] bond0 (unregistering): Released all slaves
[ 101.874353][ T45] hsr_slave_0: left promiscuous mode
[ 101.879855][ T45] hsr_slave_1: left promiscuous mode
[ 101.886574][ T45] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 101.889885][ T45] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 101.903842][ T45] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 101.906819][ T45] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 101.929352][ T45] veth1_macvtap: left promiscuous mode
[ 101.940594][ T45] veth0_macvtap: left promiscuous mode
[ 101.944357][ T45] veth1_vlan: left promiscuous mode
[ 101.946575][ T45] veth0_vlan: left promiscuous mode
[ 102.224346][ T47] Bluetooth: hci0: command tx timeout
[ 102.354705][ T45] team0 (unregistering): Port device team_slave_1 removed
[ 102.378837][ T45] team0 (unregistering): Port device team_slave_0 removed
[ 102.836465][ T5441] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 102.854819][ T5441] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 102.868450][ T5441] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 102.893282][ T5441] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 103.228699][ T5441] 8021q: adding VLAN 0 to HW filter on device bond0
[ 103.276408][ T5441] 8021q: adding VLAN 0 to HW filter on device team0
[ 103.295498][ T2681] bridge0: port 1(bridge_slave_0) entered blocking state
[ 103.299378][ T2681] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 103.326219][ T2681] bridge0: port 2(bridge_slave_1) entered blocking state
[ 103.329532][ T2681] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 103.396398][ T5441] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 103.552488][ T5441] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 103.586724][ T5441] veth0_vlan: entered promiscuous mode
[ 103.596697][ T5441] veth1_vlan: entered promiscuous mode
[ 103.619882][ T5441] veth0_macvtap: entered promiscuous mode
[ 103.626448][ T5441] veth1_macvtap: entered promiscuous mode
[ 103.644594][ T5441] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 103.654751][ T5441] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 103.664305][ T2681] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 103.673852][ T2681] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 103.677791][ T2681] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 103.698417][ T2681] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 103.739589][ T2681] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 103.760689][ T2681] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 103.784886][ T45] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 103.788025][ T45] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 104.186511][ T5484] loop0: detected capacity change from 0 to 40427
[ 104.213592][ T5484] F2FS-fs (loop0): Image doesn't support compression
[ 104.225535][ T5484] F2FS-fs (loop0): invalid crc value
[ 104.301967][ T47] Bluetooth: hci0: command tx timeout
[ 104.370815][ T5484] F2FS-fs (loop0): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[ 104.385565][ T5484] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5
[ 104.403866][ T26] audit: type=1800 audit(1766376426.935:2): pid=5484 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.17" name="file1" dev="loop0" ino=10 res=0 errno=0
[ 104.413639][ T5484] F2FS-fs (loop0): inconsistent node block, node_type:1, nid:11, node_footer[nid:11,ino:3,ofs:2041,cpver:0,blkaddr:0]
[ 104.440559][ T5484] syz.0.17: attempt to access beyond end of device
[ 104.440559][ T5484] loop0: rw=2049, sector=40960, nr_sectors = 16 limit=40427
[ 104.446804][ T5484] CPU: 0 UID: 0 PID: 5484 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 104.446823][ T5484] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 104.446831][ T5484] Call Trace:
[ 104.446836][ T5484]
[ 104.446840][ T5484] dump_stack_lvl+0xe8/0x150
[ 104.446957][ T5484] f2fs_handle_critical_error+0x37c/0x540
[ 104.447011][ T5484] f2fs_write_end_io+0x886/0xb60
[ 104.447032][ T5484] __submit_merged_bio+0x256/0x660
[ 104.447052][ T5484] __submit_merged_write_cond+0x471/0x530
[ 104.447072][ T5484] f2fs_sync_node_pages+0x1479/0x15e0
[ 104.447098][ T5484] ? __pfx_f2fs_sync_node_pages+0x10/0x10
[ 104.447139][ T5484] f2fs_write_checkpoint+0xdd5/0x2430
[ 104.447169][ T5484] ? __pfx_f2fs_write_checkpoint+0x10/0x10
[ 104.447218][ T5484] kill_f2fs_super+0x2d2/0x6c0
[ 104.447234][ T5484] ? __pfx_kill_f2fs_super+0x10/0x10
[ 104.447258][ T5484] deactivate_locked_super+0xbc/0x130
[ 104.447272][ T5484] cleanup_mnt+0x425/0x4c0
[ 104.447288][ T5484] task_work_run+0x1d4/0x260
[ 104.447305][ T5484] ? __pfx_task_work_run+0x10/0x10
[ 104.447318][ T5484] ? kmem_cache_free+0x197/0x620
[ 104.447331][ T5484] ? do_exit+0x68f/0x22f0
[ 104.447345][ T5484] do_exit+0x694/0x22f0
[ 104.447362][ T5484] ? __pfx_do_exit+0x10/0x10
[ 104.447372][ T5484] ? do_raw_spin_lock+0x121/0x290
[ 104.447391][ T5484] ? _raw_spin_unlock_irq+0x23/0x50
[ 104.447463][ T5484] do_group_exit+0x21c/0x2d0
[ 104.447482][ T5484] __x64_sys_exit_group+0x3f/0x40
[ 104.447496][ T5484] x64_sys_call+0x2210/0x2210
[ 104.447508][ T5484] do_syscall_64+0xec/0xf80
[ 104.447518][ T5484] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 104.447526][ T5484] ? trace_irq_disable+0x37/0x100
[ 104.447539][ T5484] ? clear_bhb_loop+0x60/0xb0
[ 104.447551][ T5484] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 104.447560][ T5484] RIP: 0033:0x7fc7a918f7c9
[ 104.447569][ T5484] Code: Unable to access opcode bytes at 0x7fc7a918f79f.
[ 104.447574][ T5484] RSP: 002b:00007fffe9faf508 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 104.447585][ T5484] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc7a918f7c9
[ 104.447592][ T5484] RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000
[ 104.447597][ T5484] RBP: 0000000000000003 R08: 00000007e9faf5ff R09: 00007fc7a93b4280
[ 104.447603][ T5484] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000
[ 104.447608][ T5484] R13: 00007fc7a93b4280 R14: 0000000000000003 R15: 00007fffe9faf5c0
[ 104.447624][ T5484]
[ 104.447629][ T5484] F2FS-fs (loop0): Stopped filesystem due to reason: 3
[ 104.553969][ T5484] CPU: 0 UID: 0 PID: 5484 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 104.553985][ T5484] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 104.553991][ T5484] Call Trace:
[ 104.553996][ T5484]
[ 104.554001][ T5484] dump_stack_lvl+0xe8/0x150
[ 104.554022][ T5484] f2fs_handle_critical_error+0x37c/0x540
[ 104.554043][ T5484] f2fs_write_end_io+0x886/0xb60
[ 104.554066][ T5484] __submit_merged_bio+0x256/0x660
[ 104.554084][ T5484] __submit_merged_write_cond+0x471/0x530
[ 104.554101][ T5484] f2fs_sync_node_pages+0x1479/0x15e0
[ 104.554128][ T5484] ? __pfx_f2fs_sync_node_pages+0x10/0x10
[ 104.554168][ T5484] f2fs_write_checkpoint+0xdd5/0x2430
[ 104.554196][ T5484] ? __pfx_f2fs_write_checkpoint+0x10/0x10
[ 104.554242][ T5484] kill_f2fs_super+0x2d2/0x6c0
[ 104.554257][ T5484] ? __pfx_kill_f2fs_super+0x10/0x10
[ 104.554273][ T5484] deactivate_locked_super+0xbc/0x130
[ 104.554283][ T5484] cleanup_mnt+0x425/0x4c0
[ 104.554294][ T5484] task_work_run+0x1d4/0x260
[ 104.554304][ T5484] ? __pfx_task_work_run+0x10/0x10
[ 104.554313][ T5484] ? kmem_cache_free+0x197/0x620
[ 104.554323][ T5484] ? do_exit+0x68f/0x22f0
[ 104.554334][ T5484] do_exit+0x694/0x22f0
[ 104.554345][ T5484] ? __pfx_do_exit+0x10/0x10
[ 104.554352][ T5484] ? do_raw_spin_lock+0x121/0x290
[ 104.554366][ T5484] ? _raw_spin_unlock_irq+0x23/0x50
[ 104.554382][ T5484] do_group_exit+0x21c/0x2d0
[ 104.554399][ T5484] __x64_sys_exit_group+0x3f/0x40
[ 104.554411][ T5484] x64_sys_call+0x2210/0x2210
[ 104.554423][ T5484] do_syscall_64+0xec/0xf80
[ 104.554434][ T5484] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 104.554443][ T5484] ? trace_irq_disable+0x37/0x100
[ 104.554456][ T5484] ? clear_bhb_loop+0x60/0xb0
[ 104.554469][ T5484] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 104.554478][ T5484] RIP: 0033:0x7fc7a918f7c9
[ 104.554487][ T5484] Code: Unable to access opcode bytes at 0x7fc7a918f79f.
[ 104.554492][ T5484] RSP: 002b:00007fffe9faf508 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 104.554504][ T5484] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc7a918f7c9
[ 104.554511][ T5484] RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000
[ 104.554517][ T5484] RBP: 0000000000000003 R08: 00000007e9faf5ff R09: 00007fc7a93b4280
[ 104.554523][ T5484] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000
[ 104.554529][ T5484] R13: 00007fc7a93b4280 R14: 0000000000000003 R15: 00007fffe9faf5c0
[ 104.554547][ T5484]
[ 104.554552][ T5484] F2FS-fs (loop0): Stopped filesystem due to reason: 3
[ 104.731629][ T45] ==================================================================
[ 104.735086][ T45] BUG: KASAN: slab-use-after-free in f2fs_write_end_io+0x9b9/0xb60
[ 104.738524][ T45] Read of size 4 at addr ffff88804357d170 by task kworker/u4:4/45
[ 104.742522][ T45]
[ 104.743612][ T45] CPU: 0 UID: 0 PID: 45 Comm: kworker/u4:4 Not tainted syzkaller #0 PREEMPT(full)
[ 104.743626][ T45] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 104.743634][ T45] Workqueue: loop0 loop_workfn
[ 104.743650][ T45] Call Trace:
[ 104.743658][ T45]
[ 104.743663][ T45] dump_stack_lvl+0xe8/0x150
[ 104.743679][ T45] print_report+0xca/0x240
[ 104.743689][ T45] ? f2fs_write_end_io+0x9b9/0xb60
[ 104.743699][ T45] kasan_report+0x118/0x150
[ 104.743711][ T45] ? f2fs_write_end_io+0x9b9/0xb60
[ 104.743723][ T45] kasan_check_range+0x2b0/0x2c0
[ 104.743733][ T45] f2fs_write_end_io+0x9b9/0xb60
[ 104.743747][ T45] blk_update_request+0x57e/0xe60
[ 104.743764][ T45] blk_mq_end_request+0x3e/0x70
[ 104.743774][ T45] lo_rw_aio+0xcd1/0xef0
[ 104.743785][ T45] ? __pfx_lo_rw_aio+0x10/0x10
[ 104.743798][ T45] ? kthread_associate_blkcg+0x491/0x600
[ 104.743811][ T45] ? _raw_spin_unlock_irq+0x23/0x50
[ 104.743825][ T45] loop_process_work+0x8fe/0x10b0
[ 104.743837][ T45] ? trace_sched_exit_tp+0x36/0xf0
[ 104.743852][ T45] ? __pfx_loop_process_work+0x10/0x10
[ 104.743862][ T45] ? look_up_lock_class+0x57/0x110
[ 104.743871][ T45] ? register_lock_class+0x31/0x2e0
[ 104.743882][ T45] ? __lock_acquire+0x6b6/0x2cf0
[ 104.743893][ T45] ? __pfx___schedule+0x10/0x10
[ 104.743907][ T45] ? do_raw_spin_unlock+0x4d/0x240
[ 104.743921][ T45] ? process_scheduled_works+0x9ef/0x1770
[ 104.743938][ T45] ? process_scheduled_works+0x9ef/0x1770
[ 104.743949][ T45] ? preempt_schedule_thunk+0x16/0x30
[ 104.743958][ T45] ? process_scheduled_works+0x9ef/0x1770
[ 104.743967][ T45] ? process_scheduled_works+0x9ef/0x1770
[ 104.743976][ T45] process_scheduled_works+0xad1/0x1770
[ 104.743992][ T45] ? __pfx_process_scheduled_works+0x10/0x10
[ 104.744001][ T45] ? do_raw_spin_lock+0x121/0x290
[ 104.744016][ T45] worker_thread+0x8a0/0xda0
[ 104.744032][ T45] kthread+0x711/0x8a0
[ 104.744044][ T45] ? __pfx_worker_thread+0x10/0x10
[ 104.744054][ T45] ? __pfx_kthread+0x10/0x10
[ 104.744066][ T45] ? _raw_spin_unlock_irq+0x23/0x50
[ 104.744079][ T45] ? __pfx_kthread+0x10/0x10
[ 104.744091][ T45] ret_from_fork+0x510/0xa50
[ 104.744101][ T45] ? __pfx_ret_from_fork+0x10/0x10
[ 104.744109][ T45] ? __switch_to+0xc9e/0x1480
[ 104.744124][ T45] ? __pfx_kthread+0x10/0x10
[ 104.744136][ T45] ret_from_fork_asm+0x1a/0x30
[ 104.744152][ T45]
[ 104.744157][ T45]
[ 104.852051][ T45] Allocated by task 5484:
[ 104.853940][ T45] kasan_save_track+0x3e/0x80
[ 104.856025][ T45] __kasan_kmalloc+0x93/0xb0
[ 104.858130][ T45] __kmalloc_cache_noprof+0x3e2/0x700
[ 104.860497][ T45] f2fs_fill_super+0x8c/0x6ec0
[ 104.862657][ T45] get_tree_bdev_flags+0x40e/0x4d0
[ 104.864854][ T45] vfs_get_tree+0x92/0x2a0
[ 104.866829][ T45] do_new_mount+0x302/0xa10
[ 104.871992][ T45] __se_sys_mount+0x313/0x410
[ 104.874052][ T45] do_syscall_64+0xec/0xf80
[ 104.876069][ T45] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 104.878674][ T45]
[ 104.879832][ T45] Freed by task 5484:
[ 104.881599][ T45] kasan_save_track+0x3e/0x80
[ 104.883772][ T45] kasan_save_free_info+0x46/0x50
[ 104.886029][ T45] __kasan_slab_free+0x5c/0x80
[ 104.888154][ T45] kfree+0x1c0/0x660
[ 104.889880][ T45] kill_f2fs_super+0x5b6/0x6c0
[ 104.891991][ T45] deactivate_locked_super+0xbc/0x130
[ 104.894410][ T45] cleanup_mnt+0x425/0x4c0
[ 104.896404][ T45] task_work_run+0x1d4/0x260
[ 104.898344][ T45] do_exit+0x694/0x22f0
[ 104.899993][ T45] do_group_exit+0x21c/0x2d0
[ 104.901801][ T45] __x64_sys_exit_group+0x3f/0x40
[ 104.903743][ T45] __pfx_syscall_get_nr+0x0/0x10
[ 104.905678][ T45] do_syscall_64+0xec/0xf80
[ 104.907497][ T45] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 104.909994][ T45]
[ 104.911061][ T45] Last potentially related work creation:
[ 104.913403][ T45] kasan_save_stack+0x3e/0x60
[ 104.915348][ T45] kasan_record_aux_stack+0xbd/0xd0
[ 104.917740][ T45] insert_work+0x3d/0x330
[ 104.919676][ T45] __queue_work+0xcd0/0xf90
[ 104.921681][ T45] queue_work_on+0x106/0x1c0
[ 104.923821][ T45] f2fs_handle_critical_error+0x255/0x540
[ 104.926281][ T45] f2fs_write_end_io+0x886/0xb60
[ 104.928505][ T45] __submit_merged_bio+0x256/0x660
[ 104.930719][ T45] __submit_merged_write_cond+0x471/0x530
[ 104.933183][ T45] f2fs_sync_node_pages+0x1479/0x15e0
[ 104.935556][ T45] f2fs_write_checkpoint+0xdd5/0x2430
[ 104.937931][ T45] kill_f2fs_super+0x2d2/0x6c0
[ 104.940080][ T45] deactivate_locked_super+0xbc/0x130
[ 104.942375][ T45] cleanup_mnt+0x425/0x4c0
[ 104.944292][ T45] task_work_run+0x1d4/0x260
[ 104.946325][ T45] do_exit+0x694/0x22f0
[ 104.948116][ T45] do_group_exit+0x21c/0x2d0
[ 104.950158][ T45] __x64_sys_exit_group+0x3f/0x40
[ 104.952453][ T45] __pfx_syscall_get_nr+0x0/0x10
[ 104.954623][ T45] do_syscall_64+0xec/0xf80
[ 104.956628][ T45] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 104.959217][ T45]
[ 104.960331][ T45] Second to last potentially related work creation:
[ 104.963176][ T45] kasan_save_stack+0x3e/0x60
[ 104.965226][ T45] kasan_record_aux_stack+0xbd/0xd0
[ 104.967544][ T45] insert_work+0x3d/0x330
[ 104.969539][ T45] __queue_work+0xcd0/0xf90
[ 104.971575][ T45] queue_work_on+0x106/0x1c0
[ 104.973639][ T45] __get_node_folio+0xcaf/0x14f0
[ 104.975861][ T45] f2fs_iget+0x77c/0x5640
[ 104.977830][ T45] f2fs_nfs_get_inode+0x76/0x110
[ 104.980051][ T45] generic_fh_to_dentry+0x9f/0xf0
[ 104.982310][ T45] exportfs_decode_fh_raw+0x178/0x6e0
[ 104.984771][ T45] do_handle_to_path+0xa4/0x1a0
[ 104.987009][ T45] do_handle_open+0x6a1/0x930
[ 104.989221][ T45] do_syscall_64+0xec/0xf80
[ 104.991260][ T45] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 104.993986][ T45]
[ 104.995063][ T45] The buggy address belongs to the object at ffff88804357c000
[ 104.995063][ T45] which belongs to the cache kmalloc-8k of size 8192
[ 105.001142][ T45] The buggy address is located 4464 bytes inside of
[ 105.001142][ T45] freed 8192-byte region [ffff88804357c000, ffff88804357e000)
[ 105.007069][ T45]
[ 105.008224][ T45] The buggy address belongs to the physical page:
[ 105.011064][ T45] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x43578
[ 105.014713][ T45] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 105.018494][ T45] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff)
[ 105.021869][ T45] page_type: f5(slab)
[ 105.023685][ T45] raw: 04fff00000000040 ffff88801a442280 ffffea000046b000 0000000000000002
[ 105.027431][ T45] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 105.031242][ T45] head: 04fff00000000040 ffff88801a442280 ffffea000046b000 0000000000000002
[ 105.035041][ T45] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 105.038811][ T45] head: 04fff00000000003 ffffea00010d5e01 00000000ffffffff 00000000ffffffff
[ 105.042642][ T45] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 105.046274][ T45] page dumped because: kasan: bad access detected
[ 105.049040][ T45] page_owner tracks the page as allocated
[ 105.051530][ T45] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x528c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP), pid 5411, tgid 5411 (syz-executor), ts 97414573985, free_ts 95403368329
[ 105.060130][ T45] post_alloc_hook+0x234/0x290
[ 105.062385][ T45] get_page_from_freelist+0x24e0/0x2580
[ 105.064898][ T45] __alloc_frozen_pages_noprof+0x181/0x370
[ 105.067420][ T45] alloc_pages_mpol+0x232/0x4a0
[ 105.069608][ T45] allocate_slab+0x86/0x3b0
[ 105.071628][ T45] ___slab_alloc+0xe53/0x1820
[ 105.073660][ T45] __slab_alloc+0x65/0x100
[ 105.075570][ T45] __kvmalloc_node_noprof+0x6b6/0x920
[ 105.077897][ T45] wg_packet_queue_init+0xbc/0x320
[ 105.080206][ T45] wg_newlink+0x2f6/0x670
[ 105.082185][ T45] rtnl_newlink_create+0x310/0xb00
[ 105.084650][ T45] rtnl_newlink+0x16e7/0x1c90
[ 105.086695][ T45] rtnetlink_rcv_msg+0x7cf/0xb70
[ 105.088942][ T45] netlink_rcv_skb+0x208/0x470
[ 105.091149][ T45] netlink_unicast+0x82f/0x9e0
[ 105.093280][ T45] netlink_sendmsg+0x805/0xb30
[ 105.095325][ T45] page last free pid 4363 tgid 4363 stack trace:
[ 105.098013][ T45] __free_frozen_pages+0xbc8/0xd30
[ 105.100271][ T45] unix_net_exit+0x6b/0xb0
[ 105.102152][ T45] ops_undo_list+0x49a/0x990
[ 105.104062][ T45] cleanup_net+0x4d8/0x7a0
[ 105.106024][ T45] process_scheduled_works+0xad1/0x1770
[ 105.108377][ T45] worker_thread+0x8a0/0xda0
[ 105.110367][ T45] kthread+0x711/0x8a0
[ 105.112117][ T45] ret_from_fork+0x510/0xa50
[ 105.114175][ T45] ret_from_fork_asm+0x1a/0x30
[ 105.116107][ T45]
[ 105.117135][ T45] Memory state around the buggy address:
[ 105.119534][ T45] ffff88804357d000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 105.123041][ T45] ffff88804357d080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 105.126486][ T45] >ffff88804357d100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 105.130056][ T45] ^
[ 105.133585][ T45] ffff88804357d180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 105.137128][ T45] ffff88804357d200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 105.140654][ T45] ==================================================================
2025/12/22 04:07:07 executed programs: 3
[ 105.509774][ T5488] loop0: detected capacity change from 0 to 40427
[ 105.526298][ T45] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 105.529525][ T45] CPU: 0 UID: 0 PID: 45 Comm: kworker/u4:4 Not tainted syzkaller #0 PREEMPT(full)
[ 105.533572][ T45] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 105.538211][ T45] Workqueue: loop0 loop_workfn
[ 105.540341][ T45] Call Trace:
[ 105.541778][ T45]
[ 105.543002][ T45] vpanic+0x1e0/0x670
[ 105.544808][ T45] panic+0xb9/0xc0
[ 105.546425][ T45] ? __pfx_panic+0x10/0x10
[ 105.548420][ T45] ? preempt_schedule_thunk+0x16/0x30
[ 105.550746][ T45] ? f2fs_write_end_io+0x9b9/0xb60
[ 105.553024][ T45] ? preempt_schedule_thunk+0x16/0x30
[ 105.555363][ T45] ? f2fs_write_end_io+0x9b9/0xb60
[ 105.557608][ T45] check_panic_on_warn+0x89/0xb0
[ 105.559728][ T45] ? f2fs_write_end_io+0x9b9/0xb60
[ 105.561909][ T45] end_report+0x6f/0x140
[ 105.563983][ T45] kasan_report+0x129/0x150
[ 105.565969][ T45] ? f2fs_write_end_io+0x9b9/0xb60
[ 105.568225][ T45] kasan_check_range+0x2b0/0x2c0
[ 105.570350][ T45] f2fs_write_end_io+0x9b9/0xb60
[ 105.572783][ T45] blk_update_request+0x57e/0xe60
[ 105.574823][ T45] blk_mq_end_request+0x3e/0x70
[ 105.576826][ T45] lo_rw_aio+0xcd1/0xef0
[ 105.578729][ T45] ? __pfx_lo_rw_aio+0x10/0x10
[ 105.580729][ T45] ? kthread_associate_blkcg+0x491/0x600
[ 105.582991][ T45] ? _raw_spin_unlock_irq+0x23/0x50
[ 105.585010][ T45] loop_process_work+0x8fe/0x10b0
[ 105.587067][ T45] ? trace_sched_exit_tp+0x36/0xf0
[ 105.589195][ T45] ? __pfx_loop_process_work+0x10/0x10
[ 105.591633][ T45] ? look_up_lock_class+0x57/0x110
[ 105.593939][ T45] ? register_lock_class+0x31/0x2e0
[ 105.596213][ T45] ? __lock_acquire+0x6b6/0x2cf0
[ 105.598511][ T45] ? __pfx___schedule+0x10/0x10
[ 105.600665][ T45] ? do_raw_spin_unlock+0x4d/0x240
[ 105.602868][ T45] ? process_scheduled_works+0x9ef/0x1770
[ 105.605404][ T45] ? process_scheduled_works+0x9ef/0x1770
[ 105.607888][ T45] ? preempt_schedule_thunk+0x16/0x30
[ 105.610313][ T45] ? process_scheduled_works+0x9ef/0x1770
[ 105.612831][ T45] ? process_scheduled_works+0x9ef/0x1770
[ 105.615312][ T45] process_scheduled_works+0xad1/0x1770
[ 105.617795][ T45] ? __pfx_process_scheduled_works+0x10/0x10
[ 105.620429][ T45] ? do_raw_spin_lock+0x121/0x290
[ 105.622517][ T45] worker_thread+0x8a0/0xda0
[ 105.624511][ T45] kthread+0x711/0x8a0
[ 105.626316][ T45] ? __pfx_worker_thread+0x10/0x10
[ 105.628532][ T45] ? __pfx_kthread+0x10/0x10
[ 105.630528][ T45] ? _raw_spin_unlock_irq+0x23/0x50
[ 105.632709][ T45] ? __pfx_kthread+0x10/0x10
[ 105.634597][ T45] ret_from_fork+0x510/0xa50
[ 105.636634][ T45] ? __pfx_ret_from_fork+0x10/0x10
[ 105.638875][ T45] ? __switch_to+0xc9e/0x1480
[ 105.640997][ T45] ? __pfx_kthread+0x10/0x10
[ 105.642990][ T45] ret_from_fork_asm+0x1a/0x30
[ 105.645060][ T45]
[ 105.646680][ T45] Kernel Offset: disabled
[ 105.648568][ T45] Rebooting in 86400 seconds..
VM DIAGNOSIS:
04:07:07 Registers:
info registers vcpu 0
CPU#0
RAX=0000000000000061 RBX=0000000000000061 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90000a26df0
R8 =ffff888033ce0237 R9 =1ffff1100679c046 R10=dffffc0000000000 R11=ffffffff851baf30
R12=dffffc0000000000 R13=ffffffff998fea07 R14=ffffffff99c136a0 R15=0000000000000000
RIP=ffffffff851bafac RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff88808d416000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=0000555589b77608 CR3=0000000040ee2000 CR4=00352ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=0000000008200002 Opmask01=0000000000000001 Opmask02=0000000000000001 Opmask03=0000000000000000
Opmask04=00000000ffffffff Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000056127b32db30 000056127b32db30
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000056127b32db30 000056127b32db30
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000056127b3292e0
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000056127b322a40
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffff0000 ffffffffffffffff
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffff0000000000
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffff0000 ffffffffffffffff
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f51e0d52c80
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4e5552006d25203a 7d73257b52545441 20676e6974697277 20726f7272650065
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000000000000a
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 697377685f313132 303863616d2f6c61 75747269762f7365 63697665642f7379
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 003a756b733a302e 30312d3533712d63 707276633a317463 3a554d45516e7663
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3a302e30312d3533 712d63707276703a 29393030322c3948 43492b3533512843
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 50647261646e6174 536e703a554d4551 6e76733a302e3072 623a343130322f31
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 302f343064623a31 2b32316f70627e32 2d332e36312e312d 6e61696265642d33
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 423731302c313731 302c453631302c35 3631302c34363130 2c333431302c3234
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000