Warning: Permanently added '10.128.1.32' (ED25519) to the list of known hosts. [ 81.525938][ T1828] cfg80211: failed to load regulatory.db 2026/09/01 22:34:42 parsed 1 programs Setting up swapspace version 1, size = 127995904 bytes [ 85.568931][ T4527] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 86.958845][ T491] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.969933][ T491] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.979198][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 86.999308][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.007310][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.014945][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 88.307209][ T4624] chnl_net:caif_netlink_parms(): no params data found [ 88.373806][ T4624] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.380972][ T4624] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.389297][ T4624] device bridge_slave_0 entered promiscuous mode [ 88.397925][ T4624] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.405489][ T4624] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.413621][ T4624] device bridge_slave_1 entered promiscuous mode [ 88.441159][ T4624] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.457400][ T4624] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.484009][ T4624] team0: Port device team_slave_0 added [ 88.491764][ T4624] team0: Port device team_slave_1 added [ 88.513224][ T4624] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.520331][ T4624] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.548701][ T4624] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.561228][ T4624] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.568527][ T4624] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.595977][ T4624] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.632282][ T4624] device hsr_slave_0 entered promiscuous mode [ 88.639165][ T4624] device hsr_slave_1 entered promiscuous mode [ 89.227888][ T4624] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 89.246715][ T4624] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 89.266188][ T4624] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 89.286451][ T4624] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 89.400178][ T4624] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.427754][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 89.436190][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 89.457178][ T4624] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.470287][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 89.479446][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 89.488463][ T154] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.495572][ T154] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.505349][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 89.519004][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 89.529691][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 89.538857][ T1174] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.545975][ T1174] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.565007][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 89.574251][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 89.585478][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 89.596222][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 89.617188][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 89.625681][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 89.635869][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 89.646671][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 89.672163][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 89.680869][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 89.691465][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 89.712568][ T4624] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 89.827888][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 89.837339][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 89.851717][ T4624] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.873511][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 89.884959][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 89.903594][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 89.912081][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 89.920847][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 89.929300][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 89.940813][ T4624] device veth0_vlan entered promiscuous mode [ 89.953537][ T4624] device veth1_vlan entered promiscuous mode [ 89.975001][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 89.983239][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 89.992886][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 90.003170][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 90.031166][ T4624] device veth0_macvtap entered promiscuous mode [ 90.042155][ T4624] device veth1_macvtap entered promiscuous mode [ 90.054447][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 90.063274][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 90.078435][ T4624] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.087509][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 90.097111][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 90.108196][ T4624] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.118170][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 90.127116][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 90.150077][ T4624] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.159691][ T4624] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.169994][ T4624] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.179045][ T4624] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.620328][ T9] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2026/09/01 22:34:52 executed programs: 0 [ 92.859290][ T4810] chnl_net:caif_netlink_parms(): no params data found [ 92.922149][ T4810] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.931411][ T4810] bridge0: port 1(bridge_slave_0) entered disabled state [ 92.939907][ T4810] device bridge_slave_0 entered promiscuous mode [ 92.950710][ T4810] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.958241][ T4810] bridge0: port 2(bridge_slave_1) entered disabled state [ 92.966700][ T4810] device bridge_slave_1 entered promiscuous mode [ 92.988782][ T4810] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 93.000158][ T4810] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 93.026862][ T4810] team0: Port device team_slave_0 added [ 93.035803][ T4810] team0: Port device team_slave_1 added [ 93.056310][ T4810] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 93.063303][ T4810] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 93.091040][ T4810] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 93.106644][ T4810] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 93.114407][ T4810] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 93.141736][ T4810] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 93.177905][ T4810] device hsr_slave_0 entered promiscuous mode [ 93.184851][ T4810] device hsr_slave_1 entered promiscuous mode [ 93.191466][ T4810] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 93.199632][ T4810] Cannot create hsr debugfs directory [ 94.749115][ T9] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 94.803946][ T4322] Bluetooth: hci0: command 0x0409 tx timeout [ 94.819955][ T9] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 94.871457][ T9] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 95.761929][ T4810] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 95.773752][ T4810] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 95.782592][ T4810] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 95.806220][ T4810] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 95.846764][ T4810] 8021q: adding VLAN 0 to HW filter on device bond0 [ 95.877234][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 95.885361][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 95.895279][ T4810] 8021q: adding VLAN 0 to HW filter on device team0 [ 95.905811][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 95.915072][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 95.923620][ T154] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.930721][ T154] bridge0: port 1(bridge_slave_0) entered forwarding state [ 95.940601][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 95.951586][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 95.960337][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 95.968701][ T154] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.975780][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 96.000426][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 96.011398][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 96.023270][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 96.032046][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 96.041450][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 96.063540][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 96.073042][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 96.084652][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 96.093202][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 96.107540][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 96.116692][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 96.127196][ T4810] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 96.138917][ T9] device hsr_slave_0 left promiscuous mode [ 96.145818][ T9] device hsr_slave_1 left promiscuous mode [ 96.152311][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 96.160049][ T9] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 96.169414][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 96.176967][ T9] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 96.184677][ T9] device bridge_slave_1 left promiscuous mode [ 96.190831][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 96.199200][ T9] device bridge_slave_0 left promiscuous mode [ 96.206088][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 96.216699][ T9] device veth1_macvtap left promiscuous mode [ 96.222748][ T9] device veth0_macvtap left promiscuous mode [ 96.229216][ T9] device veth1_vlan left promiscuous mode [ 96.235083][ T9] device veth0_vlan left promiscuous mode [ 96.364715][ T9] team0 (unregistering): Port device team_slave_1 removed [ 96.378406][ T9] team0 (unregistering): Port device team_slave_0 removed [ 96.391433][ T9] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 96.405055][ T9] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 96.453497][ T9] bond0 (unregistering): Released all slaves [ 96.577204][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 96.585074][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 96.594751][ T4810] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 96.610371][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 96.619073][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 96.638865][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 96.651143][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 96.669670][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 96.680677][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 96.690366][ T4810] device veth0_vlan entered promiscuous mode [ 96.701475][ T4810] device veth1_vlan entered promiscuous mode [ 96.727547][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 96.735839][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 96.744290][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 96.752702][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 96.763419][ T4810] device veth0_macvtap entered promiscuous mode [ 96.772907][ T4810] device veth1_macvtap entered promiscuous mode [ 96.789269][ T4810] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 96.797686][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 96.805994][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 96.814189][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 96.823434][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 96.834942][ T4810] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 96.843408][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 96.852732][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 96.864108][ T4810] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.872834][ T4810] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.881947][ T4810] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.891025][ T4810] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.891097][ T4255] Bluetooth: hci0: command 0x041b tx timeout [ 96.967196][ T491] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.981485][ T491] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.004728][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 97.024862][ T491] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.033182][ T491] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.042782][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 97.142250][ T5028] loop0: detected capacity change from 0 to 4096 [ 97.253290][ T5028] ntfs: (device loop0): parse_options(): Option utf8 is no longer supported, using option nls=utf8. Please use option nls=utf8 in the future and make sure utf8 is compiled either as a module or into the kernel. [ 97.292770][ T5028] ntfs: volume version 3.1. [ 97.315164][ T5028] ================================================================== [ 97.323567][ T5028] BUG: KASAN: use-after-free in ntfs_readpage+0x7f6/0x2140 [ 97.330797][ T5028] Read of size 10 at addr ffff88806816d170 by task syz.0.17/5028 [ 97.338702][ T5028] [ 97.341033][ T5028] CPU: 0 PID: 5028 Comm: syz.0.17 Not tainted syzkaller #0 [ 97.348226][ T5028] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 97.358384][ T5028] Call Trace: [ 97.361666][ T5028] [ 97.364637][ T5028] dump_stack_lvl+0x188/0x250 [ 97.369355][ T5028] ? show_regs_print_info+0x20/0x20 [ 97.374556][ T5028] ? _printk+0xda/0x130 [ 97.378716][ T5028] ? ntfs_readpage+0x7f6/0x2140 [ 97.383583][ T5028] ? load_image+0x410/0x410 [ 97.388095][ T5028] print_address_description+0x60/0x2d0 [ 97.393665][ T5028] ? ntfs_readpage+0x7f6/0x2140 [ 97.398544][ T5028] kasan_report+0xdf/0x130 [ 97.402963][ T5028] ? ntfs_readpage+0x7f6/0x2140 [ 97.407812][ T5028] kasan_check_range+0x235/0x290 [ 97.412842][ T5028] ? ntfs_readpage+0x7f6/0x2140 [ 97.417690][ T5028] memcpy+0x25/0x60 [ 97.421499][ T5028] ntfs_readpage+0x7f6/0x2140 [ 97.426182][ T5028] ? __lock_acquire+0x7b50/0x7b50 [ 97.431221][ T5028] ? ntfs_writepage+0x1360/0x1360 [ 97.436252][ T5028] ? xa_load+0x276/0x2a0 [ 97.440515][ T5028] ? readahead_page+0x295/0x3d0 [ 97.445370][ T5028] ? ntfs_writepage+0x1360/0x1360 [ 97.450388][ T5028] read_pages+0x60a/0x920 [ 97.454727][ T5028] ? page_cache_ra_unbounded+0x8f0/0x8f0 [ 97.460368][ T5028] ? add_to_page_cache_lru+0x2ad/0x4a0 [ 97.465921][ T5028] page_cache_ra_unbounded+0x7f4/0x8f0 [ 97.471398][ T5028] ? read_cache_pages_invalidate_pages+0x1c0/0x1c0 [ 97.477909][ T5028] ? blk_cgroup_congested+0x30b/0x390 [ 97.483298][ T5028] filemap_read+0x5ef/0x2560 [ 97.487887][ T5028] ? rcu_lock_release+0x5/0x20 [ 97.492681][ T5028] ? find_get_pages_range_tag+0x450/0x450 [ 97.498402][ T5028] ? __kernel_text_address+0x9a/0x100 [ 97.503783][ T5028] ? unwind_get_return_address+0x49/0x80 [ 97.509450][ T5028] ? generic_file_read_iter+0x94/0x480 [ 97.514931][ T5028] ? iov_iter_kvec+0xb4/0x170 [ 97.519616][ T5028] __kernel_read+0x51d/0x980 [ 97.524205][ T5028] ? __kasan_kmalloc+0xc6/0xe0 [ 97.528976][ T5028] ? __kasan_kmalloc+0xaf/0xe0 [ 97.533762][ T5028] ? rw_verify_area+0x1b0/0x1b0 [ 97.538655][ T5028] integrity_kernel_read+0x86/0xd0 [ 97.543853][ T5028] ? integrity_inode_free+0x170/0x170 [ 97.549326][ T5028] ima_calc_file_hash+0x946/0x1940 [ 97.554438][ T5028] ? mark_lock+0x94/0x320 [ 97.558776][ T5028] ? __lock_acquire+0x13dc/0x7b50 [ 97.563813][ T5028] ? ima_alloc_tfm+0x2f0/0x2f0 [ 97.568637][ T5028] ? __mutex_trylock_common+0x15c/0x260 [ 97.574194][ T5028] ? rcu_lock_release+0x20/0x20 [ 97.579065][ T5028] ima_collect_measurement+0x335/0x7e0 [ 97.584540][ T5028] ? ima_get_action+0xa0/0xa0 [ 97.589235][ T5028] ? is_bad_inode+0x9/0x40 [ 97.593660][ T5028] process_measurement+0x1185/0x1c20 [ 97.598962][ T5028] ? ima_file_mmap+0x140/0x140 [ 97.603734][ T5028] ? tomoyo_check_path_number_acl+0x280/0x280 [ 97.610025][ T5028] ima_file_check+0xc7/0x110 [ 97.614621][ T5028] ? ima_bprm_check+0x200/0x200 [ 97.619531][ T5028] ? vfs_open+0x2b/0x80 [ 97.623686][ T5028] path_openat+0x27cf/0x2fb0 [ 97.628346][ T5028] ? do_filp_open+0x400/0x400 [ 97.633048][ T5028] do_filp_open+0x1df/0x400 [ 97.637609][ T5028] ? vfs_tmpfile+0x300/0x300 [ 97.642222][ T5028] ? _raw_spin_unlock+0x24/0x40 [ 97.647080][ T5028] ? alloc_fd+0x59e/0x650 [ 97.651425][ T5028] do_sys_openat2+0x14b/0x500 [ 97.656190][ T5028] ? __lock_acquire+0x7b50/0x7b50 [ 97.661225][ T5028] ? do_sys_open+0xe0/0xe0 [ 97.665645][ T5028] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 97.671633][ T5028] ? lock_chain_count+0x20/0x20 [ 97.676492][ T5028] __x64_sys_openat+0x135/0x160 [ 97.681359][ T5028] do_syscall_64+0x4c/0xa0 [ 97.685775][ T5028] ? clear_bhb_loop+0x30/0x80 [ 97.690450][ T5028] ? clear_bhb_loop+0x30/0x80 [ 97.695139][ T5028] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 97.701050][ T5028] RIP: 0033:0x7efd7ffd2629 [ 97.705469][ T5028] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 97.725112][ T5028] RSP: 002b:00007efd7f634028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 97.733544][ T5028] RAX: ffffffffffffffda RBX: 00007efd8024bfa0 RCX: 00007efd7ffd2629 [ 97.741526][ T5028] RDX: 0000000000141842 RSI: 0000200000000100 RDI: ffffffffffffff9c [ 97.749508][ T5028] RBP: 00007efd80068b39 R08: 0000000000000000 R09: 0000000000000000 [ 97.757493][ T5028] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 97.765479][ T5028] R13: 00007efd8024c038 R14: 00007efd8024bfa0 R15: 00007fff1907a038 [ 97.773471][ T5028] [ 97.776495][ T5028] [ 97.778820][ T5028] The buggy address belongs to the page: [ 97.784456][ T5028] page:ffffea0001a05b40 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x6816d [ 97.794697][ T5028] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 97.801834][ T5028] raw: 00fff00000000000 ffffea0001a06048 ffffea0001a05e88 0000000000000000 [ 97.810424][ T5028] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 97.819005][ T5028] page dumped because: kasan: bad access detected [ 97.825433][ T5028] page_owner tracks the page as freed [ 97.831087][ T5028] page last allocated via order 0, migratetype Movable, gfp_mask 0x1100dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO), pid 4977, ts 94865778255, free_ts 94871704904 [ 97.846714][ T5028] get_page_from_freelist+0x24f6/0x2670 [ 97.852278][ T5028] __alloc_pages+0x1ee/0x480 [ 97.856907][ T5028] alloc_pages_vma+0x2bc/0x790 [ 97.861655][ T5028] handle_mm_fault+0x23be/0x4440 [ 97.866575][ T5028] do_user_addr_fault+0x494/0xc90 [ 97.871587][ T5028] exc_page_fault+0x60/0x100 [ 97.876159][ T5028] asm_exc_page_fault+0x22/0x30 [ 97.881001][ T5028] page last free stack trace: [ 97.885653][ T5028] free_unref_page_prepare+0x637/0x6c0 [ 97.891093][ T5028] free_unref_page_list+0x119/0x830 [ 97.896271][ T5028] release_pages+0x185f/0x1bd0 [ 97.901024][ T5028] tlb_finish_mmu+0x1b4/0x370 [ 97.905685][ T5028] exit_mmap+0x3d0/0x640 [ 97.909930][ T5028] __mmput+0x115/0x390 [ 97.913980][ T5028] exit_mm+0x632/0x7b0 [ 97.918027][ T5028] do_exit+0x5b8/0x2110 [ 97.922257][ T5028] do_group_exit+0x12c/0x2f0 [ 97.926835][ T5028] __x64_sys_exit_group+0x3b/0x40 [ 97.931842][ T5028] do_syscall_64+0x4c/0xa0 [ 97.936244][ T5028] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 97.942126][ T5028] [ 97.944430][ T5028] Memory state around the buggy address: [ 97.950039][ T5028] ffff88806816d000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 97.958094][ T5028] ffff88806816d080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 97.966143][ T5028] >ffff88806816d100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 97.974179][ T5028] ^ [ 97.981875][ T5028] ffff88806816d180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 97.990006][ T5028] ffff88806816d200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 97.998052][ T5028] ================================================================== [ 98.006089][ T5028] Disabling lock debugging due to kernel taint [ 98.012888][ T5028] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 98.020082][ T5028] CPU: 0 PID: 5028 Comm: syz.0.17 Tainted: G B syzkaller #0 [ 98.028665][ T5028] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 98.038717][ T5028] Call Trace: [ 98.042000][ T5028] [ 98.044933][ T5028] dump_stack_lvl+0x188/0x250 [ 98.049619][ T5028] ? show_regs_print_info+0x20/0x20 [ 98.054824][ T5028] ? load_image+0x410/0x410 [ 98.059349][ T5028] panic+0x2f8/0x850 [ 98.063256][ T5028] ? bpf_jit_dump+0xd0/0xd0 [ 98.068010][ T5028] ? _raw_spin_unlock_irqrestore+0xbc/0x120 [ 98.073924][ T5028] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 98.079811][ T5028] ? _raw_spin_unlock+0x40/0x40 [ 98.084653][ T5028] ? print_memory_metadata+0x314/0x400 [ 98.090098][ T5028] ? ntfs_readpage+0x7f6/0x2140 [ 98.094948][ T5028] check_panic_on_warn+0x80/0xa0 [ 98.099882][ T5028] ? ntfs_readpage+0x7f6/0x2140 [ 98.104711][ T5028] end_report+0x6d/0xf0 [ 98.108847][ T5028] kasan_report+0x102/0x130 [ 98.113340][ T5028] ? ntfs_readpage+0x7f6/0x2140 [ 98.118176][ T5028] kasan_check_range+0x235/0x290 [ 98.123222][ T5028] ? ntfs_readpage+0x7f6/0x2140 [ 98.128059][ T5028] memcpy+0x25/0x60 [ 98.131892][ T5028] ntfs_readpage+0x7f6/0x2140 [ 98.136667][ T5028] ? __lock_acquire+0x7b50/0x7b50 [ 98.141691][ T5028] ? ntfs_writepage+0x1360/0x1360 [ 98.146800][ T5028] ? xa_load+0x276/0x2a0 [ 98.151029][ T5028] ? readahead_page+0x295/0x3d0 [ 98.155864][ T5028] ? ntfs_writepage+0x1360/0x1360 [ 98.160980][ T5028] read_pages+0x60a/0x920 [ 98.165303][ T5028] ? page_cache_ra_unbounded+0x8f0/0x8f0 [ 98.170925][ T5028] ? add_to_page_cache_lru+0x2ad/0x4a0 [ 98.176363][ T5028] page_cache_ra_unbounded+0x7f4/0x8f0 [ 98.181809][ T5028] ? read_cache_pages_invalidate_pages+0x1c0/0x1c0 [ 98.188471][ T5028] ? blk_cgroup_congested+0x30b/0x390 [ 98.193833][ T5028] filemap_read+0x5ef/0x2560 [ 98.198438][ T5028] ? rcu_lock_release+0x5/0x20 [ 98.203184][ T5028] ? find_get_pages_range_tag+0x450/0x450 [ 98.208896][ T5028] ? __kernel_text_address+0x9a/0x100 [ 98.214255][ T5028] ? unwind_get_return_address+0x49/0x80 [ 98.219882][ T5028] ? generic_file_read_iter+0x94/0x480 [ 98.225323][ T5028] ? iov_iter_kvec+0xb4/0x170 [ 98.229997][ T5028] __kernel_read+0x51d/0x980 [ 98.234907][ T5028] ? __kasan_kmalloc+0xc6/0xe0 [ 98.239671][ T5028] ? __kasan_kmalloc+0xaf/0xe0 [ 98.244438][ T5028] ? rw_verify_area+0x1b0/0x1b0 [ 98.249299][ T5028] integrity_kernel_read+0x86/0xd0 [ 98.254674][ T5028] ? integrity_inode_free+0x170/0x170 [ 98.260030][ T5028] ima_calc_file_hash+0x946/0x1940 [ 98.265125][ T5028] ? mark_lock+0x94/0x320 [ 98.269438][ T5028] ? __lock_acquire+0x13dc/0x7b50 [ 98.274454][ T5028] ? ima_alloc_tfm+0x2f0/0x2f0 [ 98.279227][ T5028] ? __mutex_trylock_common+0x15c/0x260 [ 98.284866][ T5028] ? rcu_lock_release+0x20/0x20 [ 98.289702][ T5028] ima_collect_measurement+0x335/0x7e0 [ 98.295169][ T5028] ? ima_get_action+0xa0/0xa0 [ 98.299828][ T5028] ? is_bad_inode+0x9/0x40 [ 98.304224][ T5028] process_measurement+0x1185/0x1c20 [ 98.309508][ T5028] ? ima_file_mmap+0x140/0x140 [ 98.314252][ T5028] ? tomoyo_check_path_number_acl+0x280/0x280 [ 98.320303][ T5028] ima_file_check+0xc7/0x110 [ 98.324868][ T5028] ? ima_bprm_check+0x200/0x200 [ 98.329701][ T5028] ? vfs_open+0x2b/0x80 [ 98.333837][ T5028] path_openat+0x27cf/0x2fb0 [ 98.338409][ T5028] ? do_filp_open+0x400/0x400 [ 98.343090][ T5028] do_filp_open+0x1df/0x400 [ 98.347579][ T5028] ? vfs_tmpfile+0x300/0x300 [ 98.352146][ T5028] ? _raw_spin_unlock+0x24/0x40 [ 98.356972][ T5028] ? alloc_fd+0x59e/0x650 [ 98.361279][ T5028] do_sys_openat2+0x14b/0x500 [ 98.365964][ T5028] ? __lock_acquire+0x7b50/0x7b50 [ 98.370971][ T5028] ? do_sys_open+0xe0/0xe0 [ 98.375539][ T5028] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 98.382845][ T5028] ? lock_chain_count+0x20/0x20 [ 98.387689][ T5028] __x64_sys_openat+0x135/0x160 [ 98.392526][ T5028] do_syscall_64+0x4c/0xa0 [ 98.396935][ T5028] ? clear_bhb_loop+0x30/0x80 [ 98.401590][ T5028] ? clear_bhb_loop+0x30/0x80 [ 98.406261][ T5028] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 98.412134][ T5028] RIP: 0033:0x7efd7ffd2629 [ 98.416534][ T5028] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 98.436397][ T5028] RSP: 002b:00007efd7f634028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 98.444822][ T5028] RAX: ffffffffffffffda RBX: 00007efd8024bfa0 RCX: 00007efd7ffd2629 [ 98.452893][ T5028] RDX: 0000000000141842 RSI: 0000200000000100 RDI: ffffffffffffff9c [ 98.460862][ T5028] RBP: 00007efd80068b39 R08: 0000000000000000 R09: 0000000000000000 [ 98.468822][ T5028] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 98.476779][ T5028] R13: 00007efd8024c038 R14: 00007efd8024bfa0 R15: 00007fff1907a038 [ 98.484739][ T5028] [ 98.487994][ T5028] Kernel Offset: disabled [ 98.492431][ T5028] Rebooting in 86400 seconds..