Warning: Permanently added '[localhost]:48218' (ED25519) to the list of known hosts. 2025/09/23 13:24:48 parsed 1 programs syzkaller login: [ 54.921737][ T5852] cgroup: Unknown subsys name 'net' [ 55.005378][ T5852] cgroup: Unknown subsys name 'cpuset' [ 55.011111][ T5852] cgroup: Unknown subsys name 'rlimit' [ 56.791987][ T5852] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 59.201480][ T5859] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 60.513248][ T5897] chnl_net:caif_netlink_parms(): no params data found [ 60.620953][ T5897] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.624790][ T5897] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.627685][ T5897] bridge_slave_0: entered allmulticast mode [ 60.632068][ T5897] bridge_slave_0: entered promiscuous mode [ 60.637816][ T5897] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.640893][ T5897] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.643687][ T5897] bridge_slave_1: entered allmulticast mode [ 60.646638][ T5897] bridge_slave_1: entered promiscuous mode [ 60.667073][ T5897] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 60.671623][ T5897] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 60.692819][ T5897] team0: Port device team_slave_0 added [ 60.696399][ T5897] team0: Port device team_slave_1 added [ 60.717113][ T5897] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 60.719885][ T5897] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 60.728077][ T5897] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 60.734322][ T5897] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 60.736773][ T5897] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 60.745627][ T5897] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 60.776565][ T5897] hsr_slave_0: entered promiscuous mode [ 60.779054][ T5897] hsr_slave_1: entered promiscuous mode [ 60.886935][ T5897] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 60.893498][ T5897] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 60.897947][ T5897] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 60.903019][ T5897] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 60.923092][ T5897] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.925393][ T5897] bridge0: port 2(bridge_slave_1) entered forwarding state [ 60.928013][ T5897] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.930286][ T5897] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.967398][ T5897] 8021q: adding VLAN 0 to HW filter on device bond0 [ 60.978113][ T27] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.982204][ T27] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.991390][ T5897] 8021q: adding VLAN 0 to HW filter on device team0 [ 60.998576][ T27] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.001300][ T27] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.010679][ T27] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.012872][ T27] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.126144][ T5897] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 61.159099][ T5897] veth0_vlan: entered promiscuous mode [ 61.169088][ T5897] veth1_vlan: entered promiscuous mode [ 61.195138][ T5897] veth0_macvtap: entered promiscuous mode [ 61.201925][ T5897] veth1_macvtap: entered promiscuous mode [ 61.218429][ T5897] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 61.227858][ T5897] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 61.238937][ T5911] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.242444][ T5911] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.245489][ T5911] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.251121][ T5911] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.330302][ T5911] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 61.382223][ T5911] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 61.407198][ T942] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 61.411055][ T942] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 61.427451][ T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 61.431503][ T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 61.441445][ T5911] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 61.506078][ T5911] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 61.981278][ T5942] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 61.984190][ T5942] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 61.986672][ T5942] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 61.989962][ T5942] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 61.992794][ T5942] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 2025/09/23 13:24:57 executed programs: 0 [ 62.312054][ T5238] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 62.314897][ T5238] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 62.319808][ T5238] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 62.323083][ T5238] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 62.325717][ T5238] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 62.434029][ T5952] chnl_net:caif_netlink_parms(): no params data found [ 62.484995][ T5952] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.487228][ T5952] bridge0: port 1(bridge_slave_0) entered disabled state [ 62.489773][ T5952] bridge_slave_0: entered allmulticast mode [ 62.492506][ T5952] bridge_slave_0: entered promiscuous mode [ 62.496233][ T5952] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.498853][ T5952] bridge0: port 2(bridge_slave_1) entered disabled state [ 62.502015][ T5952] bridge_slave_1: entered allmulticast mode [ 62.504725][ T5952] bridge_slave_1: entered promiscuous mode [ 62.526790][ T5952] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 62.531622][ T5952] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 62.551467][ T5952] team0: Port device team_slave_0 added [ 62.554909][ T5952] team0: Port device team_slave_1 added [ 62.573869][ T5952] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 62.576059][ T5952] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 62.583893][ T5952] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 62.588705][ T5952] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 62.591176][ T5952] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 62.599156][ T5952] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 62.629102][ T5952] hsr_slave_0: entered promiscuous mode [ 62.632178][ T5952] hsr_slave_1: entered promiscuous mode [ 62.634490][ T5952] debugfs: 'hsr0' already exists in 'hsr' [ 62.636599][ T5952] Cannot create hsr debugfs directory [ 64.410070][ T5942] Bluetooth: hci0: command tx timeout [ 64.788324][ T5911] bridge_slave_1: left allmulticast mode [ 64.791306][ T5911] bridge_slave_1: left promiscuous mode [ 64.797130][ T5911] bridge0: port 2(bridge_slave_1) entered disabled state [ 64.805376][ T5911] bridge_slave_0: left allmulticast mode [ 64.807589][ T5911] bridge_slave_0: left promiscuous mode [ 64.811245][ T5911] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.141703][ T5911] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 65.147168][ T5911] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 65.152407][ T5911] bond0 (unregistering): Released all slaves [ 65.240226][ T5911] hsr_slave_0: left promiscuous mode [ 65.243118][ T5911] hsr_slave_1: left promiscuous mode [ 65.245777][ T5911] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 65.248343][ T5911] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 65.252934][ T5911] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 65.255988][ T5911] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 65.281374][ T5911] veth1_macvtap: left promiscuous mode [ 65.283213][ T5911] veth0_macvtap: left promiscuous mode [ 65.285201][ T5911] veth1_vlan: left promiscuous mode [ 65.287329][ T5911] veth0_vlan: left promiscuous mode [ 65.643619][ T5911] team0 (unregistering): Port device team_slave_1 removed [ 65.662735][ T5911] team0 (unregistering): Port device team_slave_0 removed [ 66.173292][ T5952] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 66.184490][ T5952] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 66.196080][ T5952] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 66.208107][ T5952] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 66.461554][ T5952] 8021q: adding VLAN 0 to HW filter on device bond0 [ 66.477246][ T5952] 8021q: adding VLAN 0 to HW filter on device team0 [ 66.488054][ T28] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.490946][ T28] bridge0: port 1(bridge_slave_0) entered forwarding state [ 66.496463][ T5942] Bluetooth: hci0: command tx timeout [ 66.507845][ T28] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.510763][ T28] bridge0: port 2(bridge_slave_1) entered forwarding state [ 66.764282][ T5952] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 66.826429][ T5952] veth0_vlan: entered promiscuous mode [ 66.836404][ T5952] veth1_vlan: entered promiscuous mode [ 66.864197][ T5952] veth0_macvtap: entered promiscuous mode [ 66.870870][ T5952] veth1_macvtap: entered promiscuous mode [ 66.883430][ T5952] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 66.906124][ T5952] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 66.916086][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.921466][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.925761][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.929907][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.985359][ T1091] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.987716][ T1091] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.005641][ T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.008172][ T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.036953][ T5992] ================================================================== [ 67.039489][ T5992] BUG: KASAN: slab-out-of-bounds in zpool_get_total_pages+0x46/0x70 [ 67.041820][ T5992] Read of size 8 at addr ffff88810ccc7b10 by task syz.0.17/5992 [ 67.044688][ T5992] [ 67.045795][ T5992] CPU: 0 UID: 0 PID: 5992 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 67.045807][ T5992] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 67.045813][ T5992] Call Trace: [ 67.045818][ T5992] [ 67.045823][ T5992] dump_stack_lvl+0x189/0x250 [ 67.045836][ T5992] ? __virt_addr_valid+0x1c8/0x5c0 [ 67.045845][ T5992] ? rcu_is_watching+0x15/0xb0 [ 67.045857][ T5992] ? __kasan_check_byte+0x12/0x40 [ 67.045865][ T5992] ? __pfx_dump_stack_lvl+0x10/0x10 [ 67.045873][ T5992] ? rcu_is_watching+0x15/0xb0 [ 67.045884][ T5992] ? lock_release+0x4b/0x3e0 [ 67.045895][ T5992] ? __virt_addr_valid+0x1c8/0x5c0 [ 67.045903][ T5992] ? __virt_addr_valid+0x4a5/0x5c0 [ 67.045911][ T5992] print_report+0xca/0x240 [ 67.045918][ T5992] ? zpool_get_total_pages+0x46/0x70 [ 67.045926][ T5992] kasan_report+0x118/0x150 [ 67.045933][ T5992] ? zpool_get_total_pages+0x46/0x70 [ 67.045943][ T5992] kasan_check_range+0x2b0/0x2c0 [ 67.045951][ T5992] zpool_get_total_pages+0x46/0x70 [ 67.045958][ T5992] ? zswap_total_pages+0x1f/0x1e0 [ 67.045967][ T5992] zswap_total_pages+0xf6/0x1e0 [ 67.045975][ T5992] zswap_store+0x52f/0x1f40 [ 67.045982][ T5992] ? preempt_schedule+0xae/0xc0 [ 67.045990][ T5992] ? preempt_schedule_common+0x83/0xd0 [ 67.045997][ T5992] ? preempt_schedule+0xae/0xc0 [ 67.046003][ T5992] ? __pfx_preempt_schedule+0x10/0x10 [ 67.046009][ T5992] ? do_raw_spin_lock+0x121/0x290 [ 67.046019][ T5992] ? __pfx_zswap_store+0x10/0x10 [ 67.046026][ T5992] ? preempt_schedule_thunk+0x16/0x30 [ 67.046034][ T5992] ? _raw_spin_unlock+0x3f/0x50 [ 67.046044][ T5992] ? swap_entry_swapped+0x139/0x1c0 [ 67.046054][ T5992] ? folio_free_swap+0x1ed/0x370 [ 67.046071][ T5992] swap_writeout+0x710/0xd70 [ 67.046081][ T5992] shrink_folio_list+0x3011/0x4c70 [ 67.046097][ T5992] ? __pfx_shrink_folio_list+0x10/0x10 [ 67.046107][ T5992] ? __lock_acquire+0xab9/0xd20 [ 67.046145][ T5992] ? is_bpf_text_address+0x26/0x2b0 [ 67.046158][ T5992] ? css_rstat_updated+0x23a/0x4f0 [ 67.046169][ T5992] ? is_bpf_text_address+0x292/0x2b0 [ 67.046181][ T5992] reclaim_folio_list+0xeb/0x500 [ 67.046190][ T5992] ? arch_stack_walk+0xfc/0x150 [ 67.046200][ T5992] ? __pfx_reclaim_folio_list+0x10/0x10 [ 67.046209][ T5992] ? lru_gen_update_size+0x818/0xd20 [ 67.046224][ T5992] ? __mod_zone_page_state+0xd7/0x140 [ 67.046237][ T5992] ? lru_gen_del_folio+0x359/0x540 [ 67.046244][ T5992] reclaim_pages+0x454/0x520 [ 67.046254][ T5992] ? __pfx_reclaim_pages+0x10/0x10 [ 67.046263][ T5992] ? madvise_cold_or_pageout_pte_range+0x194b/0x1d00 [ 67.046272][ T5992] madvise_cold_or_pageout_pte_range+0x1974/0x1d00 [ 67.046284][ T5992] ? __pfx_madvise_cold_or_pageout_pte_range+0x10/0x10 [ 67.046292][ T5992] ? lock_release+0x4b/0x3e0 [ 67.046303][ T5992] ? is_bpf_text_address+0x292/0x2b0 [ 67.046312][ T5992] ? is_bpf_text_address+0x26/0x2b0 [ 67.046323][ T5992] walk_pgd_range+0xfe9/0x1d40 [ 67.046339][ T5992] ? __pfx_walk_pgd_range+0x10/0x10 [ 67.046347][ T5992] ? lockdep_unlock+0x89/0x120 [ 67.046356][ T5992] ? validate_chain+0x897/0x2140 [ 67.046363][ T5992] __walk_page_range+0x14c/0x710 [ 67.046376][ T5992] walk_page_range_vma+0x393/0x440 [ 67.046385][ T5992] ? mlock_drain_local+0x79/0x490 [ 67.046394][ T5992] ? __pfx_walk_page_range_vma+0x10/0x10 [ 67.046404][ T5992] ? mlock_drain_local+0x79/0x490 [ 67.046413][ T5992] madvise_vma_behavior+0x311f/0x3a10 [ 67.046422][ T5992] ? __pfx_madvise_vma_behavior+0x10/0x10 [ 67.046432][ T5992] ? __lock_acquire+0xab9/0xd20 [ 67.046442][ T5992] ? ktime_get_coarse_real_ts64_mg+0x52/0x1e0 [ 67.046457][ T5992] ? mas_prev_slot+0xb31/0xbb0 [ 67.046470][ T5992] ? find_vma_prev+0xe3/0x150 [ 67.046480][ T5992] ? __pfx_find_vma_prev+0x10/0x10 [ 67.046491][ T5992] ? __lock_acquire+0xab9/0xd20 [ 67.046501][ T5992] madvise_walk_vmas+0x51c/0xa30 [ 67.046510][ T5992] ? __pfx_madvise_walk_vmas+0x10/0x10 [ 67.046518][ T5992] ? blk_start_plug+0x6f/0x1b0 [ 67.046530][ T5992] madvise_do_behavior+0x38e/0x550 [ 67.046538][ T5992] ? __pfx_madvise_do_behavior+0x10/0x10 [ 67.046546][ T5992] ? down_read+0x1ad/0x2e0 [ 67.046555][ T5992] do_madvise+0x1bc/0x270 [ 67.046562][ T5992] ? __pfx_do_madvise+0x10/0x10 [ 67.046573][ T5992] ? __pfx___se_sys_futex+0x10/0x10 [ 67.046582][ T5992] ? do_user_addr_fault+0xc85/0x1380 [ 67.046593][ T5992] __x64_sys_madvise+0xa7/0xc0 [ 67.046600][ T5992] do_syscall_64+0xfa/0xfa0 [ 67.046608][ T5992] ? lockdep_hardirqs_on+0x9c/0x150 [ 67.046615][ T5992] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 67.046623][ T5992] ? exc_page_fault+0xab/0x100 [ 67.046630][ T5992] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 67.046637][ T5992] RIP: 0033:0x7f526318ec29 [ 67.046646][ T5992] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 67.046662][ T5992] RSP: 002b:00007ffdd0a28298 EFLAGS: 00000246 ORIG_RAX: 000000000000001c [ 67.046671][ T5992] RAX: ffffffffffffffda RBX: 00007f52633d5fa0 RCX: 00007f526318ec29 [ 67.046676][ T5992] RDX: 0000000000000015 RSI: 0000000000003000 RDI: 0000200000000000 [ 67.046681][ T5992] RBP: 00007f5263211e41 R08: 0000000000000000 R09: 0000000000000000 [ 67.046686][ T5992] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 67.046690][ T5992] R13: 00007f52633d5fa0 R14: 00007f52633d5fa0 R15: 0000000000000003 [ 67.046698][ T5992] [ 67.046701][ T5992] [ 67.210666][ T5992] Allocated by task 1: [ 67.211996][ T5992] kasan_save_track+0x3e/0x80 [ 67.213404][ T5992] __kasan_kmalloc+0x93/0xb0 [ 67.214817][ T5992] __kmalloc_noprof+0x411/0x7f0 [ 67.216270][ T5992] shrinker_alloc+0x199/0xa80 [ 67.217687][ T5992] binder_alloc_shrinker_init+0x45/0xe0 [ 67.219361][ T5992] binder_init+0x17/0x260 [ 67.220627][ T5992] do_one_initcall+0x236/0x820 [ 67.222065][ T5992] do_initcall_level+0x104/0x190 [ 67.223533][ T5992] do_initcalls+0x59/0xa0 [ 67.224797][ T5992] kernel_init_freeable+0x334/0x4b0 [ 67.226336][ T5992] kernel_init+0x1d/0x1d0 [ 67.227615][ T5992] ret_from_fork+0x4bc/0x870 [ 67.228978][ T5992] ret_from_fork_asm+0x1a/0x30 [ 67.230416][ T5992] [ 67.231121][ T5992] The buggy address belongs to the object at ffff88810ccc7b00 [ 67.231121][ T5992] which belongs to the cache kmalloc-8 of size 8 [ 67.235114][ T5992] The buggy address is located 8 bytes to the right of [ 67.235114][ T5992] allocated 8-byte region [ffff88810ccc7b00, ffff88810ccc7b08) [ 67.239294][ T5992] [ 67.240002][ T5992] The buggy address belongs to the physical page: [ 67.241868][ T5992] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10ccc7 [ 67.244459][ T5992] anon flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff) [ 67.246826][ T5992] page_type: f5(slab) [ 67.248058][ T5992] raw: 057ff00000000000 ffff88801a841500 0000000000000000 dead000000000001 [ 67.250609][ T5992] raw: 0000000000000000 0000000000800080 00000000f5000000 0000000000000000 [ 67.253164][ T5992] page dumped because: kasan: bad access detected [ 67.255057][ T5992] page_owner tracks the page as allocated [ 67.256740][ T5992] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 16130935485, free_ts 0 [ 67.261868][ T5992] post_alloc_hook+0x240/0x2a0 [ 67.263308][ T5992] get_page_from_freelist+0x21e4/0x22c0 [ 67.264955][ T5992] __alloc_frozen_pages_noprof+0x181/0x370 [ 67.266711][ T5992] alloc_pages_mpol+0x232/0x4a0 [ 67.268166][ T5992] allocate_slab+0x96/0x3a0 [ 67.269523][ T5992] ___slab_alloc+0xe94/0x1920 [ 67.271074][ T5992] __slab_alloc+0x65/0x100 [ 67.272500][ T5992] __kmalloc_node_track_caller_noprof+0x5c7/0x800 [ 67.274581][ T5992] kstrdup+0x42/0x100 [ 67.275823][ T5992] __kernfs_new_node+0x9c/0x7e0 [ 67.277313][ T5992] kernfs_new_node+0x102/0x210 [ 67.278826][ T5992] kernfs_create_link+0xa7/0x200 [ 67.280329][ T5992] sysfs_do_create_link_sd+0x83/0x110 [ 67.282242][ T5992] device_create_sys_dev_entry+0x11a/0x180 [ 67.284383][ T5992] device_add+0x733/0xb50 [ 67.285900][ T5992] __video_register_device+0x3dc1/0x4ca0 [ 67.287946][ T5992] page_owner free stack trace missing [ 67.289611][ T5992] [ 67.290428][ T5992] Memory state around the buggy address: [ 67.292511][ T5992] ffff88810ccc7a00: 00 fc fc fc 05 fc fc fc 00 fc fc fc 00 fc fc fc [ 67.295451][ T5992] ffff88810ccc7a80: 00 fc fc fc 05 fc fc fc 06 fc fc fc 06 fc fc fc [ 67.298430][ T5992] >ffff88810ccc7b00: 00 fc fc fc 06 fc fc fc 07 fc fc fc 07 fc fc fc [ 67.300808][ T5992] ^ [ 67.302532][ T5992] ffff88810ccc7b80: 04 fc fc fc 06 fc fc fc 00 fc fc fc 00 fc fc fc [ 67.305344][ T5992] ffff88810ccc7c00: 07 fc fc fc 00 fc fc fc 06 fc fc fc 05 fc fc fc [ 67.307952][ T5992] ================================================================== [ 67.317624][ T5992] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 67.319864][ T5992] CPU: 0 UID: 0 PID: 5992 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 67.322557][ T5992] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 67.325595][ T5992] Call Trace: [ 67.326621][ T5992] [ 67.327524][ T5992] dump_stack_lvl+0x99/0x250 [ 67.328923][ T5992] ? __asan_memcpy+0x40/0x70 [ 67.330340][ T5992] ? __pfx_dump_stack_lvl+0x10/0x10 [ 67.331909][ T5992] ? __pfx__printk+0x10/0x10 [ 67.333301][ T5992] vpanic+0x237/0x6d0 [ 67.334477][ T5992] ? __pfx_vpanic+0x10/0x10 [ 67.335872][ T5992] ? preempt_schedule_common+0x83/0xd0 [ 67.337520][ T5992] ? preempt_schedule+0xae/0xc0 [ 67.339027][ T5992] panic+0xb9/0xc0 [ 67.340187][ T5992] ? __pfx_panic+0x10/0x10 [ 67.341513][ T5992] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 67.343402][ T5992] ? zpool_get_total_pages+0x46/0x70 [ 67.345008][ T5992] check_panic_on_warn+0x89/0xb0 [ 67.346553][ T5992] ? zpool_get_total_pages+0x46/0x70 [ 67.348264][ T5992] end_report+0x78/0x160 [ 67.349708][ T5992] kasan_report+0x129/0x150 [ 67.351193][ T5992] ? zpool_get_total_pages+0x46/0x70 [ 67.352842][ T5992] kasan_check_range+0x2b0/0x2c0 [ 67.354324][ T5992] zpool_get_total_pages+0x46/0x70 [ 67.355822][ T5992] ? zswap_total_pages+0x1f/0x1e0 [ 67.357384][ T5992] zswap_total_pages+0xf6/0x1e0 [ 67.358992][ T5992] zswap_store+0x52f/0x1f40 [ 67.360412][ T5992] ? preempt_schedule+0xae/0xc0 [ 67.361962][ T5992] ? preempt_schedule_common+0x83/0xd0 [ 67.363675][ T5992] ? preempt_schedule+0xae/0xc0 [ 67.365190][ T5992] ? __pfx_preempt_schedule+0x10/0x10 [ 67.367046][ T5992] ? do_raw_spin_lock+0x121/0x290 [ 67.368835][ T5992] ? __pfx_zswap_store+0x10/0x10 [ 67.370485][ T5992] ? preempt_schedule_thunk+0x16/0x30 [ 67.372334][ T5992] ? _raw_spin_unlock+0x3f/0x50 [ 67.374174][ T5992] ? swap_entry_swapped+0x139/0x1c0 [ 67.375926][ T5992] ? folio_free_swap+0x1ed/0x370 [ 67.377742][ T5992] swap_writeout+0x710/0xd70 [ 67.379464][ T5992] shrink_folio_list+0x3011/0x4c70 [ 67.381220][ T5992] ? __pfx_shrink_folio_list+0x10/0x10 [ 67.382935][ T5992] ? __lock_acquire+0xab9/0xd20 [ 67.384403][ T5992] ? is_bpf_text_address+0x26/0x2b0 [ 67.386330][ T5992] ? css_rstat_updated+0x23a/0x4f0 [ 67.388055][ T5992] ? is_bpf_text_address+0x292/0x2b0 [ 67.389796][ T5992] reclaim_folio_list+0xeb/0x500 [ 67.391448][ T5992] ? arch_stack_walk+0xfc/0x150 [ 67.393157][ T5992] ? __pfx_reclaim_folio_list+0x10/0x10 [ 67.395024][ T5992] ? lru_gen_update_size+0x818/0xd20 [ 67.396796][ T5992] ? __mod_zone_page_state+0xd7/0x140 [ 67.398400][ T5992] ? lru_gen_del_folio+0x359/0x540 [ 67.399904][ T5992] reclaim_pages+0x454/0x520 [ 67.401300][ T5992] ? __pfx_reclaim_pages+0x10/0x10 [ 67.402819][ T5992] ? madvise_cold_or_pageout_pte_range+0x194b/0x1d00 [ 67.404855][ T5992] madvise_cold_or_pageout_pte_range+0x1974/0x1d00 [ 67.406774][ T5992] ? __pfx_madvise_cold_or_pageout_pte_range+0x10/0x10 [ 67.408867][ T5992] ? lock_release+0x4b/0x3e0 [ 67.410338][ T5992] ? is_bpf_text_address+0x292/0x2b0 [ 67.412112][ T5992] ? is_bpf_text_address+0x26/0x2b0 [ 67.413729][ T5992] walk_pgd_range+0xfe9/0x1d40 [ 67.415256][ T5992] ? __pfx_walk_pgd_range+0x10/0x10 [ 67.416776][ T5992] ? lockdep_unlock+0x89/0x120 [ 67.418335][ T5992] ? validate_chain+0x897/0x2140 [ 67.419991][ T5992] __walk_page_range+0x14c/0x710 [ 67.421689][ T5992] walk_page_range_vma+0x393/0x440 [ 67.423413][ T5992] ? mlock_drain_local+0x79/0x490 [ 67.425126][ T5992] ? __pfx_walk_page_range_vma+0x10/0x10 [ 67.426842][ T5992] ? mlock_drain_local+0x79/0x490 [ 67.428674][ T5992] madvise_vma_behavior+0x311f/0x3a10 [ 67.430577][ T5992] ? __pfx_madvise_vma_behavior+0x10/0x10 [ 67.432534][ T5992] ? __lock_acquire+0xab9/0xd20 [ 67.434000][ T5992] ? ktime_get_coarse_real_ts64_mg+0x52/0x1e0 [ 67.435902][ T5992] ? mas_prev_slot+0xb31/0xbb0 [ 67.437384][ T5992] ? find_vma_prev+0xe3/0x150 [ 67.438962][ T5992] ? __pfx_find_vma_prev+0x10/0x10 [ 67.440590][ T5992] ? __lock_acquire+0xab9/0xd20 [ 67.442123][ T5992] madvise_walk_vmas+0x51c/0xa30 [ 67.443611][ T5992] ? __pfx_madvise_walk_vmas+0x10/0x10 [ 67.445233][ T5992] ? blk_start_plug+0x6f/0x1b0 [ 67.446647][ T5992] madvise_do_behavior+0x38e/0x550 [ 67.448135][ T5992] ? __pfx_madvise_do_behavior+0x10/0x10 [ 67.449789][ T5992] ? down_read+0x1ad/0x2e0 [ 67.451118][ T5992] do_madvise+0x1bc/0x270 [ 67.452484][ T5992] ? __pfx_do_madvise+0x10/0x10 [ 67.453916][ T5992] ? __pfx___se_sys_futex+0x10/0x10 [ 67.455459][ T5992] ? do_user_addr_fault+0xc85/0x1380 [ 67.457001][ T5992] __x64_sys_madvise+0xa7/0xc0 [ 67.458378][ T5992] do_syscall_64+0xfa/0xfa0 [ 67.459687][ T5992] ? lockdep_hardirqs_on+0x9c/0x150 [ 67.461191][ T5992] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 67.463000][ T5992] ? exc_page_fault+0xab/0x100 [ 67.464395][ T5992] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 67.466114][ T5992] RIP: 0033:0x7f526318ec29 [ 67.467404][ T5992] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 67.472975][ T5992] RSP: 002b:00007ffdd0a28298 EFLAGS: 00000246 ORIG_RAX: 000000000000001c [ 67.475396][ T5992] RAX: ffffffffffffffda RBX: 00007f52633d5fa0 RCX: 00007f526318ec29 [ 67.477693][ T5992] RDX: 0000000000000015 RSI: 0000000000003000 RDI: 0000200000000000 [ 67.479965][ T5992] RBP: 00007f5263211e41 R08: 0000000000000000 R09: 0000000000000000 [ 67.482380][ T5992] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 67.484690][ T5992] R13: 00007f52633d5fa0 R14: 00007f52633d5fa0 R15: 0000000000000003 [ 67.487019][ T5992] [ 67.488574][ T5992] Kernel Offset: disabled [ 67.489899][ T5992] Rebooting in 86400 seconds.. VM DIAGNOSIS: 13:25:02 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000020 RBX=0000000000000020 RCX=0000000000000000 RDX=00000000000003f8 RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90002eedf70 R8 =ffff888021da8237 R9 =1ffff110043b5046 R10=dffffc0000000000 R11=ffffffff855472f0 R12=dffffc0000000000 R13=ffffffff99d38922 R14=ffffffff9a02d140 R15=0000000000000000 RIP=ffffffff8554736c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 000055556322a500 ffffffff 00c00000 GS =0000 ffff8880b83dd000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f11a28bf97a CR3=0000000110c22000 CR4=000006f0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0000000000000000 00000000000000ff XMM01=2525252525252525 2525252525252525 XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000 XMM04=0000000000000000 00000000000000ff XMM05=0000000000002200 0000000000002200 XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000 XMM08=ffffffffffff00ff ffffffffffff00ff XMM09=0000000000003441 0000000000003031 XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000 XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000 XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=8327c5e56e50f900 RBX=ffffffff8196a397 RCX=8327c5e56e50f900 RDX=0000000000000001 RSI=ffffffff8dbc4329 RDI=ffffffff8c03aae0 RBP=ffffc90000177f10 RSP=ffffc90000177de0 R8 =ffff888136632fdb R9 =1ffff11026cc65fb R10=dffffc0000000000 R11=ffffed1026cc65fc R12=ffffffff8fc45d30 R13=0000000000000001 R14=0000000000000001 R15=1ffff11020005000 RIP=ffffffff8b841dd3 RFL=00000286 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8881a39dd000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=000055556322a808 CR3=0000000109de6000 CR4=000006f0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0000000000000000 0000000000000000 XMM01=2525252525252525 2525252525252525 XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000 XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 00007f5263212e7b XMM06=0000000000000000 00007f5263212e75 XMM07=0000000000000000 00007f5263212e89 XMM08=0000000000000000 00007f5263212f0f XMM09=0000000000000000 00007f5263212fed XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000 XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000 XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000