Warning: Permanently added '[localhost]:57222' (ED25519) to the list of known hosts. 2026/03/02 18:25:05 parsed 1 programs syzkaller login: [ 61.024479][ T5817] cgroup: Unknown subsys name 'net' [ 61.107334][ T5817] cgroup: Unknown subsys name 'cpuset' [ 61.110991][ T5817] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 62.689929][ T5817] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 64.735098][ T5826] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 66.115827][ T5872] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 66.118887][ T54] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 66.121714][ T54] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 66.125715][ T54] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 66.128478][ T54] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 66.396378][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.398639][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.419770][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.423134][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.189728][ T5897] chnl_net:caif_netlink_parms(): no params data found [ 67.278636][ T5897] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.281260][ T5897] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.283308][ T5897] bridge_slave_0: entered allmulticast mode [ 67.286060][ T5897] bridge_slave_0: entered promiscuous mode [ 67.289907][ T5897] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.291898][ T5897] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.294432][ T5897] bridge_slave_1: entered allmulticast mode [ 67.297507][ T5897] bridge_slave_1: entered promiscuous mode [ 67.318489][ T5897] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 67.323365][ T5897] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 67.342410][ T5897] team0: Port device team_slave_0 added [ 67.345650][ T5897] team0: Port device team_slave_1 added [ 67.360039][ T5897] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 67.362575][ T5897] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.369747][ T5897] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 67.374592][ T5897] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 67.376541][ T5897] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.384379][ T5897] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 67.410880][ T5897] hsr_slave_0: entered promiscuous mode [ 67.413166][ T5897] hsr_slave_1: entered promiscuous mode [ 67.520679][ T5897] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 67.527236][ T5897] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 67.531203][ T5897] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 67.535658][ T5897] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 67.557634][ T5897] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.559658][ T5897] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.562106][ T5897] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.564259][ T5897] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.600406][ T5897] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.610224][ T720] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.612893][ T720] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.619711][ T5897] 8021q: adding VLAN 0 to HW filter on device team0 [ 67.629046][ T720] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.631824][ T720] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.635971][ T720] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.638671][ T720] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.748153][ T5897] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.786855][ T5897] veth0_vlan: entered promiscuous mode [ 67.794931][ T5897] veth1_vlan: entered promiscuous mode [ 67.823045][ T5897] veth0_macvtap: entered promiscuous mode [ 67.828646][ T5897] veth1_macvtap: entered promiscuous mode [ 67.838852][ T5897] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 67.845686][ T5897] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 67.852655][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.856864][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.860371][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.863727][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.961060][ T5890] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 68.015414][ T5890] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 68.087158][ T5890] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 68.139168][ T5890] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2026/03/02 18:25:14 executed programs: 0 [ 68.284797][ T5196] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 68.287639][ T5196] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 68.290052][ T5196] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 68.292882][ T5196] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 68.295905][ T5196] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 68.409066][ T5921] chnl_net:caif_netlink_parms(): no params data found [ 68.462667][ T5921] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.464844][ T5921] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.466898][ T5921] bridge_slave_0: entered allmulticast mode [ 68.469360][ T5921] bridge_slave_0: entered promiscuous mode [ 68.472541][ T5921] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.474745][ T5921] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.476749][ T5921] bridge_slave_1: entered allmulticast mode [ 68.479211][ T5921] bridge_slave_1: entered promiscuous mode [ 68.498611][ T5921] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.503045][ T5921] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 68.523546][ T5921] team0: Port device team_slave_0 added [ 68.527242][ T5921] team0: Port device team_slave_1 added [ 68.542620][ T5921] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 68.544681][ T5921] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 68.551600][ T5921] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 68.556074][ T5921] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 68.558285][ T5921] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 68.566757][ T5921] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 68.592918][ T5921] hsr_slave_0: entered promiscuous mode [ 68.595159][ T5921] hsr_slave_1: entered promiscuous mode [ 68.597270][ T5921] debugfs: 'hsr0' already exists in 'hsr' [ 68.598960][ T5921] Cannot create hsr debugfs directory [ 70.324957][ T5196] Bluetooth: hci0: command tx timeout [ 71.028213][ T5890] bridge_slave_1: left allmulticast mode [ 71.030331][ T5890] bridge_slave_1: left promiscuous mode [ 71.033136][ T5890] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.048097][ T5890] bridge_slave_0: left allmulticast mode [ 71.050095][ T5890] bridge_slave_0: left promiscuous mode [ 71.052219][ T5890] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.193069][ T5890] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 71.197496][ T5890] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 71.201204][ T5890] bond0 (unregistering): Released all slaves [ 71.283352][ T5890] hsr_slave_0: left promiscuous mode [ 71.290584][ T5890] hsr_slave_1: left promiscuous mode [ 71.292765][ T5890] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 71.295348][ T5890] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 71.298380][ T5890] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 71.300378][ T5890] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 71.307959][ T5890] veth1_macvtap: left promiscuous mode [ 71.309698][ T5890] veth0_macvtap: left promiscuous mode [ 71.311477][ T5890] veth1_vlan: left promiscuous mode [ 71.313351][ T5890] veth0_vlan: left promiscuous mode [ 71.457445][ T5890] team0 (unregistering): Port device team_slave_1 removed [ 71.467596][ T5890] team0 (unregistering): Port device team_slave_0 removed [ 71.825324][ T5921] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 71.835748][ T5921] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 71.841687][ T5921] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 71.847847][ T5921] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 71.957196][ T5921] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.971079][ T5921] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.000291][ T720] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.002953][ T720] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.014066][ T720] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.016788][ T720] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.051300][ T5921] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 72.054971][ T5921] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 72.175370][ T5921] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.210506][ T5921] veth0_vlan: entered promiscuous mode [ 72.219725][ T5921] veth1_vlan: entered promiscuous mode [ 72.245958][ T5921] veth0_macvtap: entered promiscuous mode [ 72.251677][ T5921] veth1_macvtap: entered promiscuous mode [ 72.265359][ T5921] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.276657][ T5921] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.286803][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.290261][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.293096][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.297183][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.343191][ T1228] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.345609][ T1228] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.367372][ T1224] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.369683][ T1224] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.409625][ T5966] loop0: detected capacity change from 0 to 128 [ 72.414030][ T5196] Bluetooth: hci0: command tx timeout [ 72.418574][ T5966] EXT4-fs (loop0): Test dummy encryption mode enabled [ 72.423754][ T5966] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=16, mo=a806c018, mo2=0042] [ 72.431103][ T5966] System zones: 1-3, 19-19, 35-36 [ 72.439079][ T5966] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: writeback. [ 72.445290][ T5966] ext4 filesystem being mounted at /0/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 72.496144][ T5966] fscrypt: AES-256-CBC-CTS using implementation "cts(cbc(ecb(aes-lib)))" [ 72.501597][ T5966] ================================================================== [ 72.504072][ T5966] BUG: KASAN: slab-use-after-free in crc32c+0x3cc/0x470 [ 72.506063][ T5966] Read of size 1 at addr ffff88816c2f9000 by task syz.0.17/5966 [ 72.508999][ T5966] [ 72.510258][ T5966] CPU: 0 UID: 0 PID: 5966 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 72.510274][ T5966] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 72.510283][ T5966] Call Trace: [ 72.510290][ T5966] [ 72.510297][ T5966] dump_stack_lvl+0xe8/0x150 [ 72.510319][ T5966] print_report+0xba/0x230 [ 72.510334][ T5966] ? crc32c+0x3cc/0x470 [ 72.510350][ T5966] kasan_report+0x117/0x150 [ 72.510365][ T5966] ? trace_kmem_cache_alloc+0x29/0xf0 [ 72.510374][ T5966] ? crc32c+0x3cc/0x470 [ 72.510387][ T5966] crc32c+0x3cc/0x470 [ 72.510403][ T5966] ext4_xattr_block_csum_set+0x241/0x330 [ 72.510420][ T5966] ? find_get_block_common+0xa68/0xe10 [ 72.510435][ T5966] ? __pfx_ext4_xattr_block_csum_set+0x10/0x10 [ 72.510451][ T5966] ? __pfx___ext4_journal_get_create_access+0x10/0x10 [ 72.510469][ T5966] ? ext4_xattr_block_set+0x2485/0x2b00 [ 72.510485][ T5966] ext4_xattr_block_set+0x2494/0x2b00 [ 72.510495][ T5966] ? ext4_fc_track_inode+0xca/0xc60 [ 72.510518][ T5966] ? __ext4_journal_get_write_access+0x84/0x590 [ 72.510533][ T5966] ? __pfx_ext4_fc_track_inode+0x10/0x10 [ 72.510548][ T5966] ? __ext4_journal_get_write_access+0x27f/0x590 [ 72.510567][ T5966] ? __pfx_ext4_xattr_block_set+0x10/0x10 [ 72.510581][ T5966] ? ext4_xattr_ibody_set+0x110/0x6a0 [ 72.510595][ T5966] ? ext4_reserve_inode_write+0x2ef/0x360 [ 72.510609][ T5966] ? ext4_xattr_block_find+0xea/0x370 [ 72.510617][ T5966] ext4_xattr_set_handle+0xe37/0x14d0 [ 72.510635][ T5966] ? __pfx_ext4_xattr_set_handle+0x10/0x10 [ 72.510653][ T5966] ? __lock_acquire+0x6b5/0x2cf0 [ 72.510669][ T5966] ext4_set_context+0x233/0x560 [ 72.510683][ T5966] ? fscrypt_new_context+0x212/0x410 [ 72.510701][ T5966] ? __pfx_ext4_set_context+0x10/0x10 [ 72.510713][ T5966] ? fscrypt_new_context+0x212/0x410 [ 72.510724][ T5966] fscrypt_set_context+0x397/0x460 [ 72.510740][ T5966] ? __pfx_fscrypt_set_context+0x10/0x10 [ 72.510758][ T5966] ? _raw_spin_unlock+0x28/0x50 [ 72.510775][ T5966] ? insert_inode_locked+0x438/0x4f0 [ 72.510786][ T5966] ? crc32c+0x429/0x470 [ 72.510801][ T5966] __ext4_new_inode+0x3158/0x3d20 [ 72.510815][ T5966] ? __pfx___ext4_new_inode+0x10/0x10 [ 72.510833][ T5966] ext4_mkdir+0x3da/0xbf0 [ 72.510856][ T5966] ? __pfx_ext4_mkdir+0x10/0x10 [ 72.510874][ T5966] ? inode_permission+0x346/0x5f0 [ 72.510890][ T5966] ? bpf_lsm_inode_mkdir+0x9/0x20 [ 72.510904][ T5966] vfs_mkdir+0x413/0x630 [ 72.510913][ T5966] filename_mkdirat+0x285/0x510 [ 72.510927][ T5966] ? __pfx_filename_mkdirat+0x10/0x10 [ 72.510942][ T5966] ? do_getname+0x151/0x250 [ 72.510958][ T5966] __se_sys_mkdir+0x34/0x150 [ 72.510973][ T5966] do_syscall_64+0x14d/0xf80 [ 72.510984][ T5966] ? trace_irq_disable+0x3b/0x150 [ 72.510996][ T5966] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.511008][ T5966] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.511021][ T5966] RIP: 0033:0x7fb91ff9c799 [ 72.511033][ T5966] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 72.511044][ T5966] RSP: 002b:00007ffe3b8b33f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 72.511058][ T5966] RAX: ffffffffffffffda RBX: 00007fb920215fa0 RCX: 00007fb91ff9c799 [ 72.511068][ T5966] RDX: 0000000000000000 RSI: 0000000000000142 RDI: 0000200000000300 [ 72.511075][ T5966] RBP: 00007fb920032bd9 R08: 0000000000000000 R09: 0000000000000000 [ 72.511083][ T5966] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 72.511090][ T5966] R13: 00007fb920215fac R14: 00007fb920215fa0 R15: 00007fb920215fa0 [ 72.511099][ T5966] [ 72.511101][ T5966] [ 72.630439][ T5966] Allocated by task 5807: [ 72.632028][ T5966] kasan_save_track+0x3e/0x80 [ 72.633766][ T5966] __kasan_kmalloc+0x93/0xb0 [ 72.635563][ T5966] __kmalloc_cache_noprof+0x31c/0x660 [ 72.637577][ T5966] kmem_cache_free+0x15b/0x630 [ 72.639288][ T5966] __put_anon_vma+0x12b/0x2d0 [ 72.640958][ T5966] unlink_anon_vmas+0x58b/0x730 [ 72.642800][ T5966] free_pgtables+0x663/0xb70 [ 72.644591][ T5966] exit_mmap+0x490/0xa10 [ 72.646167][ T5966] __mmput+0x118/0x430 [ 72.647691][ T5966] exec_mmap+0x3b4/0x440 [ 72.649332][ T5966] begin_new_exec+0x134a/0x24a0 [ 72.651186][ T5966] load_elf_binary+0xa47/0x2980 [ 72.652910][ T5966] bprm_execve+0x93d/0x1460 [ 72.654612][ T5966] do_execveat_common+0x50d/0x690 [ 72.656554][ T5966] __x64_sys_execve+0x97/0xc0 [ 72.658282][ T5966] do_syscall_64+0x14d/0xf80 [ 72.659952][ T5966] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.662172][ T5966] [ 72.663109][ T5966] Freed by task 5807: [ 72.664530][ T5966] kasan_save_track+0x3e/0x80 [ 72.666296][ T5966] kasan_save_free_info+0x46/0x50 [ 72.668247][ T5966] __kasan_slab_free+0x5c/0x80 [ 72.669985][ T5966] kfree+0x1c1/0x630 [ 72.671381][ T5966] slab_free_after_rcu_debug+0x5e/0x220 [ 72.673442][ T5966] rcu_core+0x7cd/0x1070 [ 72.675029][ T5966] handle_softirqs+0x22a/0x870 [ 72.676750][ T5966] __irq_exit_rcu+0x5f/0x150 [ 72.678455][ T5966] irq_exit_rcu+0x9/0x30 [ 72.680042][ T5966] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 72.682153][ T5966] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 72.684378][ T5966] [ 72.685289][ T5966] Last potentially related work creation: [ 72.687395][ T5966] kasan_save_stack+0x3e/0x60 [ 72.689242][ T5966] kasan_record_aux_stack+0xbd/0xd0 [ 72.691144][ T5966] call_rcu+0xee/0x890 [ 72.692708][ T5966] kmem_cache_free+0x439/0x630 [ 72.694472][ T5966] __put_anon_vma+0x12b/0x2d0 [ 72.696345][ T5966] unlink_anon_vmas+0x58b/0x730 [ 72.698083][ T5966] free_pgtables+0x663/0xb70 [ 72.699746][ T5966] exit_mmap+0x490/0xa10 [ 72.701235][ T5966] __mmput+0x118/0x430 [ 72.702689][ T5966] exec_mmap+0x3b4/0x440 [ 72.704257][ T5966] begin_new_exec+0x134a/0x24a0 [ 72.706025][ T5966] load_elf_binary+0xa47/0x2980 [ 72.707696][ T5966] bprm_execve+0x93d/0x1460 [ 72.709282][ T5966] do_execveat_common+0x50d/0x690 [ 72.711177][ T5966] __x64_sys_execve+0x97/0xc0 [ 72.713061][ T5966] do_syscall_64+0x14d/0xf80 [ 72.714785][ T5966] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.716892][ T5966] [ 72.717798][ T5966] The buggy address belongs to the object at ffff88816c2f9000 [ 72.717798][ T5966] which belongs to the cache kmalloc-32 of size 32 [ 72.722737][ T5966] The buggy address is located 0 bytes inside of [ 72.722737][ T5966] freed 32-byte region [ffff88816c2f9000, ffff88816c2f9020) [ 72.727581][ T5966] [ 72.728494][ T5966] The buggy address belongs to the physical page: [ 72.730834][ T5966] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x16c2f9 [ 72.733901][ T5966] flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff) [ 72.736605][ T5966] page_type: f5(slab) [ 72.738094][ T5966] raw: 057ff00000000000 ffff888100041780 dead000000000100 dead000000000122 [ 72.741135][ T5966] raw: 0000000000000000 0000000800400040 00000000f5000000 0000000000000000 [ 72.744336][ T5966] page dumped because: kasan: bad access detected [ 72.746728][ T5966] page_owner tracks the page as allocated [ 72.748737][ T5966] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5807, tgid 5807 (sshd), ts 57508476883, free_ts 57508008939 [ 72.756060][ T5966] post_alloc_hook+0x231/0x280 [ 72.757918][ T5966] get_page_from_freelist+0x24dc/0x2580 [ 72.759977][ T5966] __alloc_frozen_pages_noprof+0x18d/0x380 [ 72.762135][ T5966] allocate_slab+0x77/0x660 [ 72.763838][ T5966] refill_objects+0x331/0x3c0 [ 72.765474][ T5966] __pcs_replace_empty_main+0x2b9/0x620 [ 72.767492][ T5966] __kvmalloc_node_noprof+0x657/0x8a0 [ 72.769531][ T5966] proc_sys_call_handler+0x3d1/0x830 [ 72.771436][ T5966] vfs_read+0x582/0xa70 [ 72.772963][ T5966] ksys_read+0x150/0x270 [ 72.774579][ T5966] do_syscall_64+0x14d/0xf80 [ 72.776340][ T5966] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.778401][ T5966] page last free pid 5807 tgid 5807 stack trace: [ 72.780738][ T5966] __free_frozen_pages+0xc2b/0xdb0 [ 72.782645][ T5966] tlb_finish_mmu+0x144/0x230 [ 72.784321][ T5966] unmap_region+0x2a5/0x330 [ 72.786014][ T5966] vms_complete_munmap_vmas+0x493/0xc60 [ 72.788057][ T5966] do_vmi_align_munmap+0x3b7/0x4b0 [ 72.790042][ T5966] do_vmi_munmap+0x252/0x2d0 [ 72.791692][ T5966] __vm_munmap+0x22c/0x3d0 [ 72.793321][ T5966] __x64_sys_munmap+0x60/0x70 [ 72.795123][ T5966] do_syscall_64+0x14d/0xf80 [ 72.796831][ T5966] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.798878][ T5966] [ 72.799721][ T5966] Memory state around the buggy address: [ 72.801699][ T5966] ffff88816c2f8f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 72.804468][ T5966] ffff88816c2f8f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 72.807308][ T5966] >ffff88816c2f9000: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 72.809915][ T5966] ^ [ 72.811433][ T5966] ffff88816c2f9080: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 72.814398][ T5966] ffff88816c2f9100: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 72.817222][ T5966] ================================================================== [ 72.826284][ T5966] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 72.828815][ T5966] CPU: 0 UID: 0 PID: 5966 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 72.832139][ T5966] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 72.835835][ T5966] Call Trace: [ 72.837118][ T5966] [ 72.838258][ T5966] vpanic+0x56c/0xa60 [ 72.839839][ T5966] ? __pfx_vpanic+0x10/0x10 [ 72.841491][ T5966] panic+0xc5/0xd0 [ 72.842909][ T5966] ? __pfx_panic+0x10/0x10 [ 72.844665][ T5966] ? preempt_schedule_thunk+0x16/0x30 [ 72.846673][ T5966] ? crc32c+0x3cc/0x470 [ 72.848175][ T5966] ? preempt_schedule_thunk+0x16/0x30 [ 72.850125][ T5966] ? crc32c+0x3cc/0x470 [ 72.851710][ T5966] check_panic_on_warn+0x89/0xb0 [ 72.853592][ T5966] ? crc32c+0x3cc/0x470 [ 72.855092][ T5966] end_report+0x73/0x180 [ 72.856718][ T5966] ? crc32c+0x3cc/0x470 [ 72.858343][ T5966] kasan_report+0x128/0x150 [ 72.860020][ T5966] ? trace_kmem_cache_alloc+0x29/0xf0 [ 72.861966][ T5966] ? crc32c+0x3cc/0x470 [ 72.863564][ T5966] crc32c+0x3cc/0x470 [ 72.865100][ T5966] ext4_xattr_block_csum_set+0x241/0x330 [ 72.867122][ T5966] ? find_get_block_common+0xa68/0xe10 [ 72.869163][ T5966] ? __pfx_ext4_xattr_block_csum_set+0x10/0x10 [ 72.871516][ T5966] ? __pfx___ext4_journal_get_create_access+0x10/0x10 [ 72.873952][ T5966] ? ext4_xattr_block_set+0x2485/0x2b00 [ 72.876045][ T5966] ext4_xattr_block_set+0x2494/0x2b00 [ 72.878043][ T5966] ? ext4_fc_track_inode+0xca/0xc60 [ 72.879894][ T5966] ? __ext4_journal_get_write_access+0x84/0x590 [ 72.882222][ T5966] ? __pfx_ext4_fc_track_inode+0x10/0x10 [ 72.884330][ T5966] ? __ext4_journal_get_write_access+0x27f/0x590 [ 72.886589][ T5966] ? __pfx_ext4_xattr_block_set+0x10/0x10 [ 72.888738][ T5966] ? ext4_xattr_ibody_set+0x110/0x6a0 [ 72.890827][ T5966] ? ext4_reserve_inode_write+0x2ef/0x360 [ 72.892933][ T5966] ? ext4_xattr_block_find+0xea/0x370 [ 72.894949][ T5966] ext4_xattr_set_handle+0xe37/0x14d0 [ 72.896904][ T5966] ? __pfx_ext4_xattr_set_handle+0x10/0x10 [ 72.899135][ T5966] ? __lock_acquire+0x6b5/0x2cf0 [ 72.901064][ T5966] ext4_set_context+0x233/0x560 [ 72.902822][ T5966] ? fscrypt_new_context+0x212/0x410 [ 72.904708][ T5966] ? __pfx_ext4_set_context+0x10/0x10 [ 72.906650][ T5966] ? fscrypt_new_context+0x212/0x410 [ 72.908555][ T5966] fscrypt_set_context+0x397/0x460 [ 72.910345][ T5966] ? __pfx_fscrypt_set_context+0x10/0x10 [ 72.912323][ T5966] ? _raw_spin_unlock+0x28/0x50 [ 72.914134][ T5966] ? insert_inode_locked+0x438/0x4f0 [ 72.916147][ T5966] ? crc32c+0x429/0x470 [ 72.917628][ T5966] __ext4_new_inode+0x3158/0x3d20 [ 72.919492][ T5966] ? __pfx___ext4_new_inode+0x10/0x10 [ 72.921521][ T5966] ext4_mkdir+0x3da/0xbf0 [ 72.923098][ T5966] ? __pfx_ext4_mkdir+0x10/0x10 [ 72.924902][ T5966] ? inode_permission+0x346/0x5f0 [ 72.926791][ T5966] ? bpf_lsm_inode_mkdir+0x9/0x20 [ 72.928662][ T5966] vfs_mkdir+0x413/0x630 [ 72.930107][ T5966] filename_mkdirat+0x285/0x510 [ 72.931964][ T5966] ? __pfx_filename_mkdirat+0x10/0x10 [ 72.933976][ T5966] ? do_getname+0x151/0x250 [ 72.935609][ T5966] __se_sys_mkdir+0x34/0x150 [ 72.937324][ T5966] do_syscall_64+0x14d/0xf80 [ 72.939055][ T5966] ? trace_irq_disable+0x3b/0x150 [ 72.940959][ T5966] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.943110][ T5966] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.945385][ T5966] RIP: 0033:0x7fb91ff9c799 [ 72.947084][ T5966] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 72.954081][ T5966] RSP: 002b:00007ffe3b8b33f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 72.957307][ T5966] RAX: ffffffffffffffda RBX: 00007fb920215fa0 RCX: 00007fb91ff9c799 [ 72.960305][ T5966] RDX: 0000000000000000 RSI: 0000000000000142 RDI: 0000200000000300 [ 72.963216][ T5966] RBP: 00007fb920032bd9 R08: 0000000000000000 R09: 0000000000000000 [ 72.966213][ T5966] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 72.969005][ T5966] R13: 00007fb920215fac R14: 00007fb920215fa0 R15: 00007fb920215fa0 [ 72.971994][ T5966] [ 72.973868][ T5966] Kernel Offset: disabled [ 72.975523][ T5966] Rebooting in 86400 seconds.. VM DIAGNOSIS: 18:25:18 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000020 RBX=0000000000000020 RCX=0000000000000000 RDX=00000000000003f8 RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90004686d90 R8 =ffff8881046f8237 R9 =1ffff110208df046 R10=dffffc0000000000 R11=ffffffff85402320 R12=dffffc0000000000 R13=ffffffff9a2b2a82 R14=ffffffff9a5ca8a0 R15=0000000000000000 RIP=ffffffff8540239c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000555592194500 ffffffff 00c00000 GS =0000 ffff88818de64000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000000000000000 CR3=00000001734cc000 CR4=000006f0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000 XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000 XMM04=0000000000000000 0000000000000000 XMM05=0000000000000000 0000000000000000 XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000 XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000 XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000 XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000 XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000000040a31 RBX=ffffffff819a886d RCX=0000000080000001 RDX=0000000000000001 RSI=ffffffff8def3169 RDI=ffffffff8c27ae80 RBP=ffffc90000197f10 RSP=ffffc90000197e20 R8 =ffff88823c63395b R9 =1ffff110478c672b R10=dffffc0000000000 R11=ffffed10478c672c R12=ffffffff90118cb0 R13=1ffff1102c096000 R14=0000000000000001 R15=0000000000000001 RIP=ffffffff8bad6e9f RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8882a9464000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007fe46761b440 CR3=00000001799e2000 CR4=000006f0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0000000000000000 0000000000000000 XMM01=ffffffffffffffff ffffffffffffffff XMM02=0000000000000000 0000000000000000 XMM03=ffffffffffffffff ffffffffffffffff XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 0000000000000000 XMM06=0000000000000000 000000524f525245 XMM07=0000000000000000 0000000000000000 XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 0000000000000000 XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000 XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000 XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000