Warning: Permanently added '[localhost]:24454' (ED25519) to the list of known hosts.
2026/09/26 12:59:22 parsed 1 programs
2026/09/26 12:59:22 serving rpc on tcp://45405
syzkaller login: [ 54.722074][ T5596] cgroup: Unknown subsys name 'net'
[ 54.838361][ T5596] cgroup: Unknown subsys name 'cpuset'
[ 54.840408][ T5596] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 56.845365][ T5596] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 59.199589][ T5605] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 59.917167][ T1104] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 59.917180][ T1104] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 60.000830][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 60.000846][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 60.195042][ T5604] bridge0: port 1(bridge_slave_0) entered blocking state
[ 60.197877][ T5604] bridge0: port 1(bridge_slave_0) entered disabled state
[ 60.197961][ T5604] bridge_slave_0: entered allmulticast mode
[ 60.198670][ T5604] bridge_slave_0: entered promiscuous mode
[ 60.203211][ T5604] bridge0: port 2(bridge_slave_1) entered blocking state
[ 60.203252][ T5604] bridge0: port 2(bridge_slave_1) entered disabled state
[ 60.205878][ T5604] bridge_slave_1: entered allmulticast mode
[ 60.206553][ T5604] bridge_slave_1: entered promiscuous mode
[ 60.263188][ T5604] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 60.271041][ T5604] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 60.337626][ T5604] team0: Port device team_slave_0 added
[ 60.342504][ T5604] team0: Port device team_slave_1 added
[ 60.442088][ T5604] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 60.442102][ T5604] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 60.442119][ T5604] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 60.474454][ T5604] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 60.474467][ T5604] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 60.474482][ T5604] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 60.674582][ T5604] hsr_slave_0: entered promiscuous mode
[ 60.678834][ T5604] hsr_slave_1: entered promiscuous mode
[ 61.238698][ T5604] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 61.256686][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 61.260681][ T5604] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 61.274669][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 61.353016][ T5604] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 61.373127][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 61.373530][ T5604] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 61.386185][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 61.723362][ T55] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 61.724484][ T55] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 61.729132][ T55] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 61.736762][ T55] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 61.738129][ T55] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 61.866839][ T5604] 8021q: adding VLAN 0 to HW filter on device bond0
[ 62.115919][ T5604] 8021q: adding VLAN 0 to HW filter on device team0
[ 62.131422][ T35] bridge0: port 1(bridge_slave_0) entered blocking state
[ 62.132077][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 62.174268][ T35] bridge0: port 2(bridge_slave_1) entered blocking state
[ 62.174345][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 62.570005][ T5604] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 62.601178][ T5604] veth0_vlan: entered promiscuous mode
[ 62.607479][ T5604] veth1_vlan: entered promiscuous mode
[ 62.628291][ T5604] veth0_macvtap: entered promiscuous mode
[ 62.630457][ T5604] veth1_macvtap: entered promiscuous mode
[ 62.638200][ T5604] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 62.642009][ T5604] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 62.649492][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 62.649522][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 62.649542][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 62.685450][ T5625] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
2026/09/26 12:59:32 executed programs: 0
[ 62.844911][ T55] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 62.848470][ T55] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 62.852035][ T55] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 62.858000][ T5625] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 62.863603][ T5721] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 62.864489][ T5690] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 62.869286][ T5721] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 62.869543][ T5690] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 62.879843][ T4991] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 62.880943][ T4991] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 62.887672][ T4991] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[ 62.890091][ T5721] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[ 62.893251][ T5725] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[ 62.893337][ T5725] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 62.897575][ T5725] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 62.906230][ T4991] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[ 62.960090][ T5625] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 63.041398][ T5625] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 63.117531][ T5625] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 63.560451][ T5718] bridge0: port 1(bridge_slave_0) entered blocking state
[ 63.561686][ T5718] bridge0: port 1(bridge_slave_0) entered disabled state
[ 63.561823][ T5718] bridge_slave_0: entered allmulticast mode
[ 63.566256][ T5718] bridge_slave_0: entered promiscuous mode
[ 63.572324][ T5718] bridge0: port 2(bridge_slave_1) entered blocking state
[ 63.572404][ T5718] bridge0: port 2(bridge_slave_1) entered disabled state
[ 63.572739][ T5718] bridge_slave_1: entered allmulticast mode
[ 63.573980][ T5718] bridge_slave_1: entered promiscuous mode
[ 63.604893][ T5718] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 63.637063][ T5718] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 63.734360][ T5718] team0: Port device team_slave_0 added
[ 63.767543][ T5718] team0: Port device team_slave_1 added
[ 63.815161][ T5720] bridge0: port 1(bridge_slave_0) entered blocking state
[ 63.818593][ T5720] bridge0: port 1(bridge_slave_0) entered disabled state
[ 63.818695][ T5720] bridge_slave_0: entered allmulticast mode
[ 63.819889][ T5720] bridge_slave_0: entered promiscuous mode
[ 63.840183][ T5625] bridge_slave_1: left allmulticast mode
[ 63.840216][ T5625] bridge_slave_1: left promiscuous mode
[ 63.840399][ T5625] bridge0: port 2(bridge_slave_1) entered disabled state
[ 63.846767][ T5625] bridge_slave_0: left allmulticast mode
[ 63.846785][ T5625] bridge_slave_0: left promiscuous mode
[ 63.846958][ T5625] bridge0: port 1(bridge_slave_0) entered disabled state
[ 63.990281][ T5625] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 63.995028][ T5625] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 64.000672][ T5625] bond0 (unregistering): Released all slaves
[ 64.018950][ T5718] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 64.018964][ T5718] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 64.018979][ T5718] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 64.019388][ T5720] bridge0: port 2(bridge_slave_1) entered blocking state
[ 64.019454][ T5720] bridge0: port 2(bridge_slave_1) entered disabled state
[ 64.019535][ T5720] bridge_slave_1: entered allmulticast mode
[ 64.020747][ T5720] bridge_slave_1: entered promiscuous mode
[ 64.053982][ T5718] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 64.053994][ T5718] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 64.054010][ T5718] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 64.118932][ T5625] hsr_slave_0: left promiscuous mode
[ 64.119370][ T5625] hsr_slave_1: left promiscuous mode
[ 64.119837][ T5625] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 64.119854][ T5625] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 64.120444][ T5625] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 64.120452][ T5625] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 64.124002][ T5625] veth1_macvtap: left promiscuous mode
[ 64.124086][ T5625] veth0_macvtap: left promiscuous mode
[ 64.124178][ T5625] veth1_vlan: left promiscuous mode
[ 64.124230][ T5625] veth0_vlan: left promiscuous mode
[ 64.297625][ T5625] team0 (unregistering): Port device team_slave_1 removed
[ 64.311122][ T5625] team0 (unregistering): Port device team_slave_0 removed
[ 64.411041][ T5720] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 64.412602][ T5720] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 64.412786][ T5723] bridge0: port 1(bridge_slave_0) entered blocking state
[ 64.412863][ T5723] bridge0: port 1(bridge_slave_0) entered disabled state
[ 64.412974][ T5723] bridge_slave_0: entered allmulticast mode
[ 64.414408][ T5723] bridge_slave_0: entered promiscuous mode
[ 64.417098][ T5723] bridge0: port 2(bridge_slave_1) entered blocking state
[ 64.417143][ T5723] bridge0: port 2(bridge_slave_1) entered disabled state
[ 64.417202][ T5723] bridge_slave_1: entered allmulticast mode
[ 64.417925][ T5723] bridge_slave_1: entered promiscuous mode
[ 64.479642][ T5720] team0: Port device team_slave_0 added
[ 64.498506][ T5723] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 64.499694][ T5720] team0: Port device team_slave_1 added
[ 64.504301][ T5723] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 64.513904][ T5718] hsr_slave_0: entered promiscuous mode
[ 64.515820][ T5718] hsr_slave_1: entered promiscuous mode
[ 64.560011][ T5723] team0: Port device team_slave_0 added
[ 64.597585][ T5720] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 64.597599][ T5720] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 64.597614][ T5720] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 64.599891][ T5723] team0: Port device team_slave_1 added
[ 64.641124][ T5720] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 64.641138][ T5720] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 64.641155][ T5720] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 64.676050][ T5723] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 64.676063][ T5723] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 64.676078][ T5723] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 64.693499][ T5723] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 64.693512][ T5723] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 64.693528][ T5723] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 64.759877][ T5720] hsr_slave_0: entered promiscuous mode
[ 64.760352][ T5720] hsr_slave_1: entered promiscuous mode
[ 64.760694][ T5720] debugfs: 'hsr0' already exists in 'hsr'
[ 64.761412][ T5720] Cannot create hsr debugfs directory
[ 64.810426][ T5723] hsr_slave_0: entered promiscuous mode
[ 64.811154][ T5723] hsr_slave_1: entered promiscuous mode
[ 64.811611][ T5723] debugfs: 'hsr0' already exists in 'hsr'
[ 64.811623][ T5723] Cannot create hsr debugfs directory
[ 64.895989][ T55] Bluetooth: hci0: command tx timeout
[ 64.931610][ T5338] 8021q: adding VLAN 0 to HW filter on device eth1
[ 64.976732][ T55] Bluetooth: hci1: command tx timeout
[ 64.976886][ T5725] Bluetooth: hci2: command tx timeout
[ 65.350482][ T5723] netdevsim netdevsim1 netdevsim0: renamed from eth0
[ 65.368973][ T5723] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 65.371616][ T5723] netdevsim netdevsim1 netdevsim1: renamed from eth1
[ 65.382068][ T5723] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 65.382809][ T5723] netdevsim netdevsim1 netdevsim2: renamed from eth2
[ 65.390231][ T5723] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 65.393221][ T5723] netdevsim netdevsim1 netdevsim3: renamed from eth3
[ 65.398423][ T5723] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 65.476562][ T5718] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 65.479648][ T5718] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 65.481888][ T5718] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 65.485906][ T5718] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 65.486447][ T5718] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 65.501753][ T5718] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 65.507626][ T5718] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 65.511870][ T5718] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 65.587904][ T5720] netdevsim netdevsim2 netdevsim0: renamed from eth0
[ 65.590935][ T5720] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 65.601374][ T5720] netdevsim netdevsim2 netdevsim1: renamed from eth1
[ 65.609032][ T5720] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 65.609666][ T5720] netdevsim netdevsim2 netdevsim2: renamed from eth2
[ 65.612737][ T5720] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 65.613599][ T5720] netdevsim netdevsim2 netdevsim3: renamed from eth3
[ 65.628791][ T5720] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 65.688490][ T5723] 8021q: adding VLAN 0 to HW filter on device bond0
[ 65.734430][ T5723] 8021q: adding VLAN 0 to HW filter on device team0
[ 65.753730][ T35] bridge0: port 1(bridge_slave_0) entered blocking state
[ 65.753804][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 65.769979][ T35] bridge0: port 2(bridge_slave_1) entered blocking state
[ 65.770058][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 65.838436][ T5718] 8021q: adding VLAN 0 to HW filter on device bond0
[ 65.871805][ T5723] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[ 65.871824][ T5723] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 65.896111][ T5718] 8021q: adding VLAN 0 to HW filter on device team0
[ 65.916320][ T1104] bridge0: port 1(bridge_slave_0) entered blocking state
[ 65.916441][ T1104] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 65.935042][ T1104] bridge0: port 2(bridge_slave_1) entered blocking state
[ 65.935115][ T1104] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 65.964011][ T5720] 8021q: adding VLAN 0 to HW filter on device bond0
[ 65.993771][ T5720] 8021q: adding VLAN 0 to HW filter on device team0
[ 66.003842][ T1104] bridge0: port 1(bridge_slave_0) entered blocking state
[ 66.004034][ T1104] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 66.018490][ T1104] bridge0: port 2(bridge_slave_1) entered blocking state
[ 66.018585][ T1104] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 66.322089][ T5723] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 66.360880][ T5723] veth0_vlan: entered promiscuous mode
[ 66.365005][ T5723] veth1_vlan: entered promiscuous mode
[ 66.381394][ T5723] veth0_macvtap: entered promiscuous mode
[ 66.383566][ T5723] veth1_macvtap: entered promiscuous mode
[ 66.391335][ T5723] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 66.397057][ T5723] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 66.416360][ T5625] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 66.416541][ T5625] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 66.416662][ T5625] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 66.416842][ T5625] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 66.474524][ T5720] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 66.478192][ T29] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 66.478203][ T29] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 66.510772][ T1104] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 66.510783][ T1104] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 66.514781][ T5718] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 66.544751][ T5720] veth0_vlan: entered promiscuous mode
[ 66.559429][ T5720] veth1_vlan: entered promiscuous mode
[ 66.580986][ T5837] loop1: detected capacity change from 0 to 64
[ 66.596112][ T5837] hfs: inconsistent allocation block parameters in MDB
[ 66.596161][ T5837] hfs: can't find a HFS filesystem on dev loop1
[ 66.596166][ T5837] ==================================================================
[ 66.596170][ T5837] BUG: KASAN: double-free in hfs_mdb_put+0x15b/0x270
[ 66.596182][ T5837] Free of addr ffff888117e9bc00 by task syz.1.18/5837
[ 66.596187][ T5837]
[ 66.596192][ T5837] CPU: 0 UID: 0 PID: 5837 Comm: syz.1.18 Not tainted syzkaller #0 PREEMPT(full)
[ 66.596199][ T5837] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 66.596203][ T5837] Call Trace:
[ 66.596206][ T5837]
[ 66.596210][ T5837] dump_stack_lvl+0xe8/0x150
[ 66.596220][ T5837] print_address_description+0x55/0x1e0
[ 66.596230][ T5837] print_report+0x58/0x70
[ 66.596237][ T5837] ? hfs_mdb_put+0x15b/0x270
[ 66.596245][ T5837] kasan_report_invalid_free+0xea/0x110
[ 66.596254][ T5837] ? hfs_mdb_put+0x15b/0x270
[ 66.596262][ T5837] ? hfs_mdb_put+0x15b/0x270
[ 66.596269][ T5837] __kasan_slab_pre_free+0x104/0x120
[ 66.596277][ T5837] kfree+0x173/0x650
[ 66.596286][ T5837] ? hfs_mdb_put+0x15b/0x270
[ 66.596294][ T5837] hfs_mdb_put+0x15b/0x270
[ 66.596301][ T5837] hfs_fill_super+0x4d2/0x7b0
[ 66.596309][ T5837] ? __pfx_hfs_fill_super+0x10/0x10
[ 66.596320][ T5837] ? sb_set_blocksize+0x155/0x240
[ 66.596328][ T5837] ? setup_bdev_super+0x586/0x680
[ 66.596335][ T5837] get_tree_bdev_flags+0x430/0x4f0
[ 66.596341][ T5837] ? __pfx_hfs_fill_super+0x10/0x10
[ 66.596348][ T5837] ? __pfx_get_tree_bdev_flags+0x10/0x10
[ 66.596356][ T5837] vfs_get_tree+0x92/0x2a0
[ 66.596362][ T5837] do_new_mount+0x319/0xdc0
[ 66.596372][ T5837] ? __pfx_do_new_mount+0x10/0x10
[ 66.596381][ T5837] ? ns_capable+0x89/0xe0
[ 66.596390][ T5837] ? path_mount+0x647/0x1050
[ 66.596399][ T5837] ? user_path_at+0xd4/0x160
[ 66.596409][ T5837] __se_sys_mount+0x31d/0x420
[ 66.596419][ T5837] ? __pfx___se_sys_mount+0x10/0x10
[ 66.596428][ T5837] ? __x64_sys_mount+0x20/0xc0
[ 66.596437][ T5837] do_syscall_64+0x166/0x520
[ 66.596445][ T5837] ? trace_irq_disable+0x3b/0x140
[ 66.596452][ T5837] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 66.596460][ T5837] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 66.596466][ T5837] RIP: 0033:0x7f0f2619f3ca
[ 66.596473][ T5837] Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 66.596479][ T5837] RSP: 002b:00007f0f27037e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 66.596493][ T5837] RAX: ffffffffffffffda RBX: 00007f0f27037ee0 RCX: 00007f0f2619f3ca
[ 66.596499][ T5837] RDX: 0000200000000180 RSI: 00002000000000c0 RDI: 00007f0f27037ea0
[ 66.596503][ T5837] RBP: 0000200000000180 R08: 00007f0f27037ee0 R09: 0000000000000000
[ 66.596508][ T5837] R10: 0000000000000000 R11: 0000000000000246 R12: 00002000000000c0
[ 66.596512][ T5837] R13: 00007f0f27037ea0 R14: 0000000000000305 R15: 0000200000001800
[ 66.596519][ T5837]
[ 66.596521][ T5837]
[ 66.596523][ T5837] Allocated by task 5837:
[ 66.596527][ T5837] kasan_save_track+0x3e/0x80
[ 66.596533][ T5837] __kasan_kmalloc+0x93/0xb0
[ 66.596540][ T5837] __kmalloc_node_track_caller_noprof+0x4b4/0x720
[ 66.596546][ T5837] kmemdup_noprof+0x2b/0x70
[ 66.596552][ T5837] hfs_mdb_get+0x895/0x2350
[ 66.596558][ T5837] hfs_fill_super+0x482/0x7b0
[ 66.596565][ T5837] get_tree_bdev_flags+0x430/0x4f0
[ 66.596570][ T5837] vfs_get_tree+0x92/0x2a0
[ 66.596575][ T5837] do_new_mount+0x319/0xdc0
[ 66.596583][ T5837] __se_sys_mount+0x31d/0x420
[ 66.596591][ T5837] do_syscall_64+0x166/0x520
[ 66.596598][ T5837] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 66.596604][ T5837]
[ 66.596605][ T5837] Freed by task 5837:
[ 66.596608][ T5837] kasan_save_track+0x3e/0x80
[ 66.596614][ T5837] kasan_save_free_info+0x40/0x50
[ 66.596622][ T5837] __kasan_slab_free+0x5c/0x80
[ 66.596629][ T5837] kfree+0x1c5/0x650
[ 66.596636][ T5837] hfs_mdb_put+0x15b/0x270
[ 66.596643][ T5837] hfs_mdb_get+0x1935/0x2350
[ 66.596649][ T5837] hfs_fill_super+0x482/0x7b0
[ 66.596656][ T5837] get_tree_bdev_flags+0x430/0x4f0
[ 66.596661][ T5837] vfs_get_tree+0x92/0x2a0
[ 66.596666][ T5837] do_new_mount+0x319/0xdc0
[ 66.596697][ T5837] __se_sys_mount+0x31d/0x420
[ 66.596706][ T5837] do_syscall_64+0x166/0x520
[ 66.596715][ T5837] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 66.596723][ T5837]
[ 66.596725][ T5837] The buggy address belongs to the object at ffff888117e9bc00
[ 66.596725][ T5837] which belongs to the cache kmalloc-512 of size 512
[ 66.596734][ T5837] The buggy address is located 0 bytes inside of
[ 66.596734][ T5837] 512-byte region [ffff888117e9bc00, ffff888117e9be00)
[ 66.596743][ T5837]
[ 66.596745][ T5837] The buggy address belongs to the physical page:
[ 66.596751][ T5837] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888117e9b400 pfn:0x117e98
[ 66.596761][ T5837] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 66.596769][ T5837] flags: 0x17ff00000000240(workingset|head|node=0|zone=2|lastcpupid=0x7ff)
[ 66.596779][ T5837] page_type: f5(slab)
[ 66.596788][ T5837] raw: 017ff00000000240 ffff888100041c80 ffffea00045caa10 ffffea000440b710
[ 66.596797][ T5837] raw: ffff888117e9b400 000000000010000c 00000000f5000000 0000000000000000
[ 66.596806][ T5837] head: 017ff00000000240 ffff888100041c80 ffffea00045caa10 ffffea000440b710
[ 66.596815][ T5837] head: ffff888117e9b400 000000000010000c 00000000f5000000 0000000000000000
[ 66.596824][ T5837] head: 017ff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff
[ 66.596832][ T5837] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[ 66.596838][ T5837] page dumped because: kasan: bad access detected
[ 66.596843][ T5837] page_owner tracks the page as allocated
[ 66.596847][ T5837] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5611, tgid 5611 (syz-executor), ts 59180259569
[ 66.596864][ T5837] post_alloc_hook+0x1f9/0x250
[ 66.596878][ T5837] get_page_from_freelist+0x2209/0x2280
[ 66.596888][ T5837] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 66.596898][ T5837] allocate_slab+0x7d/0x620
[ 66.596909][ T5837] refill_objects+0x2d5/0x350
[ 66.596921][ T5837] __pcs_replace_empty_main+0x2c8/0x6c0
[ 66.596933][ T5837] __kmalloc_cache_noprof+0x39b/0x600
[ 66.596941][ T5837] device_add+0xb6/0xb80
[ 66.596951][ T5837] netdev_register_kobject+0x197/0x350
[ 66.596962][ T5837] register_netdevice+0x1433/0x1eb0
[ 66.596976][ T5837] __ip_tunnel_create+0x3e8/0x550
[ 66.596985][ T5837] ip_tunnel_init_net+0x2e5/0x820
[ 66.596998][ T5837] ops_init+0x35d/0x5d0
[ 66.597005][ T5837] setup_net+0x118/0x350
[ 66.597011][ T5837] copy_net_ns+0x53b/0x780
[ 66.597017][ T5837] create_new_namespaces+0x3f0/0x6b0
[ 66.597050][ T5837] page last free pid 5575 tgid 5575 ts 47941916741 stack trace:
[ 66.597058][ T5837] __free_frozen_pages+0xc93/0xd90
[ 66.597072][ T5837] __slab_free+0x274/0x2c0
[ 66.597081][ T5837] qlist_free_all+0x99/0x100
[ 66.597089][ T5837] kasan_quarantine_reduce+0x148/0x160
[ 66.597099][ T5837] __kasan_slab_alloc+0x22/0x80
[ 66.597109][ T5837] kmem_cache_alloc_noprof+0x2b9/0x600
[ 66.597122][ T5837] alloc_buffer_head+0x2a/0x280
[ 66.597133][ T5837] folio_alloc_buffers+0x1a4/0x630
[ 66.597144][ T5837] create_empty_buffers+0x3a/0x520
[ 66.597156][ T5837] ext4_block_write_begin+0x610/0x1560
[ 66.597169][ T5837] ext4_da_write_begin+0x879/0xd70
[ 66.597179][ T5837] generic_perform_write+0x2d5/0x8f0
[ 66.597189][ T5837] ext4_buffered_write_iter+0xd4/0x380
[ 66.597198][ T5837] ext4_file_write_iter+0xae4/0x1cd0
[ 66.597205][ T5837] vfs_write+0x612/0xba0
[ 66.597214][ T5837] ksys_write+0x150/0x270
[ 66.597223][ T5837]
[ 66.597224][ T5837] Memory state around the buggy address:
[ 66.597228][ T5837] ffff888117e9bb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 66.597232][ T5837] ffff888117e9bb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 66.597237][ T5837] >ffff888117e9bc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 66.597240][ T5837] ^
[ 66.597243][ T5837] ffff888117e9bc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 66.597247][ T5837] ffff888117e9bd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 66.597250][ T5837] ==================================================================
[ 66.597288][ T5837] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 66.862083][ T5837] CPU: 0 UID: 0 PID: 5837 Comm: syz.1.18 Not tainted syzkaller #0 PREEMPT(full)
[ 66.865063][ T5837] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 66.868553][ T5837] Call Trace:
[ 66.869748][ T5837]
[ 66.870708][ T5837] vpanic+0x56d/0xa60
[ 66.872193][ T5837] ? rcu_is_watching+0x16/0xb0
[ 66.873854][ T5837] ? __pfx_vpanic+0x10/0x10
[ 66.875323][ T5837] panic+0xc5/0xd0
[ 66.876453][ T5837] ? __pfx_panic+0x10/0x10
[ 66.877780][ T5837] check_panic_on_warn+0x89/0xb0
[ 66.879236][ T5837] end_report+0x73/0x170
[ 66.880599][ T5837] ? hfs_mdb_put+0x15b/0x270
[ 66.882094][ T5837] kasan_report_invalid_free+0xfa/0x110
[ 66.883957][ T5837] ? hfs_mdb_put+0x15b/0x270
[ 66.885761][ T5837] ? hfs_mdb_put+0x15b/0x270
[ 66.887074][ T5837] __kasan_slab_pre_free+0x104/0x120
[ 66.888725][ T5837] kfree+0x173/0x650
[ 66.889973][ T5837] ? hfs_mdb_put+0x15b/0x270
[ 66.891494][ T5837] hfs_mdb_put+0x15b/0x270
[ 66.893260][ T5837] hfs_fill_super+0x4d2/0x7b0
[ 66.895003][ T5837] ? __pfx_hfs_fill_super+0x10/0x10
[ 66.896591][ T5837] ? sb_set_blocksize+0x155/0x240
[ 66.898120][ T5837] ? setup_bdev_super+0x586/0x680
[ 66.899751][ T5837] get_tree_bdev_flags+0x430/0x4f0
[ 66.901409][ T5837] ? __pfx_hfs_fill_super+0x10/0x10
[ 66.903051][ T5837] ? __pfx_get_tree_bdev_flags+0x10/0x10
[ 66.904657][ T5837] vfs_get_tree+0x92/0x2a0
[ 66.905952][ T5837] do_new_mount+0x319/0xdc0
[ 66.907346][ T5837] ? __pfx_do_new_mount+0x10/0x10
[ 66.908797][ T5837] ? ns_capable+0x89/0xe0
[ 66.910209][ T5837] ? path_mount+0x647/0x1050
[ 66.911642][ T5837] ? user_path_at+0xd4/0x160
[ 66.913074][ T5837] __se_sys_mount+0x31d/0x420
[ 66.914429][ T5837] ? __pfx___se_sys_mount+0x10/0x10
[ 66.916055][ T5837] ? __x64_sys_mount+0x20/0xc0
[ 66.917890][ T5837] do_syscall_64+0x166/0x520
[ 66.919360][ T5837] ? trace_irq_disable+0x3b/0x140
[ 66.920842][ T5837] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 66.922695][ T5837] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 66.924427][ T5837] RIP: 0033:0x7f0f2619f3ca
[ 66.925765][ T5837] Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 66.931808][ T5837] RSP: 002b:00007f0f27037e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 66.934918][ T5837] RAX: ffffffffffffffda RBX: 00007f0f27037ee0 RCX: 00007f0f2619f3ca
[ 66.937987][ T5837] RDX: 0000200000000180 RSI: 00002000000000c0 RDI: 00007f0f27037ea0
[ 66.941109][ T5837] RBP: 0000200000000180 R08: 00007f0f27037ee0 R09: 0000000000000000
[ 66.944120][ T5837] R10: 0000000000000000 R11: 0000000000000246 R12: 00002000000000c0
[ 66.946936][ T5837] R13: 00007f0f27037ea0 R14: 0000000000000305 R15: 0000200000001800
[ 66.949477][ T5837]
[ 66.951163][ T5837] Kernel Offset: disabled
[ 66.952433][ T5837] Rebooting in 86400 seconds..
VM DIAGNOSIS:
12:59:36 Registers:
info registers vcpu 0
CPU#0
RAX=1ffffffff35a7c60 RBX=00000000000003fd RCX=0000000000000000 RDX=00000000000003fd
RSI=0000000000000000 RDI=0000000000000020 RBP=dffffc0000000000 RSP=ffffc9000387ef38
R8 =0000000000000003 R9 =0000000000000004 R10=dffffc0000000000 R11=ffffffff85735310
R12=dffffc0000000000 R13=0000000000000000 R14=ffffffff9ad3e1c0 R15=0000000000000000
RIP=ffffffff85735387 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f0f270386c0 ffffffff 00c00000
GS =0000 ffff88818d6cd000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007f0f2624df30 CR3=000000001b96c000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000561f51a0baf0 0000561f51a04360 XMM01=0000561f51a0baf0 0000561f51a04360
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 0000000000ff0000 XMM05=0000000000000036 0000000000003230
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=ffffffffffffff00 ffffffffffff0000 XMM09=6c6c696b66722f36 7968702f31313230
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1
CPU#1
RAX=ffffc90004e17b01 RBX=0000000000000010 RCX=ffffffff8177fe54 RDX=0000000000000001
RSI=0000000000000010 RDI=ffffc90004e16758 RBP=0000000000000000 RSP=ffffc90004e16638
R8 =ffffc90004e16767 R9 =1ffff920009c2cec R10=dffffc0000000000 R11=fffff520009c2ced
R12=dffffc0000000000 R13=ffffffff91a0af00 R14=ffffc90004e16758 R15=ffffc90004e16750
RIP=ffffffff8be90d20 RFL=00000256 [---ZAP-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 000055557445f500 ffffffff 00c00000
GS =0000 ffff8882a8ccd000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000048000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007f74f36eb440 CR3=00000001077d0000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000100000001 0000003900000000 XMM01=00000000ff000000 0000000000ff0000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=00000000000000ff 0000000000000000 XMM05=0000000000000000 00007f06fd63568e
XMM06=0000000000000000 00007f06fd6357f2 XMM07=0000000000000000 00007f06fd635680
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000