Warning: Permanently added '[localhost]:37309' (ED25519) to the list of known hosts. 2026/03/02 18:18:53 parsed 1 programs syzkaller login: [ 62.283124][ T5817] cgroup: Unknown subsys name 'net' [ 62.407642][ T5817] cgroup: Unknown subsys name 'cpuset' [ 62.412153][ T5817] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 64.164933][ T5817] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 67.509461][ T5826] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 68.530361][ T5842] chnl_net:caif_netlink_parms(): no params data found [ 68.618143][ T5842] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.620853][ T5842] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.623763][ T5842] bridge_slave_0: entered allmulticast mode [ 68.627697][ T5842] bridge_slave_0: entered promiscuous mode [ 68.633577][ T5842] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.637830][ T5842] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.640514][ T5842] bridge_slave_1: entered allmulticast mode [ 68.644523][ T5842] bridge_slave_1: entered promiscuous mode [ 68.673303][ T5842] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.679266][ T5842] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 68.706661][ T5842] team0: Port device team_slave_0 added [ 68.711141][ T5842] team0: Port device team_slave_1 added [ 68.735983][ T5842] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 68.738560][ T5842] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 68.747459][ T5842] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 68.754137][ T5842] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 68.756663][ T5842] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 68.766159][ T5842] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 68.803821][ T5842] hsr_slave_0: entered promiscuous mode [ 68.806943][ T5842] hsr_slave_1: entered promiscuous mode [ 68.972397][ T5842] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 68.980867][ T5842] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 68.987137][ T5842] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 68.993428][ T5842] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 69.028425][ T5842] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.031124][ T5842] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.034539][ T5842] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.037059][ T5842] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.089138][ T5842] 8021q: adding VLAN 0 to HW filter on device bond0 [ 69.103479][ T40] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.110097][ T40] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.122401][ T5842] 8021q: adding VLAN 0 to HW filter on device team0 [ 69.131223][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.134331][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.146979][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.149696][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.297741][ T5842] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.338031][ T5842] veth0_vlan: entered promiscuous mode [ 69.346047][ T5842] veth1_vlan: entered promiscuous mode [ 69.372904][ T5842] veth0_macvtap: entered promiscuous mode [ 69.379450][ T5842] veth1_macvtap: entered promiscuous mode [ 69.396906][ T5842] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 69.407020][ T5842] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 69.417544][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.421811][ T5666] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.425476][ T5666] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.432129][ T5666] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.536599][ T5666] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 69.612701][ T5666] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 69.628450][ T950] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.630895][ T950] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.662319][ T5666] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 69.691461][ T70] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.694826][ T70] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.710903][ T5666] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 70.041260][ T5195] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 70.044192][ T5195] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 70.046897][ T5195] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 70.049859][ T5195] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 70.052514][ T5195] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 2026/03/02 18:19:04 executed programs: 0 [ 71.644801][ T5195] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 71.648307][ T5195] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 71.651673][ T5195] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 71.658870][ T5195] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 71.661939][ T5195] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 71.784483][ T5924] chnl_net:caif_netlink_parms(): no params data found [ 71.841618][ T5924] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.844094][ T5924] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.846216][ T5924] bridge_slave_0: entered allmulticast mode [ 71.848706][ T5924] bridge_slave_0: entered promiscuous mode [ 71.852431][ T5924] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.854684][ T5924] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.857282][ T5924] bridge_slave_1: entered allmulticast mode [ 71.860413][ T5924] bridge_slave_1: entered promiscuous mode [ 71.881173][ T5924] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 71.888332][ T5924] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 71.909420][ T5924] team0: Port device team_slave_0 added [ 71.912775][ T5924] team0: Port device team_slave_1 added [ 71.929822][ T5924] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.931867][ T5924] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.939286][ T5924] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.944173][ T5924] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.946480][ T5924] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.954541][ T5924] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.986957][ T5924] hsr_slave_0: entered promiscuous mode [ 71.989057][ T5924] hsr_slave_1: entered promiscuous mode [ 71.991666][ T5924] debugfs: 'hsr0' already exists in 'hsr' [ 71.994345][ T5924] Cannot create hsr debugfs directory [ 72.161069][ T5666] bridge_slave_1: left allmulticast mode [ 72.162901][ T5666] bridge_slave_1: left promiscuous mode [ 72.165969][ T5666] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.171963][ T5666] bridge_slave_0: left allmulticast mode [ 72.174438][ T5666] bridge_slave_0: left promiscuous mode [ 72.176112][ T5666] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.331229][ T5666] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 72.337093][ T5666] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 72.341050][ T5666] bond0 (unregistering): Released all slaves [ 72.427718][ T5666] hsr_slave_0: left promiscuous mode [ 72.430471][ T5666] hsr_slave_1: left promiscuous mode [ 72.433394][ T5666] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 72.436061][ T5666] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 72.440203][ T5666] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 72.442831][ T5666] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 72.453804][ T5666] veth1_macvtap: left promiscuous mode [ 72.456003][ T5666] veth0_macvtap: left promiscuous mode [ 72.458116][ T5666] veth1_vlan: left promiscuous mode [ 72.460141][ T5666] veth0_vlan: left promiscuous mode [ 72.673011][ T5666] team0 (unregistering): Port device team_slave_1 removed [ 72.691735][ T5666] team0 (unregistering): Port device team_slave_0 removed [ 72.984073][ T5924] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 72.989717][ T5924] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 72.994112][ T5924] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 72.998514][ T5924] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 73.062715][ T5924] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.074554][ T5924] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.079796][ T54] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.081715][ T54] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.096109][ T54] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.098871][ T54] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.454621][ T5924] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 73.457543][ T5924] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 73.553592][ T5924] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.585519][ T5924] veth0_vlan: entered promiscuous mode [ 73.590467][ T5924] veth1_vlan: entered promiscuous mode [ 73.618584][ T5924] veth0_macvtap: entered promiscuous mode [ 73.622729][ T5924] veth1_macvtap: entered promiscuous mode [ 73.631987][ T5924] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 73.637050][ T5924] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.646071][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.700876][ T5860] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.709258][ T5860] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.717308][ T56] Bluetooth: hci0: command tx timeout [ 73.726792][ T5860] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.850637][ T54] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.864848][ T54] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.939553][ T31] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.943587][ T31] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.034352][ T5956] loop0: detected capacity change from 0 to 2048 [ 74.081076][ T5956] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 74.091904][ T5956] ext4 filesystem being mounted at /0/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 74.104125][ T5956] ================================================================== [ 74.106384][ T5956] BUG: KASAN: use-after-free in ext4_xattr_set_entry+0x179e/0x1e20 [ 74.108510][ T5956] Read of size 260 at addr ffff88811cde4000 by task syz.0.17/5956 [ 74.111271][ T5956] [ 74.112298][ T5956] CPU: 0 UID: 0 PID: 5956 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 74.112309][ T5956] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 74.112314][ T5956] Call Trace: [ 74.112319][ T5956] [ 74.112328][ T5956] dump_stack_lvl+0xe8/0x150 [ 74.112342][ T5956] print_report+0xba/0x230 [ 74.112352][ T5956] ? ext4_xattr_set_entry+0x179e/0x1e20 [ 74.112362][ T5956] kasan_report+0x117/0x150 [ 74.112371][ T5956] ? ext4_xattr_set_entry+0x179e/0x1e20 [ 74.112381][ T5956] kasan_check_range+0x264/0x2c0 [ 74.112389][ T5956] ? ext4_xattr_set_entry+0x179e/0x1e20 [ 74.112401][ T5956] __asan_memmove+0x29/0x70 [ 74.112412][ T5956] ext4_xattr_set_entry+0x179e/0x1e20 [ 74.112424][ T5956] ext4_xattr_block_set+0x636/0x2b00 [ 74.112436][ T5956] ? __pfx_check_xattrs+0x10/0x10 [ 74.112443][ T5956] ? xattr_find_entry+0x126/0x280 [ 74.112452][ T5956] ? __pfx_ext4_xattr_block_set+0x10/0x10 [ 74.112460][ T5956] ? ext4_xattr_block_find+0x303/0x370 [ 74.112469][ T5956] ext4_xattr_set_handle+0xdc2/0x14d0 [ 74.112480][ T5956] ? __pfx_ext4_xattr_set_handle+0x10/0x10 [ 74.112491][ T5956] ext4_xattr_set+0x255/0x340 [ 74.112501][ T5956] ? __pfx_ext4_xattr_set+0x10/0x10 [ 74.112509][ T5956] ? evm_protect_xattr+0x4d4/0xac0 [ 74.112521][ T5956] ? __pfx_evm_protect_xattr+0x10/0x10 [ 74.112531][ T5956] ? __pfx_ext4_xattr_trusted_set+0x10/0x10 [ 74.112540][ T5956] __vfs_removexattr+0x431/0x470 [ 74.112553][ T5956] __vfs_removexattr_locked+0xe2/0x280 [ 74.112563][ T5956] ? __pfx_vfs_setxattr+0x10/0x10 [ 74.112573][ T5956] vfs_removexattr+0x7f/0x230 [ 74.112583][ T5956] ovl_fill_super+0x4c09/0x5e00 [ 74.112594][ T5956] ? rcu_is_watching+0x15/0xb0 [ 74.112608][ T5956] ? __lock_acquire+0x6b5/0x2cf0 [ 74.112620][ T5956] ? __pfx_ovl_fill_super+0x10/0x10 [ 74.112628][ T5956] ? xas_create+0x1902/0x1b90 [ 74.112641][ T5956] ? __pfx___mutex_trylock_common+0x10/0x10 [ 74.112653][ T5956] ? trace_contention_end+0x3d/0x150 [ 74.112665][ T5956] ? shrinker_register+0x124/0x230 [ 74.112676][ T5956] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 74.112683][ T5956] ? __pfx___mutex_lock+0x10/0x10 [ 74.112690][ T5956] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 74.112698][ T5956] ? __raw_spin_lock_init+0x45/0x100 [ 74.112707][ T5956] ? sget_fc+0x962/0xa40 [ 74.112718][ T5956] ? __pfx_set_anon_super_fc+0x10/0x10 [ 74.112724][ T5956] ? __pfx_ovl_fill_super+0x10/0x10 [ 74.112733][ T5956] get_tree_nodev+0xbb/0x150 [ 74.112740][ T5956] vfs_get_tree+0x92/0x2a0 [ 74.112748][ T5956] do_new_mount+0x341/0xd30 [ 74.112757][ T5956] ? apparmor_capable+0x126/0x170 [ 74.112768][ T5956] ? __pfx_do_new_mount+0x10/0x10 [ 74.112778][ T5956] ? ns_capable+0x89/0xe0 [ 74.112787][ T5956] ? path_mount+0x690/0x10e0 [ 74.112797][ T5956] ? user_path_at+0xd4/0x160 [ 74.112803][ T5956] __se_sys_mount+0x31d/0x420 [ 74.112814][ T5956] ? __pfx___se_sys_mount+0x10/0x10 [ 74.112825][ T5956] ? __x64_sys_mount+0x20/0xc0 [ 74.112834][ T5956] do_syscall_64+0x14d/0xf80 [ 74.112841][ T5956] ? trace_irq_disable+0x3b/0x150 [ 74.112852][ T5956] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.112860][ T5956] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.112890][ T5956] RIP: 0033:0x7f60b0d9c799 [ 74.112901][ T5956] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 74.112908][ T5956] RSP: 002b:00007ffcaa4270a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 74.112916][ T5956] RAX: ffffffffffffffda RBX: 00007f60b1015fa0 RCX: 00007f60b0d9c799 [ 74.112922][ T5956] RDX: 0000200000000b80 RSI: 0000200000000000 RDI: 0000000000000000 [ 74.112927][ T5956] RBP: 00007f60b0e32bd9 R08: 0000200000000100 R09: 0000000000000000 [ 74.112931][ T5956] R10: 0000000000000804 R11: 0000000000000246 R12: 0000000000000000 [ 74.112936][ T5956] R13: 00007f60b1015fac R14: 00007f60b1015fa0 R15: 00007f60b1015fa0 [ 74.112944][ T5956] [ 74.112947][ T5956] [ 74.221816][ T5956] The buggy address belongs to the physical page: [ 74.223654][ T5956] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x39c pfn:0x11cde4 [ 74.226244][ T5956] flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff) [ 74.228315][ T5956] raw: 017ff00000000000 ffffea0004737948 ffff888121040d70 0000000000000000 [ 74.231092][ T5956] raw: 000000000000039c 0000000000000000 00000000ffffffff 0000000000000000 [ 74.233446][ T5956] page dumped because: kasan: bad access detected [ 74.235329][ T5956] page_owner tracks the page as freed [ 74.237004][ T5956] page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 5919, tgid 5919 (syz-executor), ts 71335198059, free_ts 71626869117 [ 74.241998][ T5956] post_alloc_hook+0x231/0x280 [ 74.243359][ T5956] get_page_from_freelist+0x24dc/0x2580 [ 74.244951][ T5956] __alloc_frozen_pages_noprof+0x18d/0x380 [ 74.246830][ T5956] alloc_pages_mpol+0x232/0x4a0 [ 74.248476][ T5956] vma_alloc_folio_noprof+0xea/0x210 [ 74.250084][ T5956] do_pte_missing+0x4ea/0x3750 [ 74.251418][ T5956] handle_mm_fault+0x1bec/0x3310 [ 74.252785][ T5956] do_user_addr_fault+0xa73/0x1340 [ 74.254230][ T5956] exc_page_fault+0x6a/0xc0 [ 74.255553][ T5956] asm_exc_page_fault+0x26/0x30 [ 74.256918][ T5956] page last free pid 5920 tgid 5920 stack trace: [ 74.258626][ T5956] free_unref_folios+0xed5/0x16d0 [ 74.260050][ T5956] folios_put_refs+0x789/0x8d0 [ 74.261376][ T5956] free_pages_and_swap_cache+0x537/0x5b0 [ 74.262984][ T5956] tlb_flush_mmu+0x6d3/0xa30 [ 74.264412][ T5956] tlb_finish_mmu+0xf9/0x230 [ 74.265760][ T5956] exit_mmap+0x498/0xa10 [ 74.266959][ T5956] __mmput+0x118/0x430 [ 74.268173][ T5956] exit_mm+0x168/0x220 [ 74.269309][ T5956] do_exit+0x62e/0x2320 [ 74.270443][ T5956] do_group_exit+0x21b/0x2d0 [ 74.271694][ T5956] get_signal+0x1284/0x1330 [ 74.272987][ T5956] arch_do_signal_or_restart+0xbc/0x830 [ 74.274589][ T5956] exit_to_user_mode_loop+0x86/0x480 [ 74.276064][ T5956] do_syscall_64+0x32d/0xf80 [ 74.277377][ T5956] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.278995][ T5956] [ 74.279679][ T5956] Memory state around the buggy address: [ 74.281254][ T5956] ffff88811cde3f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 74.283472][ T5956] ffff88811cde3f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 74.285767][ T5956] >ffff88811cde4000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 74.288053][ T5956] ^ [ 74.289224][ T5956] ffff88811cde4080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 74.291497][ T5956] ffff88811cde4100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 74.293775][ T5956] ================================================================== [ 74.302425][ T5956] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 74.304505][ T5956] CPU: 0 UID: 0 PID: 5956 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 74.307109][ T5956] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 74.310083][ T5956] Call Trace: [ 74.311059][ T5956] [ 74.311927][ T5956] vpanic+0x56c/0xa60 [ 74.313079][ T5956] ? __pfx_vpanic+0x10/0x10 [ 74.314389][ T5956] panic+0xc5/0xd0 [ 74.315470][ T5956] ? __pfx_panic+0x10/0x10 [ 74.316749][ T5956] ? preempt_schedule_thunk+0x16/0x30 [ 74.318309][ T5956] ? ext4_xattr_set_entry+0x179e/0x1e20 [ 74.319984][ T5956] ? preempt_schedule_thunk+0x16/0x30 [ 74.321511][ T5956] ? ext4_xattr_set_entry+0x179e/0x1e20 [ 74.323089][ T5956] check_panic_on_warn+0x89/0xb0 [ 74.324502][ T5956] ? ext4_xattr_set_entry+0x179e/0x1e20 [ 74.326103][ T5956] end_report+0x73/0x180 [ 74.327324][ T5956] ? ext4_xattr_set_entry+0x179e/0x1e20 [ 74.328928][ T5956] kasan_report+0x128/0x150 [ 74.330262][ T5956] ? ext4_xattr_set_entry+0x179e/0x1e20 [ 74.331840][ T5956] kasan_check_range+0x264/0x2c0 [ 74.333251][ T5956] ? ext4_xattr_set_entry+0x179e/0x1e20 [ 74.334754][ T5956] __asan_memmove+0x29/0x70 [ 74.336017][ T5956] ext4_xattr_set_entry+0x179e/0x1e20 [ 74.337561][ T5956] ext4_xattr_block_set+0x636/0x2b00 [ 74.339173][ T5956] ? __pfx_check_xattrs+0x10/0x10 [ 74.340844][ T5956] ? xattr_find_entry+0x126/0x280 [ 74.342392][ T5956] ? __pfx_ext4_xattr_block_set+0x10/0x10 [ 74.344045][ T5956] ? ext4_xattr_block_find+0x303/0x370 [ 74.345612][ T5956] ext4_xattr_set_handle+0xdc2/0x14d0 [ 74.347166][ T5956] ? __pfx_ext4_xattr_set_handle+0x10/0x10 [ 74.349117][ T5956] ext4_xattr_set+0x255/0x340 [ 74.350480][ T5956] ? __pfx_ext4_xattr_set+0x10/0x10 [ 74.351977][ T5956] ? evm_protect_xattr+0x4d4/0xac0 [ 74.353449][ T5956] ? __pfx_evm_protect_xattr+0x10/0x10 [ 74.355041][ T5956] ? __pfx_ext4_xattr_trusted_set+0x10/0x10 [ 74.356742][ T5956] __vfs_removexattr+0x431/0x470 [ 74.358193][ T5956] __vfs_removexattr_locked+0xe2/0x280 [ 74.359795][ T5956] ? __pfx_vfs_setxattr+0x10/0x10 [ 74.361240][ T5956] vfs_removexattr+0x7f/0x230 [ 74.362585][ T5956] ovl_fill_super+0x4c09/0x5e00 [ 74.363982][ T5956] ? rcu_is_watching+0x15/0xb0 [ 74.365375][ T5956] ? __lock_acquire+0x6b5/0x2cf0 [ 74.366794][ T5956] ? __pfx_ovl_fill_super+0x10/0x10 [ 74.368302][ T5956] ? xas_create+0x1902/0x1b90 [ 74.369887][ T5956] ? __pfx___mutex_trylock_common+0x10/0x10 [ 74.371924][ T5956] ? trace_contention_end+0x3d/0x150 [ 74.373499][ T5956] ? shrinker_register+0x124/0x230 [ 74.374942][ T5956] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 74.376553][ T5956] ? __pfx___mutex_lock+0x10/0x10 [ 74.378027][ T5956] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 74.379695][ T5956] ? __raw_spin_lock_init+0x45/0x100 [ 74.381183][ T5956] ? sget_fc+0x962/0xa40 [ 74.382633][ T5956] ? __pfx_set_anon_super_fc+0x10/0x10 [ 74.384494][ T5956] ? __pfx_ovl_fill_super+0x10/0x10 [ 74.386443][ T5956] get_tree_nodev+0xbb/0x150 [ 74.388029][ T5956] vfs_get_tree+0x92/0x2a0 [ 74.389314][ T5956] do_new_mount+0x341/0xd30 [ 74.390653][ T5956] ? apparmor_capable+0x126/0x170 [ 74.392363][ T5956] ? __pfx_do_new_mount+0x10/0x10 [ 74.394020][ T5956] ? ns_capable+0x89/0xe0 [ 74.395259][ T5956] ? path_mount+0x690/0x10e0 [ 74.396511][ T5956] ? user_path_at+0xd4/0x160 [ 74.397774][ T5956] __se_sys_mount+0x31d/0x420 [ 74.399280][ T5956] ? __pfx___se_sys_mount+0x10/0x10 [ 74.400663][ T5956] ? __x64_sys_mount+0x20/0xc0 [ 74.401992][ T5956] do_syscall_64+0x14d/0xf80 [ 74.403300][ T5956] ? trace_irq_disable+0x3b/0x150 [ 74.404640][ T5956] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.406279][ T5956] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.408166][ T5956] RIP: 0033:0x7f60b0d9c799 [ 74.409414][ T5956] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 74.414710][ T5956] RSP: 002b:00007ffcaa4270a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 74.416992][ T5956] RAX: ffffffffffffffda RBX: 00007f60b1015fa0 RCX: 00007f60b0d9c799 [ 74.419138][ T5956] RDX: 0000200000000b80 RSI: 0000200000000000 RDI: 0000000000000000 [ 74.421296][ T5956] RBP: 00007f60b0e32bd9 R08: 0000200000000100 R09: 0000000000000000 [ 74.423442][ T5956] R10: 0000000000000804 R11: 0000000000000246 R12: 0000000000000000 [ 74.425610][ T5956] R13: 00007f60b1015fac R14: 00007f60b1015fa0 R15: 00007f60b1015fa0 [ 74.427707][ T5956] [ 74.429196][ T5956] Kernel Offset: disabled [ 74.430571][ T5956] Rebooting in 86400 seconds.. VM DIAGNOSIS: 18:19:07 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000079 RBX=0000000000000079 RCX=0000000000000000 RDX=00000000000003f8 RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc900045269d0 R8 =ffff888109db8237 R9 =1ffff110213b7046 R10=dffffc0000000000 R11=ffffffff85402320 R12=dffffc0000000000 R13=ffffffff9a2b2a83 R14=ffffffff9a5ca8a0 R15=0000000000000000 RIP=ffffffff8540239c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000555587a72500 ffffffff 00c00000 GS =0000 ffff88818de64000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000200000001000 CR3=00000001098ec000 CR4=000006f0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000 XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000 XMM04=0000000000000000 0000000000000000 XMM05=0000000000000000 0000000000000000 XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000 XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000 XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000 XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000 XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=00000000a4937fdc RBX=00000000f1c84f84 RCX=000000003b773593 RDX=00000000bbb22145 RSI=00000000169c7044 RDI=ffff888102b29d40 RBP=0d85804f00000000 RSP=ffffc90004acf298 R8 =ffffffff81767a45 R9 =ffffffff8e7602e0 R10=ffffc90004acf578 R11=ffffffff81b0bb90 R12=ffff888102b2a910 R13=ffff888102b2a910 R14=ffff888102b29d40 R15=0000000000000003 RIP=ffffffff81a18ebb RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8882a9464000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f60a7ed2000 CR3=000000016c658000 CR4=000006f0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000 XMM02=ff00000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000 XMM04=0000000000000000 0000000000000000 XMM05=0000000000000000 0000000000000000 XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000 XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000 XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000 XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000 XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000