syzkaller login: [ 92.063107][ T1375] cfg80211: failed to load regulatory.db
Warning: Permanently added '[localhost]:19894' (ED25519) to the list of known hosts.
2026/10/20 17:55:10 parsed 1 programs
2026/10/20 17:55:10 serving rpc on tcp://34081
qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x400000)
[ 112.202308][ T5298] cgroup: Unknown subsys name 'net'
[ 112.285463][ T5298] cgroup: Unknown subsys name 'cpuset'
[ 112.296125][ T5298] cgroup: Unknown subsys name 'rlimit'
[ 138.142261][ T1328] ieee802154 phy0 wpan0: encryption failed: -22
[ 138.142328][ T1328] ieee802154 phy1 wpan1: encryption failed: -22
[ 142.638661][ T1022] ata1.00: exception Emask 0x0 SAct 0x800 SErr 0x0 action 0x6 frozen
[ 142.638687][ T1022] ata1.00: failed command: WRITE FPDMA QUEUED
[ 142.638694][ T1022] ata1.00: cmd 61/00:58:36:81:04/20:00:00:00:00/40 tag 11 ncq dma 4194304 ou
[ 142.638694][ T1022] res 40/00:00:00:00:00/00:00:00:00:00/00 Emask 0x4 (timeout)
[ 142.638722][ T1022] ata1.00: status: { DRDY }
[ 142.638776][ T1022] ata1: hard resetting link
[ 142.963047][ T1022] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
[ 142.964173][ T1022] ata1.00: configured for UDMA/100
qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x400000)
[ 142.964469][ T1022] ata1: EH complete
[ 142.989336][ T1022] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1
[ 142.989349][ T1022] ata1: failed to read log page 10h (errno=-5)
[ 142.989358][ T1022] ata1.00: exception Emask 0x1 SAct 0x8000000 SErr 0x0 action 0x0
[ 142.989365][ T1022] ata1.00: irq_stat 0x41000008
[ 142.989372][ T1022] ata1.00: failed command: WRITE FPDMA QUEUED
[ 142.989377][ T1022] ata1.00: cmd 61/00:d8:36:81:04/20:00:00:00:00/40 tag 27 ncq dma 4194304 ou
[ 142.989377][ T1022] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 142.989396][ T1022] ata1.00: status: { DRDY }
[ 142.989400][ T1022] ata1.00: error: { ABRT }
[ 142.991728][ T1022] ata1.00: configured for UDMA/100
[ 142.992241][ T1022] ata1: EH complete
Setting up swapspace version 1, size = 127995904 bytes
[ 144.447186][ T5298] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 149.500405][ T5316] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 152.046686][ T5339] rxe_eth0 speed is unknown, defaulting to 1000
[ 152.056781][ T5339] rxe_eth0 speed is unknown, defaulting to 1000
[ 152.066415][ T5339] rxe_eth0 speed is unknown, defaulting to 1000
[ 152.369697][ T55] rxe_eth0 speed is unknown, defaulting to 1000
[ 152.381133][ T5339] infiniband rxe0: set active
[ 152.381150][ T5339] infiniband rxe0: added rxe_eth0
[ 152.408165][ T5339] smbdirect: ib_dev[rxe0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000
[ 152.408194][ T5339] smbdirect: ib_dev[rxe0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32
[ 152.408213][ T5339] smbdirect: ib_dev[rxe0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005
[ 152.508145][ T5339] RDS/IB: rxe0: added
[ 152.513018][ T5339] smc: adding ib device rxe0 with port count 1
[ 152.513089][ T5339] smc: ib device rxe0 port 1 has no pnetid
[ 152.513897][ T55] rxe_eth0 speed is unknown, defaulting to 1000
[ 152.570651][ T5339] rxe_eth0 speed is unknown, defaulting to 1000
[ 153.051523][ T5339] bridge0: port 1(bridge_slave_0) entered blocking state
[ 153.052117][ T5339] bridge0: port 1(bridge_slave_0) entered disabled state
[ 153.052586][ T5339] bridge_slave_0: entered allmulticast mode
[ 153.053918][ T5339] bridge_slave_0: entered promiscuous mode
[ 153.070212][ T5339] bridge0: port 2(bridge_slave_1) entered blocking state
[ 153.070332][ T5339] bridge0: port 2(bridge_slave_1) entered disabled state
[ 153.070613][ T5339] bridge_slave_1: entered allmulticast mode
[ 153.071585][ T5339] bridge_slave_1: entered promiscuous mode
[ 153.160782][ T5339] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 153.175444][ T5339] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 153.220558][ T5339] team0: Port device team_slave_0 added
[ 153.233801][ T5339] team0: Port device team_slave_1 added
[ 153.281619][ T5339] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 153.281635][ T5339] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 153.281648][ T5339] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 153.283581][ T5339] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 153.283591][ T5339] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 153.283605][ T5339] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 153.403546][ T5339] hsr_slave_0: entered promiscuous mode
[ 153.404584][ T5339] hsr_slave_1: entered promiscuous mode
[ 153.761819][ T5339] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 153.785429][ T5339] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 153.787563][ T5339] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 153.801068][ T5339] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 153.803081][ T5339] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 153.820837][ T5339] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 153.836972][ T5339] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 153.848107][ T5339] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 153.965046][ T5339] 8021q: adding VLAN 0 to HW filter on device bond0
[ 153.990860][ T5339] 8021q: adding VLAN 0 to HW filter on device team0
[ 153.997387][ T188] bridge0: port 1(bridge_slave_0) entered blocking state
[ 153.997498][ T188] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 154.021910][ T188] bridge0: port 2(bridge_slave_1) entered blocking state
[ 154.022001][ T188] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 154.421388][ T5339] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 154.491004][ T5339] veth0_vlan: entered promiscuous mode
[ 154.497570][ T5339] veth1_vlan: entered promiscuous mode
[ 154.532918][ T5339] veth0_macvtap: entered promiscuous mode
[ 154.537125][ T5339] veth1_macvtap: entered promiscuous mode
[ 154.562701][ T5339] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 154.575293][ T5339] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 154.660422][ T188] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 154.660457][ T188] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 154.660476][ T188] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 154.660494][ T188] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 154.897152][ T76] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 155.024597][ T76] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 155.110417][ T76] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 155.144364][ T5380] rxe_eth0 speed is unknown, defaulting to 1000
[ 155.620390][ T5385] rxe_eth0 speed is unknown, defaulting to 1000
[ 155.871187][ T76] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 156.128989][ T5391] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 156.130902][ T5391] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 156.131408][ T47] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 156.131951][ T47] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 156.132453][ T47] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 156.247685][ T5390] rxe_eth0 speed is unknown, defaulting to 1000
[ 156.716530][ T5397] rxe_eth0 speed is unknown, defaulting to 1000
[ 157.035766][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 157.035784][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 157.091329][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 157.091346][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 157.626101][ T5403] rxe_eth0 speed is unknown, defaulting to 1000
[ 157.725471][ T76] bridge_slave_1: left allmulticast mode
[ 157.725570][ T76] bridge_slave_1: left promiscuous mode
[ 157.727210][ T76] bridge0: port 2(bridge_slave_1) entered disabled state
[ 157.753548][ T76] bridge_slave_0: left allmulticast mode
[ 157.753571][ T76] bridge_slave_0: left promiscuous mode
[ 157.753721][ T76] bridge0: port 1(bridge_slave_0) entered disabled state
[ 158.044897][ T76] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 158.047871][ T76] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 158.060150][ T76] bond0 (unregistering): Released all slaves
[ 158.516502][ T76] hsr_slave_0: left promiscuous mode
[ 158.517794][ T76] hsr_slave_1: left promiscuous mode
[ 158.524015][ T76] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 158.524051][ T76] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 158.526737][ T76] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 158.526750][ T76] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 158.581313][ T76] veth1_macvtap: left promiscuous mode
[ 158.581405][ T76] veth0_macvtap: left promiscuous mode
[ 158.583758][ T76] veth1_vlan: left promiscuous mode
[ 158.584043][ T76] veth0_vlan: left promiscuous mode
[ 159.354760][ T76] team0 (unregistering): Port device team_slave_1 removed
[ 159.365860][ T76] team0 (unregistering): Port device team_slave_0 removed
[ 159.491332][ T4989] 8021q: adding VLAN 0 to HW filter on device eth2
[ 159.544429][ T5416] rxe_eth0 speed is unknown, defaulting to 1000
[ 160.212733][ T4989] 8021q: adding VLAN 0 to HW filter on device eth3
[ 160.956468][ T5431] rxe_eth0 speed is unknown, defaulting to 1000
[ 161.275288][ T4989] 8021q: adding VLAN 0 to HW filter on device eth4
[ 161.944537][ T4989] 8021q: adding VLAN 0 to HW filter on device eth5
[ 162.230693][ T5446] rxe_eth0 speed is unknown, defaulting to 1000
[ 162.843613][ T5455] rxe_eth0 speed is unknown, defaulting to 1000
[ 163.277645][ T1911] rxe_eth0 speed is unknown, defaulting to 1000
[ 163.611763][ T5465] rxe_eth0 speed is unknown, defaulting to 1000
2026/10/20 17:56:05 executed programs: 0
[ 164.831522][ T4643] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 164.834294][ T4643] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 164.834715][ T4643] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 164.835258][ T4643] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 164.835555][ T4643] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 165.324294][ T5472] rxe_eth0 speed is unknown, defaulting to 1000
[ 165.627077][ T5472] bridge0: port 1(bridge_slave_0) entered blocking state
[ 165.627225][ T5472] bridge0: port 1(bridge_slave_0) entered disabled state
[ 165.627339][ T5472] bridge_slave_0: entered allmulticast mode
[ 165.640397][ T5472] bridge_slave_0: entered promiscuous mode
[ 165.646444][ T5472] bridge0: port 2(bridge_slave_1) entered blocking state
[ 165.646627][ T5472] bridge0: port 2(bridge_slave_1) entered disabled state
[ 165.646716][ T5472] bridge_slave_1: entered allmulticast mode
[ 165.647844][ T5472] bridge_slave_1: entered promiscuous mode
[ 165.683812][ T5472] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 165.686154][ T5472] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 165.715524][ T5472] team0: Port device team_slave_0 added
[ 165.717996][ T5472] team0: Port device team_slave_1 added
[ 165.742921][ T5472] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 165.742931][ T5472] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 165.742940][ T5472] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 165.744168][ T5472] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 165.744178][ T5472] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 165.744186][ T5472] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 165.815895][ T5472] hsr_slave_0: entered promiscuous mode
[ 165.816632][ T5472] hsr_slave_1: entered promiscuous mode
[ 166.406102][ T5472] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 166.419629][ T5472] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 166.420405][ T5472] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 166.422582][ T5472] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 166.423559][ T5472] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 166.443665][ T5472] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 166.445289][ T5472] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 166.456500][ T5472] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 166.506373][ T5472] bridge0: port 2(bridge_slave_1) entered blocking state
[ 166.506498][ T5472] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 166.506958][ T5472] bridge0: port 1(bridge_slave_0) entered blocking state
[ 166.507016][ T5472] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 166.539205][ T13] bridge0: port 1(bridge_slave_0) entered disabled state
[ 166.539706][ T13] bridge0: port 2(bridge_slave_1) entered disabled state
[ 166.645054][ T5472] 8021q: adding VLAN 0 to HW filter on device bond0
[ 166.682374][ T5472] 8021q: adding VLAN 0 to HW filter on device team0
[ 166.694884][ T12] bridge0: port 1(bridge_slave_0) entered blocking state
[ 166.694955][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 166.714834][ T12] bridge0: port 2(bridge_slave_1) entered blocking state
[ 166.714909][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 166.941866][ T4643] Bluetooth: hci0: command tx timeout
[ 167.507865][ T5472] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 167.606137][ T5472] veth0_vlan: entered promiscuous mode
[ 167.626937][ T5472] veth1_vlan: entered promiscuous mode
[ 167.693043][ T5472] veth0_macvtap: entered promiscuous mode
[ 167.709043][ T5472] veth1_macvtap: entered promiscuous mode
[ 167.736493][ T5472] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 167.759377][ T5472] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 167.808616][ T43] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 167.808651][ T43] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 167.808669][ T43] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 167.808685][ T43] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 168.031417][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 168.031437][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 168.104216][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 168.104237][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 168.241920][ T5536] ==================================================================
[ 168.241947][ T5536] BUG: KASAN: slab-use-after-free in snapshot_ctr+0x5cb/0x1340
[ 168.242190][ T5536] Read of size 8 at addr ffff888014662218 by task syz.0.17/5536
[ 168.242199][ T5536]
[ 168.242214][ T5536] CPU: 0 UID: 0 PID: 5536 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 168.242225][ T5536] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 168.242231][ T5536] Call Trace:
[ 168.242238][ T5536]
[ 168.242243][ T5536] dump_stack_lvl+0xe8/0x150
[ 168.242287][ T5536] print_address_description+0x55/0x1e0
[ 168.242300][ T5536] ? snapshot_ctr+0x5cb/0x1340
[ 168.242310][ T5536] print_report+0x58/0x70
[ 168.242321][ T5536] kasan_report+0x117/0x150
[ 168.242340][ T5536] ? snapshot_ctr+0x5cb/0x1340
[ 168.242352][ T5536] snapshot_ctr+0x5cb/0x1340
[ 168.242366][ T5536] ? __pfx_snapshot_ctr+0x10/0x10
[ 168.242377][ T5536] ? skip_spaces+0x8a/0xa0
[ 168.242474][ T5536] ? dm_split_args+0x50b/0x5d0
[ 168.242500][ T5536] dm_table_add_target+0x58d/0xc70
[ 168.242520][ T5536] table_load+0x325/0x8a0
[ 168.242538][ T5536] ? __pfx_table_load+0x10/0x10
[ 168.242555][ T5536] dm_ctl_ioctl+0x9ec/0xe10
[ 168.242571][ T5536] ? __pfx_table_load+0x10/0x10
[ 168.242583][ T5536] ? __pfx_dm_ctl_ioctl+0x10/0x10
[ 168.242600][ T5536] ? __pfx___se_sys_futex+0x10/0x10
[ 168.242627][ T5536] ? bpf_lsm_file_ioctl+0x9/0x20
[ 168.242641][ T5536] ? __pfx_dm_ctl_ioctl+0x10/0x10
[ 168.242652][ T5536] __se_sys_ioctl+0xfc/0x170
[ 168.242664][ T5536] do_syscall_64+0x166/0x520
[ 168.242702][ T5536] ? trace_irq_disable+0x3b/0x140
[ 168.242716][ T5536] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 168.242727][ T5536] ? clear_bhb_loop+0x70/0xc0
[ 168.242738][ T5536] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 168.242747][ T5536] RIP: 0033:0x7fc98db9f559
[ 168.242758][ T5536] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 168.242766][ T5536] RSP: 002b:00007ffd55a94228 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 168.242777][ T5536] RAX: ffffffffffffffda RBX: 00007fc98de25fa0 RCX: 00007fc98db9f559
[ 168.242784][ T5536] RDX: 0000200000001640 RSI: 00000000c138fd09 RDI: 0000000000000003
[ 168.242790][ T5536] RBP: 00007fc98dc36b20 R08: 0000000000000000 R09: 0000000000000000
[ 168.242796][ T5536] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 168.242801][ T5536] R13: 00007fc98de25fac R14: 00007fc98de25fa0 R15: 00007fc98de25fa0
[ 168.242812][ T5536]
[ 168.242815][ T5536]
[ 168.242818][ T5536] Allocated by task 5536:
[ 168.242829][ T5536] kasan_save_track+0x3e/0x80
[ 168.242840][ T5536] __kasan_kmalloc+0x93/0xb0
[ 168.242848][ T5536] __kmalloc_cache_node_noprof+0x3d1/0x620
[ 168.242858][ T5536] dm_get_table_device+0x23e/0x740
[ 168.242866][ T5536] dm_get_device+0x327/0x760
[ 168.242878][ T5536] snapshot_ctr+0x2b2/0x1340
[ 168.242886][ T5536] dm_table_add_target+0x58d/0xc70
[ 168.242898][ T5536] table_load+0x325/0x8a0
[ 168.242909][ T5536] dm_ctl_ioctl+0x9ec/0xe10
[ 168.242920][ T5536] __se_sys_ioctl+0xfc/0x170
[ 168.242927][ T5536] do_syscall_64+0x166/0x520
[ 168.242937][ T5536] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 168.242949][ T5536]
[ 168.242951][ T5536] Freed by task 5536:
[ 168.242955][ T5536] kasan_save_track+0x3e/0x80
[ 168.242964][ T5536] kasan_save_free_info+0x40/0x50
[ 168.242978][ T5536] __kasan_slab_free+0x5c/0x80
[ 168.242987][ T5536] kfree+0x1c5/0x650
[ 168.243000][ T5536] dm_put_table_device+0x255/0x2a0
[ 168.243009][ T5536] dm_get_device+0x56f/0x760
[ 168.243020][ T5536] snapshot_ctr+0x471/0x1340
[ 168.243030][ T5536] dm_table_add_target+0x58d/0xc70
[ 168.243044][ T5536] table_load+0x325/0x8a0
[ 168.243056][ T5536] dm_ctl_ioctl+0x9ec/0xe10
[ 168.243067][ T5536] __se_sys_ioctl+0xfc/0x170
[ 168.243076][ T5536] do_syscall_64+0x166/0x520
[ 168.243087][ T5536] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 168.243097][ T5536]
[ 168.243100][ T5536] The buggy address belongs to the object at ffff888014662200
[ 168.243100][ T5536] which belongs to the cache kmalloc-96 of size 96
[ 168.243127][ T5536] The buggy address is located 24 bytes inside of
[ 168.243127][ T5536] freed 96-byte region [ffff888014662200, ffff888014662260)
[ 168.243138][ T5536]
[ 168.243142][ T5536] The buggy address belongs to the physical page:
[ 168.243148][ T5536] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14662
[ 168.243159][ T5536] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 168.243169][ T5536] page_type: f5(slab)
[ 168.243180][ T5536] raw: 00fff00000000000 ffff88801c041280 dead000000000100 dead000000000122
[ 168.243189][ T5536] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000
[ 168.243195][ T5536] page dumped because: kasan: bad access detected
[ 168.243201][ T5536] page_owner tracks the page as allocated
[ 168.243205][ T5536] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 5472, tgid 5472 (syz-executor), ts 168050917156
[ 168.243221][ T5536] post_alloc_hook+0x1f9/0x250
[ 168.243237][ T5536] get_page_from_freelist+0x2209/0x2280
[ 168.243248][ T5536] __alloc_pages_slowpath+0x3f9/0xec0
[ 168.243258][ T5536] __alloc_frozen_pages_noprof+0x3f3/0x5a0
[ 168.243268][ T5536] allocate_slab+0x7d/0x620
[ 168.243281][ T5536] ___slab_alloc+0x16a/0x960
[ 168.243292][ T5536] __kmalloc_cache_node_noprof+0x1db/0x620
[ 168.243302][ T5536] __alloc_workqueue+0x746/0x1fe0
[ 168.243312][ T5536] alloc_workqueue_noprof+0xe3/0x210
[ 168.243322][ T5536] ieee80211_register_hw+0x368f/0x4b00
[ 168.243367][ T5536] mac80211_hwsim_new_radio+0x3258/0x56b0
[ 168.243431][ T5536] hwsim_new_radio_nl+0xd8b/0xf90
[ 168.243443][ T5536] genl_family_rcv_msg_doit+0x233/0x340
[ 168.243506][ T5536] genl_rcv_msg+0x614/0x7a0
[ 168.243518][ T5536] netlink_rcv_skb+0x226/0x4a0
[ 168.243527][ T5536] genl_rcv+0x28/0x40
[ 168.243537][ T5536] page last free pid 5532 tgid 5532 ts 167966643301 stack trace:
[ 168.243545][ T5536] __free_frozen_pages+0xc93/0xd90
[ 168.243560][ T5536] __slab_free+0x274/0x2c0
[ 168.243569][ T5536] qlist_free_all+0x99/0x100
[ 168.243576][ T5536] kasan_quarantine_reduce+0x148/0x160
[ 168.243584][ T5536] __kasan_slab_alloc+0x22/0x80
[ 168.243595][ T5536] kmem_cache_alloc_noprof+0x2b9/0x600
[ 168.243609][ T5536] __anon_vma_prepare+0xc3/0x4d0
[ 168.243623][ T5536] do_pte_missing+0x2f18/0x34b0
[ 168.243632][ T5536] handle_mm_fault+0x1a53/0x3750
[ 168.243644][ T5536] do_user_addr_fault+0xb35/0x1480
[ 168.243655][ T5536] exc_page_fault+0x6a/0xc0
[ 168.243666][ T5536] asm_exc_page_fault+0x26/0x30
[ 168.243676][ T5536]
[ 168.243679][ T5536] Memory state around the buggy address:
[ 168.243685][ T5536] ffff888014662100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 168.243692][ T5536] ffff888014662180: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[ 168.243700][ T5536] >ffff888014662200: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 168.243705][ T5536] ^
[ 168.243711][ T5536] ffff888014662280: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc
[ 168.243717][ T5536] ffff888014662300: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[ 168.243722][ T5536] ==================================================================
[ 168.243729][ T5536] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 168.553152][ T5536] CPU: 0 UID: 0 PID: 5536 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 168.557121][ T5536] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 168.561424][ T5536] Call Trace:
[ 168.562954][ T5536]
[ 168.564267][ T5536] vpanic+0x56d/0xa60
[ 168.565936][ T5536] ? __pfx_vpanic+0x10/0x10
[ 168.567840][ T5536] panic+0xc5/0xd0
[ 168.569453][ T5536] ? __pfx_panic+0x10/0x10
[ 168.571205][ T5536] ? snapshot_ctr+0x5cb/0x1340
[ 168.573525][ T5536] ? snapshot_ctr+0x5cb/0x1340
[ 168.576061][ T5536] check_panic_on_warn+0x89/0xb0
[ 168.578393][ T5536] ? snapshot_ctr+0x5cb/0x1340
[ 168.580579][ T5536] end_report+0x73/0x170
[ 168.582524][ T5536] ? snapshot_ctr+0x5cb/0x1340
[ 168.584653][ T5536] kasan_report+0x128/0x150
[ 168.586665][ T5536] ? snapshot_ctr+0x5cb/0x1340
[ 168.588827][ T5536] snapshot_ctr+0x5cb/0x1340
[ 168.590816][ T5536] ? __pfx_snapshot_ctr+0x10/0x10
[ 168.592931][ T5536] ? skip_spaces+0x8a/0xa0
[ 168.594825][ T5536] ? dm_split_args+0x50b/0x5d0
[ 168.596914][ T5536] dm_table_add_target+0x58d/0xc70
[ 168.598913][ T5536] table_load+0x325/0x8a0
[ 168.600618][ T5536] ? __pfx_table_load+0x10/0x10
[ 168.602498][ T5536] dm_ctl_ioctl+0x9ec/0xe10
[ 168.604384][ T5536] ? __pfx_table_load+0x10/0x10
[ 168.606381][ T5536] ? __pfx_dm_ctl_ioctl+0x10/0x10
[ 168.608415][ T5536] ? __pfx___se_sys_futex+0x10/0x10
[ 168.610638][ T5536] ? bpf_lsm_file_ioctl+0x9/0x20
[ 168.612741][ T5536] ? __pfx_dm_ctl_ioctl+0x10/0x10
[ 168.614903][ T5536] __se_sys_ioctl+0xfc/0x170
[ 168.616916][ T5536] do_syscall_64+0x166/0x520
[ 168.618865][ T5536] ? trace_irq_disable+0x3b/0x140
[ 168.621079][ T5536] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 168.623700][ T5536] ? clear_bhb_loop+0x70/0xc0
[ 168.625743][ T5536] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 168.628136][ T5536] RIP: 0033:0x7fc98db9f559
[ 168.630199][ T5536] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 168.637788][ T5536] RSP: 002b:00007ffd55a94228 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 168.641309][ T5536] RAX: ffffffffffffffda RBX: 00007fc98de25fa0 RCX: 00007fc98db9f559
[ 168.644546][ T5536] RDX: 0000200000001640 RSI: 00000000c138fd09 RDI: 0000000000000003
[ 168.647697][ T5536] RBP: 00007fc98dc36b20 R08: 0000000000000000 R09: 0000000000000000
[ 168.650792][ T5536] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 168.654022][ T5536] R13: 00007fc98de25fac R14: 00007fc98de25fa0 R15: 00007fc98de25fa0
[ 168.657369][ T5536]
[ 168.659156][ T5536] Kernel Offset: disabled
[ 168.661457][ T5536] Rebooting in 86400 seconds..
VM DIAGNOSIS:
17:56:09 Registers:
info registers vcpu 0
CPU#0
RAX=0000000000000064 RBX=0000000000000064 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc9000358ef00
R8 =0000000000000003 R9 =0000000000000004 R10=dffffc0000000000 R11=ffffffff8576b480
R12=dffffc0000000000 R13=0000000000000064 R14=ffffffff9bd5b220 R15=0000000000000000
RIP=ffffffff8576b4fc RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 000055556d844500 ffffffff 00c00000
GS =0000 ffff88808b0b0000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007fca253e6000 CR3=000000003605e000 CR4=00352ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=0000000000008001 Opmask01=00000000000000ff Opmask02=000000000000003f Opmask03=0000000000000000
Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 776f635f73656f72 657a5f6472616373
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffd55a94676
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffd55a94676 00007ffd55a9467c
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc98dc3714a
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc98dc37184
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc98dc372e8
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc98dc37176
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0073746e656d6572 757361656d5f656d 69746e75725f7972 616e69622f616d69
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000700080006
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000000000004c
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 0000000000000000 0000000000000000 000000000000004c
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000