program: r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[@ANYBLOB="480000001400b59500000000000000000a000000", @ANYRES32, @ANYBLOB="140002"], 0x48}}, 0x0) r1 = socket(0x2d, 0x2, 0x0) bind$xdp(r1, &(0x7f00000011c0)={0x2d, 0x0, 0x0, 0x48}, 0x10) r2 = socket(0x2d, 0x2, 0x0) bind$xdp(r2, &(0x7f0000001200)={0x2d, 0x0, 0x0, 0xc}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000640)='./sec\x00', &(0x7f0000001140)='securityfs\x00', 0xa40804, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000001180)='./sec\x00', 0x2, 0x0) write(r3, 0x0, 0x37) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000bc0)=ANY=[@ANYRESDEC=r1], 0x1d}}, 0x240cc8c0) syz_mount_image$ext4(&(0x7f0000000300)='ext4\x00', &(0x7f0000000340)='./file0\x00', 0x8, &(0x7f0000000380), 0x1, 0x51a, &(0x7f0000000680)="$eJzs3U9sI1cZAPBvJsnam6ZNCj0AKnQphQWt1k68bVT1QjlVCFVC9MhhGxInimLHUeyUJuwhe+SORCVOcOLMAYkDUk/ckTjAjUs5IBVYgRokJFx5bGedP06sbGJv499PGvnNvLG/93Y071mfN/MCGFu3ImI/Im5ExLsRMds5nnS2eLO9tc775NGD5YNHD5aTaDbf+WeS1beORc97Wp7pfGY+In7wVsSPkmNB/xRR393bWKpUytudQ8VGdatY3927u15dWiuvlTdLpcWFxfnX771WurS+vlT9zcc3I+L3v/vyR3/c/9ZPWs2a6dT19uMytbs+dRinZTIivncVwUZgotOfGxd584XexGVKI+JzEfFydv/PxkR2NY86epm+PcTWAQBXodmcjeZs7z4AcN2lWQ4sSQudXMBMpGmh0M7hvRDTaaVWb9xZre1srrRzZXMxla6uV8rznVzhXEwlq+uT5YWs3N2vlEvH9u9FxPMR8bPczWy/sFyrrIzyiw8AjLFnjs3//8m1538A4JrLPy7mRtkOAGB48qNuAAAwdOZ/ABg/5n8AGD/mfwAYP+Z/ABg/5n8AGCvff/vt1tY86Dz/euW93Z2N2nt3V8r1jUJ1Z7mwXNveKqzVamvZM3uq531epVbbWng1dt4vNsr1RrG+u3e/WtvZbNzPnut9vzw1lF4BAGd5/qUP/5JExP4bN7Mtep73f+5c/eJVtw64SumoGwCMzMSoGwCMzMnVvoBxIR8P4+v/zWYzetbujYiHh6Weh4H2/S9CHwwUJrVuKDx9bn/xCfL/wGea/D+Mr4vl/32Xh+tA/h/GV7OZWPMfAMaMHD+QnFPf+/v/fLNnZ7Df/wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBamsm2JC101gKfiTQtFCKejYi5mEpW1yvl+Yh4LiL+nJvKtfYXIsK6QQDwWZb+Pems/3V79pWZ47U3cv/NZa8R8eNfvPPz95caje2FiBvJvw6PNz7oHC+Nov0AwHm683R3Hu/65NGD5e42zPZ8/J324qKtuAedrV0zGZPZaz7LNUz/O+nst7W+r0xcQvz9hxHxhdP6n2S5kbnOyqfH47diPzvU+OmR+GlW135t/Vt8/hLaAuPmw9b48+Zp918at7LX0+//fDZCPbnu+HdwYvxLD8e/iT7j361BY7z6h++eONicbdc9jPjSZMRB98N7xp9u/KRP/FcGjP/XF7/ycr+65i8jbsdp/U+OxCo2qlvF+u7e3fXq0lp5rbxZKi0uLM6/fu+1UjHLURe7meqT/vHGnef6xW/1f7pP/Pw5/f/6gP3/1f/e/eFXz4j/za+dfv1fOCN+a078xoDxl6Z/m+9X14q/0qf/513/OwPG/+hveysDngoADEF9d29jqVIpbz95IX/mOellhBigkETsX3GIx4Xcr3/61vkn54bWngsWol/VxNPSwmtTyD0dzRigMOqRCbhqj2/6UbcEAAAAAAAAAAAAAADoZxh/TjTqPgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHB9fRoAAP//j4/W2A==") ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000001c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x24810, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}, @uuid={'CRP-syz', 0x0, '2\x00'}}}) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000f80)={0x4, 0x0, 0x0, 0x188, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_dev={r5}, [@snapshot={0x0, 0x1008, 0x0, 0x50, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x1}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'PO', 0x20, '8'}}]}) openat$dm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x7542d000) r6 = userfaultfd(0x80801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000040)) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x5}) r7 = socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000001280)={'syzkaller0\x00', 0x7101}) r9 = openat$tun(0xffffffffffffff9c, &(0x7f00000012c0), 0x0, 0x0) close(r9) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000001300)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001380)={&(0x7f00000013c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r11, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000001440)={0x0, 0x0, &(0x7f0000001480)={&(0x7f00000014c0)=@newqdisc={0x3c, 0x24, 0x20, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r11, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_WASH={0x8, 0xd, 0x1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040a1}, 0x4890) [ 102.413191][ T5288] Bluetooth: hci0: command tx timeout [ 102.516825][ T5331] loop0: detected capacity change from 0 to 512 [ 102.640475][ T5331] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000d40000 r/w without journal. Quota mode: writeback. [ 102.640712][ T5331] ext4 filesystem being mounted at /0/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 102.664545][ T5331] ================================================================== [ 102.664558][ T5331] BUG: KASAN: slab-use-after-free in snapshot_ctr+0x5cb/0x1340 [ 102.664648][ T5331] Read of size 8 at addr ffff888013ce7918 by task syz.0.0/5331 [ 102.664658][ T5331] [ 102.664666][ T5331] CPU: 0 UID: 0 PID: 5331 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 102.664680][ T5331] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.664698][ T5331] Call Trace: [ 102.664714][ T5331] [ 102.664722][ T5331] dump_stack_lvl+0xe8/0x150 [ 102.664759][ T5331] print_address_description+0x55/0x1e0 [ 102.664778][ T5331] ? snapshot_ctr+0x5cb/0x1340 [ 102.664792][ T5331] print_report+0x58/0x70 [ 102.664829][ T5331] kasan_report+0x117/0x150 [ 102.664854][ T5331] ? snapshot_ctr+0x5cb/0x1340 [ 102.664871][ T5331] snapshot_ctr+0x5cb/0x1340 [ 102.664898][ T5331] ? __pfx_snapshot_ctr+0x10/0x10 [ 102.664912][ T5331] ? skip_spaces+0x8a/0xa0 [ 102.664960][ T5331] ? dm_split_args+0x50b/0x5d0 [ 102.664976][ T5331] dm_table_add_target+0x58d/0xc70 [ 102.664995][ T5331] table_load+0x325/0x8a0 [ 102.665008][ T5331] ? __pfx_table_load+0x10/0x10 [ 102.665021][ T5331] dm_ctl_ioctl+0x9ec/0xe10 [ 102.665038][ T5331] ? __pfx_table_load+0x10/0x10 [ 102.665049][ T5331] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 102.665075][ T5331] ? __fget_files+0x2a/0x420 [ 102.665116][ T5331] ? bpf_lsm_file_ioctl+0x9/0x20 [ 102.665142][ T5331] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 102.665160][ T5331] __se_sys_ioctl+0xfc/0x170 [ 102.665174][ T5331] do_syscall_64+0x166/0x520 [ 102.665189][ T5331] ? trace_irq_disable+0x3b/0x140 [ 102.665214][ T5331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.665228][ T5331] ? clear_bhb_loop+0x70/0xc0 [ 102.665242][ T5331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.665254][ T5331] RIP: 0033:0x7f732c99f559 [ 102.665268][ T5331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 102.665290][ T5331] RSP: 002b:00007f732d7ecfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 102.665306][ T5331] RAX: ffffffffffffffda RBX: 00007f732cc25fa0 RCX: 00007f732c99f559 [ 102.665315][ T5331] RDX: 0000200000000f80 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 102.665323][ T5331] RBP: 00007f732ca36b20 R08: 0000000000000000 R09: 0000000000000000 [ 102.665331][ T5331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.665339][ T5331] R13: 00007f732cc26038 R14: 00007f732cc25fa0 R15: 00007ffc56a889f8 [ 102.665354][ T5331] [ 102.665360][ T5331] [ 102.665363][ T5331] Allocated by task 5331: [ 102.665382][ T5331] kasan_save_track+0x3e/0x80 [ 102.665394][ T5331] __kasan_kmalloc+0x93/0xb0 [ 102.665405][ T5331] __kmalloc_cache_node_noprof+0x3cc/0x620 [ 102.665437][ T5331] dm_get_table_device+0x23e/0x730 [ 102.665451][ T5331] dm_get_device+0x327/0x760 [ 102.665461][ T5331] snapshot_ctr+0x2b2/0x1340 [ 102.665480][ T5331] dm_table_add_target+0x58d/0xc70 [ 102.665490][ T5331] table_load+0x325/0x8a0 [ 102.665499][ T5331] dm_ctl_ioctl+0x9ec/0xe10 [ 102.665514][ T5331] __se_sys_ioctl+0xfc/0x170 [ 102.665524][ T5331] do_syscall_64+0x166/0x520 [ 102.665537][ T5331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.665547][ T5331] [ 102.665550][ T5331] Freed by task 5331: [ 102.665555][ T5331] kasan_save_track+0x3e/0x80 [ 102.665566][ T5331] kasan_save_free_info+0x40/0x50 [ 102.665581][ T5331] __kasan_slab_free+0x5c/0x80 [ 102.665592][ T5331] kfree+0x1c5/0x650 [ 102.665606][ T5331] dm_put_table_device+0x255/0x2a0 [ 102.665619][ T5331] dm_get_device+0x56f/0x760 [ 102.665629][ T5331] snapshot_ctr+0x471/0x1340 [ 102.665643][ T5331] dm_table_add_target+0x58d/0xc70 [ 102.665654][ T5331] table_load+0x325/0x8a0 [ 102.665664][ T5331] dm_ctl_ioctl+0x9ec/0xe10 [ 102.665680][ T5331] __se_sys_ioctl+0xfc/0x170 [ 102.665704][ T5331] do_syscall_64+0x166/0x520 [ 102.665746][ T5331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.665758][ T5331] [ 102.665761][ T5331] The buggy address belongs to the object at ffff888013ce7900 [ 102.665761][ T5331] which belongs to the cache kmalloc-96 of size 96 [ 102.665772][ T5331] The buggy address is located 24 bytes inside of [ 102.665772][ T5331] freed 96-byte region [ffff888013ce7900, ffff888013ce7960) [ 102.665785][ T5331] [ 102.665788][ T5331] The buggy address belongs to the physical page: [ 102.665795][ T5331] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13ce7 [ 102.665808][ T5331] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 102.665819][ T5331] page_type: f5(slab) [ 102.665830][ T5331] raw: 00fff00000000000 ffff88801c041280 dead000000000100 dead000000000122 [ 102.665840][ T5331] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000 [ 102.665846][ T5331] page dumped because: kasan: bad access detected [ 102.665852][ T5331] page_owner tracks the page as allocated [ 102.665856][ T5331] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 5331, tgid 5330 (syz.0.0), ts 102503327421 [ 102.665874][ T5331] post_alloc_hook+0x1f9/0x250 [ 102.665899][ T5331] get_page_from_freelist+0x2209/0x2280 [ 102.665910][ T5331] __alloc_pages_slowpath+0x3f9/0xec0 [ 102.665931][ T5331] __alloc_frozen_pages_noprof+0x3f3/0x5a0 [ 102.665942][ T5331] allocate_slab+0x7d/0x620 [ 102.665955][ T5331] ___slab_alloc+0x16a/0x960 [ 102.665968][ T5331] __kmalloc_flags_noprof+0x33c/0x790 [ 102.665985][ T5331] alloc_slab_obj_exts+0x5c/0x180 [ 102.666000][ T5331] __memcg_slab_post_alloc_hook+0x60b/0xd90 [ 102.666017][ T5331] kmem_cache_alloc_lru_noprof+0x34c/0x5f0 [ 102.666033][ T5331] xas_create+0x670/0x1bd0 [ 102.666048][ T5331] xas_store+0x94/0x17f0 [ 102.666061][ T5331] shmem_add_to_page_cache+0x8df/0xd40 [ 102.666085][ T5331] shmem_alloc_and_add_folio+0x854/0xf60 [ 102.666107][ T5331] shmem_get_folio_gfp+0x5d5/0x16d0 [ 102.666121][ T5331] shmem_write_begin+0x16c/0x330 [ 102.666135][ T5331] page last free pid 808 tgid 808 ts 102410587557 stack trace: [ 102.666143][ T5331] __free_frozen_pages+0xc93/0xd90 [ 102.666159][ T5331] __slab_free+0x274/0x2c0 [ 102.666167][ T5331] qlist_free_all+0x99/0x100 [ 102.666185][ T5331] kasan_quarantine_reduce+0x148/0x160 [ 102.666199][ T5331] __kasan_slab_alloc+0x22/0x80 [ 102.666211][ T5331] __kmalloc_cache_noprof+0x29a/0x600 [ 102.666227][ T5331] nsim_fib_event+0x4c8/0xa3a0 [ 102.666242][ T5331] nsim_fib_event_work+0x244/0x3b0 [ 102.666255][ T5331] process_scheduled_works+0xc3d/0x1630 [ 102.666280][ T5331] worker_thread+0xa47/0xfb0 [ 102.666293][ T5331] kthread+0x38b/0x480 [ 102.666308][ T5331] ret_from_fork+0x514/0xb70 [ 102.666329][ T5331] ret_from_fork_asm+0x1a/0x30 [ 102.666341][ T5331] [ 102.666344][ T5331] Memory state around the buggy address: [ 102.666351][ T5331] ffff888013ce7800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 102.666360][ T5331] ffff888013ce7880: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 102.666368][ T5331] >ffff888013ce7900: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 102.666375][ T5331] ^ [ 102.666381][ T5331] ffff888013ce7980: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc [ 102.666388][ T5331] ffff888013ce7a00: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 102.666394][ T5331] ================================================================== [ 103.024549][ T5331] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 103.027844][ T5331] CPU: 0 UID: 0 PID: 5331 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.031869][ T5331] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.036270][ T5331] Call Trace: [ 103.037812][ T5331] [ 103.039178][ T5331] vpanic+0x56d/0xa60 [ 103.040998][ T5331] ? __pfx_vpanic+0x10/0x10 [ 103.043142][ T5331] panic+0xc5/0xd0 [ 103.044688][ T5331] ? __pfx_panic+0x10/0x10 [ 103.046642][ T5331] ? preempt_schedule_thunk+0x16/0x40 [ 103.048805][ T5331] ? snapshot_ctr+0x5cb/0x1340 [ 103.050620][ T5331] ? preempt_schedule_thunk+0x16/0x40 [ 103.052686][ T5331] ? snapshot_ctr+0x5cb/0x1340 [ 103.054630][ T5331] check_panic_on_warn+0x89/0xb0 [ 103.056955][ T5331] ? snapshot_ctr+0x5cb/0x1340 [ 103.058735][ T5331] end_report+0x73/0x170 [ 103.060345][ T5331] ? snapshot_ctr+0x5cb/0x1340 [ 103.062155][ T5331] kasan_report+0x128/0x150 [ 103.063873][ T5331] ? snapshot_ctr+0x5cb/0x1340 [ 103.065788][ T5331] snapshot_ctr+0x5cb/0x1340 [ 103.067623][ T5331] ? __pfx_snapshot_ctr+0x10/0x10 [ 103.069465][ T5331] ? skip_spaces+0x8a/0xa0 [ 103.071113][ T5331] ? dm_split_args+0x50b/0x5d0 [ 103.072907][ T5331] dm_table_add_target+0x58d/0xc70 [ 103.074628][ T5331] table_load+0x325/0x8a0 [ 103.076159][ T5331] ? __pfx_table_load+0x10/0x10 [ 103.077920][ T5331] dm_ctl_ioctl+0x9ec/0xe10 [ 103.079451][ T5331] ? __pfx_table_load+0x10/0x10 [ 103.081090][ T5331] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 103.082983][ T5331] ? __fget_files+0x2a/0x420 [ 103.084935][ T5331] ? bpf_lsm_file_ioctl+0x9/0x20 [ 103.086999][ T5331] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 103.089193][ T5331] __se_sys_ioctl+0xfc/0x170 [ 103.090979][ T5331] do_syscall_64+0x166/0x520 [ 103.092963][ T5331] ? trace_irq_disable+0x3b/0x140 [ 103.095128][ T5331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.097647][ T5331] ? clear_bhb_loop+0x70/0xc0 [ 103.099686][ T5331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.102184][ T5331] RIP: 0033:0x7f732c99f559 [ 103.104064][ T5331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.111989][ T5331] RSP: 002b:00007f732d7ecfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 103.115257][ T5331] RAX: ffffffffffffffda RBX: 00007f732cc25fa0 RCX: 00007f732c99f559 [ 103.118500][ T5331] RDX: 0000200000000f80 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 103.121538][ T5331] RBP: 00007f732ca36b20 R08: 0000000000000000 R09: 0000000000000000 [ 103.124643][ T5331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.127775][ T5331] R13: 00007f732cc26038 R14: 00007f732cc25fa0 R15: 00007ffc56a889f8 [ 103.130936][ T5331] [ 103.132569][ T5331] Kernel Offset: disabled [ 103.134322][ T5331] Rebooting in 86400 seconds..