Warning: Permanently added '10.128.1.33' (ED25519) to the list of known hosts. 2026/05/07 20:14:57 parsed 1 programs [ 84.120496][ T4214] cgroup: Unknown subsys name 'net' [ 84.258502][ T4214] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 85.815494][ T4214] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 87.300222][ T4228] chnl_net:caif_netlink_parms(): no params data found [ 87.354065][ T4228] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.362158][ T4228] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.370676][ T4228] device bridge_slave_0 entered promiscuous mode [ 87.380977][ T4228] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.388310][ T4228] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.396803][ T4228] device bridge_slave_1 entered promiscuous mode [ 87.420005][ T4228] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.431651][ T4228] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.456691][ T4228] team0: Port device team_slave_0 added [ 87.464428][ T4228] team0: Port device team_slave_1 added [ 87.483737][ T4228] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.497367][ T4228] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 87.524013][ T4228] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.538904][ T4228] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.546216][ T4228] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 87.572308][ T4228] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.609210][ T4228] device hsr_slave_0 entered promiscuous mode [ 87.617231][ T4228] device hsr_slave_1 entered promiscuous mode [ 87.730449][ T4228] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 87.742424][ T4228] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 87.753683][ T4228] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 87.764124][ T4228] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 87.792338][ T4228] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.799616][ T4228] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.808078][ T4228] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.815193][ T4228] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.871516][ T4228] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.885519][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 87.897515][ T144] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.906631][ T144] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.914784][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 87.930932][ T4228] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.943604][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 87.952192][ T144] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.959589][ T144] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.977467][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 87.986688][ T144] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.993773][ T144] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.015017][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 88.024691][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 88.041362][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 88.054814][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 88.068120][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 88.080298][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 88.179390][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 88.187181][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 88.202885][ T4228] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.224489][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 88.247638][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 88.257310][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 88.265250][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 88.277928][ T4228] device veth0_vlan entered promiscuous mode [ 88.290992][ T4228] device veth1_vlan entered promiscuous mode [ 88.314100][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 88.323740][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 88.337320][ T4228] device veth0_macvtap entered promiscuous mode [ 88.349071][ T4228] device veth1_macvtap entered promiscuous mode [ 88.366432][ T4228] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.375396][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 88.383927][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 88.392582][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 88.401601][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 88.414790][ T4228] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.422548][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 88.431697][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 88.444797][ T4228] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.454772][ T4228] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.463633][ T4228] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.472855][ T4228] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.637848][ T4228] syz-executor (4228) used greatest stack depth: 21136 bytes left [ 88.663655][ T154] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 89.208521][ T1467] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.224610][ T1467] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.245866][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 89.269924][ T155] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.279819][ T155] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.334612][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 91.134646][ T154] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 93.683374][ T154] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 93.765039][ T154] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 93.910354][ T21] cfg80211: failed to load regulatory.db [ 94.670483][ T154] device hsr_slave_0 left promiscuous mode [ 94.686487][ T154] device hsr_slave_1 left promiscuous mode [ 94.703881][ T154] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 94.723090][ T154] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 94.737396][ T154] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 94.755207][ T154] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 94.776706][ T154] device bridge_slave_1 left promiscuous mode [ 94.784346][ T154] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.819548][ T154] device bridge_slave_0 left promiscuous mode [ 94.835932][ T154] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.890226][ T154] device veth1_macvtap left promiscuous mode [ 94.924539][ T154] device veth0_macvtap left promiscuous mode [ 94.932216][ T154] device veth1_vlan left promiscuous mode [ 94.939348][ T154] device veth0_vlan left promiscuous mode 2026/05/07 20:15:10 executed programs: 0 [ 95.265221][ T154] team0 (unregistering): Port device team_slave_1 removed [ 95.280106][ T154] team0 (unregistering): Port device team_slave_0 removed [ 95.296618][ T154] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 95.312502][ T154] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 95.380894][ T154] bond0 (unregistering): Released all slaves [ 95.657230][ T4335] chnl_net:caif_netlink_parms(): no params data found [ 95.766205][ T4335] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.773691][ T4335] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.782504][ T4335] device bridge_slave_0 entered promiscuous mode [ 95.792777][ T4335] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.800587][ T4335] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.809107][ T4335] device bridge_slave_1 entered promiscuous mode [ 95.836161][ T4335] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 95.848317][ T4335] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 95.886513][ T4335] team0: Port device team_slave_0 added [ 95.923190][ T4335] team0: Port device team_slave_1 added [ 95.965165][ T4335] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 95.972544][ T4335] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 95.999053][ T4335] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 96.032433][ T4335] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 96.040674][ T4335] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 96.066942][ T4335] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 96.139693][ T4335] device hsr_slave_0 entered promiscuous mode [ 96.147717][ T4335] device hsr_slave_1 entered promiscuous mode [ 96.770867][ T4335] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 96.781693][ T4335] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 96.794120][ T4335] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 96.826575][ T4335] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 96.941296][ T4335] 8021q: adding VLAN 0 to HW filter on device bond0 [ 96.959447][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 96.970019][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 96.982674][ T4335] 8021q: adding VLAN 0 to HW filter on device team0 [ 96.997433][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 97.008616][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 97.019246][ T1467] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.026619][ T1467] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.054165][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 97.064005][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 97.073748][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 97.085134][ T1467] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.092345][ T1467] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.108364][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 97.131118][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 97.142462][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 97.153895][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 97.176805][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 97.187694][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 97.203752][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 97.221347][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 97.233309][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 97.253127][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 97.264026][ T4221] Bluetooth: hci0: command 0x0409 tx timeout [ 97.274036][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 97.287846][ T4335] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 97.440467][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 97.449373][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 97.461861][ T4335] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 97.488109][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 97.498517][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 97.524511][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 97.536788][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 97.559989][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 97.568576][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 97.601639][ T4335] device veth0_vlan entered promiscuous mode [ 97.617119][ T4335] device veth1_vlan entered promiscuous mode [ 97.663730][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 97.678029][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 97.694546][ T4335] device veth0_macvtap entered promiscuous mode [ 97.729371][ T4335] device veth1_macvtap entered promiscuous mode [ 97.763454][ T4335] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 97.772835][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 97.782324][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 97.792798][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 97.802497][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 97.831093][ T4335] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 97.847656][ T4335] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.864377][ T4335] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.874859][ T4335] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.889706][ T4335] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.904070][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 97.914954][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 98.011281][ T4333] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.025455][ T4333] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.047371][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 98.074558][ T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.083585][ T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.093486][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 98.112985][ T154] ODEBUG: Out of memory. ODEBUG disabled [ 98.645783][ T4404] loop0: detected capacity change from 0 to 32768 [ 98.688367][ T4404] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 98.707905][ T4404] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 98.782075][ T4404] gfs2: fsid=syz:syz.0: journal 0 mapped with 5 extents in 0ms [ 98.817496][ T4439] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 98.824718][ T4439] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 98.890704][ T4439] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 65ms [ 98.901627][ T4439] gfs2: fsid=syz:syz.0: jid=0: Done [ 98.908728][ T4404] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 99.097264][ T4404] gfs2: fsid=syz:syz.0: found 1 quota changes [ 99.150823][ T4335] gfs2: fsid=syz:syz.0: fatal: filesystem consistency error [ 99.150823][ T4335] inode = 11 2339 [ 99.150823][ T4335] function = gfs2_dinode_in, file = fs/gfs2/glops.c, line = 465 [ 99.170258][ T4335] gfs2: fsid=syz:syz.0: about to withdraw this file system [ 99.204588][ T4335] gfs2: fsid=syz:syz.0: warning: assertion "!qd->qd_change" failed at function = gfs2_quota_cleanup, file = fs/gfs2/quota.c, line = 1485 [ 99.243876][ T4335] CPU: 0 PID: 4335 Comm: syz-executor Not tainted syzkaller #0 [ 99.251609][ T4335] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 99.261740][ T4335] Call Trace: [ 99.265076][ T4335] [ 99.268058][ T4335] dump_stack_lvl+0x188/0x250 [ 99.272838][ T4335] ? show_regs_print_info+0x20/0x20 [ 99.278084][ T4335] ? load_image+0x400/0x400 [ 99.282739][ T4335] ? do_raw_spin_unlock+0x11d/0x230 [ 99.287996][ T4335] gfs2_assert_warn_i+0x18f/0x2c0 [ 99.293088][ T4335] gfs2_quota_cleanup+0x4b4/0x6a0 [ 99.298185][ T4335] gfs2_make_fs_ro+0x440/0x620 [ 99.303009][ T4335] ? __might_sleep+0xf0/0xf0 [ 99.307660][ T4335] ? gfs2_dinode_out+0xb00/0xb00 [ 99.312653][ T4335] ? _raw_spin_unlock+0x24/0x40 [ 99.317566][ T4335] ? gfs2_glock_nq+0xcb0/0x1550 [ 99.322492][ T4335] gfs2_withdraw+0x610/0x1490 [ 99.327234][ T4335] ? gfs2_lm+0x240/0x240 [ 99.331516][ T4335] ? __schedule+0x11f7/0x43c0 [ 99.336246][ T4335] ? gfs2_freeze_lock+0x52/0xc0 [ 99.341148][ T4335] ? gfs2_consist_inode_i+0xc0/0xe0 [ 99.346914][ T4335] gfs2_inode_refresh+0xb64/0xff0 [ 99.352076][ T4335] ? do_promote+0x71a/0xab0 [ 99.356634][ T4335] ? gfs2_inode_metasync+0xf0/0xf0 [ 99.361792][ T4335] ? __lock_acquire+0x7d10/0x7d10 [ 99.366869][ T4335] inode_go_lock+0x127/0x470 [ 99.371506][ T4335] do_promote+0x741/0xab0 [ 99.375890][ T4335] finish_xmote+0x4df/0xb00 [ 99.380440][ T4335] do_xmote+0x7b6/0x1120 [ 99.384751][ T4335] gfs2_glock_nq+0xc7a/0x1550 [ 99.389542][ T4335] do_sync+0x4ab/0xc40 [ 99.393667][ T4335] ? slot_put+0x1e0/0x1e0 [ 99.398039][ T4335] ? __lock_acquire+0x7d10/0x7d10 [ 99.403193][ T4335] ? do_raw_spin_lock+0x128/0x2f0 [ 99.408464][ T4335] ? do_sync+0x4a3/0xc40 [ 99.412963][ T4335] ? do_raw_spin_unlock+0x11d/0x230 [ 99.418216][ T4335] gfs2_quota_sync+0x32c/0x700 [ 99.423044][ T4335] gfs2_sync_fs+0x48/0xb0 [ 99.427418][ T4335] sync_filesystem+0xe6/0x220 [ 99.432144][ T4335] generic_shutdown_super+0x6b/0x300 [ 99.437499][ T4335] kill_block_super+0x7c/0xe0 [ 99.442328][ T4335] deactivate_locked_super+0x93/0xf0 [ 99.447657][ T4335] cleanup_mnt+0x42d/0x4e0 [ 99.452132][ T4335] ? lockdep_hardirqs_on+0x94/0x140 [ 99.457401][ T4335] task_work_run+0x125/0x1a0 [ 99.462057][ T4335] exit_to_user_mode_loop+0x10f/0x130 [ 99.467488][ T4335] exit_to_user_mode_prepare+0xee/0x180 [ 99.473151][ T4335] syscall_exit_to_user_mode+0x16/0x40 [ 99.478662][ T4335] do_syscall_64+0x58/0xa0 [ 99.483120][ T4335] ? clear_bhb_loop+0x30/0x80 [ 99.487831][ T4335] ? clear_bhb_loop+0x30/0x80 [ 99.492551][ T4335] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 99.498480][ T4335] RIP: 0033:0x7f33f1a65017 [ 99.502948][ T4335] Code: a2 c7 05 dc 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 99.522806][ T4335] RSP: 002b:00007fff753c2338 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 99.531270][ T4335] RAX: 0000000000000000 RBX: 00007f33f1af9120 RCX: 00007f33f1a65017 [ 99.539280][ T4335] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff753c23f0 [ 99.547288][ T4335] RBP: 00007fff753c23f0 R08: 00007fff753c33f0 R09: 00000000ffffffff [ 99.555478][ T4335] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff753c3480 [ 99.563506][ T4335] R13: 00007f33f1af9120 R14: 0000000000017f79 R15: 00007fff753c34c0 [ 99.571566][ T4335] [ 99.584673][ T4432] Bluetooth: hci0: command 0x041b tx timeout [ 99.614894][ T4335] gfs2: fsid=syz:syz.0: Journal recovery skipped for jid 0 until next mount. [ 99.624173][ T4335] gfs2: fsid=syz:syz.0: Glock dequeues delayed: 0 [ 99.633619][ T4335] gfs2: fsid=syz:syz.0: File system withdrawn [ 99.640163][ T4335] CPU: 0 PID: 4335 Comm: syz-executor Not tainted syzkaller #0 [ 99.647981][ T4335] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 99.658100][ T4335] Call Trace: [ 99.661439][ T4335] [ 99.664404][ T4335] dump_stack_lvl+0x188/0x250 [ 99.669129][ T4335] ? kobject_uevent_env+0x371/0x890 [ 99.674369][ T4335] ? show_regs_print_info+0x20/0x20 [ 99.679609][ T4335] ? load_image+0x400/0x400 [ 99.684176][ T4335] ? kobject_uevent_env+0x371/0x890 [ 99.689443][ T4335] ? lockref_put_or_lock+0x6e/0xb0 [ 99.694610][ T4335] gfs2_withdraw+0x1149/0x1490 [ 99.699435][ T4335] ? gfs2_lm+0x240/0x240 [ 99.703722][ T4335] ? __schedule+0x11f7/0x43c0 [ 99.708546][ T4335] ? gfs2_consist_inode_i+0xc0/0xe0 [ 99.713811][ T4335] gfs2_inode_refresh+0xb64/0xff0 [ 99.718900][ T4335] ? do_promote+0x71a/0xab0 [ 99.723452][ T4335] ? gfs2_inode_metasync+0xf0/0xf0 [ 99.728781][ T4335] ? __lock_acquire+0x7d10/0x7d10 [ 99.733870][ T4335] inode_go_lock+0x127/0x470 [ 99.738515][ T4335] do_promote+0x741/0xab0 [ 99.742901][ T4335] finish_xmote+0x4df/0xb00 [ 99.747457][ T4335] do_xmote+0x7b6/0x1120 [ 99.751887][ T4335] gfs2_glock_nq+0xc7a/0x1550 [ 99.756636][ T4335] do_sync+0x4ab/0xc40 [ 99.760758][ T4335] ? slot_put+0x1e0/0x1e0 [ 99.765144][ T4335] ? __lock_acquire+0x7d10/0x7d10 [ 99.770224][ T4335] ? do_raw_spin_lock+0x128/0x2f0 [ 99.775299][ T4335] ? do_sync+0x4a3/0xc40 [ 99.779594][ T4335] ? do_raw_spin_unlock+0x11d/0x230 [ 99.785018][ T4335] gfs2_quota_sync+0x32c/0x700 [ 99.789856][ T4335] gfs2_sync_fs+0x48/0xb0 [ 99.794246][ T4335] sync_filesystem+0xe6/0x220 [ 99.798972][ T4335] generic_shutdown_super+0x6b/0x300 [ 99.804335][ T4335] kill_block_super+0x7c/0xe0 [ 99.809056][ T4335] deactivate_locked_super+0x93/0xf0 [ 99.814390][ T4335] cleanup_mnt+0x42d/0x4e0 [ 99.818852][ T4335] ? lockdep_hardirqs_on+0x94/0x140 [ 99.824109][ T4335] task_work_run+0x125/0x1a0 [ 99.828765][ T4335] exit_to_user_mode_loop+0x10f/0x130 [ 99.834194][ T4335] exit_to_user_mode_prepare+0xee/0x180 [ 99.839793][ T4335] syscall_exit_to_user_mode+0x16/0x40 [ 99.845310][ T4335] do_syscall_64+0x58/0xa0 [ 99.849765][ T4335] ? clear_bhb_loop+0x30/0x80 [ 99.854499][ T4335] ? clear_bhb_loop+0x30/0x80 [ 99.859232][ T4335] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 99.865179][ T4335] RIP: 0033:0x7f33f1a65017 [ 99.869661][ T4335] Code: a2 c7 05 dc 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 99.889307][ T4335] RSP: 002b:00007fff753c2338 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 99.897774][ T4335] RAX: 0000000000000000 RBX: 00007f33f1af9120 RCX: 00007f33f1a65017 [ 99.905968][ T4335] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff753c23f0 [ 99.913983][ T4335] RBP: 00007fff753c23f0 R08: 00007fff753c33f0 R09: 00000000ffffffff [ 99.922005][ T4335] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff753c3480 [ 99.930019][ T4335] R13: 00007f33f1af9120 R14: 0000000000017f79 R15: 00007fff753c34c0 [ 99.938046][ T4335] [ 99.951916][ T4335] ================================================================== [ 99.960392][ T4335] BUG: KASAN: use-after-free in qd_unlock+0x30/0x2d0 [ 99.967137][ T4335] Read of size 8 at addr ffff8880741f6090 by task syz-executor/4335 [ 99.975201][ T4335] [ 99.977575][ T4335] CPU: 0 PID: 4335 Comm: syz-executor Not tainted syzkaller #0 [ 99.985338][ T4335] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 99.995477][ T4335] Call Trace: [ 99.998810][ T4335] [ 100.001792][ T4335] dump_stack_lvl+0x188/0x250 [ 100.006532][ T4335] ? show_regs_print_info+0x20/0x20 [ 100.011783][ T4335] ? _printk+0xda/0x130 [ 100.015985][ T4335] ? qd_unlock+0x30/0x2d0 [ 100.020362][ T4335] ? load_image+0x400/0x400 [ 100.024896][ T4335] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 100.030408][ T4335] print_address_description+0x60/0x2d0 [ 100.036021][ T4335] ? qd_unlock+0x30/0x2d0 [ 100.040412][ T4335] kasan_report+0xdf/0x130 [ 100.044988][ T4335] ? qd_unlock+0x30/0x2d0 [ 100.049376][ T4335] kasan_check_range+0x235/0x290 [ 100.054368][ T4335] qd_unlock+0x30/0x2d0 [ 100.058567][ T4335] gfs2_quota_sync+0x5cf/0x700 [ 100.063397][ T4335] gfs2_sync_fs+0x48/0xb0 [ 100.067789][ T4335] sync_filesystem+0xe6/0x220 [ 100.072583][ T4335] generic_shutdown_super+0x6b/0x300 [ 100.078128][ T4335] kill_block_super+0x7c/0xe0 [ 100.082858][ T4335] deactivate_locked_super+0x93/0xf0 [ 100.088215][ T4335] cleanup_mnt+0x42d/0x4e0 [ 100.092711][ T4335] ? lockdep_hardirqs_on+0x94/0x140 [ 100.097982][ T4335] task_work_run+0x125/0x1a0 [ 100.102645][ T4335] exit_to_user_mode_loop+0x10f/0x130 [ 100.108089][ T4335] exit_to_user_mode_prepare+0xee/0x180 [ 100.113705][ T4335] syscall_exit_to_user_mode+0x16/0x40 [ 100.119220][ T4335] do_syscall_64+0x58/0xa0 [ 100.123684][ T4335] ? clear_bhb_loop+0x30/0x80 [ 100.128414][ T4335] ? clear_bhb_loop+0x30/0x80 [ 100.133178][ T4335] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 100.139132][ T4335] RIP: 0033:0x7f33f1a65017 [ 100.143625][ T4335] Code: a2 c7 05 dc 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 100.163294][ T4335] RSP: 002b:00007fff753c2338 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 100.171776][ T4335] RAX: 0000000000000000 RBX: 00007f33f1af9120 RCX: 00007f33f1a65017 [ 100.179811][ T4335] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff753c23f0 [ 100.188090][ T4335] RBP: 00007fff753c23f0 R08: 00007fff753c33f0 R09: 00000000ffffffff [ 100.196106][ T4335] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff753c3480 [ 100.204111][ T4335] R13: 00007f33f1af9120 R14: 0000000000017f79 R15: 00007fff753c34c0 [ 100.212144][ T4335] [ 100.215205][ T4335] [ 100.217553][ T4335] Allocated by task 4404: [ 100.221928][ T4335] __kasan_slab_alloc+0x9c/0xd0 [ 100.226828][ T4335] slab_post_alloc_hook+0x4c/0x380 [ 100.231984][ T4335] kmem_cache_alloc+0x100/0x290 [ 100.236860][ T4335] qd_alloc+0x50/0x260 [ 100.240974][ T4335] gfs2_quota_init+0x74e/0xea0 [ 100.245772][ T4335] gfs2_make_fs_rw+0x414/0x580 [ 100.250568][ T4335] gfs2_fill_super+0x1837/0x1f00 [ 100.255542][ T4335] get_tree_bdev+0x3f1/0x610 [ 100.260173][ T4335] gfs2_get_tree+0x4d/0x1e0 [ 100.264739][ T4335] vfs_get_tree+0x88/0x270 [ 100.269199][ T4335] do_new_mount+0x24a/0xa40 [ 100.273752][ T4335] __se_sys_mount+0x2e3/0x3d0 [ 100.278469][ T4335] do_syscall_64+0x4c/0xa0 [ 100.282929][ T4335] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 100.288865][ T4335] [ 100.291291][ T4335] Freed by task 4442: [ 100.295295][ T4335] kasan_set_track+0x4b/0x70 [ 100.299921][ T4335] kasan_set_free_info+0x1f/0x40 [ 100.304892][ T4335] ____kasan_slab_free+0xd5/0x110 [ 100.309955][ T4335] slab_free_freelist_hook+0xea/0x170 [ 100.315377][ T4335] kmem_cache_free+0x8f/0x210 [ 100.320109][ T4335] rcu_core+0x9d2/0x1670 [ 100.324409][ T4335] handle_softirqs+0x339/0x830 [ 100.329235][ T4335] do_softirq+0x142/0x210 [ 100.333611][ T4335] __local_bh_enable_ip+0x180/0x1c0 [ 100.338858][ T4335] copy_fpstate_to_sigframe+0x804/0xbf0 [ 100.344450][ T4335] arch_do_signal_or_restart+0x679/0x12c0 [ 100.350210][ T4335] exit_to_user_mode_loop+0x9e/0x130 [ 100.355528][ T4335] exit_to_user_mode_prepare+0xee/0x180 [ 100.361114][ T4335] syscall_exit_to_user_mode+0x16/0x40 [ 100.366630][ T4335] do_syscall_64+0x58/0xa0 [ 100.371086][ T4335] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 100.377016][ T4335] [ 100.379370][ T4335] Last potentially related work creation: [ 100.385126][ T4335] kasan_save_stack+0x35/0x60 [ 100.389848][ T4335] kasan_record_aux_stack+0xb8/0x100 [ 100.395166][ T4335] call_rcu+0x189/0x950 [ 100.399386][ T4335] gfs2_quota_cleanup+0x43c/0x6a0 [ 100.404458][ T4335] gfs2_make_fs_ro+0x440/0x620 [ 100.409357][ T4335] gfs2_withdraw+0x610/0x1490 [ 100.414080][ T4335] gfs2_inode_refresh+0xb64/0xff0 [ 100.419147][ T4335] inode_go_lock+0x127/0x470 [ 100.423786][ T4335] do_promote+0x741/0xab0 [ 100.428148][ T4335] finish_xmote+0x4df/0xb00 [ 100.432696][ T4335] do_xmote+0x7b6/0x1120 [ 100.436975][ T4335] gfs2_glock_nq+0xc7a/0x1550 [ 100.441681][ T4335] do_sync+0x4ab/0xc40 [ 100.445781][ T4335] gfs2_quota_sync+0x32c/0x700 [ 100.450580][ T4335] gfs2_sync_fs+0x48/0xb0 [ 100.454939][ T4335] sync_filesystem+0xe6/0x220 [ 100.459658][ T4335] generic_shutdown_super+0x6b/0x300 [ 100.465000][ T4335] kill_block_super+0x7c/0xe0 [ 100.469726][ T4335] deactivate_locked_super+0x93/0xf0 [ 100.475048][ T4335] cleanup_mnt+0x42d/0x4e0 [ 100.479509][ T4335] task_work_run+0x125/0x1a0 [ 100.484225][ T4335] exit_to_user_mode_loop+0x10f/0x130 [ 100.489631][ T4335] exit_to_user_mode_prepare+0xee/0x180 [ 100.495212][ T4335] syscall_exit_to_user_mode+0x16/0x40 [ 100.500712][ T4335] do_syscall_64+0x58/0xa0 [ 100.505167][ T4335] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 100.511094][ T4335] [ 100.513447][ T4335] The buggy address belongs to the object at ffff8880741f6000 [ 100.513447][ T4335] which belongs to the cache gfs2_quotad of size 272 [ 100.527541][ T4335] The buggy address is located 144 bytes inside of [ 100.527541][ T4335] 272-byte region [ffff8880741f6000, ffff8880741f6110) [ 100.540859][ T4335] The buggy address belongs to the page: [ 100.546549][ T4335] page:ffffea0001d07d80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x741f6 [ 100.556742][ T4335] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 100.564352][ T4335] raw: 00fff00000000200 0000000000000000 dead000000000122 ffff88814686adc0 [ 100.572971][ T4335] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 [ 100.581586][ T4335] page dumped because: kasan: bad access detected [ 100.588047][ T4335] page_owner tracks the page as allocated [ 100.593789][ T4335] page last allocated via order 0, migratetype Reclaimable, gfp_mask 0x112c50(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 4404, ts 99088914971, free_ts 99027677459 [ 100.612969][ T4335] get_page_from_freelist+0x1bbd/0x1ca0 [ 100.618582][ T4335] __alloc_pages+0x1ee/0x480 [ 100.623218][ T4335] new_slab+0xc0/0x4b0 [ 100.627332][ T4335] ___slab_alloc+0x80a/0xdd0 [ 100.631961][ T4335] kmem_cache_alloc+0x195/0x290 [ 100.636842][ T4335] qd_alloc+0x50/0x260 [ 100.640954][ T4335] gfs2_quota_init+0x74e/0xea0 [ 100.645751][ T4335] gfs2_make_fs_rw+0x414/0x580 [ 100.650552][ T4335] gfs2_fill_super+0x1837/0x1f00 [ 100.655545][ T4335] get_tree_bdev+0x3f1/0x610 [ 100.660176][ T4335] gfs2_get_tree+0x4d/0x1e0 [ 100.664722][ T4335] vfs_get_tree+0x88/0x270 [ 100.669263][ T4335] do_new_mount+0x24a/0xa40 [ 100.673798][ T4335] __se_sys_mount+0x2e3/0x3d0 [ 100.678507][ T4335] do_syscall_64+0x4c/0xa0 [ 100.682966][ T4335] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 100.689069][ T4335] page last free stack trace: [ 100.693806][ T4335] free_unref_page_prepare+0x637/0x6c0 [ 100.699325][ T4335] free_unref_page+0x8f/0x2a0 [ 100.704047][ T4335] __unfreeze_partials+0x1a5/0x200 [ 100.709207][ T4335] put_cpu_partial+0x12d/0x190 [ 100.714011][ T4335] qlist_free_all+0x35/0x90 [ 100.718554][ T4335] kasan_quarantine_reduce+0x150/0x160 [ 100.724057][ T4335] __kasan_slab_alloc+0x2f/0xd0 [ 100.728993][ T4335] slab_post_alloc_hook+0x4c/0x380 [ 100.734334][ T4335] kmem_cache_alloc_node+0x12d/0x2d0 [ 100.739670][ T4335] __alloc_skb+0xf4/0x750 [ 100.744041][ T4335] mld_newpack+0x12f/0xb90 [ 100.748499][ T4335] add_grhead+0x5a/0x240 [ 100.752862][ T4335] add_grec+0x1341/0x15d0 [ 100.757347][ T4335] mld_send_initial_cr+0xed/0x240 [ 100.762419][ T4335] mld_dad_work+0x41/0x270 [ 100.766884][ T4335] process_one_wor