Warning: Permanently added '10.128.0.217' (ED25519) to the list of known hosts. 2026/06/30 00:41:30 parsed 1 programs 2026/06/30 00:41:30 serving rpc on tcp://39649 [ 101.532944][ T5796] cgroup: Unknown subsys name 'net' [ 101.671009][ T5796] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 103.057857][ T5796] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 105.226714][ T5813] chnl_net:caif_netlink_parms(): no params data found [ 105.286919][ T5813] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.294194][ T5813] bridge0: port 1(bridge_slave_0) entered disabled state [ 105.301501][ T5813] bridge_slave_0: entered allmulticast mode [ 105.309326][ T5813] bridge_slave_0: entered promiscuous mode [ 105.317983][ T5813] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.325327][ T5813] bridge0: port 2(bridge_slave_1) entered disabled state [ 105.332493][ T5813] bridge_slave_1: entered allmulticast mode [ 105.339399][ T5813] bridge_slave_1: entered promiscuous mode [ 105.367406][ T5813] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 105.379519][ T5813] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 105.412253][ T5813] team0: Port device team_slave_0 added [ 105.420266][ T5813] team0: Port device team_slave_1 added [ 105.445017][ T5813] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 105.451991][ T5813] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 105.477952][ T5813] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 105.491563][ T5813] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 105.498794][ T5813] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 105.524827][ T5813] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 105.558754][ T5813] hsr_slave_0: entered promiscuous mode [ 105.565365][ T5813] hsr_slave_1: entered promiscuous mode [ 105.694840][ T5813] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 105.706266][ T5813] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 105.715752][ T5813] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 105.730542][ T5813] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 105.756091][ T5813] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.763274][ T5813] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.771148][ T5813] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.778669][ T5813] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.832085][ T5813] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.852234][ T1310] bridge0: port 1(bridge_slave_0) entered disabled state [ 105.860624][ T1310] bridge0: port 2(bridge_slave_1) entered disabled state [ 105.876670][ T5813] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.892833][ T2927] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.899975][ T2927] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.913313][ T2927] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.920701][ T2927] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.078193][ T5813] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 106.117732][ T5813] veth0_vlan: entered promiscuous mode [ 106.128076][ T5813] veth1_vlan: entered promiscuous mode [ 106.158136][ T5813] veth0_macvtap: entered promiscuous mode [ 106.166876][ T5813] veth1_macvtap: entered promiscuous mode [ 106.185586][ T5813] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 106.203547][ T5813] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 106.217076][ T5813] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.227083][ T5813] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.235857][ T5813] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.244597][ T5813] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.392564][ T42] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 106.876365][ T5847] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 106.885049][ T5847] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 106.893206][ T5847] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 106.905842][ T5847] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 106.913478][ T5847] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 106.921549][ T5847] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 107.141485][ T2927] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.155175][ T2927] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.185551][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.193402][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2026/06/30 00:41:40 executed programs: 0 [ 109.168493][ T5088] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 109.177621][ T5088] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 109.187224][ T5088] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 109.195728][ T5088] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 109.207755][ T5088] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 109.215697][ T5088] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 109.219831][ T42] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 109.347527][ T5894] chnl_net:caif_netlink_parms(): no params data found [ 109.400124][ T5894] bridge0: port 1(bridge_slave_0) entered blocking state [ 109.407497][ T5894] bridge0: port 1(bridge_slave_0) entered disabled state [ 109.414752][ T5894] bridge_slave_0: entered allmulticast mode [ 109.421580][ T5894] bridge_slave_0: entered promiscuous mode [ 109.429409][ T5894] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.436642][ T5894] bridge0: port 2(bridge_slave_1) entered disabled state [ 109.443763][ T5894] bridge_slave_1: entered allmulticast mode [ 109.450869][ T5894] bridge_slave_1: entered promiscuous mode [ 109.476132][ T5894] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 109.487916][ T5894] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 109.512406][ T5894] team0: Port device team_slave_0 added [ 109.520529][ T5894] team0: Port device team_slave_1 added [ 109.540130][ T5894] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 109.547274][ T5894] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 109.573522][ T5894] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 109.586403][ T5894] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 109.593344][ T5894] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 109.620566][ T5894] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 109.654258][ T5894] hsr_slave_0: entered promiscuous mode [ 109.660582][ T5894] hsr_slave_1: entered promiscuous mode [ 109.667187][ T5894] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 109.675973][ T5894] Cannot create hsr debugfs directory [ 111.295003][ T5088] Bluetooth: hci0: command tx timeout [ 111.413424][ T42] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.485508][ T42] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.328121][ T42] hsr_slave_0: left promiscuous mode [ 112.335101][ T42] hsr_slave_1: left promiscuous mode [ 112.341006][ T42] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 112.348540][ T42] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 112.356968][ T42] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 112.364445][ T42] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 112.373273][ T42] bridge_slave_1: left allmulticast mode [ 112.379547][ T42] bridge_slave_1: left promiscuous mode [ 112.386015][ T42] bridge0: port 2(bridge_slave_1) entered disabled state [ 112.397442][ T42] bridge_slave_0: left allmulticast mode [ 112.403191][ T42] bridge_slave_0: left promiscuous mode [ 112.409003][ T42] bridge0: port 1(bridge_slave_0) entered disabled state [ 112.428466][ T42] veth1_macvtap: left promiscuous mode [ 112.434582][ T42] veth0_macvtap: left promiscuous mode [ 112.440228][ T42] veth1_vlan: left promiscuous mode [ 112.446200][ T42] veth0_vlan: left promiscuous mode [ 112.791135][ T42] team0 (unregistering): Port device team_slave_1 removed [ 112.819979][ T42] team0 (unregistering): Port device team_slave_0 removed [ 112.849074][ T42] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 112.880906][ T42] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 113.078455][ T42] bond0 (unregistering): Released all slaves [ 113.146651][ T5894] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 113.155696][ T5894] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 113.168013][ T5894] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 113.183090][ T5894] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 113.262174][ T5894] 8021q: adding VLAN 0 to HW filter on device bond0 [ 113.284114][ T5894] 8021q: adding VLAN 0 to HW filter on device team0 [ 113.297197][ T2927] bridge0: port 1(bridge_slave_0) entered blocking state [ 113.304531][ T2927] bridge0: port 1(bridge_slave_0) entered forwarding state [ 113.320502][ T1082] bridge0: port 2(bridge_slave_1) entered blocking state [ 113.327638][ T1082] bridge0: port 2(bridge_slave_1) entered forwarding state [ 113.374479][ T5088] Bluetooth: hci0: command tx timeout [ 113.378965][ T5894] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 113.522542][ T5894] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 113.567028][ T5894] veth0_vlan: entered promiscuous mode [ 113.581883][ T5894] veth1_vlan: entered promiscuous mode [ 113.633240][ T5894] veth0_macvtap: entered promiscuous mode [ 113.654554][ T5894] veth1_macvtap: entered promiscuous mode [ 113.681882][ T5894] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 113.696916][ T5894] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 113.709075][ T5894] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.719273][ T5894] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.728709][ T5894] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.737694][ T5894] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.847672][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.857520][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.915374][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.940072][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.989733][ T5939] syz.0.17[5939]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 114.001836][ T5939] loop0: detected capacity change from 0 to 16 [ 114.019712][ T5939] erofs: (device loop0): mounted with root inode @ nid 36. [ 114.045689][ T5939] syz.0.17: attempt to access beyond end of device [ 114.045689][ T5939] loop0: rw=524288, sector=8, nr_sectors = 16 limit=16 [ 114.061668][ T5939] syz.0.17: attempt to access beyond end of device [ 114.061668][ T5939] loop0: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 114.076925][ T5939] ================================================================== [ 114.085008][ T5939] BUG: KASAN: use-after-free in z_erofs_transform_plain+0x3ab/0x4a0 [ 114.093008][ T5939] Read of size 4096 at addr ffff888027552000 by task syz.0.17/5939 [ 114.100889][ T5939] [ 114.103214][ T5939] CPU: 1 PID: 5939 Comm: syz.0.17 Not tainted syzkaller #0 [ 114.110413][ T5939] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 114.120462][ T5939] Call Trace: [ 114.123731][ T5939] [ 114.126648][ T5939] dump_stack_lvl+0x18c/0x250 [ 114.131314][ T5939] ? __lock_acquire+0x7d80/0x7d80 [ 114.136408][ T5939] ? show_regs_print_info+0x20/0x20 [ 114.141627][ T5939] ? load_image+0x420/0x420 [ 114.146217][ T5939] ? _raw_spin_lock_irqsave+0xc0/0x100 [ 114.151671][ T5939] ? __virt_addr_valid+0x10c/0x380 [ 114.156778][ T5939] ? __virt_addr_valid+0x10c/0x380 [ 114.161877][ T5939] ? __virt_addr_valid+0x10c/0x380 [ 114.166977][ T5939] ? __virt_addr_valid+0x10c/0x380 [ 114.172081][ T5939] print_report+0xa8/0x210 [ 114.176589][ T5939] ? z_erofs_transform_plain+0x3ab/0x4a0 [ 114.182223][ T5939] kasan_report+0x117/0x150 [ 114.186733][ T5939] ? z_erofs_transform_plain+0x3ab/0x4a0 [ 114.192397][ T5939] kasan_check_range+0x241/0x290 [ 114.197330][ T5939] ? z_erofs_transform_plain+0x3ab/0x4a0 [ 114.202971][ T5939] __asan_memcpy+0x29/0x70 [ 114.207410][ T5939] z_erofs_transform_plain+0x3ab/0x4a0 [ 114.212869][ T5939] ? z_erofs_lz4_decompress+0x1800/0x1800 [ 114.218578][ T5939] z_erofs_decompress_queue+0x1705/0x2670 [ 114.224295][ T5939] ? z_erofs_onlinepage_end+0x360/0x360 [ 114.229829][ T5939] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 114.235833][ T5939] ? lock_chain_count+0x20/0x20 [ 114.240691][ T5939] ? z_erofs_decompressqueue_endio+0x540/0x540 [ 114.246839][ T5939] ? erofs_map_blocks+0x17b0/0x17b0 [ 114.252024][ T5939] ? folio_unlock+0x118/0x2f0 [ 114.256698][ T5939] z_erofs_runqueue+0x1993/0x1b20 [ 114.261722][ T5939] ? z_erofs_do_read_page+0x3500/0x3500 [ 114.267267][ T5939] ? __lock_acquire+0x7d80/0x7d80 [ 114.272291][ T5939] ? put_page+0xea/0x260 [ 114.276525][ T5939] ? z_erofs_pcluster_readmore+0x3a7/0x460 [ 114.282321][ T5939] z_erofs_read_folio+0x321/0x5c0 [ 114.287376][ T5939] ? z_erofs_rcu_callback+0x1b0/0x1b0 [ 114.292829][ T5939] ? up_read+0x20/0x20 [ 114.296888][ T5939] ? __might_sleep+0xe0/0xe0 [ 114.301466][ T5939] ? filemap_add_folio+0x190/0x3d0 [ 114.306596][ T5939] filemap_read_folio+0x16b/0x790 [ 114.311608][ T5939] ? z_erofs_rcu_callback+0x1b0/0x1b0 [ 114.316970][ T5939] ? maybe_unlock_mmap_for_io+0xf0/0xf0 [ 114.322501][ T5939] ? down_read+0x1ac/0x2e0 [ 114.326906][ T5939] filemap_get_pages+0x13ac/0x1f10 [ 114.332012][ T5939] ? filemap_read+0xf20/0xf20 [ 114.336685][ T5939] ? __might_sleep+0xe0/0xe0 [ 114.341267][ T5939] ? folio_mark_accessed+0x203/0x14a0 [ 114.346634][ T5939] ? folio_activate_fn+0x2000/0x2000 [ 114.351928][ T5939] filemap_read+0x409/0xf20 [ 114.356430][ T5939] ? filemap_get_folios_tag+0x840/0x840 [ 114.361969][ T5939] ? generic_file_read_iter+0x9b/0x550 [ 114.367417][ T5939] ? iov_iter_kvec+0xd4/0x1b0 [ 114.372091][ T5939] __kernel_read+0x2e5/0x730 [ 114.376763][ T5939] ? rw_verify_area+0x1b0/0x1b0 [ 114.381616][ T5939] integrity_kernel_read+0x8a/0xd0 [ 114.386719][ T5939] ? integrity_inode_free+0x170/0x170 [ 114.392105][ T5939] ? _sha256_update+0x127/0x1e0 [ 114.396963][ T5939] ? sha256_transform_avx+0xcc0/0xcc0 [ 114.402326][ T5939] ima_calc_file_hash+0xb1f/0x1960 [ 114.407435][ T5939] ? is_bpf_text_address+0x28f/0x2a0 [ 114.412711][ T5939] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 114.418772][ T5939] ? kernel_text_address+0xa0/0xd0 [ 114.423873][ T5939] ? look_up_lock_class+0x75/0x140 [ 114.429067][ T5939] ? ima_alloc_tfm+0x2f0/0x2f0 [ 114.433818][ T5939] ? register_lock_class+0xc4/0x8a0 [ 114.439038][ T5939] ? erofs_init_inode_xattrs+0x2eb/0xb50 [ 114.444689][ T5939] ? generic_fillattr+0x2b5/0x690 [ 114.449709][ T5939] ? __asan_memcpy+0x40/0x70 [ 114.454316][ T5939] ? generic_fillattr+0x451/0x690 [ 114.459354][ T5939] ima_collect_measurement+0x4d4/0xa30 [ 114.464831][ T5939] ? ima_get_action+0xb0/0xb0 [ 114.469503][ T5939] ? erofs_getxattr+0x13f/0x450 [ 114.474352][ T5939] ? rcu_is_watching+0x15/0xb0 [ 114.479135][ T5939] ? ima_get_hash_algo+0x91/0x4a0 [ 114.484154][ T5939] ? ima_get_cache_status+0xd0/0xd0 [ 114.489360][ T5939] process_measurement+0x123a/0x1d50 [ 114.494645][ T5939] ? ima_file_mmap+0x1d0/0x1d0 [ 114.499511][ T5939] ? tomoyo_check_open_permission+0x384/0x460 [ 114.505580][ T5939] ? tomoyo_check_open_permission+0x1cf/0x460 [ 114.511646][ T5939] ? tomoyo_check_path_number_acl+0x280/0x280 [ 114.517801][ T5939] ? apparmor_current_getsecid_subj+0xb5/0x120 [ 114.524137][ T5939] ima_file_check+0xcc/0x110 [ 114.528731][ T5939] ? ima_bprm_check+0x200/0x200 [ 114.533581][ T5939] path_openat+0x2910/0x3270 [ 114.538183][ T5939] ? do_filp_open+0x430/0x430 [ 114.542857][ T5939] do_filp_open+0x1f2/0x430 [ 114.547350][ T5939] ? vfs_tmpfile+0x480/0x480 [ 114.551931][ T5939] ? _raw_spin_unlock+0x28/0x40 [ 114.556779][ T5939] ? alloc_fd+0x590/0x640 [ 114.561098][ T5939] do_sys_openat2+0x134/0x1d0 [ 114.565828][ T5939] ? do_sys_open+0xe0/0xe0 [ 114.570233][ T5939] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 114.576304][ T5939] ? lock_chain_count+0x20/0x20 [ 114.581167][ T5939] __x64_sys_open+0x11f/0x140 [ 114.585861][ T5939] do_syscall_64+0x55/0xb0 [ 114.590280][ T5939] ? clear_bhb_loop+0x40/0x90 [ 114.594956][ T5939] ? clear_bhb_loop+0x40/0x90 [ 114.599625][ T5939] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 114.605522][ T5939] RIP: 0033:0x7f5e1199ce59 [ 114.609930][ T5939] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 114.629527][ T5939] RSP: 002b:00007f5e1282d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 114.637930][ T5939] RAX: ffffffffffffffda RBX: 00007f5e11c15fa0 RCX: 00007f5e1199ce59 [ 114.645887][ T5939] RDX: 0000000000000009 RSI: 0000000000000080 RDI: 00002000000001c0 [ 114.653874][ T5939] RBP: 00007f5e11a32e6f R08: 0000000000000000 R09: 0000000000000000 [ 114.661844][ T5939] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 114.669811][ T5939] R13: 00007f5e11c16038 R14: 00007f5e11c15fa0 R15: 00007fff9e431e18 [ 114.677786][ T5939] [ 114.680796][ T5939] [ 114.683108][ T5939] The buggy address belongs to the physical page: [ 114.689513][ T5939] page:ffffea00009d5480 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x27552 [ 114.699655][ T5939] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 114.706747][ T5939] page_type: 0xffffff7f(buddy) [ 114.711556][ T5939] raw: 00fff00000000000 ffffea00009b1788 ffffea00009c2dc8 0000000000000000 [ 114.720214][ T5939] raw: 0000000000000000 0000000000000000 00000000ffffff7f 0000000000000000 [ 114.728780][ T5939] page dumped because: kasan: bad access detected [ 114.735182][ T5939] page_owner tracks the page as freed [ 114.740531][ T5939] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 5687, tgid 5687 (dhcpcd-run-hook), ts 60116105088, free_ts 113468027327 [ 114.759212][ T5939] post_alloc_hook+0x1c1/0x200 [ 114.763978][ T5939] get_page_from_freelist+0x2181/0x22a0 [ 114.769614][ T5939] __alloc_pages+0x1f0/0x460 [ 114.774190][ T5939] alloc_slab_page+0x5d/0x180 [ 114.778854][ T5939] new_slab+0x87/0x2d0 [ 114.782914][ T5939] ___slab_alloc+0xc5c/0x12f0 [ 114.787583][ T5939] kmem_cache_alloc+0x109/0x2c0 [ 114.792434][ T5939] vm_area_dup+0x27/0x270 [ 114.796767][ T5939] copy_mm+0x11a6/0x1e30 [ 114.801110][ T5939] copy_process+0x171d/0x3df0 [ 114.805792][ T5939] kernel_clone+0x24b/0x8a0 [ 114.810297][ T5939] __x64_sys_clone+0x1b7/0x230 [ 114.815052][ T5939] do_syscall_64+0x55/0xb0 [ 114.819482][ T5939] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 114.825809][ T5939] page last free stack trace: [ 114.830473][ T5939] free_unref_page_prepare+0x7d7/0x8f0 [ 114.835926][ T5939] free_unref_page+0x32/0x2e0 [ 114.840682][ T5939] __unfreeze_partials+0x1cf/0x210 [ 114.845777][ T5939] put_cpu_partial+0x17c/0x250 [ 114.850521][ T5939] __slab_free+0x319/0x400 [ 114.854919][ T5939] qlist_free_all+0x75/0xd0 [ 114.859541][ T5939] kasan_quarantine_reduce+0x143/0x160 [ 114.865084][ T5939] __kasan_slab_alloc+0x22/0x80 [ 114.869928][ T5939] slab_post_alloc_hook+0x6a/0x4d0 [ 114.875144][ T5939] __kmem_cache_alloc_node+0x194/0x250 [ 114.880591][ T5939] __kmalloc_node+0xa6/0x240 [ 114.885256][ T5939] kvmalloc_node+0x70/0x180 [ 114.889768][ T5939] __nf_hook_entries_try_shrink+0x336/0x700 [ 114.895654][ T5939] __nf_unregister_net_hook+0x4da/0x6d0 [ 114.901188][ T5939] nf_unregister_net_hooks+0xcb/0x130 [ 114.906549][ T5939] brnf_exit_net+0x61/0x120 [ 114.911040][ T5939] [ 114.913345][ T5939] Memory state around the buggy address: [ 114.918956][ T5939] ffff888027551f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 114.927004][ T5939] ffff888027551f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 114.935048][ T5939] >ffff888027552000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 114.943086][ T5939] ^ [ 114.947159][ T5939] ffff888027552080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 114.955203][ T5939] ffff888027552100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 114.963263][ T5939] ================================================================== [ 114.988050][ T5939] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 114.995292][ T5939] CPU: 1 PID: 5939 Comm: syz.0.17 Not tainted syzkaller #0 [ 115.002509][ T5939] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 115.012578][ T5939] Call Trace: [ 115.015876][ T5939] [ 115.018813][ T5939] dump_stack_lvl+0x18c/0x250 [ 115.023551][ T5939] ? show_regs_print_info+0x20/0x20 [ 115.028738][ T5939] ? load_image+0x420/0x420 [ 115.033232][ T5939] panic+0x2ca/0x720 [ 115.037117][ T5939] ? bpf_jit_dump+0xd0/0xd0 [ 115.041609][ T5939] ? _raw_spin_unlock_irqrestore+0x111/0x120 [ 115.047579][ T5939] ? _raw_spin_unlock+0x40/0x40 [ 115.052418][ T5939] ? print_memory_metadata+0x314/0x400 [ 115.057903][ T5939] ? z_erofs_transform_plain+0x3ab/0x4a0 [ 115.063812][ T5939] check_panic_on_warn+0x84/0xa0 [ 115.068749][ T5939] ? z_erofs_transform_plain+0x3ab/0x4a0 [ 115.074373][ T5939] end_report+0x6f/0x130 [ 115.078605][ T5939] kasan_report+0x128/0x150 [ 115.083096][ T5939] ? z_erofs_transform_plain+0x3ab/0x4a0 [ 115.088721][ T5939] kasan_check_range+0x241/0x290 [ 115.093649][ T5939] ? z_erofs_transform_plain+0x3ab/0x4a0 [ 115.099271][ T5939] __asan_memcpy+0x29/0x70 [ 115.103678][ T5939] z_erofs_transform_plain+0x3ab/0x4a0 [ 115.109129][ T5939] ? z_erofs_lz4_decompress+0x1800/0x1800 [ 115.114841][ T5939] z_erofs_decompress_queue+0x1705/0x2670 [ 115.120585][ T5939] ? z_erofs_onlinepage_end+0x360/0x360 [ 115.126118][ T5939] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 115.132085][ T5939] ? lock_chain_count+0x20/0x20 [ 115.136931][ T5939] ? z_erofs_decompressqueue_endio+0x540/0x540 [ 115.143075][ T5939] ? erofs_map_blocks+0x17b0/0x17b0 [ 115.148273][ T5939] ? folio_unlock+0x118/0x2f0 [ 115.152938][ T5939] z_erofs_runqueue+0x1993/0x1b20 [ 115.157963][ T5939] ? z_erofs_do_read_page+0x3500/0x3500 [ 115.163503][ T5939] ? __lock_acquire+0x7d80/0x7d80 [ 115.168522][ T5939] ? put_page+0xea/0x260 [ 115.172753][ T5939] ? z_erofs_pcluster_readmore+0x3a7/0x460 [ 115.178546][ T5939] z_erofs_read_folio+0x321/0x5c0 [ 115.183594][ T5939] ? z_erofs_rcu_callback+0x1b0/0x1b0 [ 115.188959][ T5939] ? up_read+0x20/0x20 [ 115.193015][ T5939] ? __might_sleep+0xe0/0xe0 [ 115.197597][ T5939] ? filemap_add_folio+0x190/0x3d0 [ 115.202697][ T5939] filemap_read_folio+0x16b/0x790 [ 115.207714][ T5939] ? z_erofs_rcu_callback+0x1b0/0x1b0 [ 115.213094][ T5939] ? maybe_unlock_mmap_for_io+0xf0/0xf0 [ 115.218627][ T5939] ? down_read+0x1ac/0x2e0 [ 115.223035][ T5939] filemap_get_pages+0x13ac/0x1f10 [ 115.228317][ T5939] ? filemap_read+0xf20/0xf20 [ 115.233001][ T5939] ? __might_sleep+0xe0/0xe0 [ 115.237604][ T5939] ? folio_mark_accessed+0x203/0x14a0 [ 115.243076][ T5939] ? folio_activate_fn+0x2000/0x2000 [ 115.248372][ T5939] filemap_read+0x409/0xf20 [ 115.252884][ T5939] ? filemap_get_folios_tag+0x840/0x840 [ 115.258426][ T5939] ? generic_file_read_iter+0x9b/0x550 [ 115.263927][ T5939] ? iov_iter_kvec+0xd4/0x1b0 [ 115.268593][ T5939] __kernel_read+0x2e5/0x730 [ 115.273176][ T5939] ? rw_verify_area+0x1b0/0x1b0 [ 115.278021][ T5939] integrity_kernel_read+0x8a/0xd0 [ 115.283127][ T5939] ? integrity_inode_free+0x170/0x170 [ 115.288488][ T5939] ? _sha256_update+0x127/0x1e0 [ 115.293341][ T5939] ? sha256_transform_avx+0xcc0/0xcc0 [ 115.298708][ T5939] ima_calc_file_hash+0xb1f/0x1960 [ 115.303815][ T5939] ? is_bpf_text_address+0x28f/0x2a0 [ 115.309090][ T5939] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 115.315148][ T5939] ? kernel_text_address+0xa0/0xd0 [ 115.320260][ T5939] ? look_up_lock_class+0x75/0x140 [ 115.325416][ T5939] ? ima_alloc_tfm+0x2f0/0x2f0 [ 115.330215][ T5939] ? register_lock_class+0xc4/0x8a0 [ 115.335429][ T5939] ? erofs_init_inode_xattrs+0x2eb/0xb50 [ 115.341052][ T5939] ? generic_fillattr+0x2b5/0x690 [ 115.346067][ T5939] ? __asan_memcpy+0x40/0x70 [ 115.350647][ T5939] ? generic_fillattr+0x451/0x690 [ 115.355835][ T5939] ima_collect_measurement+0x4d4/0xa30 [ 115.361322][ T5939] ? ima_get_action+0xb0/0xb0 [ 115.365988][ T5939] ? erofs_getxattr+0x13f/0x450 [ 115.370840][ T5939] ? rcu_is_watching+0x15/0xb0 [ 115.375638][ T5939] ? ima_get_hash_algo+0x91/0x4a0 [ 115.380668][ T5939] ? ima_get_cache_status+0xd0/0xd0 [ 115.385871][ T5939] process_measurement+0x123a/0x1d50 [ 115.391164][ T5939] ? ima_file_mmap+0x1d0/0x1d0 [ 115.395920][ T5939] ? tomoyo_check_open_permission+0x384/0x460 [ 115.401978][ T5939] ? tomoyo_check_open_permission+0x1cf/0x460 [ 115.408031][ T5939] ? tomoyo_check_path_number_acl+0x280/0x280 [ 115.414100][ T5939] ? apparmor_current_getsecid_subj+0xb5/0x120 [ 115.420247][ T5939] ima_file_check+0xcc/0x110 [ 115.424830][ T5939] ? ima_bprm_check+0x200/0x200 [ 115.429760][ T5939] path_openat+0x2910/0x3270 [ 115.434345][ T5939] ? do_filp_open+0x430/0x430 [ 115.439013][ T5939] do_filp_open+0x1f2/0x430 [ 115.443591][ T5939] ? vfs_tmpfile+0x480/0x480 [ 115.448186][ T5939] ? _raw_spin_unlock+0x28/0x40 [ 115.453046][ T5939] ? alloc_fd+0x590/0x640 [ 115.457385][ T5939] do_sys_openat2+0x134/0x1d0 [ 115.462066][ T5939] ? do_sys_open+0xe0/0xe0 [ 115.466473][ T5939] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 115.472444][ T5939] ? lock_chain_count+0x20/0x20 [ 115.477396][ T5939] __x64_sys_open+0x11f/0x140 [ 115.482079][ T5939] do_syscall_64+0x55/0xb0 [ 115.486529][ T5939] ? clear_bhb_loop+0x40/0x90 [ 115.491214][ T5939] ? clear_bhb_loop+0x40/0x90 [ 115.495911][ T5939] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 115.501800][ T5939] RIP: 0033:0x7f5e1199ce59 [ 115.506218][ T5939] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 115.525908][ T5939] RSP: 002b:00007f5e1282d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 115.534309][ T5939] RAX: ffffffffffffffda RBX: 00007f5e11c15fa0 RCX: 00007f5e1199ce59 [ 115.542268][ T5939] RDX: 0000000000000009 RSI: 0000000000000080 RDI: 00002000000001c0 [ 115.550225][ T5939] RBP: 00007f5e11a32e6f R08: 0000000000000000 R09: 0000000000000000 [ 115.558184][ T5939] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 115.566234][ T5939] R13: 00007f5e11c16038 R14: 00007f5e11c15fa0 R15: 00007fff9e431e18 [ 115.574198][ T5939] [ 115.577477][ T5939] Kernel Offset: disabled [ 115.581791][ T5939] Rebooting in 86400 seconds..