Warning: Permanently added '[localhost]:30034' (ED25519) to the list of known hosts. 2026/10/20 20:23:15 parsed 1 programs 2026/10/20 20:23:15 serving rpc on tcp://35387 syzkaller login: [ 92.026265][ T111] cfg80211: failed to load regulatory.db [ 94.277934][ T5288] cgroup: Unknown subsys name 'net' [ 94.355537][ T5288] cgroup: Unknown subsys name 'cpuset' [ 94.358732][ T5288] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 96.090176][ T5288] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 101.062086][ T5303] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 104.036208][ T5332] rxe_eth0 speed is unknown, defaulting to 1000 [ 104.037077][ T5332] rxe_eth0 speed is unknown, defaulting to 1000 [ 104.038131][ T5332] rxe_eth0 speed is unknown, defaulting to 1000 [ 104.241501][ T5332] infiniband rxe0: set active [ 104.241925][ T4692] rxe_eth0 speed is unknown, defaulting to 1000 [ 104.242029][ T5332] infiniband rxe0: added rxe_eth0 [ 104.257738][ T5332] smbdirect: ib_dev[rxe0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 104.257761][ T5332] smbdirect: ib_dev[rxe0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 104.257780][ T5332] smbdirect: ib_dev[rxe0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 104.295171][ T5332] RDS/IB: rxe0: added [ 104.295295][ T5332] smc: adding ib device rxe0 with port count 1 [ 104.295335][ T5332] smc: ib device rxe0 port 1 has no pnetid [ 104.295877][ T4692] rxe_eth0 speed is unknown, defaulting to 1000 [ 104.317939][ T5332] rxe_eth0 speed is unknown, defaulting to 1000 [ 104.772817][ T5332] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.774681][ T5332] bridge0: port 1(bridge_slave_0) entered disabled state [ 104.774990][ T5332] bridge_slave_0: entered allmulticast mode [ 104.793860][ T5332] bridge_slave_0: entered promiscuous mode [ 104.819652][ T5332] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.819706][ T5332] bridge0: port 2(bridge_slave_1) entered disabled state [ 104.819829][ T5332] bridge_slave_1: entered allmulticast mode [ 104.821156][ T5332] bridge_slave_1: entered promiscuous mode [ 104.891178][ T5332] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 104.896343][ T5332] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 104.964149][ T5332] team0: Port device team_slave_0 added [ 104.966143][ T5332] team0: Port device team_slave_1 added [ 105.024630][ T5332] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 105.024676][ T5332] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 105.024688][ T5332] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 105.028798][ T5332] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 105.028811][ T5332] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 105.028823][ T5332] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 105.138050][ T5332] hsr_slave_0: entered promiscuous mode [ 105.138795][ T5332] hsr_slave_1: entered promiscuous mode [ 105.407850][ T5332] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 105.419061][ T5332] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 105.425686][ T5332] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 105.441164][ T5332] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 105.442041][ T5332] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 105.464375][ T5332] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 105.465399][ T5332] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 105.479079][ T5332] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 105.536896][ T5332] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.536981][ T5332] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.537386][ T5332] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.537463][ T5332] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.614187][ T72] bridge0: port 1(bridge_slave_0) entered disabled state [ 105.616066][ T72] bridge0: port 2(bridge_slave_1) entered disabled state [ 105.703979][ T5332] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.740737][ T5332] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.756492][ T72] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.756566][ T72] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.779097][ T72] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.779167][ T72] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.356711][ T5332] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 106.435874][ T5332] veth0_vlan: entered promiscuous mode [ 106.446658][ T5332] veth1_vlan: entered promiscuous mode [ 106.482240][ T5332] veth0_macvtap: entered promiscuous mode [ 106.487560][ T5332] veth1_macvtap: entered promiscuous mode [ 106.508039][ T5332] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 106.523413][ T5332] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 106.576010][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.610789][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.610831][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.610847][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.864295][ T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 106.974223][ T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.310174][ T5372] rxe_eth0 speed is unknown, defaulting to 1000 [ 107.766590][ T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.460679][ T5377] rxe_eth0 speed is unknown, defaulting to 1000 [ 108.568195][ T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.867708][ T5382] rxe_eth0 speed is unknown, defaulting to 1000 [ 109.265599][ T5388] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 109.267588][ T5388] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 109.276489][ T5388] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 109.279142][ T5388] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 109.287526][ T5388] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 109.409201][ T13] bridge_slave_1: left allmulticast mode [ 109.409235][ T13] bridge_slave_1: left promiscuous mode [ 109.416723][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 109.452689][ T13] bridge_slave_0: left allmulticast mode [ 109.452711][ T13] bridge_slave_0: left promiscuous mode [ 109.453443][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 109.621576][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 109.626138][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 109.628281][ T13] bond0 (unregistering): Released all slaves [ 109.698230][ T5387] rxe_eth0 speed is unknown, defaulting to 1000 [ 110.542924][ T13] hsr_slave_0: left promiscuous mode [ 110.555019][ T13] hsr_slave_1: left promiscuous mode [ 110.563157][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 110.563193][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 110.580541][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 110.580560][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 110.663307][ T13] veth1_macvtap: left promiscuous mode [ 110.665149][ T13] veth0_macvtap: left promiscuous mode [ 110.665281][ T13] veth1_vlan: left promiscuous mode [ 110.665384][ T13] veth0_vlan: left promiscuous mode [ 111.034935][ T13] team0 (unregistering): Port device team_slave_1 removed [ 111.063792][ T13] team0 (unregistering): Port device team_slave_0 removed [ 111.188257][ T4989] 8021q: adding VLAN 0 to HW filter on device eth2 [ 111.281967][ T5404] rxe_eth0 speed is unknown, defaulting to 1000 [ 111.933427][ T4989] 8021q: adding VLAN 0 to HW filter on device eth4 [ 112.320858][ T72] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.320878][ T72] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.455279][ T72] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.455296][ T72] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.881780][ T4989] 8021q: adding VLAN 0 to HW filter on device eth3 [ 113.168312][ T5423] rxe_eth0 speed is unknown, defaulting to 1000 [ 114.181053][ T4989] 8021q: adding VLAN 0 to HW filter on device eth5 [ 114.334899][ T5434] rxe_eth0 speed is unknown, defaulting to 1000 [ 115.032753][ T5443] rxe_eth0 speed is unknown, defaulting to 1000 2026/10/20 20:23:40 executed programs: 0 [ 115.952642][ T4642] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 115.955290][ T4642] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 115.955742][ T4642] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 115.956361][ T4642] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 115.956804][ T4642] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 116.453084][ T5449] rxe_eth0 speed is unknown, defaulting to 1000 [ 116.795297][ T5449] bridge0: port 1(bridge_slave_0) entered blocking state [ 116.795416][ T5449] bridge0: port 1(bridge_slave_0) entered disabled state [ 116.795496][ T5449] bridge_slave_0: entered allmulticast mode [ 116.796703][ T5449] bridge_slave_0: entered promiscuous mode [ 116.815919][ T5449] bridge0: port 2(bridge_slave_1) entered blocking state [ 116.816030][ T5449] bridge0: port 2(bridge_slave_1) entered disabled state [ 116.816116][ T5449] bridge_slave_1: entered allmulticast mode [ 116.817546][ T5449] bridge_slave_1: entered promiscuous mode [ 116.853578][ T5449] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 116.856840][ T5449] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 116.885813][ T5449] team0: Port device team_slave_0 added [ 116.887780][ T5449] team0: Port device team_slave_1 added [ 116.914414][ T5449] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 116.914428][ T5449] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 116.914441][ T5449] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 116.915802][ T5449] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 116.915810][ T5449] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 116.915926][ T5449] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 116.984719][ T5449] hsr_slave_0: entered promiscuous mode [ 116.985409][ T5449] hsr_slave_1: entered promiscuous mode [ 117.535377][ T5449] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 117.575578][ T5449] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 117.578051][ T5449] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 117.596196][ T5449] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 117.598003][ T5449] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 117.633303][ T5449] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 117.644235][ T5449] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 117.663166][ T5449] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 117.696930][ T5449] bridge0: port 2(bridge_slave_1) entered blocking state [ 117.697011][ T5449] bridge0: port 2(bridge_slave_1) entered forwarding state [ 117.697149][ T5449] bridge0: port 1(bridge_slave_0) entered blocking state [ 117.697321][ T5449] bridge0: port 1(bridge_slave_0) entered forwarding state [ 117.722345][ T72] bridge0: port 1(bridge_slave_0) entered disabled state [ 117.737507][ T72] bridge0: port 2(bridge_slave_1) entered disabled state [ 117.848735][ T5449] 8021q: adding VLAN 0 to HW filter on device bond0 [ 117.887402][ T5449] 8021q: adding VLAN 0 to HW filter on device team0 [ 117.913292][ T72] bridge0: port 1(bridge_slave_0) entered blocking state [ 117.913415][ T72] bridge0: port 1(bridge_slave_0) entered forwarding state [ 117.935184][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 117.935304][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 117.955002][ T4692] rxe_eth0 speed is unknown, defaulting to 1000 [ 118.013156][ T5388] Bluetooth: hci0: command tx timeout [ 118.725715][ T5449] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 118.806470][ T5449] veth0_vlan: entered promiscuous mode [ 118.834141][ T5449] veth1_vlan: entered promiscuous mode [ 118.894720][ T5449] veth0_macvtap: entered promiscuous mode [ 118.904845][ T5449] veth1_macvtap: entered promiscuous mode [ 118.951042][ T5449] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 118.958689][ T5449] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 119.080496][ T195] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.086712][ T72] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.086740][ T72] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.086753][ T72] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.172979][ T1058] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 119.172997][ T1058] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.239032][ T139] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 119.239050][ T139] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.386487][ T5512] ================================================================== [ 119.386525][ T5512] BUG: KASAN: slab-use-after-free in snapshot_ctr+0x5cb/0x1340 [ 119.386857][ T5512] Read of size 8 at addr ffff888038e19518 by task syz.0.17/5512 [ 119.386888][ T5512] [ 119.386908][ T5512] CPU: 0 UID: 0 PID: 5512 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 119.386937][ T5512] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 119.386945][ T5512] Call Trace: [ 119.386980][ T5512] [ 119.387007][ T5512] dump_stack_lvl+0xe8/0x150 [ 119.387178][ T5512] print_address_description+0x55/0x1e0 [ 119.387195][ T5512] ? snapshot_ctr+0x5cb/0x1340 [ 119.387206][ T5512] print_report+0x58/0x70 [ 119.387219][ T5512] kasan_report+0x117/0x150 [ 119.387279][ T5512] ? snapshot_ctr+0x5cb/0x1340 [ 119.387292][ T5512] snapshot_ctr+0x5cb/0x1340 [ 119.387306][ T5512] ? __pfx_snapshot_ctr+0x10/0x10 [ 119.387317][ T5512] ? skip_spaces+0x8a/0xa0 [ 119.387445][ T5512] ? dm_split_args+0x50b/0x5d0 [ 119.387464][ T5512] dm_table_add_target+0x58d/0xc70 [ 119.387481][ T5512] table_load+0x325/0x8a0 [ 119.387497][ T5512] ? __pfx_table_load+0x10/0x10 [ 119.387514][ T5512] dm_ctl_ioctl+0x9ec/0xe10 [ 119.387529][ T5512] ? __pfx_table_load+0x10/0x10 [ 119.387542][ T5512] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 119.387562][ T5512] ? __pfx___se_sys_futex+0x10/0x10 [ 119.387641][ T5512] ? bpf_lsm_file_ioctl+0x9/0x20 [ 119.387670][ T5512] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 119.387684][ T5512] __se_sys_ioctl+0xfc/0x170 [ 119.387706][ T5512] do_syscall_64+0x166/0x520 [ 119.387766][ T5512] ? trace_irq_disable+0x3b/0x140 [ 119.387786][ T5512] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.387797][ T5512] ? clear_bhb_loop+0x70/0xc0 [ 119.387809][ T5512] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.387819][ T5512] RIP: 0033:0x7f239a99f559 [ 119.387831][ T5512] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 119.387840][ T5512] RSP: 002b:00007ffdb38c50f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 119.387869][ T5512] RAX: ffffffffffffffda RBX: 00007f239ac25fa0 RCX: 00007f239a99f559 [ 119.387876][ T5512] RDX: 0000200000001640 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 119.387883][ T5512] RBP: 00007f239aa36b20 R08: 0000000000000000 R09: 0000000000000000 [ 119.387890][ T5512] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 119.387896][ T5512] R13: 00007f239ac25fac R14: 00007f239ac25fa0 R15: 00007f239ac25fa0 [ 119.387907][ T5512] [ 119.387911][ T5512] [ 119.387914][ T5512] Allocated by task 5512: [ 119.387928][ T5512] kasan_save_track+0x3e/0x80 [ 119.387939][ T5512] __kasan_kmalloc+0x93/0xb0 [ 119.387949][ T5512] __kmalloc_cache_node_noprof+0x3d1/0x620 [ 119.387960][ T5512] dm_get_table_device+0x23e/0x740 [ 119.387969][ T5512] dm_get_device+0x327/0x760 [ 119.387982][ T5512] snapshot_ctr+0x2b2/0x1340 [ 119.387992][ T5512] dm_table_add_target+0x58d/0xc70 [ 119.388005][ T5512] table_load+0x325/0x8a0 [ 119.388016][ T5512] dm_ctl_ioctl+0x9ec/0xe10 [ 119.388027][ T5512] __se_sys_ioctl+0xfc/0x170 [ 119.388037][ T5512] do_syscall_64+0x166/0x520 [ 119.388047][ T5512] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.388056][ T5512] [ 119.388058][ T5512] Freed by task 5512: [ 119.388063][ T5512] kasan_save_track+0x3e/0x80 [ 119.388072][ T5512] kasan_save_free_info+0x40/0x50 [ 119.388093][ T5512] __kasan_slab_free+0x5c/0x80 [ 119.388103][ T5512] kfree+0x1c5/0x650 [ 119.388115][ T5512] dm_put_table_device+0x255/0x2a0 [ 119.388124][ T5512] dm_get_device+0x56f/0x760 [ 119.388136][ T5512] snapshot_ctr+0x471/0x1340 [ 119.388146][ T5512] dm_table_add_target+0x58d/0xc70 [ 119.388159][ T5512] table_load+0x325/0x8a0 [ 119.388170][ T5512] dm_ctl_ioctl+0x9ec/0xe10 [ 119.388181][ T5512] __se_sys_ioctl+0xfc/0x170 [ 119.388191][ T5512] do_syscall_64+0x166/0x520 [ 119.388202][ T5512] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.388211][ T5512] [ 119.388214][ T5512] The buggy address belongs to the object at ffff888038e19500 [ 119.388214][ T5512] which belongs to the cache kmalloc-96 of size 96 [ 119.388236][ T5512] The buggy address is located 24 bytes inside of [ 119.388236][ T5512] freed 96-byte region [ffff888038e19500, ffff888038e19560) [ 119.388246][ T5512] [ 119.388248][ T5512] The buggy address belongs to the physical page: [ 119.388254][ T5512] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x38e19 [ 119.388265][ T5512] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 119.388274][ T5512] page_type: f5(slab) [ 119.388284][ T5512] raw: 04fff00000000000 ffff88801c041280 dead000000000100 dead000000000122 [ 119.388293][ T5512] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000 [ 119.388299][ T5512] page dumped because: kasan: bad access detected [ 119.388304][ T5512] page_owner tracks the page as allocated [ 119.388308][ T5512] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 195, tgid 195 (kworker/u4:7), ts 22161879156 [ 119.388325][ T5512] post_alloc_hook+0x1f9/0x250 [ 119.388350][ T5512] get_page_from_freelist+0x2209/0x2280 [ 119.388360][ T5512] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 119.388370][ T5512] allocate_slab+0x7d/0x620 [ 119.388382][ T5512] refill_objects+0x2d5/0x350 [ 119.388394][ T5512] __pcs_replace_empty_main+0x2c8/0x6c0 [ 119.388405][ T5512] __kmalloc_noprof+0x47b/0x720 [ 119.388413][ T5512] security_task_alloc+0x4d/0x330 [ 119.388460][ T5512] copy_process+0x1c7a/0x44b0 [ 119.388532][ T5512] kernel_clone+0x2d7/0x940 [ 119.388545][ T5512] user_mode_thread+0x115/0x180 [ 119.388557][ T5512] call_usermodehelper_exec_work+0x5c/0x230 [ 119.388595][ T5512] process_scheduled_works+0xc3d/0x1630 [ 119.388607][ T5512] worker_thread+0xa47/0xfb0 [ 119.388619][ T5512] kthread+0x38b/0x480 [ 119.388627][ T5512] ret_from_fork+0x514/0xb70 [ 119.388671][ T5512] page last free pid 195 tgid 195 ts 22161737366 stack trace: [ 119.388679][ T5512] __free_frozen_pages+0xc93/0xd90 [ 119.388692][ T5512] __kasan_populate_vmalloc+0x12d/0x1c0 [ 119.388701][ T5512] alloc_vmap_area+0xd1a/0x1420 [ 119.388713][ T5512] __get_vm_area_node+0x200/0x2f0 [ 119.388725][ T5512] __vmalloc_node_range_noprof+0x343/0x1540 [ 119.388738][ T5512] __vmalloc_node_noprof+0xc2/0x100 [ 119.388751][ T5512] dup_task_struct+0x2c6/0xa00 [ 119.388762][ T5512] copy_process+0x7ef/0x44b0 [ 119.388774][ T5512] kernel_clone+0x2d7/0x940 [ 119.388785][ T5512] user_mode_thread+0x115/0x180 [ 119.388798][ T5512] call_usermodehelper_exec_work+0x5c/0x230 [ 119.388810][ T5512] process_scheduled_works+0xc3d/0x1630 [ 119.388821][ T5512] worker_thread+0xa47/0xfb0 [ 119.388833][ T5512] kthread+0x38b/0x480 [ 119.388841][ T5512] ret_from_fork+0x514/0xb70 [ 119.388849][ T5512] ret_from_fork_asm+0x1a/0x30 [ 119.388857][ T5512] [ 119.388860][ T5512] Memory state around the buggy address: [ 119.388866][ T5512] ffff888038e19400: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc [ 119.388873][ T5512] ffff888038e19480: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc [ 119.388879][ T5512] >ffff888038e19500: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 119.388884][ T5512] ^ [ 119.388889][ T5512] ffff888038e19580: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 119.388895][ T5512] ffff888038e19600: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 119.388900][ T5512] ================================================================== [ 119.603065][ T5512] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 119.720641][ T5512] CPU: 0 UID: 0 PID: 5512 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 119.724097][ T5512] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 119.728128][ T5512] Call Trace: [ 119.729634][ T5512] [ 119.730980][ T5512] vpanic+0x56d/0xa60 [ 119.732793][ T5512] ? __pfx_vpanic+0x10/0x10 [ 119.734843][ T5512] panic+0xc5/0xd0 [ 119.736596][ T5512] ? __pfx_panic+0x10/0x10 [ 119.738784][ T5512] ? preempt_schedule_thunk+0x16/0x40 [ 119.741209][ T5512] ? snapshot_ctr+0x5cb/0x1340 [ 119.743293][ T5512] ? preempt_schedule_thunk+0x16/0x40 [ 119.745649][ T5512] ? snapshot_ctr+0x5cb/0x1340 [ 119.747716][ T5512] check_panic_on_warn+0x89/0xb0 [ 119.749713][ T5512] ? snapshot_ctr+0x5cb/0x1340 [ 119.751647][ T5512] end_report+0x73/0x170 [ 119.753379][ T5512] ? snapshot_ctr+0x5cb/0x1340 [ 119.755344][ T5512] kasan_report+0x128/0x150 [ 119.757198][ T5512] ? snapshot_ctr+0x5cb/0x1340 [ 119.759103][ T5512] snapshot_ctr+0x5cb/0x1340 [ 119.761090][ T5512] ? __pfx_snapshot_ctr+0x10/0x10 [ 119.763247][ T5512] ? skip_spaces+0x8a/0xa0 [ 119.765224][ T5512] ? dm_split_args+0x50b/0x5d0 [ 119.767280][ T5512] dm_table_add_target+0x58d/0xc70 [ 119.769412][ T5512] table_load+0x325/0x8a0 [ 119.771333][ T5512] ? __pfx_table_load+0x10/0x10 [ 119.773391][ T5512] dm_ctl_ioctl+0x9ec/0xe10 [ 119.775267][ T5512] ? __pfx_table_load+0x10/0x10 [ 119.777263][ T5512] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 119.779225][ T5512] ? __pfx___se_sys_futex+0x10/0x10 [ 119.781164][ T5512] ? bpf_lsm_file_ioctl+0x9/0x20 [ 119.782980][ T5512] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 119.785028][ T5512] __se_sys_ioctl+0xfc/0x170 [ 119.787043][ T5512] do_syscall_64+0x166/0x520 [ 119.789033][ T5512] ? trace_irq_disable+0x3b/0x140 [ 119.791158][ T5512] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.793824][ T5512] ? clear_bhb_loop+0x70/0xc0 [ 119.795883][ T5512] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.798407][ T5512] RIP: 0033:0x7f239a99f559 [ 119.800337][ T5512] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 119.808791][ T5512] RSP: 002b:00007ffdb38c50f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 119.812338][ T5512] RAX: ffffffffffffffda RBX: 00007f239ac25fa0 RCX: 00007f239a99f559 [ 119.815641][ T5512] RDX: 0000200000001640 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 119.818950][ T5512] RBP: 00007f239aa36b20 R08: 0000000000000000 R09: 0000000000000000 [ 119.822119][ T5512] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 119.825301][ T5512] R13: 00007f239ac25fac R14: 00007f239ac25fa0 R15: 00007f239ac25fa0 [ 119.828353][ T5512] [ 119.829879][ T5512] Kernel Offset: disabled [ 119.831434][ T5512] Rebooting in 86400 seconds.. VM DIAGNOSIS: 20:23:43 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000032 RBX=0000000000000032 RCX=0000000000000000 RDX=00000000000003f8 RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90000337900 R8 =0000000000000003 R9 =0000000000000004 R10=dffffc0000000000 R11=ffffffff8576b480 R12=dffffc0000000000 R13=0000000000000032 R14=ffffffff9bd5b220 R15=0000000000000000 RIP=ffffffff8576b4fc RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88808b0b0000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f0089cdb4ac CR3=00000000140cb000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000ff000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000001da0 0000000000033260 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000