[ 46.264180][ T5435] 8021q: adding VLAN 0 to HW filter on device bond0
[ 46.280295][ T5435] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting crond: OK
[ 46.661221][ T5512] ssh-keygen (5512) used greatest stack depth: 20944 bytes left
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.1.21' (ED25519) to the list of known hosts.
2026/07/26 02:02:26 parsed 1 programs
2026/07/26 02:02:26 serving rpc on tcp://42109
syzkaller login: [ 74.195117][ T5781] cgroup: Unknown subsys name 'net'
[ 74.363157][ T5781] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 75.706724][ T5781] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 78.430294][ T4453] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 78.438578][ T4453] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 78.488058][ T1078] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 78.495934][ T1078] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 79.443757][ T5848] chnl_net:caif_netlink_parms(): no params data found
[ 79.513473][ T5848] bridge0: port 1(bridge_slave_0) entered blocking state
[ 79.521339][ T5848] bridge0: port 1(bridge_slave_0) entered disabled state
[ 79.528597][ T5848] bridge_slave_0: entered allmulticast mode
[ 79.535449][ T5848] bridge_slave_0: entered promiscuous mode
[ 79.558620][ T5848] bridge0: port 2(bridge_slave_1) entered blocking state
[ 79.565760][ T5848] bridge0: port 2(bridge_slave_1) entered disabled state
[ 79.573027][ T5848] bridge_slave_1: entered allmulticast mode
[ 79.579909][ T5848] bridge_slave_1: entered promiscuous mode
[ 79.604612][ T5848] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 79.625930][ T5848] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 79.649924][ T5848] team0: Port device team_slave_0 added
[ 79.657910][ T5848] team0: Port device team_slave_1 added
[ 79.678238][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 79.685226][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 79.711239][ T5848] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 79.736745][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 79.743763][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 79.770196][ T5848] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 79.822808][ T5848] hsr_slave_0: entered promiscuous mode
[ 79.829506][ T5848] hsr_slave_1: entered promiscuous mode
[ 79.964766][ T5848] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 79.983905][ T5848] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 79.993134][ T5848] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 80.002731][ T5848] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 80.029492][ T5848] bridge0: port 2(bridge_slave_1) entered blocking state
[ 80.036798][ T5848] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 80.044554][ T5848] bridge0: port 1(bridge_slave_0) entered blocking state
[ 80.051730][ T5848] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 80.139513][ T5848] 8021q: adding VLAN 0 to HW filter on device bond0
[ 80.177383][ T1078] bridge0: port 1(bridge_slave_0) entered disabled state
[ 80.185983][ T1078] bridge0: port 2(bridge_slave_1) entered disabled state
[ 80.215172][ T5848] 8021q: adding VLAN 0 to HW filter on device team0
[ 80.229784][ T3470] bridge0: port 1(bridge_slave_0) entered blocking state
[ 80.236950][ T3470] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 80.252140][ T4453] bridge0: port 2(bridge_slave_1) entered blocking state
[ 80.259560][ T4453] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 80.489006][ T5848] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 80.536418][ T5848] veth0_vlan: entered promiscuous mode
[ 80.548371][ T5848] veth1_vlan: entered promiscuous mode
[ 80.578340][ T5848] veth0_macvtap: entered promiscuous mode
[ 80.588213][ T5848] veth1_macvtap: entered promiscuous mode
[ 80.609606][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 80.623518][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 80.635583][ T5848] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 80.644511][ T5848] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 80.653577][ T5848] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 80.662442][ T5848] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 80.798325][ T5848] syz-executor (5848) used greatest stack depth: 19824 bytes left
[ 81.131077][ T49] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 81.597452][ T5877] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 81.606093][ T5877] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 81.614449][ T5877] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 81.623153][ T5877] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 81.632272][ T5877] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 81.639652][ T5877] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
2026/07/26 02:02:36 executed programs: 0
[ 82.469173][ T5086] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 82.477334][ T5086] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 82.485330][ T5086] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 82.496224][ T5086] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 82.504812][ T5086] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 82.512448][ T5086] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 82.632670][ T5887] chnl_net:caif_netlink_parms(): no params data found
[ 82.692157][ T5887] bridge0: port 1(bridge_slave_0) entered blocking state
[ 82.699795][ T5887] bridge0: port 1(bridge_slave_0) entered disabled state
[ 82.707038][ T5887] bridge_slave_0: entered allmulticast mode
[ 82.713735][ T5887] bridge_slave_0: entered promiscuous mode
[ 82.721614][ T5887] bridge0: port 2(bridge_slave_1) entered blocking state
[ 82.728836][ T5887] bridge0: port 2(bridge_slave_1) entered disabled state
[ 82.735983][ T5887] bridge_slave_1: entered allmulticast mode
[ 82.742911][ T5887] bridge_slave_1: entered promiscuous mode
[ 82.766171][ T5887] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 82.777790][ T5887] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 82.802919][ T5887] team0: Port device team_slave_0 added
[ 82.811070][ T5887] team0: Port device team_slave_1 added
[ 82.832493][ T5887] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 82.839929][ T5887] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 82.865907][ T5887] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 82.878870][ T5887] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 82.885832][ T5887] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 82.913176][ T5887] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 82.946411][ T5887] hsr_slave_0: entered promiscuous mode
[ 82.952956][ T5887] hsr_slave_1: entered promiscuous mode
[ 82.959507][ T5887] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 82.968089][ T5887] Cannot create hsr debugfs directory
[ 83.316794][ T49] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 84.587583][ T5086] Bluetooth: hci0: command tx timeout
[ 85.575597][ T49] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 85.631189][ T49] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 86.491483][ T5887] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 86.500624][ T5887] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 86.510746][ T5887] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 86.519769][ T5887] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 86.582674][ T5887] 8021q: adding VLAN 0 to HW filter on device bond0
[ 86.596349][ T49] hsr_slave_0: left promiscuous mode
[ 86.603822][ T49] hsr_slave_1: left promiscuous mode
[ 86.609945][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 86.617506][ T49] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 86.625537][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 86.633305][ T49] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 86.641060][ T49] bridge_slave_1: left allmulticast mode
[ 86.647676][ T49] bridge_slave_1: left promiscuous mode
[ 86.653978][ T49] bridge0: port 2(bridge_slave_1) entered disabled state
[ 86.665759][ T49] bridge_slave_0: left allmulticast mode
[ 86.666685][ T5086] Bluetooth: hci0: command tx timeout
[ 86.672409][ T49] bridge_slave_0: left promiscuous mode
[ 86.682570][ T49] bridge0: port 1(bridge_slave_0) entered disabled state
[ 86.701769][ T49] veth1_macvtap: left promiscuous mode
[ 86.707994][ T49] veth0_macvtap: left promiscuous mode
[ 86.713552][ T49] veth1_vlan: left promiscuous mode
[ 86.719095][ T49] veth0_vlan: left promiscuous mode
[ 86.910277][ T1638] cfg80211: failed to load regulatory.db
[ 87.081525][ T49] team0 (unregistering): Port device team_slave_1 removed
[ 87.111012][ T49] team0 (unregistering): Port device team_slave_0 removed
[ 87.141170][ T49] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 87.171553][ T49] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 87.362329][ T49] bond0 (unregistering): Released all slaves
[ 87.482467][ T5887] 8021q: adding VLAN 0 to HW filter on device team0
[ 87.494366][ T3470] bridge0: port 1(bridge_slave_0) entered blocking state
[ 87.501556][ T3470] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 87.520938][ T11] bridge0: port 2(bridge_slave_1) entered blocking state
[ 87.528102][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 87.722913][ T5887] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 87.755836][ T5887] veth0_vlan: entered promiscuous mode
[ 87.774937][ T5887] veth1_vlan: entered promiscuous mode
[ 87.815466][ T5887] veth0_macvtap: entered promiscuous mode
[ 87.825177][ T5887] veth1_macvtap: entered promiscuous mode
[ 87.842717][ T5887] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 87.854324][ T5887] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 87.871287][ T5887] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 87.881722][ T5887] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 87.890831][ T5887] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 87.900172][ T5887] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
2026/07/26 02:02:42 executed programs: 2
[ 88.012004][ T4453] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 88.020562][ T4453] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 88.045844][ T4453] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 88.054319][ T4453] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 88.103760][ T5929] syz.0.17[5929]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set
[ 88.121624][ T5929] loop0: detected capacity change from 0 to 128
[ 88.130343][ T5929] =======================================================
[ 88.130343][ T5929] WARNING: The mand mount option has been deprecated and
[ 88.130343][ T5929] and is ignored by this kernel. Remove the mand
[ 88.130343][ T5929] option from the mount to silence this warning.
[ 88.130343][ T5929] =======================================================
[ 88.185100][ T5929] hpfs: filesystem error: improperly stopped; already mounted read-only
[ 88.195630][ T5929] hpfs: filesystem error: warning: spare dnodes used, try chkdsk
[ 88.204935][ T5929] hpfs: You really don't want any checks? You are crazy...
[ 88.213247][ T5929] hpfs: hpfs_map_sector(): read error
[ 88.219093][ T5929] hpfs: code page support is disabled
[ 88.225600][ T5929] hpfs: hpfs_map_sector(): read error
[ 88.233840][ T5929] hpfs: hpfs_map_sector(): read error
[ 88.239676][ T5929] hpfs: hpfs_map_sector(): read error
[ 88.245444][ T5929] hpfs: hpfs_map_sector(): read error
[ 88.251334][ T5929] hpfs: hpfs_map_4sectors(): unaligned read
[ 88.257850][ T5929] hpfs: hpfs_map_4sectors(): unaligned read
[ 88.263836][ T5929] hpfs: filesystem error: unable to find root dir
[ 88.305087][ T5930] loop0: detected capacity change from 0 to 128
[ 88.334484][ T5930] hpfs: filesystem error: improperly stopped; already mounted read-only
[ 88.345089][ T5930] hpfs: filesystem error: warning: spare dnodes used, try chkdsk
[ 88.361572][ T5930] hpfs: You really don't want any checks? You are crazy...
[ 88.372157][ T5930] hpfs: hpfs_map_sector(): read error
[ 88.387061][ T5930] hpfs: code page support is disabled
[ 88.392671][ T5930] ==================================================================
[ 88.400741][ T5930] BUG: KASAN: use-after-free in strcmp+0x6b/0xb0
[ 88.407076][ T5930] Read of size 1 at addr ffff88806ca6a97f by task syz.0.18/5930
[ 88.414699][ T5930]
[ 88.417030][ T5930] CPU: 1 PID: 5930 Comm: syz.0.18 Not tainted syzkaller #0
[ 88.424207][ T5930] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[ 88.434260][ T5930] Call Trace:
[ 88.437535][ T5930]
[ 88.440468][ T5930] dump_stack_lvl+0x18c/0x250
[ 88.445130][ T5930] ? read_lock_is_recursive+0x20/0x20
[ 88.450491][ T5930] ? show_regs_print_info+0x20/0x20
[ 88.455669][ T5930] ? load_image+0x420/0x420
[ 88.460159][ T5930] ? _raw_spin_lock_irqsave+0xc0/0x100
[ 88.465604][ T5930] ? __virt_addr_valid+0x10c/0x380
[ 88.470710][ T5930] ? __virt_addr_valid+0x10c/0x380
[ 88.475825][ T5930] ? __virt_addr_valid+0x10c/0x380
[ 88.480925][ T5930] print_report+0xa8/0x210
[ 88.485327][ T5930] ? strcmp+0x6b/0xb0
[ 88.489299][ T5930] kasan_report+0x117/0x150
[ 88.493800][ T5930] ? strcmp+0x6b/0xb0
[ 88.497778][ T5930] strcmp+0x6b/0xb0
[ 88.501576][ T5930] hpfs_get_ea+0x138/0xea0
[ 88.505984][ T5930] ? hpfs_read_ea+0xc20/0xc20
[ 88.510653][ T5930] ? __getblk_gfp+0x53/0x620
[ 88.515236][ T5930] ? __might_sleep+0xe0/0xe0
[ 88.519824][ T5930] ? __bread_gfp+0x64/0x330
[ 88.524318][ T5930] ? hpfs_map_sector+0x149/0x370
[ 88.529251][ T5930] hpfs_read_inode+0x1aa/0x1050
[ 88.534094][ T5930] ? rcu_is_watching+0x15/0xb0
[ 88.538849][ T5930] ? iget_locked+0x7a6/0x8c0
[ 88.543429][ T5930] ? __lock_acquire+0x7d80/0x7d80
[ 88.548440][ T5930] ? hpfs_init_inode+0x2d0/0x2d0
[ 88.553370][ T5930] ? __rwlock_init+0x150/0x150
[ 88.558124][ T5930] ? do_raw_spin_unlock+0x121/0x230
[ 88.563333][ T5930] ? hpfs_init_inode+0x1d0/0x2d0
[ 88.568277][ T5930] hpfs_fill_super+0x12f2/0x1f40
[ 88.573222][ T5930] ? hpfs_mount+0x40/0x40
[ 88.577548][ T5930] ? vscnprintf+0x80/0x80
[ 88.581879][ T5930] ? down_read_killable+0x340/0x340
[ 88.587083][ T5930] ? setup_bdev_super+0x56b/0x660
[ 88.592100][ T5930] mount_bdev+0x21c/0x2c0
[ 88.596416][ T5930] ? kfree+0x31/0x1a0
[ 88.600388][ T5930] ? hpfs_mount+0x40/0x40
[ 88.604704][ T5930] ? get_tree_bdev+0x520/0x520
[ 88.609455][ T5930] ? vfs_parse_fs_param+0x420/0x420
[ 88.614646][ T5930] legacy_get_tree+0xea/0x180
[ 88.619319][ T5930] ? hpfs_ioctl+0x270/0x270
[ 88.623809][ T5930] vfs_get_tree+0x8c/0x280
[ 88.628215][ T5930] do_new_mount+0x24a/0xa40
[ 88.632709][ T5930] __se_sys_mount+0x2e7/0x3d0
[ 88.637376][ T5930] ? __x64_sys_mount+0xc0/0xc0
[ 88.642131][ T5930] ? lockdep_hardirqs_on+0x98/0x150
[ 88.647320][ T5930] ? __x64_sys_mount+0x20/0xc0
[ 88.652070][ T5930] do_syscall_64+0x55/0xb0
[ 88.656475][ T5930] ? clear_bhb_loop+0x40/0x90
[ 88.661140][ T5930] ? clear_bhb_loop+0x40/0x90
[ 88.665804][ T5930] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 88.671697][ T5930] RIP: 0033:0x7f5da079f10a
[ 88.676108][ T5930] Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 88.695706][ T5930] RSP: 002b:00007fff8eb78558 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 88.704114][ T5930] RAX: ffffffffffffffda RBX: 00007fff8eb785e0 RCX: 00007f5da079f10a
[ 88.712074][ T5930] RDX: 0000200000000080 RSI: 0000200000009ec0 RDI: 00007fff8eb785a0
[ 88.720035][ T5930] RBP: 0000200000000080 R08: 00007fff8eb785e0 R09: 0000000003a00041
[ 88.727996][ T5930] R10: 0000000003a00041 R11: 0000000000000246 R12: 0000200000009ec0
[ 88.735984][ T5930] R13: 00007fff8eb785a0 R14: 0000000000009e31 R15: 0000200000000000
[ 88.743968][ T5930]
[ 88.746996][ T5930]
[ 88.749307][ T5930] The buggy address belongs to the physical page:
[ 88.755712][ T5930] page:ffffea0001b29a80 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x6ca6a
[ 88.765857][ T5930] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 88.772961][ T5930] page_type: 0xffffffff()
[ 88.777289][ T5930] raw: 00fff00000000000 ffffea0001b211c8 ffffea0001b3e708 0000000000000000
[ 88.785857][ T5930] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
[ 88.794421][ T5930] page dumped because: kasan: bad access detected
[ 88.800828][ T5930] page_owner tracks the page as freed
[ 88.806179][ T5930] page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 5882, tgid 5882 (syz-executor), ts 81871667600, free_ts 82441696869
[ 88.823878][ T5930] post_alloc_hook+0x1c1/0x200
[ 88.828641][ T5930] get_page_from_freelist+0x2181/0x22a0
[ 88.834173][ T5930] __alloc_pages+0x1f0/0x460
[ 88.838755][ T5930] __folio_alloc+0x10/0x20
[ 88.843159][ T5930] vma_alloc_folio+0x474/0x8f0
[ 88.847910][ T5930] handle_mm_fault+0x1881/0x4a50
[ 88.852833][ T5930] do_user_addr_fault+0x736/0x12d0
[ 88.857931][ T5930] exc_page_fault+0x64/0x100
[ 88.862510][ T5930] asm_exc_page_fault+0x26/0x30
[ 88.867351][ T5930] page last free stack trace:
[ 88.872010][ T5930] free_unref_page_prepare+0x7d7/0x8f0
[ 88.877459][ T5930] free_unref_page_list+0xbe/0x860
[ 88.882557][ T5930] release_pages+0x208a/0x2300
[ 88.887309][ T5930] tlb_flush_mmu+0x379/0x510
[ 88.891896][ T5930] tlb_finish_mmu+0xf4/0x220
[ 88.896480][ T5930] exit_mmap+0x428/0xb90
[ 88.900718][ T5930] __mmput+0x118/0x3a0
[ 88.904778][ T5930] exit_mm+0x23f/0x340
[ 88.908837][ T5930] do_exit+0x909/0x2530
[ 88.912989][ T5930] do_group_exit+0x22d/0x2f0
[ 88.917576][ T5930] get_signal+0x12a6/0x1390
[ 88.922070][ T5930] arch_do_signal_or_restart+0xc2/0x7b0
[ 88.927609][ T5930] exit_to_user_mode_loop+0x70/0x110
[ 88.932890][ T5930] exit_to_user_mode_prepare+0xee/0x180
[ 88.938426][ T5930] syscall_exit_to_user_mode+0x1a/0x50
[ 88.943893][ T5930] do_syscall_64+0x61/0xb0
[ 88.948320][ T5930]
[ 88.950634][ T5930] Memory state around the buggy address:
[ 88.956249][ T5930] ffff88806ca6a800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 88.964297][ T5930] ffff88806ca6a880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 88.972345][ T5930] >ffff88806ca6a900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 88.980389][ T5930] ^
[ 88.988354][ T5930] ffff88806ca6a980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 88.996402][ T5930] ffff88806ca6aa00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 89.004450][ T5930] ==================================================================
[ 89.013936][ T5930] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 89.019139][ T5086] Bluetooth: hci0: command tx timeout
[ 89.026488][ T5930] CPU: 0 PID: 5930 Comm: syz.0.18 Not tainted syzkaller #0
[ 89.033683][ T5930] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[ 89.043734][ T5930] Call Trace:
[ 89.047006][ T5930]
[ 89.049925][ T5930] dump_stack_lvl+0x18c/0x250
[ 89.054609][ T5930] ? show_regs_print_info+0x20/0x20
[ 89.059798][ T5930] ? load_image+0x420/0x420
[ 89.064300][ T5930] panic+0x2ca/0x720
[ 89.068193][ T5930] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 89.074343][ T5930] ? bpf_jit_dump+0xd0/0xd0
[ 89.078842][ T5930] ? _raw_spin_unlock_irqrestore+0x111/0x120
[ 89.084816][ T5930] ? _raw_spin_unlock+0x40/0x40
[ 89.089665][ T5930] ? strcmp+0x6b/0xb0
[ 89.093640][ T5930] check_panic_on_warn+0x84/0xa0
[ 89.098571][ T5930] ? strcmp+0x6b/0xb0
[ 89.102545][ T5930] end_report+0x6f/0x130
[ 89.106782][ T5930] kasan_report+0x128/0x150
[ 89.111275][ T5930] ? strcmp+0x6b/0xb0
[ 89.115266][ T5930] strcmp+0x6b/0xb0
[ 89.119090][ T5930] hpfs_get_ea+0x138/0xea0
[ 89.123516][ T5930] ? hpfs_read_ea+0xc20/0xc20
[ 89.128189][ T5930] ? __getblk_gfp+0x53/0x620
[ 89.132776][ T5930] ? __might_sleep+0xe0/0xe0
[ 89.137361][ T5930] ? __bread_gfp+0x64/0x330
[ 89.141860][ T5930] ? hpfs_map_sector+0x149/0x370
[ 89.146795][ T5930] hpfs_read_inode+0x1aa/0x1050
[ 89.151643][ T5930] ? rcu_is_watching+0x15/0xb0
[ 89.156397][ T5930] ? iget_locked+0x7a6/0x8c0
[ 89.160977][ T5930] ? __lock_acquire+0x7d80/0x7d80
[ 89.165989][ T5930] ? hpfs_init_inode+0x2d0/0x2d0
[ 89.170926][ T5930] ? __rwlock_init+0x150/0x150
[ 89.175683][ T5930] ? do_raw_spin_unlock+0x121/0x230
[ 89.180874][ T5930] ? hpfs_init_inode+0x1d0/0x2d0
[ 89.185828][ T5930] hpfs_fill_super+0x12f2/0x1f40
[ 89.190761][ T5930] ? hpfs_mount+0x40/0x40
[ 89.195078][ T5930] ? vscnprintf+0x80/0x80
[ 89.199401][ T5930] ? down_read_killable+0x340/0x340
[ 89.204616][ T5930] ? setup_bdev_super+0x56b/0x660
[ 89.209643][ T5930] mount_bdev+0x21c/0x2c0
[ 89.213962][ T5930] ? kfree+0x31/0x1a0
[ 89.217945][ T5930] ? hpfs_mount+0x40/0x40
[ 89.222262][ T5930] ? get_tree_bdev+0x520/0x520
[ 89.227019][ T5930] ? vfs_parse_fs_param+0x420/0x420
[ 89.232211][ T5930] legacy_get_tree+0xea/0x180
[ 89.236882][ T5930] ? hpfs_ioctl+0x270/0x270
[ 89.241381][ T5930] vfs_get_tree+0x8c/0x280
[ 89.245787][ T5930] do_new_mount+0x24a/0xa40
[ 89.250284][ T5930] __se_sys_mount+0x2e7/0x3d0
[ 89.254958][ T5930] ? __x64_sys_mount+0xc0/0xc0
[ 89.259713][ T5930] ? lockdep_hardirqs_on+0x98/0x150
[ 89.264904][ T5930] ? __x64_sys_mount+0x20/0xc0
[ 89.269659][ T5930] do_syscall_64+0x55/0xb0
[ 89.274069][ T5930] ? clear_bhb_loop+0x40/0x90
[ 89.278736][ T5930] ? clear_bhb_loop+0x40/0x90
[ 89.283418][ T5930] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 89.289320][ T5930] RIP: 0033:0x7f5da079f10a
[ 89.293747][ T5930] Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 89.313362][ T5930] RSP: 002b:00007fff8eb78558 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 89.321777][ T5930] RAX: ffffffffffffffda RBX: 00007fff8eb785e0 RCX: 00007f5da079f10a
[ 89.329743][ T5930] RDX: 0000200000000080 RSI: 0000200000009ec0 RDI: 00007fff8eb785a0
[ 89.337732][ T5930] RBP: 0000200000000080 R08: 00007fff8eb785e0 R09: 0000000003a00041
[ 89.345694][ T5930] R10: 0000000003a00041 R11: 0000000000000246 R12: 0000200000009ec0
[ 89.353666][ T5930] R13: 00007fff8eb785a0 R14: 0000000000009e31 R15: 0000200000000000
[ 89.361632][ T5930]
[ 89.364899][ T5930] Kernel Offset: disabled
[ 89.369207][ T5930] Rebooting in 86400 seconds..