Warning: Permanently added '[localhost]:57489' (ED25519) to the list of known hosts.
2026/10/22 03:04:26 parsed 1 programs
2026/10/22 03:04:26 serving rpc on tcp://44661
syzkaller login: [ 92.011115][ T1195] cfg80211: failed to load regulatory.db
qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x400000)
[ 92.971658][ T1025] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1
[ 92.971677][ T1025] ata1: failed to read log page 10h (errno=-5)
[ 92.971688][ T1025] ata1.00: NCQ disabled due to excessive errors
[ 92.971696][ T1025] ata1.00: exception Emask 0x1 SAct 0x18000000 SErr 0x0 action 0x0
[ 92.971708][ T1025] ata1.00: irq_stat 0x41000000
[ 92.971720][ T1025] ata1.00: failed command: WRITE FPDMA QUEUED
[ 92.971727][ T1025] ata1.00: cmd 61/00:d8:36:a1:04/20:00:00:00:00/40 tag 27 ncq dma 4194304 ou
[ 92.971727][ T1025] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 92.971753][ T1025] ata1.00: status: { DRDY }
[ 92.971759][ T1025] ata1.00: failed command: WRITE FPDMA QUEUED
[ 92.971763][ T1025] ata1.00: cmd 61/00:e0:36:c1:04/20:00:00:00:00/40 tag 28 ncq dma 4194304 ou
[ 92.971763][ T1025] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 92.971785][ T1025] ata1.00: status: { DRDY }
[ 92.972769][ T1025] ata1.00: configured for UDMA/100
[ 92.973399][ T1025] ata1: EH complete
[ 93.021617][ T1025] ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0
[ 93.021636][ T1025] ata1.00: irq_stat 0x40000000
[ 93.021647][ T1025] ata1.00: failed command: WRITE DMA EXT
[ 93.021654][ T1025] ata1.00: cmd 35/00:00:36:a1:04/00:20:00:00:00/e0 tag 30 dma 4194304 out
[ 93.021654][ T1025] res 41/04:00:36:a1:04/00:20:00:00:00/e0 Emask 0x1 (device error)
[ 93.021683][ T1025] ata1.00: status: { DRDY ERR }
[ 93.021690][ T1025] ata1.00: error: { ABRT }
[ 93.025842][ T1025] ata1.00: configured for UDMA/100
[ 93.025959][ T1025] ata1: EH complete
[ 94.381576][ T5293] cgroup: Unknown subsys name 'net'
[ 94.453481][ T5293] cgroup: Unknown subsys name 'cpuset'
[ 94.462038][ T5293] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 96.069594][ T5293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 98.087923][ T1025] ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0
[ 98.087946][ T1025] ata1.00: irq_stat 0x40000000
[ 98.087957][ T1025] ata1.00: failed command: WRITE DMA EXT
[ 98.087965][ T1025] ata1.00: cmd 35/00:28:36:e1:04/00:08:00:00:00/e0 tag 14 dma 1069056 out
[ 98.087965][ T1025] res 41/04:28:36:e1:04/00:08:00:00:00/e0 Emask 0x1 (device error)
[ 98.087997][ T1025] ata1.00: status: { DRDY ERR }
[ 98.088005][ T1025] ata1.00: error: { ABRT }
[ 98.089396][ T1025] ata1.00: configured for UDMA/100
[ 98.090662][ T1025] ata1: EH complete
[ 101.904481][ T5308] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 107.708199][ T5355] rxe_eth0 speed is unknown, defaulting to 1000
[ 107.711906][ T5355] rxe_eth0 speed is unknown, defaulting to 1000
[ 107.714014][ T5355] rxe_eth0 speed is unknown, defaulting to 1000
[ 108.096003][ T9] rxe_eth0 speed is unknown, defaulting to 1000
[ 108.101796][ T5355] infiniband rxe0: set active
[ 108.101812][ T5355] infiniband rxe0: added rxe_eth0
[ 108.136121][ T5355] smbdirect: ib_dev[rxe0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000
[ 108.136151][ T5355] smbdirect: ib_dev[rxe0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32
[ 108.136199][ T5355] smbdirect: ib_dev[rxe0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005
[ 108.229117][ T5355] RDS/IB: rxe0: added
[ 108.229425][ T5355] smc: adding ib device rxe0 with port count 1
[ 108.229487][ T5355] smc: ib device rxe0 port 1 has no pnetid
[ 108.230450][ T9] rxe_eth0 speed is unknown, defaulting to 1000
[ 108.288398][ T5355] rxe_eth0 speed is unknown, defaulting to 1000
[ 109.013970][ T5355] bridge0: port 1(bridge_slave_0) entered blocking state
[ 109.014046][ T5355] bridge0: port 1(bridge_slave_0) entered disabled state
[ 109.014173][ T5355] bridge_slave_0: entered allmulticast mode
[ 109.017164][ T5355] bridge_slave_0: entered promiscuous mode
[ 109.039773][ T5355] bridge0: port 2(bridge_slave_1) entered blocking state
[ 109.039839][ T5355] bridge0: port 2(bridge_slave_1) entered disabled state
[ 109.039949][ T5355] bridge_slave_1: entered allmulticast mode
[ 109.044347][ T5355] bridge_slave_1: entered promiscuous mode
[ 109.109061][ T5355] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 109.113483][ T5355] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 109.170331][ T5355] team0: Port device team_slave_0 added
[ 109.175073][ T5355] team0: Port device team_slave_1 added
[ 109.205520][ T5355] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 109.205535][ T5355] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 109.205549][ T5355] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 109.226813][ T5355] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 109.226826][ T5355] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 109.226840][ T5355] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 109.297332][ T5355] hsr_slave_0: entered promiscuous mode
[ 109.302563][ T5355] hsr_slave_1: entered promiscuous mode
[ 109.682738][ T5355] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 109.754387][ T5355] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 109.776054][ T5355] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 109.790389][ T5355] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 109.792630][ T5355] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 109.810188][ T5355] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 109.813067][ T5355] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 109.830694][ T5355] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 110.035732][ T5355] 8021q: adding VLAN 0 to HW filter on device bond0
[ 110.078662][ T5355] 8021q: adding VLAN 0 to HW filter on device team0
[ 110.094162][ T55] bridge0: port 1(bridge_slave_0) entered blocking state
[ 110.094284][ T55] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 110.129053][ T13] bridge0: port 2(bridge_slave_1) entered blocking state
[ 110.129134][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 110.790327][ T5355] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 110.844320][ T5355] veth0_vlan: entered promiscuous mode
[ 110.855926][ T5355] veth1_vlan: entered promiscuous mode
[ 110.894010][ T5355] veth0_macvtap: entered promiscuous mode
[ 110.901898][ T5355] veth1_macvtap: entered promiscuous mode
[ 110.921766][ T5355] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 110.935390][ T5355] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 110.989596][ T1059] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 110.989969][ T1059] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 110.989994][ T1059] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 110.990017][ T1059] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 111.249750][ T55] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 111.324675][ T5395] rxe_eth0 speed is unknown, defaulting to 1000
[ 111.859065][ T5400] rxe_eth0 speed is unknown, defaulting to 1000
[ 112.060753][ T55] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 112.170371][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 112.170390][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 112.232464][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 112.232482][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 112.365230][ T5405] rxe_eth0 speed is unknown, defaulting to 1000
[ 112.646304][ T5411] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 112.651642][ T5411] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 112.657324][ T5411] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 112.661639][ T5411] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 112.662197][ T5411] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 112.707256][ T5410] rxe_eth0 speed is unknown, defaulting to 1000
[ 112.800852][ T55] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 113.036773][ T5417] rxe_eth0 speed is unknown, defaulting to 1000
[ 113.568335][ T55] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 113.840215][ T55] bridge_slave_1: left allmulticast mode
[ 113.840254][ T55] bridge_slave_1: left promiscuous mode
[ 113.850190][ T55] bridge0: port 2(bridge_slave_1) entered disabled state
[ 113.892867][ T55] bridge_slave_0: left allmulticast mode
[ 113.892891][ T55] bridge_slave_0: left promiscuous mode
[ 113.893028][ T55] bridge0: port 1(bridge_slave_0) entered disabled state
2026/10/22 03:04:49 executed programs: 0
[ 114.285876][ T55] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 114.311111][ T5411] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 114.313573][ T55] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 114.313842][ T5411] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 114.314359][ T5411] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 114.314970][ T5411] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 114.316939][ T5411] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 114.341742][ T55] bond0 (unregistering): Released all slaves
[ 114.931783][ T55] hsr_slave_0: left promiscuous mode
[ 114.933240][ T55] hsr_slave_1: left promiscuous mode
[ 114.934063][ T55] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 114.934084][ T55] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 114.936863][ T55] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 114.936878][ T55] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 114.978435][ T55] veth1_macvtap: left promiscuous mode
[ 114.978508][ T55] veth0_macvtap: left promiscuous mode
[ 114.978618][ T55] veth1_vlan: left promiscuous mode
[ 114.978696][ T55] veth0_vlan: left promiscuous mode
[ 115.318704][ T55] team0 (unregistering): Port device team_slave_1 removed
[ 115.326661][ T55] team0 (unregistering): Port device team_slave_0 removed
[ 115.454858][ T4995] 8021q: adding VLAN 0 to HW filter on device eth2
[ 116.163328][ T4995] 8021q: adding VLAN 0 to HW filter on device eth3
[ 116.233929][ T5423] rxe_eth0 speed is unknown, defaulting to 1000
[ 116.400146][ T5411] Bluetooth: hci0: command tx timeout
[ 116.929022][ T4995] 8021q: adding VLAN 0 to HW filter on device eth4
[ 117.922664][ T5423] bridge0: port 1(bridge_slave_0) entered blocking state
[ 117.924369][ T5423] bridge0: port 1(bridge_slave_0) entered disabled state
[ 117.924474][ T5423] bridge_slave_0: entered allmulticast mode
[ 117.941496][ T5423] bridge_slave_0: entered promiscuous mode
[ 117.956842][ T5423] bridge0: port 2(bridge_slave_1) entered blocking state
[ 117.959690][ T5423] bridge0: port 2(bridge_slave_1) entered disabled state
[ 117.959802][ T5423] bridge_slave_1: entered allmulticast mode
[ 117.966164][ T5423] bridge_slave_1: entered promiscuous mode
[ 118.114497][ T4995] 8021q: adding VLAN 0 to HW filter on device eth5
[ 118.134086][ T5423] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 118.152634][ T5423] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 118.282446][ T5423] team0: Port device team_slave_0 added
[ 118.303585][ T5423] team0: Port device team_slave_1 added
[ 118.436623][ T5423] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 118.436639][ T5423] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 118.436654][ T5423] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 118.468898][ T5423] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 118.468913][ T5423] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 118.468931][ T5423] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 118.479708][ T5411] Bluetooth: hci0: command tx timeout
[ 118.693096][ T5423] hsr_slave_0: entered promiscuous mode
[ 118.694731][ T5423] hsr_slave_1: entered promiscuous mode
[ 119.364715][ T5423] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 119.377035][ T5423] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 119.382855][ T5423] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 119.397320][ T5423] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 119.403118][ T5423] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 119.415219][ T5423] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 119.416879][ T5423] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 119.430781][ T5423] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 119.579872][ T5423] 8021q: adding VLAN 0 to HW filter on device bond0
[ 119.609090][ T5423] 8021q: adding VLAN 0 to HW filter on device team0
[ 119.623339][ T55] bridge0: port 1(bridge_slave_0) entered blocking state
[ 119.623446][ T55] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 119.647022][ T55] bridge0: port 2(bridge_slave_1) entered blocking state
[ 119.647120][ T55] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 120.404613][ T5423] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 120.488332][ T5423] veth0_vlan: entered promiscuous mode
[ 120.488651][ T1195] rxe_eth0 speed is unknown, defaulting to 1000
[ 120.510398][ T5423] veth1_vlan: entered promiscuous mode
[ 120.557820][ T5411] Bluetooth: hci0: command tx timeout
[ 120.559440][ T5423] veth0_macvtap: entered promiscuous mode
[ 120.579182][ T5423] veth1_macvtap: entered promiscuous mode
[ 120.605149][ T5423] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 120.627305][ T5423] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 120.698955][ T55] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 120.698987][ T55] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 120.699005][ T55] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 120.699022][ T55] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 120.863915][ T55] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 120.863935][ T55] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 120.938547][ T55] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 120.938564][ T55] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
2026/10/22 03:04:56 executed programs: 2
[ 121.127642][ T5513] ==================================================================
[ 121.127655][ T5513] BUG: KASAN: slab-use-after-free in pool_ctr+0x874/0xd60
[ 121.127931][ T5513] Read of size 8 at addr ffff88803fdba718 by task syz.0.17/5513
[ 121.127942][ T5513]
[ 121.127960][ T5513] CPU: 0 UID: 0 PID: 5513 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 121.127973][ T5513] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 121.127980][ T5513] Call Trace:
[ 121.127986][ T5513]
[ 121.127991][ T5513] dump_stack_lvl+0xe8/0x150
[ 121.128129][ T5513] print_address_description+0x55/0x1e0
[ 121.128153][ T5513] ? pool_ctr+0x874/0xd60
[ 121.128168][ T5513] print_report+0x58/0x70
[ 121.128182][ T5513] kasan_report+0x117/0x150
[ 121.128246][ T5513] ? pool_ctr+0x874/0xd60
[ 121.128262][ T5513] pool_ctr+0x874/0xd60
[ 121.128280][ T5513] ? __pfx_pool_ctr+0x10/0x10
[ 121.128295][ T5513] ? rcu_is_watching+0x16/0xb0
[ 121.128359][ T5513] ? kfree+0x4d/0x650
[ 121.128381][ T5513] ? skip_spaces+0x8a/0xa0
[ 121.128510][ T5513] ? dm_split_args+0x50b/0x5d0
[ 121.128545][ T5513] dm_table_add_target+0x58d/0xc70
[ 121.128560][ T5513] table_load+0x325/0x8a0
[ 121.128570][ T5513] ? __pfx_table_load+0x10/0x10
[ 121.128579][ T5513] dm_ctl_ioctl+0x9ec/0xe10
[ 121.128590][ T5513] ? __pfx_table_load+0x10/0x10
[ 121.128596][ T5513] ? __pfx_dm_ctl_ioctl+0x10/0x10
[ 121.128611][ T5513] ? __pfx___se_sys_futex+0x10/0x10
[ 121.128630][ T5513] ? bpf_lsm_file_ioctl+0x9/0x20
[ 121.128648][ T5513] ? __pfx_dm_ctl_ioctl+0x10/0x10
[ 121.128659][ T5513] __se_sys_ioctl+0xfc/0x170
[ 121.128685][ T5513] do_syscall_64+0x166/0x520
[ 121.128754][ T5513] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 121.128765][ T5513] ? clear_bhb_loop+0x70/0xc0
[ 121.128773][ T5513] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 121.128780][ T5513] RIP: 0033:0x7f93a9b9f559
[ 121.128802][ T5513] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 121.128825][ T5513] RSP: 002b:00007ffda4ebf178 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 121.128839][ T5513] RAX: ffffffffffffffda RBX: 00007f93a9e25fa0 RCX: 00007f93a9b9f559
[ 121.128848][ T5513] RDX: 00002000000003c0 RSI: 00000000c138fd09 RDI: 0000000000000003
[ 121.128856][ T5513] RBP: 00007f93a9c36b20 R08: 0000000000000000 R09: 0000000000000000
[ 121.128864][ T5513] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 121.128871][ T5513] R13: 00007f93a9e25fac R14: 00007f93a9e25fa0 R15: 00007f93a9e25fa0
[ 121.128895][ T5513]
[ 121.128899][ T5513]
[ 121.128902][ T5513] Allocated by task 5513:
[ 121.128920][ T5513] kasan_save_track+0x3e/0x80
[ 121.128931][ T5513] __kasan_kmalloc+0x93/0xb0
[ 121.128942][ T5513] __kmalloc_cache_node_noprof+0x3cc/0x620
[ 121.128959][ T5513] dm_get_table_device+0x23e/0x730
[ 121.128971][ T5513] dm_get_device+0x327/0x760
[ 121.128980][ T5513] pool_ctr+0x4ae/0xd60
[ 121.128994][ T5513] dm_table_add_target+0x58d/0xc70
[ 121.129004][ T5513] table_load+0x325/0x8a0
[ 121.129013][ T5513] dm_ctl_ioctl+0x9ec/0xe10
[ 121.129027][ T5513] __se_sys_ioctl+0xfc/0x170
[ 121.129036][ T5513] do_syscall_64+0x166/0x520
[ 121.129049][ T5513] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 121.129059][ T5513]
[ 121.129061][ T5513] Freed by task 5513:
[ 121.129067][ T5513] kasan_save_track+0x3e/0x80
[ 121.129076][ T5513] kasan_save_free_info+0x40/0x50
[ 121.129089][ T5513] __kasan_slab_free+0x5c/0x80
[ 121.129099][ T5513] kfree+0x1c5/0x650
[ 121.129112][ T5513] dm_put_table_device+0x255/0x2a0
[ 121.129123][ T5513] dm_get_device+0x56f/0x760
[ 121.129138][ T5513] pool_ctr+0x585/0xd60
[ 121.129151][ T5513] dm_table_add_target+0x58d/0xc70
[ 121.129157][ T5513] table_load+0x325/0x8a0
[ 121.129162][ T5513] dm_ctl_ioctl+0x9ec/0xe10
[ 121.129171][ T5513] __se_sys_ioctl+0xfc/0x170
[ 121.129177][ T5513] do_syscall_64+0x166/0x520
[ 121.129184][ T5513] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 121.129191][ T5513]
[ 121.129193][ T5513] The buggy address belongs to the object at ffff88803fdba700
[ 121.129193][ T5513] which belongs to the cache kmalloc-96 of size 96
[ 121.129199][ T5513] The buggy address is located 24 bytes inside of
[ 121.129199][ T5513] freed 96-byte region [ffff88803fdba700, ffff88803fdba760)
[ 121.129206][ T5513]
[ 121.129208][ T5513] The buggy address belongs to the physical page:
[ 121.129213][ T5513] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3fdba
[ 121.129221][ T5513] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 121.129229][ T5513] page_type: f5(slab)
[ 121.129236][ T5513] raw: 04fff00000000000 ffff88801c041280 dead000000000100 dead000000000122
[ 121.129243][ T5513] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000
[ 121.129248][ T5513] page dumped because: kasan: bad access detected
[ 121.129254][ T5513] page_owner tracks the page as allocated
[ 121.129258][ T5513] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 26883178518
[ 121.129275][ T5513] post_alloc_hook+0x1f9/0x250
[ 121.129290][ T5513] get_page_from_freelist+0x2209/0x2280
[ 121.129300][ T5513] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 121.129310][ T5513] allocate_slab+0x7d/0x620
[ 121.129322][ T5513] refill_objects+0x2d5/0x350
[ 121.129334][ T5513] __pcs_replace_empty_main+0x2c8/0x6c0
[ 121.129342][ T5513] __kmalloc_cache_noprof+0x396/0x600
[ 121.129352][ T5513] lookup_or_create_module_kobject+0x75/0x170
[ 121.129370][ T5513] module_add_driver+0x79/0x320
[ 121.129416][ T5513] bus_add_driver+0x3e5/0x6e0
[ 121.129458][ T5513] driver_register+0x23a/0x320
[ 121.129467][ T5513] __hid_register_driver+0x12a/0x170
[ 121.129505][ T5513] do_one_initcall+0x250/0x870
[ 121.129515][ T5513] do_initcall_level+0x10a/0x1a0
[ 121.129597][ T5513] do_initcalls+0x59/0xa0
[ 121.129609][ T5513] kernel_init_freeable+0x29d/0x3e0
[ 121.129623][ T5513] page last free pid 1 tgid 1 ts 26491888841 stack trace:
[ 121.129631][ T5513] free_pages_prepare+0x9eb/0xaf0
[ 121.129644][ T5513] __free_contig_range_common+0x174/0x340
[ 121.129656][ T5513] free_pages_bulk+0x48/0x120
[ 121.129665][ T5513] vfree+0x22c/0x490
[ 121.129689][ T5513] tpg_free+0x9b/0x420
[ 121.129717][ T5513] vivid_dev_release+0xc5/0x120
[ 121.129745][ T5513] v4l2_device_put+0x81/0xd0
[ 121.129756][ T5513] vivid_probe+0x4977/0x70c0
[ 121.129768][ T5513] platform_probe+0xf9/0x190
[ 121.129782][ T5513] really_probe+0x254/0xae0
[ 121.129791][ T5513] __driver_probe_device+0x1e8/0x360
[ 121.129804][ T5513] driver_probe_device+0x4f/0x240
[ 121.129813][ T5513] __driver_attach+0x339/0x600
[ 121.129827][ T5513] bus_for_each_dev+0x23b/0x2c0
[ 121.129838][ T5513] bus_add_driver+0x38f/0x6e0
[ 121.129849][ T5513] driver_register+0x23a/0x320
[ 121.129858][ T5513]
[ 121.129861][ T5513] Memory state around the buggy address:
[ 121.129867][ T5513] ffff88803fdba600: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
[ 121.129874][ T5513] ffff88803fdba680: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 121.129882][ T5513] >ffff88803fdba700: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 121.129887][ T5513] ^
[ 121.129893][ T5513] ffff88803fdba780: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
[ 121.129899][ T5513] ffff88803fdba800: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc
[ 121.129905][ T5513] ==================================================================
[ 121.133050][ T5513] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 121.456769][ T5513] CPU: 0 UID: 0 PID: 5513 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 121.460547][ T5513] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 121.465185][ T5513] Call Trace:
[ 121.466738][ T5513]
[ 121.468030][ T5513] vpanic+0x56d/0xa60
[ 121.469756][ T5513] ? __pfx_vpanic+0x10/0x10
[ 121.471652][ T5513] panic+0xc5/0xd0
[ 121.473349][ T5513] ? __pfx_panic+0x10/0x10
[ 121.475291][ T5513] ? preempt_schedule_thunk+0x16/0x40
[ 121.477527][ T5513] ? pool_ctr+0x874/0xd60
[ 121.479348][ T5513] ? preempt_schedule_thunk+0x16/0x40
[ 121.481584][ T5513] ? pool_ctr+0x874/0xd60
[ 121.483466][ T5513] check_panic_on_warn+0x89/0xb0
[ 121.485731][ T5513] ? pool_ctr+0x874/0xd60
[ 121.487640][ T5513] end_report+0x73/0x170
[ 121.489460][ T5513] ? pool_ctr+0x874/0xd60
[ 121.491371][ T5513] kasan_report+0x128/0x150
[ 121.493377][ T5513] ? pool_ctr+0x874/0xd60
[ 121.495257][ T5513] pool_ctr+0x874/0xd60
[ 121.497120][ T5513] ? __pfx_pool_ctr+0x10/0x10
[ 121.499137][ T5513] ? rcu_is_watching+0x16/0xb0
[ 121.501197][ T5513] ? kfree+0x4d/0x650
[ 121.502919][ T5513] ? skip_spaces+0x8a/0xa0
[ 121.504918][ T5513] ? dm_split_args+0x50b/0x5d0
[ 121.506986][ T5513] dm_table_add_target+0x58d/0xc70
[ 121.509079][ T5513] table_load+0x325/0x8a0
[ 121.510836][ T5513] ? __pfx_table_load+0x10/0x10
[ 121.512800][ T5513] dm_ctl_ioctl+0x9ec/0xe10
[ 121.514664][ T5513] ? __pfx_table_load+0x10/0x10
[ 121.516687][ T5513] ? __pfx_dm_ctl_ioctl+0x10/0x10
[ 121.518818][ T5513] ? __pfx___se_sys_futex+0x10/0x10
[ 121.521115][ T5513] ? bpf_lsm_file_ioctl+0x9/0x20
[ 121.523315][ T5513] ? __pfx_dm_ctl_ioctl+0x10/0x10
[ 121.525649][ T5513] __se_sys_ioctl+0xfc/0x170
[ 121.527697][ T5513] do_syscall_64+0x166/0x520
[ 121.529765][ T5513] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 121.532423][ T5513] ? clear_bhb_loop+0x70/0xc0
[ 121.534548][ T5513] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 121.537577][ T5513] RIP: 0033:0x7f93a9b9f559
[ 121.539760][ T5513] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 121.547778][ T5513] RSP: 002b:00007ffda4ebf178 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 121.551242][ T5513] RAX: ffffffffffffffda RBX: 00007f93a9e25fa0 RCX: 00007f93a9b9f559
[ 121.554571][ T5513] RDX: 00002000000003c0 RSI: 00000000c138fd09 RDI: 0000000000000003
[ 121.557935][ T5513] RBP: 00007f93a9c36b20 R08: 0000000000000000 R09: 0000000000000000
[ 121.561230][ T5513] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 121.564539][ T5513] R13: 00007f93a9e25fac R14: 00007f93a9e25fa0 R15: 00007f93a9e25fa0
[ 121.567755][ T5513]
[ 121.581358][ T5513] Kernel Offset: disabled
[ 121.583405][ T5513] Rebooting in 86400 seconds..
VM DIAGNOSIS:
03:04:56 Registers:
info registers vcpu 0
CPU#0
RAX=1ffffffff37acc60 RBX=00000000000003fd RCX=0000000000000000 RDX=00000000000003fd
RSI=0000000000000000 RDI=0000000000000020 RBP=dffffc0000000000 RSP=ffffc9000424ee58
R8 =0000000000000003 R9 =0000000000000004 R10=dffffc0000000000 R11=ffffffff8577d410
R12=dffffc0000000000 R13=0000000000000000 R14=ffffffff9bd66560 R15=0000000000000000
RIP=ffffffff8577d487 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000555577d1a500 ffffffff 00c00000
GS =0000 ffff88808b0a5000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007f996b343feb CR3=0000000014840000 CR4=00352ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=0000000001000811 Opmask01=000000000000001c Opmask02=000000000000001f Opmask03=0000000000000000
Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000100008781
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 68642f62696c2f87
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffffffff 0f0e0d0c0b0a0908
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000100008781
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f996b188d48
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00005576ae5b77a0
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2f2f2f2f2f2f2f2f 2f2f2f2f2f2f2f2f 2f2f2f2f2f2f2f2f 2f2f2f2f2f2f2f2f
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6f7365722d30322f 736b6f6f682d6463 706368642f646370 6368642f62696c2f
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 405c4a5d021f1d00 5c44404047024b4c 5f4c474b004b4c5f 4c474b004d464300
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 20343031203d8120 3f812481205b8120 7c7c2031263e3220 6c6c756e2f766564
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00005576ae5bdb58 0000000000000000 000000000000000f 0000000000875d81
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000