Warning: Permanently added '10.128.0.135' (ED25519) to the list of known hosts. 2026/07/04 21:59:28 parsed 1 programs 2026/07/04 21:59:28 serving rpc on tcp://38957 [ 63.157609][ T4197] cgroup: Unknown subsys name 'net' [ 63.298817][ T4197] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 64.547127][ T4197] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 65.772581][ T4211] chnl_net:caif_netlink_parms(): no params data found [ 65.812088][ T4211] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.819764][ T4211] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.828074][ T4211] device bridge_slave_0 entered promiscuous mode [ 65.837019][ T4211] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.844240][ T4211] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.851880][ T4211] device bridge_slave_1 entered promiscuous mode [ 65.870148][ T4211] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.881403][ T4211] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.902065][ T4211] team0: Port device team_slave_0 added [ 65.909455][ T4211] team0: Port device team_slave_1 added [ 65.924069][ T4211] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 65.931800][ T4211] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.958153][ T4211] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 65.970606][ T4211] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 65.977623][ T4211] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.003563][ T4211] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 66.031613][ T4211] device hsr_slave_0 entered promiscuous mode [ 66.039353][ T4211] device hsr_slave_1 entered promiscuous mode [ 66.125032][ T4211] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 66.135302][ T4211] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 66.145351][ T4211] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 66.154544][ T4211] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 66.175307][ T4211] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.182528][ T4211] bridge0: port 2(bridge_slave_1) entered forwarding state [ 66.190553][ T4211] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.197752][ T4211] bridge0: port 1(bridge_slave_0) entered forwarding state [ 66.233670][ T4211] 8021q: adding VLAN 0 to HW filter on device bond0 [ 66.246873][ T785] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 66.257234][ T785] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.265961][ T785] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.274586][ T785] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 66.288765][ T4211] 8021q: adding VLAN 0 to HW filter on device team0 [ 66.299365][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 66.308223][ T154] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.315314][ T154] bridge0: port 1(bridge_slave_0) entered forwarding state [ 66.327435][ T3053] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 66.336656][ T3053] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.343948][ T3053] bridge0: port 2(bridge_slave_1) entered forwarding state [ 66.362260][ T3053] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 66.379759][ T3053] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 66.388197][ T3053] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 66.396885][ T3053] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 66.407022][ T3053] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 66.417169][ T4211] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 66.488523][ T3053] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 66.496421][ T3053] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 66.508409][ T4211] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 66.525953][ T785] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 66.543582][ T785] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 66.552314][ T785] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 66.560350][ T785] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 66.570550][ T4211] device veth0_vlan entered promiscuous mode [ 66.581842][ T4211] device veth1_vlan entered promiscuous mode [ 66.599774][ T785] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 66.608044][ T785] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 66.616593][ T785] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 66.626815][ T4211] device veth0_macvtap entered promiscuous mode [ 66.636600][ T4211] device veth1_macvtap entered promiscuous mode [ 66.651963][ T4211] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 66.661174][ T785] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 66.670314][ T785] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 66.681569][ T4211] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 66.689522][ T785] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 66.700934][ T4211] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.710190][ T4211] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.719394][ T4211] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.728236][ T4211] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.842702][ T4211] syz-executor (4211) used greatest stack depth: 21104 bytes left [ 66.873623][ T154] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 69.900751][ T154] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 71.376603][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.383242][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 72.339047][ T154] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 72.380931][ T154] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 72.949880][ T785] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.960180][ T785] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.983842][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 73.005298][ T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.013170][ T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.022673][ T785] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 73.201212][ T154] device hsr_slave_0 left promiscuous mode [ 73.226359][ T154] device hsr_slave_1 left promiscuous mode [ 73.233159][ T154] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 73.252457][ T154] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 73.263273][ T154] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 73.271018][ T154] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 73.284743][ T154] device bridge_slave_1 left promiscuous mode [ 73.291803][ T154] bridge0: port 2(bridge_slave_1) entered disabled state [ 73.311107][ T154] device bridge_slave_0 left promiscuous mode [ 73.317603][ T154] bridge0: port 1(bridge_slave_0) entered disabled state [ 73.339688][ T154] device veth1_macvtap left promiscuous mode [ 73.347354][ T154] device veth0_macvtap left promiscuous mode [ 73.353440][ T154] device veth1_vlan left promiscuous mode [ 73.359529][ T154] device veth0_vlan left promiscuous mode [ 73.487069][ T154] team0 (unregistering): Port device team_slave_1 removed [ 73.500377][ T154] team0 (unregistering): Port device team_slave_0 removed [ 73.513111][ T154] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 73.527784][ T154] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 73.572929][ T154] bond0 (unregistering): Released all slaves 2026/07/04 21:59:42 executed programs: 0 [ 76.206058][ T4389] chnl_net:caif_netlink_parms(): no params data found [ 76.291482][ T4389] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.300597][ T4389] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.308850][ T4389] device bridge_slave_0 entered promiscuous mode [ 76.318323][ T4389] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.325567][ T4389] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.333614][ T4389] device bridge_slave_1 entered promiscuous mode [ 76.359434][ T4389] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 76.372068][ T4389] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 76.394628][ T4389] team0: Port device team_slave_0 added [ 76.402711][ T4389] team0: Port device team_slave_1 added [ 76.420438][ T4389] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 76.427492][ T4389] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 76.453914][ T4389] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 76.466344][ T4389] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 76.473305][ T4389] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 76.499426][ T4389] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 76.534673][ T4389] device hsr_slave_0 entered promiscuous mode [ 76.541530][ T4389] device hsr_slave_1 entered promiscuous mode [ 76.998902][ T4389] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 77.045517][ T4389] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 77.055371][ T4389] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 77.065812][ T4389] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 77.090476][ T4389] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.097746][ T4389] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.105195][ T4389] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.112285][ T4389] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.168544][ T3053] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.177818][ T3053] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.253086][ T4389] 8021q: adding VLAN 0 to HW filter on device bond0 [ 77.270953][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 77.284700][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 77.295864][ T4389] 8021q: adding VLAN 0 to HW filter on device team0 [ 77.340611][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 77.349831][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 77.359831][ T144] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.367209][ T144] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.378511][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 77.387603][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 77.396354][ T144] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.403403][ T144] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.417308][ T3053] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 77.429891][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 77.470383][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 77.479139][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 77.493048][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 77.501982][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 77.511928][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 77.530824][ T4389] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 77.542581][ T4389] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 77.556951][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 77.566858][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 77.577457][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 77.586729][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 77.600474][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 77.788339][ T4389] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.798918][ T3053] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 77.807166][ T3053] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 77.826912][ T3053] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 77.837681][ T3053] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 77.878190][ T3053] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 77.887619][ T3053] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 77.897201][ T3053] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 77.908326][ T3053] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 77.919365][ T4389] device veth0_vlan entered promiscuous mode [ 77.936511][ T4389] device veth1_vlan entered promiscuous mode [ 77.968123][ T3053] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 77.977414][ T3053] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 77.986986][ T3053] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 77.996669][ T3053] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 78.008868][ T4389] device veth0_macvtap entered promiscuous mode [ 78.073267][ T4389] device veth1_macvtap entered promiscuous mode [ 78.094702][ T23] Bluetooth: hci0: command 0x0409 tx timeout [ 78.106074][ T4389] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.113426][ T3053] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 78.123453][ T3053] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 78.132912][ T3053] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 78.141926][ T3053] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 78.158985][ T4389] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.168916][ T3053] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 78.180044][ T3053] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 78.192164][ T4389] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.202176][ T4389] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.211976][ T4389] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.222699][ T4389] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.348889][ T3053] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.362213][ T3053] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.396422][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 78.411130][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.420184][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.430638][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 78.871663][ T4509] loop0: detected capacity change from 0 to 32768 [ 78.917491][ T4509] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 78.926094][ T4509] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 78.964568][ T4509] gfs2: fsid=syz:syz.0: journal 0 mapped with 5 extents in 0ms [ 78.989363][ T4494] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 79.006772][ T4494] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 79.055861][ T4494] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 49ms [ 79.085464][ T4494] gfs2: fsid=syz:syz.0: jid=0: Done [ 79.091519][ T4509] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 79.254283][ T4509] gfs2: fsid=syz:syz.0: found 1 quota changes [ 79.297811][ T4389] gfs2: fsid=syz:syz.0: fatal: filesystem consistency error [ 79.297811][ T4389] inode = 11 2339 [ 79.297811][ T4389] function = gfs2_dinode_in, file = fs/gfs2/glops.c, line = 414 [ 79.343852][ T4389] gfs2: fsid=syz:syz.0: about to withdraw this file system [ 79.385377][ T4389] gfs2: fsid=syz:syz.0: warning: assertion "!qd->qd_change" failed at function = gfs2_quota_cleanup, file = fs/gfs2/quota.c, line = 1485 [ 79.414161][ T4389] CPU: 1 PID: 4389 Comm: syz-executor Not tainted syzkaller #0 [ 79.421748][ T4389] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 79.431822][ T4389] Call Trace: [ 79.435114][ T4389] [ 79.438054][ T4389] dump_stack_lvl+0x188/0x250 [ 79.442763][ T4389] ? show_regs_print_info+0x20/0x20 [ 79.447983][ T4389] ? load_image+0x410/0x410 [ 79.452515][ T4389] ? do_raw_spin_unlock+0x11d/0x230 [ 79.457749][ T4389] gfs2_assert_warn_i+0x187/0x2c0 [ 79.462800][ T4389] gfs2_quota_cleanup+0x48c/0x670 [ 79.467847][ T4389] gfs2_make_fs_ro+0x440/0x620 [ 79.472637][ T4389] ? __might_sleep+0xf0/0xf0 [ 79.477240][ T4389] ? gfs2_dinode_out+0xb00/0xb00 [ 79.482200][ T4389] ? _raw_spin_unlock+0x24/0x40 [ 79.487333][ T4389] ? gfs2_glock_nq+0xcaa/0x1510 [ 79.492387][ T4389] gfs2_withdraw+0x660/0x14e0 [ 79.497093][ T4389] ? gfs2_meta_new+0x160/0x160 [ 79.501895][ T4389] ? gfs2_lm+0x240/0x240 [ 79.506152][ T4389] ? gfs2_freeze_lock+0x52/0xc0 [ 79.511020][ T4389] ? gfs2_consist_inode_i+0xc0/0xe0 [ 79.516242][ T4389] gfs2_inode_refresh+0xb2d/0x11a0 [ 79.521566][ T4389] ? gfs2_inode_metasync+0xf0/0xf0 [ 79.526709][ T4389] inode_go_lock+0x127/0x450 [ 79.531321][ T4389] do_promote+0x75b/0xb20 [ 79.535679][ T4389] finish_xmote+0x4c2/0xaf0 [ 79.540319][ T4389] do_xmote+0x752/0x10a0 [ 79.544585][ T4389] gfs2_glock_nq+0xc6b/0x1510 [ 79.549296][ T4389] do_sync+0x49c/0xba0 [ 79.553447][ T4389] ? slot_put+0x1e0/0x1e0 [ 79.557800][ T4389] ? do_sync+0x494/0xba0 [ 79.562179][ T4389] ? do_raw_spin_unlock+0x11d/0x230 [ 79.567412][ T4389] gfs2_quota_sync+0x355/0x780 [ 79.572208][ T4389] gfs2_sync_fs+0x48/0xb0 [ 79.576563][ T4389] sync_filesystem+0xe6/0x220 [ 79.581287][ T4389] generic_shutdown_super+0x6b/0x300 [ 79.586774][ T4389] kill_block_super+0x7c/0xe0 [ 79.591486][ T4389] deactivate_locked_super+0x93/0xf0 [ 79.596802][ T4389] cleanup_mnt+0x426/0x4d0 [ 79.601418][ T4389] task_work_run+0x125/0x1a0 [ 79.606032][ T4389] exit_to_user_mode_loop+0x10f/0x130 [ 79.611419][ T4389] exit_to_user_mode_prepare+0xee/0x180 [ 79.616987][ T4389] syscall_exit_to_user_mode+0x16/0x40 [ 79.622465][ T4389] do_syscall_64+0x58/0xa0 [ 79.626898][ T4389] ? clear_bhb_loop+0x30/0x80 [ 79.631710][ T4389] ? clear_bhb_loop+0x30/0x80 [ 79.636539][ T4389] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 79.642570][ T4389] RIP: 0033:0x7f214d309097 [ 79.647119][ T4389] Code: a2 c7 05 5c 26 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 79.666736][ T4389] RSP: 002b:00007ffe46f2c978 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 79.675166][ T4389] RAX: 0000000000000000 RBX: 00007f214d39d2ca RCX: 00007f214d309097 [ 79.683243][ T4389] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe46f2ca30 [ 79.691237][ T4389] RBP: 00007ffe46f2ca30 R08: 00007ffe46f2da30 R09: 00000000ffffffff [ 79.699228][ T4389] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe46f2dac0 [ 79.707214][ T4389] R13: 00007f214d39d2ca R14: 0000000000013281 R15: 00007ffe46f2db00 [ 79.715225][ T4389] [ 80.021962][ T4389] gfs2: fsid=syz:syz.0: Journal recovery skipped for jid 0 until next mount. [ 80.031006][ T4389] gfs2: fsid=syz:syz.0: Glock dequeues delayed: 0 [ 80.042646][ T4389] gfs2: fsid=syz:syz.0: File system withdrawn [ 80.054911][ T4389] CPU: 0 PID: 4389 Comm: syz-executor Not tainted syzkaller #0 [ 80.062494][ T4389] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 80.072636][ T4389] Call Trace: [ 80.075912][ T4389] [ 80.078835][ T4389] dump_stack_lvl+0x188/0x250 [ 80.083610][ T4389] ? show_regs_print_info+0x20/0x20 [ 80.088839][ T4389] ? load_image+0x410/0x410 [ 80.093431][ T4389] ? lockref_put_or_lock+0x6e/0xb0 [ 80.098547][ T4389] gfs2_withdraw+0xb9a/0x14e0 [ 80.103239][ T4389] ? gfs2_meta_new+0x160/0x160 [ 80.107990][ T4389] ? gfs2_lm+0x240/0x240 [ 80.112348][ T4389] ? gfs2_consist_inode_i+0xc0/0xe0 [ 80.117538][ T4389] gfs2_inode_refresh+0xb2d/0x11a0 [ 80.122643][ T4389] ? gfs2_inode_metasync+0xf0/0xf0 [ 80.127755][ T4389] inode_go_lock+0x127/0x450 [ 80.132335][ T4389] do_promote+0x75b/0xb20 [ 80.136656][ T4389] finish_xmote+0x4c2/0xaf0 [ 80.141162][ T4389] do_xmote+0x752/0x10a0 [ 80.145595][ T4389] gfs2_glock_nq+0xc6b/0x1510 [ 80.150273][ T4389] do_sync+0x49c/0xba0 [ 80.154342][ T4389] ? slot_put+0x1e0/0x1e0 [ 80.158666][ T4389] ? do_sync+0x494/0xba0 [ 80.163086][ T4389] ? do_raw_spin_unlock+0x11d/0x230 [ 80.168294][ T4389] gfs2_quota_sync+0x355/0x780 [ 80.173062][ T4389] gfs2_sync_fs+0x48/0xb0 [ 80.177388][ T4389] sync_filesystem+0xe6/0x220 [ 80.182056][ T4389] generic_shutdown_super+0x6b/0x300 [ 80.187452][ T4389] kill_block_super+0x7c/0xe0 [ 80.192329][ T4389] deactivate_locked_super+0x93/0xf0 [ 80.197608][ T4389] cleanup_mnt+0x426/0x4d0 [ 80.202023][ T4389] task_work_run+0x125/0x1a0 [ 80.206641][ T4389] exit_to_user_mode_loop+0x10f/0x130 [ 80.212001][ T4389] exit_to_user_mode_prepare+0xee/0x180 [ 80.217534][ T4389] syscall_exit_to_user_mode+0x16/0x40 [ 80.222980][ T4389] do_syscall_64+0x58/0xa0 [ 80.227388][ T4389] ? clear_bhb_loop+0x30/0x80 [ 80.232145][ T4389] ? clear_bhb_loop+0x30/0x80 [ 80.236811][ T4389] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 80.242694][ T4389] RIP: 0033:0x7f214d309097 [ 80.247099][ T4389] Code: a2 c7 05 5c 26 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 80.266997][ T4389] RSP: 002b:00007ffe46f2c978 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 80.275696][ T4389] RAX: 0000000000000000 RBX: 00007f214d39d2ca RCX: 00007f214d309097 [ 80.283675][ T4389] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe46f2ca30 [ 80.291649][ T4389] RBP: 00007ffe46f2ca30 R08: 00007ffe46f2da30 R09: 00000000ffffffff [ 80.299629][ T4389] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe46f2dac0 [ 80.307592][ T4389] R13: 00007f214d39d2ca R14: 0000000000013281 R15: 00007ffe46f2db00 [ 80.315826][ T4389] [ 80.323132][ T4412] Bluetooth: hci0: command 0x041b tx timeout [ 80.358696][ T4389] ================================================================== [ 80.366970][ T4389] BUG: KASAN: use-after-free in qd_unlock+0x30/0x2d0 [ 80.373672][ T4389] Read of size 8 at addr ffff88806f0de090 by task syz-executor/4389 [ 80.381742][ T4389] [ 80.384069][ T4389] CPU: 0 PID: 4389 Comm: syz-executor Not tainted syzkaller #0 [ 80.391612][ T4389] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 80.401669][ T4389] Call Trace: [ 80.404956][ T4389] [ 80.407902][ T4389] dump_stack_lvl+0x188/0x250 [ 80.412770][ T4389] ? show_regs_print_info+0x20/0x20 [ 80.417985][ T4389] ? load_image+0x410/0x410 [ 80.422496][ T4389] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 80.427985][ T4389] print_address_description+0x60/0x2d0 [ 80.433549][ T4389] ? qd_unlock+0x30/0x2d0 [ 80.437913][ T4389] kasan_report+0xdf/0x130 [ 80.442347][ T4389] ? qd_unlock+0x30/0x2d0 [ 80.446690][ T4389] kasan_check_range+0x235/0x290 [ 80.451644][ T4389] qd_unlock+0x30/0x2d0 [ 80.455906][ T4389] gfs2_quota_sync+0x63b/0x780 [ 80.460790][ T4389] gfs2_sync_fs+0x48/0xb0 [ 80.465144][ T4389] sync_filesystem+0xe6/0x220 [ 80.469837][ T4389] generic_shutdown_super+0x6b/0x300 [ 80.475226][ T4389] kill_block_super+0x7c/0xe0 [ 80.479950][ T4389] deactivate_locked_super+0x93/0xf0 [ 80.485249][ T4389] cleanup_mnt+0x426/0x4d0 [ 80.489697][ T4389] task_work_run+0x125/0x1a0 [ 80.494315][ T4389] exit_to_user_mode_loop+0x10f/0x130 [ 80.499707][ T4389] exit_to_user_mode_prepare+0xee/0x180 [ 80.505275][ T4389] syscall_exit_to_user_mode+0x16/0x40 [ 80.510753][ T4389] do_syscall_64+0x58/0xa0 [ 80.515184][ T4389] ? clear_bhb_loop+0x30/0x80 [ 80.519883][ T4389] ? clear_bhb_loop+0x30/0x80 [ 80.524666][ T4389] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 80.530572][ T4389] RIP: 0033:0x7f214d309097 [ 80.535002][ T4389] Code: a2 c7 05 5c 26 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 80.554741][ T4389] RSP: 002b:00007ffe46f2c978 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 80.563181][ T4389] RAX: 0000000000000000 RBX: 00007f214d39d2ca RCX: 00007f214d309097 [ 80.571169][ T4389] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe46f2ca30 [ 80.579158][ T4389] RBP: 00007ffe46f2ca30 R08: 00007ffe46f2da30 R09: 00000000ffffffff [ 80.587141][ T4389] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe46f2dac0 [ 80.595142][ T4389] R13: 00007f214d39d2ca R14: 0000000000013281 R15: 00007ffe46f2db00 [ 80.603513][ T4389] [ 80.606550][ T4389] [ 80.608881][ T4389] Allocated by task 4509: [ 80.613386][ T4389] __kasan_slab_alloc+0x92/0xc0 [ 80.618257][ T4389] slab_post_alloc_hook+0x4c/0x380 [ 80.623382][ T4389] kmem_cache_alloc+0x15d/0x280 [ 80.628250][ T4389] qd_alloc+0x50/0x260 [ 80.632447][ T4389] gfs2_quota_init+0x74d/0xe80 [ 80.637229][ T4389] gfs2_make_fs_rw+0x41c/0x590 [ 80.642007][ T4389] gfs2_fill_super+0x17d1/0x1ea0 [ 80.646976][ T4389] get_tree_bdev+0x3e6/0x610 [ 80.651581][ T4389] gfs2_get_tree+0x4d/0x1e0 [ 80.656098][ T4389] vfs_get_tree+0x88/0x270 [ 80.660654][ T4389] do_new_mount+0x247/0xa40 [ 80.665357][ T4389] __se_sys_mount+0x2e3/0x3d0 [ 80.670046][ T4389] do_syscall_64+0x4c/0xa0 [ 80.674521][ T4389] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 80.680425][ T4389] [ 80.682767][ T4389] Freed by task 14: [ 80.686578][ T4389] kasan_set_track+0x4b/0x70 [ 80.691179][ T4389] kasan_set_free_info+0x1f/0x40 [ 80.696145][ T4389] ____kasan_slab_free+0xd5/0x110 [ 80.701200][ T4389] slab_free_freelist_hook+0xec/0x170 [ 80.706584][ T4389] kmem_cache_free+0x8f/0x210 [ 80.711271][ T4389] rcu_core+0x96e/0x1650 [ 80.715525][ T4389] handle_softirqs+0x336/0x830 [ 80.720299][ T4389] run_ksoftirqd+0xa4/0x100 [ 80.724825][ T4389] smpboot_thread_fn+0x520/0x990 [ 80.729998][ T4389] kthread+0x42e/0x520 [ 80.734090][ T4389] ret_from_fork+0x1f/0x30 [ 80.738523][ T4389] [ 80.740849][ T4389] Last potentially related work creation: [ 80.746572][ T4389] kasan_save_stack+0x35/0x60 [ 80.751271][ T4389] kasan_record_aux_stack+0xb8/0x100 [ 80.756574][ T4389] call_rcu+0x189/0x900 [ 80.760746][ T4389] gfs2_quota_cleanup+0x414/0x670 [ 80.765781][ T4389] gfs2_make_fs_ro+0x440/0x620 [ 80.770731][ T4389] gfs2_withdraw+0x660/0x14e0 [ 80.775434][ T4389] gfs2_inode_refresh+0xb2d/0x11a0 [ 80.781259][ T4389] inode_go_lock+0x127/0x450 [ 80.786037][ T4389] do_promote+0x75b/0xb20 [ 80.790416][ T4389] finish_xmote+0x4c2/0xaf0 [ 80.794905][ T4389] do_xmote+0x752/0x10a0 [ 80.799142][ T4389] gfs2_glock_nq+0xc6b/0x1510 [ 80.803924][ T4389] do_sync+0x49c/0xba0 [ 80.807999][ T4389] gfs2_quota_sync+0x355/0x780 [ 80.812748][ T4389] gfs2_sync_fs+0x48/0xb0 [ 80.817080][ T4389] sync_filesystem+0xe6/0x220 [ 80.821749][ T4389] generic_shutdown_super+0x6b/0x300 [ 80.827143][ T4389] kill_block_super+0x7c/0xe0 [ 80.831808][ T4389] deactivate_locked_super+0x93/0xf0 [ 80.837077][ T4389] cleanup_mnt+0x426/0x4d0 [ 80.841476][ T4389] task_work_run+0x125/0x1a0 [ 80.846044][ T4389] exit_to_user_mode_loop+0x10f/0x130 [ 80.851663][ T4389] exit_to_user_mode_prepare+0xee/0x180 [ 80.857189][ T4389] syscall_exit_to_user_mode+0x16/0x40 [ 80.862664][ T4389] do_syscall_64+0x58/0xa0 [ 80.867078][ T4389] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 80.872951][ T4389] [ 80.875253][ T4389] The buggy address belongs to the object at ffff88806f0de000 [ 80.875253][ T4389] which belongs to the cache gfs2_quotad of size 272 [ 80.889413][ T4389] The buggy address is located 144 bytes inside of [ 80.889413][ T4389] 272-byte region [ffff88806f0de000, ffff88806f0de110) [ 80.902846][ T4389] The buggy address belongs to the page: [ 80.908483][ T4389] page:ffffea0001bc3780 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6f0de [ 80.918627][ T4389] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 80.926304][ T4389] raw: 00fff00000000200 0000000000000000 dead000000000122 ffff888146d68a00 [ 80.934976][ T4389] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 [ 80.943536][ T4389] page dumped because: kasan: bad access detected [ 80.950084][ T4389] page_owner tracks the page as allocated [ 80.955792][ T4389] page last allocated via order 0, migratetype Reclaimable, gfp_mask 0x112c50(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 4509, ts 79238668059, free_ts 77317769482 [ 80.974966][ T4389] get_page_from_freelist+0x24f6/0x2670 [ 80.980504][ T4389] __alloc_pages+0x1ee/0x480 [ 80.985077][ T4389] new_slab+0xc0/0x4b0 [ 80.989218][ T4389] ___slab_alloc+0x807/0xdd0 [ 80.993976][ T4389] kmem_cache_alloc+0xf0/0x280 [ 80.998721][ T4389] qd_alloc+0x50/0x260 [ 81.002772][ T4389] gfs2_quota_init+0x74d/0xe80 [ 81.008093][ T4389] gfs2_make_fs_rw+0x41c/0x590 [ 81.012905][ T4389] gfs2_fill_super+0x17d1/0x1ea0 [ 81.017943][ T4389] get_tree_bdev+0x3e6/0x610 [ 81.023052][ T4389] gfs2_get_tree+0x4d/0x1e0 [ 81.027568][ T4389] vfs_get_tree+0x88/0x270 [ 81.031979][ T4389] do_new_mount+0x247/0xa40 [ 81.036472][ T4389] __se_sys_mount+0x2e3/0x3d0 [ 81.041143][ T4389] do_syscall_64+0x4c/0xa0 [ 81.045572][ T4389] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 81.051547][ T4389] page last free stack trace: [ 81.056206][ T4389] free_unref_page_prepare+0x637/0x6c0 [ 81.061658][ T4389] free_unref_page+0x8f/0x2a0 [ 81.066326][ T4389] __unfreeze_partials+0x188/0x1e0 [ 81.071426][ T4389] put_cpu_partial+0x12d/0x190 [ 81.077271][ T4389] qlist_free_all+0x35/0x90 [ 81.081765][ T4389] kasan_quarantine_reduce+0x150/0x160 [ 81.087210][ T4389] __kasan_slab_alloc+0x2f/0xc0 [ 81.092093][ T4389] slab_post_alloc_hook+0x4c/0x380 [ 81.097364][ T4389] kmem_cache_alloc_node+0x184/0x2c0 [ 81.102638][ T4389] __alloc_skb+0xf4/0x750 [ 81.107233][ T4389] inet_netconf_notify_devconf+0x16f/0x230 [ 81.113211][ T4389] inetdev_event+0x6f6/0x1350 [ 81.117883][ T4389] raw_notifier_call_chain+0xcb/0x160 [ 81.123253][ T4389] unregister_netdevice_many+0x109b/0x1a40 [ 81.129058][ T4389] ip_tunnel_delete_nets+0x326/0x370 [ 81.135304][ T4389] cleanup_net+0x78e/0xba0 [ 81.139712][ T4389] [ 81.142022][ T4389] Memory state around the buggy address: [ 81.147633][ T4389] ffff88806f0ddf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 81.155774][ T4389] ffff88806f0de000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 81.163829][ T4389] >ffff88806f0de080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 81.171880][ T4389] ^ [ 81.176453][ T4389] ffff88806f0de100: fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 81.184497][ T4389] ffff88806f0de180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 81.192531][ T4389] ================================================================== [ 81.200668][ T4389] Disabling lock debugging due to kernel taint [ 81.207452][ T4389] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 81.214662][ T4389] CPU: 0 PID: 4389 Comm: syz-executor Tainted: G B syzkaller #0 [ 81.223604][ T4389] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 81.233663][ T4389] Call Trace: [ 81.236957][ T4389] [ 81.239917][ T4389] dump_stack_lvl+0x188/0x250 [ 81.244613][ T4389] ? show_regs_print_info+0x20/0x20 [ 81.249825][ T4389] ? load_image+0x410/0x410 [ 81.254345][ T4389] panic+0x2f8/0x850 [ 81.258256][ T4389] ? bpf_jit_dump+0xd0/0xd0 [ 81.262775][ T4389] ? _raw_spin_unlock_irqrestore+0x10d/0x120 [ 81.268775][ T4389] ? _raw_spin_unlock+0x40/0x40 [ 81.273994][ T4389] ? qd_unlock+0x30/0x2d0 [ 81.278330][ T4389] check_panic_on_warn+0x80/0xa0 [ 81.283249][ T4389] ? qd_unlock+0x30/0x2d0 [ 81.287678][ T4389] end_report+0x6d/0xf0 [ 81.291834][ T4389] kasan_report+0x102/0x130 [ 81.296369][ T4389] ? qd_unlock+0x30/0x2d0 [ 81.301057][ T4389] kasan_check_range+0x235/0x290 [ 81.305992][ T4389] qd_unlock+0x30/0x2d0 [ 81.310161][ T4389] gfs2_quota_sync+0x63b/0x780 [ 81.314912][ T4389] gfs2_sync_fs+0x48/0xb0 [ 81.319225][ T4389] sync_filesystem+0xe6/0x220 [ 81.323891][ T4389] generic_shutdown_super+0x6b/0x300 [ 81.329168][ T4389] kill_block_super+0x7c/0xe0 [ 81.333941][ T4389] deactivate_locked_super+0x93/0xf0 [ 81.339251][ T4389] cleanup_mnt+0x426/0x4d0 [ 81.343654][ T4389] task_work_run+0x125/0x1a0 [ 81.348246][ T4389] exit_to_user_mode_loop+0x10f/0x130 [ 81.353602][ T4389] exit_to_user_mode_prepare+0xee/0x180 [ 81.359128][ T4389] syscall_exit_to_user_mode+0x16/0x40 [ 81.364602][ T4389] do_syscall_64+0x58/0xa0 [ 81.369002][ T4389] ? clear_bhb_loop+0x30/0x80 [ 81.373664][ T4389] ? clear_bhb_loop+0x30/0x80 [ 81.378372][ T4389] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 81.384251][ T4389] RIP: 0033:0x7f214d309097 [ 81.388679][ T4389] Code: a2 c7 05 5c 26 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 81.408533][ T4389] RSP: 002b:00007ffe46f2c978 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 81.417131][ T4389] RAX: 0000000000000000 RBX: 00007f214d39d2ca RCX: 00007f214d309097 [ 81.425341][ T4389] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe46f2ca30 [ 81.433443][ T4389] RBP: 00007ffe46f2ca30 R08: 00007ffe46f2da30 R09: 00000000ffffffff [ 81.441583][ T4389] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe46f2dac0 [ 81.449623][ T4389] R13: 00007f214d39d2ca R14: 0000000000013281 R15: 00007ffe46f2db00 [ 81.457678][ T4389] [ 81.460815][ T4389] Kernel Offset: disabled [ 81.465142][ T4389] Rebooting in 86400 seconds..