Warning: Permanently added '10.128.1.128' (ED25519) to the list of known hosts. 2026/09/08 02:13:11 parsed 1 programs 2026/09/08 02:13:11 serving rpc on tcp://34111 [ 81.361078][ T4207] cgroup: Unknown subsys name 'net' [ 81.503424][ T4207] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 82.953537][ T4207] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 86.091848][ T1313] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.105883][ T1313] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.134105][ T1298] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 86.147040][ T1313] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.155028][ T1313] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.163861][ T1298] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 86.535240][ T1273] ODEBUG: Out of memory. ODEBUG disabled [ 86.589315][ T1108] cfg80211: failed to load regulatory.db [ 86.946645][ T4269] chnl_net:caif_netlink_parms(): no params data found [ 87.011781][ T4269] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.021164][ T4269] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.029689][ T4269] device bridge_slave_0 entered promiscuous mode [ 87.041533][ T4269] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.048734][ T4269] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.058857][ T4269] device bridge_slave_1 entered promiscuous mode [ 87.084043][ T4269] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.097860][ T4269] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.129407][ T4269] team0: Port device team_slave_0 added [ 87.137582][ T4269] team0: Port device team_slave_1 added [ 87.161137][ T4269] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.169506][ T4269] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 87.196980][ T4269] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.210400][ T4269] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.218644][ T4269] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 87.245909][ T4269] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.293278][ T4269] device hsr_slave_0 entered promiscuous mode [ 87.353173][ T4269] device hsr_slave_1 entered promiscuous mode [ 87.468691][ T4269] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 87.478982][ T4269] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 87.487709][ T4269] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 87.497473][ T4269] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 87.546716][ T4269] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.561968][ T1313] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 87.572039][ T1313] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 87.580183][ T1313] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 87.606510][ T4269] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.616668][ T1298] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 87.625841][ T1298] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 87.635619][ T1298] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.642992][ T1298] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.672888][ T1298] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 87.681127][ T1298] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 87.690047][ T1298] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 87.699403][ T1298] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.706482][ T1298] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.727525][ T1313] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 87.745075][ T1313] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 87.754685][ T1313] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 87.763334][ T1313] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 87.774902][ T1313] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 87.805108][ T4269] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 87.921519][ T1313] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 87.929173][ T1313] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 87.942162][ T4269] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.960192][ T1313] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 87.996299][ T4269] device veth0_vlan entered promiscuous mode [ 88.003848][ T1313] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 88.012653][ T1313] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 88.022624][ T1313] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 88.035309][ T4269] device veth1_vlan entered promiscuous mode [ 88.063456][ T1313] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 88.072730][ T1313] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 88.090379][ T1313] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 88.100905][ T1313] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 88.111719][ T4269] device veth0_macvtap entered promiscuous mode [ 88.135059][ T4269] device veth1_macvtap entered promiscuous mode [ 88.151152][ T4269] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.159079][ T1313] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 88.167585][ T1313] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 88.175625][ T1313] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 88.184734][ T1313] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 88.198325][ T4269] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.206991][ T1281] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 88.215593][ T1281] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 88.238314][ T4269] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.248344][ T4269] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.258539][ T4269] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.267718][ T4269] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.361643][ T4269] syz-executor (4269) used greatest stack depth: 20720 bytes left 2026/09/08 02:13:21 executed programs: 0 [ 89.189074][ T4302] chnl_net:caif_netlink_parms(): no params data found [ 89.253119][ T4302] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.263323][ T4302] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.272262][ T4302] device bridge_slave_0 entered promiscuous mode [ 89.283249][ T4302] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.290634][ T4302] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.302355][ T4302] device bridge_slave_1 entered promiscuous mode [ 89.329722][ T4302] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.343699][ T4302] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.373475][ T4302] team0: Port device team_slave_0 added [ 89.388739][ T4302] team0: Port device team_slave_1 added [ 89.412020][ T4302] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.419058][ T4302] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.448029][ T4302] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.463448][ T4302] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.471629][ T4302] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.502364][ T4302] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.538121][ T4302] device hsr_slave_0 entered promiscuous mode [ 89.545508][ T4302] device hsr_slave_1 entered promiscuous mode [ 89.552503][ T4302] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 89.560673][ T4302] Cannot create hsr debugfs directory [ 89.651513][ T4302] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 91.057745][ T4275] Bluetooth: hci0: command 0x0409 tx timeout [ 92.922863][ T4302] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 93.147368][ T4278] Bluetooth: hci0: command 0x041b tx timeout [ 93.543011][ T4302] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 93.594596][ T4302] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 93.693006][ T4302] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 93.704145][ T4302] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 93.714963][ T4302] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 93.725362][ T4302] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 93.787927][ T4302] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.809425][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 93.818150][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 93.827056][ T4302] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.847424][ T1298] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 93.856121][ T1298] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 93.864719][ T1298] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.871815][ T1298] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.880741][ T1298] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 93.893090][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 93.902146][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 93.910802][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.917926][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.943068][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 93.955539][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 93.966556][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 93.975517][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 93.984680][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 93.998823][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 94.008853][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 94.018519][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 94.027414][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 94.051622][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 94.061169][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 94.071267][ T4302] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 94.171893][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 94.179858][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 94.191402][ T4302] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.209422][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 94.219713][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 94.234098][ T1273] device hsr_slave_0 left promiscuous mode [ 94.240761][ T1273] device hsr_slave_1 left promiscuous mode [ 94.247925][ T1273] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 94.255362][ T1273] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 94.270693][ T1273] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 94.278144][ T1273] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 94.286051][ T1273] device bridge_slave_1 left promiscuous mode [ 94.293219][ T1273] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.305307][ T1273] device bridge_slave_0 left promiscuous mode [ 94.311668][ T1273] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.329666][ T1273] device veth1_macvtap left promiscuous mode [ 94.335848][ T1273] device veth0_macvtap left promiscuous mode [ 94.342407][ T1273] device veth1_vlan left promiscuous mode [ 94.348481][ T1273] device veth0_vlan left promiscuous mode [ 94.490986][ T1273] team0 (unregistering): Port device team_slave_1 removed [ 94.503023][ T1273] team0 (unregistering): Port device team_slave_0 removed [ 94.517720][ T1273] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 94.531596][ T1273] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 94.583783][ T1273] bond0 (unregistering): Released all slaves [ 94.642972][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 94.651402][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 94.663513][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 94.672041][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 94.680721][ T4302] device veth0_vlan entered promiscuous mode [ 94.696154][ T4302] device veth1_vlan entered promiscuous mode [ 94.720772][ T1298] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 94.730363][ T1298] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 94.740542][ T1298] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 94.749537][ T1298] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 94.758798][ T4302] device veth0_macvtap entered promiscuous mode [ 94.770841][ T4302] device veth1_macvtap entered promiscuous mode [ 94.784967][ T4302] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.793072][ T1298] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 94.801261][ T1298] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 94.809358][ T1298] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 94.818436][ T1298] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 94.831002][ T4302] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.840929][ T1281] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 94.849659][ T1281] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 94.860904][ T4302] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.870236][ T4302] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.879117][ T4302] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.888098][ T4302] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.938359][ T1281] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.946217][ T1281] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.954916][ T1313] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 94.986518][ T1281] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.994666][ T1281] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.002515][ T1281] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 95.217463][ T4278] Bluetooth: hci0: command 0x040f tx timeout [ 95.329230][ T4324] loop0: detected capacity change from 0 to 32768 [ 95.366203][ T4324] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 95.380086][ T4324] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 95.417891][ T4324] gfs2: fsid=syz:syz.0: journal 0 mapped with 5 extents in 0ms [ 95.443837][ T4278] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 95.461381][ T4278] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 95.504974][ T4278] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 43ms [ 95.513607][ T4278] gfs2: fsid=syz:syz.0: jid=0: Done [ 95.519747][ T4324] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 95.639518][ T4324] gfs2: fsid=syz:syz.0: found 1 quota changes [ 95.727158][ T4302] gfs2: fsid=syz:syz.0: fatal: filesystem consistency error [ 95.727158][ T4302] inode = 11 2339 [ 95.727158][ T4302] function = gfs2_dinode_in, file = fs/gfs2/glops.c, line = 414 [ 95.767786][ T4302] gfs2: fsid=syz:syz.0: about to withdraw this file system [ 95.808959][ T4302] gfs2: fsid=syz:syz.0: warning: assertion "!qd->qd_change" failed at function = gfs2_quota_cleanup, file = fs/gfs2/quota.c, line = 1485 [ 95.823099][ T4302] CPU: 0 PID: 4302 Comm: syz-executor Not tainted syzkaller #0 [ 95.830677][ T4302] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 95.840790][ T4302] Call Trace: [ 95.844095][ T4302] [ 95.847070][ T4302] dump_stack_lvl+0x188/0x250 [ 95.851797][ T4302] ? show_regs_print_info+0x20/0x20 [ 95.857029][ T4302] ? load_image+0x410/0x410 [ 95.861568][ T4302] ? do_raw_spin_unlock+0x11d/0x230 [ 95.866808][ T4302] gfs2_assert_warn_i+0x187/0x2c0 [ 95.871865][ T4302] gfs2_quota_cleanup+0x48c/0x670 [ 95.876928][ T4302] gfs2_make_fs_ro+0x440/0x620 [ 95.881724][ T4302] ? __might_sleep+0xf0/0xf0 [ 95.886346][ T4302] ? gfs2_dinode_out+0xb00/0xb00 [ 95.891319][ T4302] ? _raw_spin_unlock+0x24/0x40 [ 95.896205][ T4302] ? gfs2_glock_nq+0xcaa/0x1510 [ 95.901354][ T4302] gfs2_withdraw+0x660/0x14e0 [ 95.906079][ T4302] ? gfs2_meta_new+0x160/0x160 [ 95.910880][ T4302] ? gfs2_lm+0x240/0x240 [ 95.915148][ T4302] ? gfs2_freeze_lock+0x52/0xc0 [ 95.920026][ T4302] ? gfs2_consist_inode_i+0xc0/0xe0 [ 95.925257][ T4302] gfs2_inode_refresh+0xb2d/0x11a0 [ 95.930457][ T4302] ? gfs2_inode_metasync+0xf0/0xf0 [ 95.935619][ T4302] inode_go_lock+0x127/0x450 [ 95.940251][ T4302] do_promote+0x75b/0xb20 [ 95.944633][ T4302] finish_xmote+0x4c2/0xaf0 [ 95.949171][ T4302] do_xmote+0x752/0x10a0 [ 95.953444][ T4302] gfs2_glock_nq+0xc6b/0x1510 [ 95.958165][ T4302] do_sync+0x49c/0xba0 [ 95.962287][ T4302] ? slot_put+0x1e0/0x1e0 [ 95.966678][ T4302] ? do_sync+0x494/0xba0 [ 95.970950][ T4302] ? do_raw_spin_unlock+0x11d/0x230 [ 95.976178][ T4302] gfs2_quota_sync+0x355/0x780 [ 95.980984][ T4302] gfs2_sync_fs+0x48/0xb0 [ 95.985354][ T4302] sync_filesystem+0xe6/0x220 [ 95.990076][ T4302] generic_shutdown_super+0x6b/0x300 [ 95.995389][ T4302] kill_block_super+0x7c/0xe0 [ 96.000100][ T4302] deactivate_locked_super+0x93/0xf0 [ 96.005441][ T4302] cleanup_mnt+0x426/0x4d0 [ 96.009890][ T4302] task_work_run+0x125/0x1a0 [ 96.014521][ T4302] exit_to_user_mode_loop+0x10f/0x130 [ 96.019922][ T4302] exit_to_user_mode_prepare+0xee/0x180 [ 96.025497][ T4302] syscall_exit_to_user_mode+0x16/0x40 [ 96.030984][ T4302] do_syscall_64+0x58/0xa0 [ 96.035422][ T4302] ? clear_bhb_loop+0x30/0x80 [ 96.040120][ T4302] ? clear_bhb_loop+0x30/0x80 [ 96.044828][ T4302] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 96.050762][ T4302] RIP: 0033:0x7f290a242397 [ 96.055206][ T4302] Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 96.074841][ T4302] RSP: 002b:00007ffe3dd2f1b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 96.083286][ T4302] RAX: 0000000000000000 RBX: 00007f290a2d7474 RCX: 00007f290a242397 [ 96.091277][ T4302] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe3dd2f270 [ 96.099280][ T4302] RBP: 00007ffe3dd2f270 R08: 00007ffe3dd30270 R09: 00000000ffffffff [ 96.107275][ T4302] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe3dd30300 [ 96.115374][ T4302] R13: 00007f290a2d7474 R14: 000000000001730b R15: 00007ffe3dd30340 [ 96.123392][ T4302] [ 96.136429][ T4302] gfs2: fsid=syz:syz.0: Journal recovery skipped for jid 0 until next mount. [ 96.145268][ T4302] gfs2: fsid=syz:syz.0: Glock dequeues delayed: 0 [ 96.153470][ T4302] gfs2: fsid=syz:syz.0: File system withdrawn [ 96.160792][ T4302] CPU: 0 PID: 4302 Comm: syz-executor Not tainted syzkaller #0 [ 96.168377][ T4302] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 96.178448][ T4302] Call Trace: [ 96.181755][ T4302] [ 96.184708][ T4302] dump_stack_lvl+0x188/0x250 [ 96.189424][ T4302] ? show_regs_print_info+0x20/0x20 [ 96.194659][ T4302] ? load_image+0x410/0x410 [ 96.199197][ T4302] ? lockref_put_or_lock+0x6e/0xb0 [ 96.204371][ T4302] gfs2_withdraw+0xb9a/0x14e0 [ 96.209083][ T4302] ? gfs2_meta_new+0x160/0x160 [ 96.213888][ T4302] ? gfs2_lm+0x240/0x240 [ 96.218174][ T4302] ? gfs2_consist_inode_i+0xc0/0xe0 [ 96.223433][ T4302] gfs2_inode_refresh+0xb2d/0x11a0 [ 96.228585][ T4302] ? gfs2_inode_metasync+0xf0/0xf0 [ 96.233737][ T4302] inode_go_lock+0x127/0x450 [ 96.238372][ T4302] do_promote+0x75b/0xb20 [ 96.242740][ T4302] finish_xmote+0x4c2/0xaf0 [ 96.247281][ T4302] do_xmote+0x752/0x10a0 [ 96.251559][ T4302] gfs2_glock_nq+0xc6b/0x1510 [ 96.256290][ T4302] do_sync+0x49c/0xba0 [ 96.260399][ T4302] ? slot_put+0x1e0/0x1e0 [ 96.264763][ T4302] ? do_sync+0x494/0xba0 [ 96.269043][ T4302] ? do_raw_spin_unlock+0x11d/0x230 [ 96.274271][ T4302] gfs2_quota_sync+0x355/0x780 [ 96.279082][ T4302] gfs2_sync_fs+0x48/0xb0 [ 96.283437][ T4302] sync_filesystem+0xe6/0x220 [ 96.288136][ T4302] generic_shutdown_super+0x6b/0x300 [ 96.293454][ T4302] kill_block_super+0x7c/0xe0 [ 96.298160][ T4302] deactivate_locked_super+0x93/0xf0 [ 96.303478][ T4302] cleanup_mnt+0x426/0x4d0 [ 96.307924][ T4302] task_work_run+0x125/0x1a0 [ 96.312553][ T4302] exit_to_user_mode_loop+0x10f/0x130 [ 96.317948][ T4302] exit_to_user_mode_prepare+0xee/0x180 [ 96.323529][ T4302] syscall_exit_to_user_mode+0x16/0x40 [ 96.329010][ T4302] do_syscall_64+0x58/0xa0 [ 96.333459][ T4302] ? clear_bhb_loop+0x30/0x80 [ 96.338156][ T4302] ? clear_bhb_loop+0x30/0x80 [ 96.342881][ T4302] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 96.348801][ T4302] RIP: 0033:0x7f290a242397 [ 96.353260][ T4302] Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 96.372884][ T4302] RSP: 002b:00007ffe3dd2f1b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 96.381344][ T4302] RAX: 0000000000000000 RBX: 00007f290a2d7474 RCX: 00007f290a242397 [ 96.389353][ T4302] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe3dd2f270 [ 96.397348][ T4302] RBP: 00007ffe3dd2f270 R08: 00007ffe3dd30270 R09: 00000000ffffffff [ 96.405341][ T4302] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe3dd30300 [ 96.413337][ T4302] R13: 00007f290a2d7474 R14: 000000000001730b R15: 00007ffe3dd30340 [ 96.421349][ T4302] [ 96.432196][ T4302] ================================================================== [ 96.440551][ T4302] BUG: KASAN: use-after-free in qd_unlock+0x30/0x2d0 [ 96.447255][ T4302] Read of size 8 at addr ffff888070b30090 by task syz-executor/4302 [ 96.455268][ T4302] [ 96.457614][ T4302] CPU: 0 PID: 4302 Comm: syz-executor Not tainted syzkaller #0 [ 96.465186][ T4302] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 96.475266][ T4302] Call Trace: [ 96.478574][ T4302] [ 96.481531][ T4302] dump_stack_lvl+0x188/0x250 [ 96.486249][ T4302] ? show_regs_print_info+0x20/0x20 [ 96.491492][ T4302] ? load_image+0x410/0x410 [ 96.496130][ T4302] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 96.501624][ T4302] print_address_description+0x60/0x2d0 [ 96.507252][ T4302] ? qd_unlock+0x30/0x2d0 [ 96.511607][ T4302] kasan_report+0xdf/0x130 [ 96.516144][ T4302] ? qd_unlock+0x30/0x2d0 [ 96.520515][ T4302] kasan_check_range+0x235/0x290 [ 96.525488][ T4302] qd_unlock+0x30/0x2d0 [ 96.529674][ T4302] gfs2_quota_sync+0x63b/0x780 [ 96.534481][ T4302] gfs2_sync_fs+0x48/0xb0 [ 96.538839][ T4302] sync_filesystem+0xe6/0x220 [ 96.543567][ T4302] generic_shutdown_super+0x6b/0x300 [ 96.548885][ T4302] kill_block_super+0x7c/0xe0 [ 96.553598][ T4302] deactivate_locked_super+0x93/0xf0 [ 96.558940][ T4302] cleanup_mnt+0x426/0x4d0 [ 96.563404][ T4302] task_work_run+0x125/0x1a0 [ 96.568025][ T4302] exit_to_user_mode_loop+0x10f/0x130 [ 96.573426][ T4302] exit_to_user_mode_prepare+0xee/0x180 [ 96.578995][ T4302] syscall_exit_to_user_mode+0x16/0x40 [ 96.584590][ T4302] do_syscall_64+0x58/0xa0 [ 96.589050][ T4302] ? clear_bhb_loop+0x30/0x80 [ 96.593766][ T4302] ? clear_bhb_loop+0x30/0x80 [ 96.598595][ T4302] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 96.604516][ T4302] RIP: 0033:0x7f290a242397 [ 96.608958][ T4302] Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 96.628586][ T4302] RSP: 002b:00007ffe3dd2f1b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 96.637028][ T4302] RAX: 0000000000000000 RBX: 00007f290a2d7474 RCX: 00007f290a242397 [ 96.645020][ T4302] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe3dd2f270 [ 96.653037][ T4302] RBP: 00007ffe3dd2f270 R08: 00007ffe3dd30270 R09: 00000000ffffffff [ 96.661032][ T4302] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe3dd30300 [ 96.669031][ T4302] R13: 00007f290a2d7474 R14: 000000000001730b R15: 00007ffe3dd30340 [ 96.677047][ T4302] [ 96.680102][ T4302] [ 96.682440][ T4302] Allocated by task 4324: [ 96.686783][ T4302] __kasan_slab_alloc+0x92/0xc0 [ 96.691659][ T4302] slab_post_alloc_hook+0x4c/0x380 [ 96.696793][ T4302] kmem_cache_alloc+0x15d/0x280 [ 96.701662][ T4302] qd_alloc+0x50/0x260 [ 96.705764][ T4302] gfs2_quota_init+0x74d/0xe80 [ 96.710557][ T4302] gfs2_make_fs_rw+0x41c/0x590 [ 96.715354][ T4302] gfs2_fill_super+0x17d1/0x1ea0 [ 96.720350][ T4302] get_tree_bdev+0x3e6/0x610 [ 96.724968][ T4302] gfs2_get_tree+0x4d/0x1e0 [ 96.729492][ T4302] vfs_get_tree+0x88/0x270 [ 96.733941][ T4302] do_new_mount+0x247/0xa40 [ 96.738469][ T4302] __se_sys_mount+0x2e3/0x3d0 [ 96.743175][ T4302] do_syscall_64+0x4c/0xa0 [ 96.747630][ T4302] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 96.753551][ T4302] [ 96.755907][ T4302] Freed by task 4278: [ 96.759903][ T4302] kasan_set_track+0x4b/0x70 [ 96.764521][ T4302] kasan_set_free_info+0x1f/0x40 [ 96.769483][ T4302] ____kasan_slab_free+0xd5/0x110 [ 96.774531][ T4302] slab_free_freelist_hook+0xec/0x170 [ 96.779928][ T4302] kmem_cache_free+0x8f/0x210 [ 96.784635][ T4302] rcu_core+0x96e/0x1650 [ 96.788903][ T4302] handle_softirqs+0x336/0x830 [ 96.793708][ T4302] do_softirq+0x142/0x210 [ 96.798061][ T4302] __local_bh_enable_ip+0x180/0x1c0 [ 96.803400][ T4302] __fib6_clean_all+0x27b/0x3b0 [ 96.808362][ T4302] addrconf_dad_completed+0x746/0xc80 [ 96.813753][ T4302] addrconf_dad_work+0xc83/0x1530 [ 96.818795][ T4302] process_one_work+0x867/0xff0 [ 96.823776][ T4302] worker_thread+0xad7/0x12a0 [ 96.828480][ T4302] kthread+0x42e/0x520 [ 96.832575][ T4302] ret_from_fork+0x1f/0x30 [ 96.837019][ T4302] [ 96.839355][ T4302] Last potentially related work creation: [ 96.845076][ T4302] kasan_save_stack+0x35/0x60 [ 96.849778][ T4302] kasan_record_aux_stack+0xb8/0x100 [ 96.855085][ T4302] call_rcu+0x189/0x900 [ 96.859265][ T4302] gfs2_quota_cleanup+0x414/0x670 [ 96.864321][ T4302] gfs2_make_fs_ro+0x440/0x620 [ 96.869113][ T4302] gfs2_withdraw+0x660/0x14e0 [ 96.873816][ T4302] gfs2_inode_refresh+0xb2d/0x11a0 [ 96.878953][ T4302] inode_go_lock+0x127/0x450 [ 96.883568][ T4302] do_promote+0x75b/0xb20 [ 96.887918][ T4302] finish_xmote+0x4c2/0xaf0 [ 96.892439][ T4302] do_xmote+0x752/0x10a0 [ 96.896713][ T4302] gfs2_glock_nq+0xc6b/0x1510 [ 96.901407][ T4302] do_sync+0x49c/0xba0 [ 96.905498][ T4302] gfs2_quota_sync+0x355/0x780 [ 96.910293][ T4302] gfs2_sync_fs+0x48/0xb0 [ 96.914647][ T4302] sync_filesystem+0xe6/0x220 [ 96.919363][ T4302] generic_shutdown_super+0x6b/0x300 [ 96.924678][ T4302] kill_block_super+0x7c/0xe0 [ 96.929382][ T4302] deactivate_locked_super+0x93/0xf0 [ 96.934693][ T4302] cleanup_mnt+0x426/0x4d0 [ 96.939134][ T4302] task_work_run+0x125/0x1a0 [ 96.943752][ T4302] exit_to_user_mode_loop+0x10f/0x130 [ 96.949148][ T4302] exit_to_user_mode_prepare+0xee/0x180 [ 96.954738][ T4302] syscall_exit_to_user_mode+0x16/0x40 [ 96.960341][ T4302] do_syscall_64+0x58/0xa0 [ 96.964785][ T4302] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 96.970708][ T4302] [ 96.973049][ T4302] The buggy address belongs to the object at ffff888070b30000 [ 96.973049][ T4302] which belongs to the cache gfs2_quotad of size 272 [ 96.987120][ T4302] The buggy address is located 144 bytes inside of [ 96.987120][ T4302] 272-byte region [ffff888070b30000, ffff888070b30110) [ 97.000432][ T4302] The buggy address belongs to the page: [ 97.006085][ T4302] page:ffffea0001c2cc00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x70b30 [ 97.016251][ T4302] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 97.023829][ T4302] raw: 00fff00000000200 0000000000000000 dead000000000122 ffff88801e5c3780 [ 97.032443][ T4302] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 [ 97.041045][ T4302] page dumped because: kasan: bad access detected [ 97.047478][ T4302] page_owner tracks the page as allocated [ 97.053198][ T4302] page last allocated via order 0, migratetype Reclaimable, gfp_mask 0x112c50(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 4324, ts 95623929057, free_ts 23344777372 [ 97.072252][ T4302] get_page_from_freelist+0x24f6/0x2670 [ 97.077823][ T4302] __alloc_pages+0x1ee/0x480 [ 97.082430][ T4302] new_slab+0xc0/0x4b0 [ 97.086516][ T4302] ___slab_alloc+0x807/0xdd0 [ 97.091153][ T4302] kmem_cache_alloc+0xf0/0x280 [ 97.095938][ T4302] qd_alloc+0x50/0x260 [ 97.100030][ T4302] gfs2_quota_init+0x74d/0xe80 [ 97.104818][ T4302] gfs2_make_fs_rw+0x41c/0x590 [ 97.109616][ T4302] gfs2_fill_super+0x17d1/0x1ea0 [ 97.114577][ T4302] get_tree_bdev+0x3e6/0x610 [ 97.119200][ T4302] gfs2_get_tree+0x4d/0x1e0 [ 97.123719][ T4302] vfs_get_tree+0x88/0x270 [ 97.128184][ T4302] do_new_mount+0x247/0xa40 [ 97.132721][ T4302] __se_sys_mount+0x2e3/0x3d0 [ 97.137425][ T4302] do_syscall_64+0x4c/0xa0 [ 97.141879][ T4302] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 97.147795][ T4302] page last free stack trace: [ 97.152479][ T4302] free_unref_page_prepare+0x637/0x6c0 [ 97.157960][ T4302] free_unref_page+0x8f/0x2a0 [ 97.162665][ T4302] free_contig_range+0x96/0xf0 [ 97.167541][ T4302] destroy_args+0xef/0xa00 [ 97.171979][ T4302] debug_vm_pgtable+0x321/0x380 [ 97.176852][ T4302] do_one_initcall+0x272/0x730 [ 97.181639][ T4302] do_initcall_level+0x13d/0x1f0 [ 97.186600][ T4302] do_initcalls+0x4b/0x90 [ 97.190946][ T4302] kernel_init_freeable+0x3d5/0x560 [ 97.196191][ T4302] kernel_init+0x19/0x1b0 [ 97.200630][ T4302] ret_from_fork+0x1f/0x30 [ 97.205075][ T4302] [ 97.207421][ T4302] Memory state around the buggy address: [ 97.213075][ T4302] ffff888070b2ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 97.221169][ T4302] ffff888070b30000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 97.229249][ T4302] >ffff888070b30080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 97.237337][ T4302] ^ [ 97.241950][ T4302] ffff888070b30100: fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 97.250027][ T4302] ffff888070b30180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 97.258112][ T4302] ================================================================== [ 97.266193][ T4302] Disabling lock debugging due to kernel taint [ 97.286413][ T4302] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 97.293666][ T4302] CPU: 0 PID: 4302 Comm: syz-executor Tainted: G B syzkaller #0 [ 97.302625][ T4302] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 97.312711][ T4302] Call Trace: [ 97.316014][ T4302] [ 97.318964][ T4302] dump_stack_lvl+0x188/0x250 [ 97.323674][ T4302] ? show_regs_print_info+0x20/0x20 [ 97.328901][ T4302] ? load_image+0x410/0x410 [ 97.333441][ T4302] panic+0x2f8/0x850 [ 97.337376][ T4302] ? bpf_jit_dump+0xd0/0xd0 [ 97.341913][ T4302] ? _raw_spin_unlock_irqrestore+0x10d/0x120 [ 97.347916][ T4302] ? _raw_spin_unlock+0x40/0x40 [ 97.352812][ T4302] ? qd_unlock+0x30/0x2d0 [ 97.357176][ T4302] check_panic_on_warn+0x80/0xa0 [ 97.362163][ T4302] ? qd_unlock+0x30/0x2d0 [ 97.366609][ T4302] end_report+0x6d/0xf0 [ 97.370792][ T4302] kasan_report+0x102/0x130 [ 97.375322][ T4302] ? qd_unlock+0x30/0x2d0 [ 97.379676][ T4302] kasan_check_range+0x235/0x290 [ 97.384645][ T4302] qd_unlock+0x30/0x2d0 [ 97.388830][ T4302] gfs2_quota_sync+0x63b/0x780 [ 97.393628][ T4302] gfs2_sync_fs+0x48/0xb0 [ 97.398000][ T4302] sync_filesystem+0xe6/0x220 [ 97.402701][ T4302] generic_shutdown_super+0x6b/0x300 [ 97.408011][ T4302] kill_block_super+0x7c/0xe0 [ 97.412718][ T4302] deactivate_locked_super+0x93/0xf0 [ 97.418030][ T4302] cleanup_mnt+0x426/0x4d0 [ 97.422511][ T4302] task_work_run+0x125/0x1a0 [ 97.427131][ T4302] exit_to_user_mode_loop+0x10f/0x130 [ 97.432527][ T4302] exit_to_user_mode_prepare+0xee/0x180 [ 97.438099][ T4302] syscall_exit_to_user_mode+0x16/0x40 [ 97.443582][ T4302] do_syscall_64+0x58/0xa0 [ 97.448024][ T4302] ? clear_bhb_loop+0x30/0x80 [ 97.452723][ T4302] ? clear_bhb_loop+0x30/0x80 [ 97.457419][ T4302] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 97.463340][ T4302] RIP: 0033:0x7f290a242397 [ 97.467777][ T4302] Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 97.487607][ T4302] RSP: 002b:00007ffe3dd2f1b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 97.496137][ T4302] RAX: 0000000000000000 RBX: 00007f290a2d7474 RCX: 00007f290a242397 [ 97.504407][ T4302] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe3dd2f270 [ 97.512492][ T4302] RBP: 00007ffe3dd2f270 R08: 00007ffe3dd30270 R09: 00000000ffffffff [ 97.520487][ T4302] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe3dd30300 [ 97.528483][ T4302] R13: 00007f290a2d7474 R14: 000000000001730b R15: 00007ffe3dd30340 [ 97.536487][ T4302] [ 97.539812][ T4302] Kernel Offset: disabled [ 97.544189][ T4302] Rebooting in 86400 seconds..