syzkaller login: [ 91.913293][ T999] cfg80211: failed to load regulatory.db Warning: Permanently added '10.128.1.70' (ED25519) to the list of known hosts. 2026/08/07 16:41:50 parsed 1 programs 2026/08/07 16:41:50 serving rpc on tcp://33379 [ 103.044746][ T5603] cgroup: Unknown subsys name 'net' [ 103.294763][ T5603] cgroup: Unknown subsys name 'cpuset' [ 103.338317][ T5603] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 105.323871][ T5603] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 111.974787][ T5648] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.975905][ T5648] bridge0: port 1(bridge_slave_0) entered disabled state [ 111.976042][ T5648] bridge_slave_0: entered allmulticast mode [ 111.982955][ T5648] bridge_slave_0: entered promiscuous mode [ 112.168257][ T5648] bridge0: port 2(bridge_slave_1) entered blocking state [ 112.168383][ T5648] bridge0: port 2(bridge_slave_1) entered disabled state [ 112.168524][ T5648] bridge_slave_1: entered allmulticast mode [ 112.170481][ T5648] bridge_slave_1: entered promiscuous mode [ 112.246703][ T5648] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 112.262225][ T5648] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 112.307080][ T5648] team0: Port device team_slave_0 added [ 112.316109][ T5648] team0: Port device team_slave_1 added [ 112.356879][ T5648] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 112.356893][ T5648] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 112.356913][ T5648] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 112.388058][ T5648] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 112.388102][ T5648] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 112.388187][ T5648] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 112.506756][ T5648] hsr_slave_0: entered promiscuous mode [ 112.512249][ T5648] hsr_slave_1: entered promiscuous mode [ 113.152115][ T5648] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 113.191004][ T5648] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 113.194157][ T5648] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 113.241720][ T5648] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 113.244393][ T5648] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 113.266427][ T5648] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 113.267389][ T5648] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 113.315504][ T5648] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 113.461738][ T5648] 8021q: adding VLAN 0 to HW filter on device bond0 [ 113.501227][ T5648] 8021q: adding VLAN 0 to HW filter on device team0 [ 113.519182][ T2274] bridge0: port 1(bridge_slave_0) entered blocking state [ 113.519561][ T2274] bridge0: port 1(bridge_slave_0) entered forwarding state [ 113.564097][ T2274] bridge0: port 2(bridge_slave_1) entered blocking state [ 113.564231][ T2274] bridge0: port 2(bridge_slave_1) entered forwarding state [ 114.055114][ T5648] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 114.139374][ T5648] veth0_vlan: entered promiscuous mode [ 114.165875][ T5648] veth1_vlan: entered promiscuous mode [ 114.225990][ T5648] veth0_macvtap: entered promiscuous mode [ 114.243755][ T5648] veth1_macvtap: entered promiscuous mode [ 114.274076][ T5648] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 114.299280][ T5648] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 114.697859][ T3380] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.697926][ T3380] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.697954][ T3380] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.697981][ T3380] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.942404][ T4899] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 114.962464][ T4899] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 114.964951][ T4899] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 114.990703][ T4899] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 114.991486][ T4899] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 115.174297][ T2274] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.730854][ T96] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.730887][ T96] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.930677][ T3355] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.930700][ T3355] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.223810][ T2274] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 117.659994][ T2274] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 117.970700][ T2274] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 118.718458][ T2274] bridge_slave_1: left allmulticast mode [ 118.718645][ T2274] bridge_slave_1: left promiscuous mode [ 118.751107][ T2274] bridge0: port 2(bridge_slave_1) entered disabled state [ 118.942115][ T2274] bridge_slave_0: left allmulticast mode [ 118.942169][ T2274] bridge_slave_0: left promiscuous mode [ 118.942417][ T2274] bridge0: port 1(bridge_slave_0) entered disabled state [ 119.798640][ T2274] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 119.858820][ T2274] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 119.879880][ T2274] bond0 (unregistering): Released all slaves [ 119.942895][ T5245] 8021q: adding VLAN 0 to HW filter on device eth1 [ 120.329076][ T2274] hsr_slave_0: left promiscuous mode [ 120.368766][ T2274] hsr_slave_1: left promiscuous mode [ 120.370063][ T2274] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 120.370147][ T2274] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 120.491204][ T2274] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 120.491233][ T2274] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 120.725877][ T2274] veth1_macvtap: left promiscuous mode [ 120.726643][ T2274] veth0_macvtap: left promiscuous mode [ 120.742304][ T2274] veth1_vlan: left promiscuous mode [ 120.742697][ T2274] veth0_vlan: left promiscuous mode 2026/08/07 16:42:12 executed programs: 0 [ 120.915960][ T59] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 120.943317][ T59] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 120.945071][ T59] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 120.947393][ T59] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 120.969376][ T59] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 121.632235][ T2274] team0 (unregistering): Port device team_slave_1 removed [ 121.678324][ T2274] team0 (unregistering): Port device team_slave_0 removed [ 121.881408][ T5245] 8021q: adding VLAN 0 to HW filter on device eth2 [ 122.693873][ T5245] 8021q: adding VLAN 0 to HW filter on device eth3 [ 123.029834][ T5750] bridge0: port 1(bridge_slave_0) entered blocking state [ 123.029945][ T5750] bridge0: port 1(bridge_slave_0) entered disabled state [ 123.029975][ T4899] Bluetooth: hci0: command tx timeout [ 123.030133][ T5750] bridge_slave_0: entered allmulticast mode [ 123.038251][ T5750] bridge_slave_0: entered promiscuous mode [ 123.080646][ T5750] bridge0: port 2(bridge_slave_1) entered blocking state [ 123.080868][ T5750] bridge0: port 2(bridge_slave_1) entered disabled state [ 123.081060][ T5750] bridge_slave_1: entered allmulticast mode [ 123.083833][ T5750] bridge_slave_1: entered promiscuous mode [ 123.162966][ T5750] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 123.179622][ T5750] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 123.242006][ T5750] team0: Port device team_slave_0 added [ 123.246305][ T5750] team0: Port device team_slave_1 added [ 123.310301][ T5750] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 123.310322][ T5750] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 123.310355][ T5750] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 123.372683][ T5750] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 123.372701][ T5750] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 123.372730][ T5750] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 123.506956][ T5750] hsr_slave_0: entered promiscuous mode [ 123.514527][ T5750] hsr_slave_1: entered promiscuous mode [ 124.198408][ T5245] 8021q: adding VLAN 0 to HW filter on device eth4 [ 125.117718][ T4899] Bluetooth: hci0: command tx timeout [ 126.835206][ T5750] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 126.874902][ T5750] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 126.880184][ T5750] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 126.925302][ T5750] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 127.057971][ T5750] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 127.101059][ T5750] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 127.105729][ T5750] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 127.179774][ T5750] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 127.189063][ T4899] Bluetooth: hci0: command tx timeout [ 127.393125][ T5750] 8021q: adding VLAN 0 to HW filter on device bond0 [ 127.431440][ T5750] 8021q: adding VLAN 0 to HW filter on device team0 [ 127.455124][ T1166] bridge0: port 1(bridge_slave_0) entered blocking state [ 127.455368][ T1166] bridge0: port 1(bridge_slave_0) entered forwarding state [ 127.529759][ T3392] bridge0: port 2(bridge_slave_1) entered blocking state [ 127.530315][ T3392] bridge0: port 2(bridge_slave_1) entered forwarding state [ 128.305281][ T5750] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 128.433928][ T5750] veth0_vlan: entered promiscuous mode [ 128.464640][ T5750] veth1_vlan: entered promiscuous mode [ 128.516276][ T5750] veth0_macvtap: entered promiscuous mode [ 128.530345][ T5750] veth1_macvtap: entered promiscuous mode [ 128.554608][ T5750] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 128.571543][ T5750] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 128.740015][ T2274] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.740427][ T2274] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.740855][ T2274] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.869308][ T2274] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.000849][ T3392] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 129.000872][ T3392] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 129.076296][ T3392] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 129.076319][ T3392] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2026/08/07 16:42:20 executed programs: 2 [ 129.267676][ T4899] Bluetooth: hci0: command tx timeout [ 129.501963][ T5898] loop0: detected capacity change from 0 to 32768 [ 130.232414][ T5902] loop0: detected capacity change from 0 to 32768 [ 130.705810][ T5903] loop0: detected capacity change from 0 to 32768 [ 131.171329][ T5904] loop0: detected capacity change from 0 to 32768 [ 131.622453][ T5905] loop0: detected capacity change from 0 to 32768 [ 132.031769][ T5906] loop0: detected capacity change from 0 to 32768 [ 132.476020][ T5907] loop0: detected capacity change from 0 to 32768 [ 132.874081][ T1329] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.874176][ T1329] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.972893][ T5908] loop0: detected capacity change from 0 to 32768 [ 133.373517][ T5909] loop0: detected capacity change from 0 to 32768 [ 133.825777][ T5910] loop0: detected capacity change from 0 to 32768 2026/08/07 16:42:26 executed programs: 13 [ 134.660621][ T5912] set_capacity_and_notify: 1 callbacks suppressed [ 134.660635][ T5912] loop0: detected capacity change from 0 to 32768 [ 135.073169][ T5913] loop0: detected capacity change from 0 to 32768 [ 135.453956][ T5914] loop0: detected capacity change from 0 to 32768 [ 135.901619][ T5915] loop0: detected capacity change from 0 to 32768 [ 136.334904][ T5916] loop0: detected capacity change from 0 to 32768 [ 136.734193][ T5917] loop0: detected capacity change from 0 to 32768 [ 137.135437][ T5918] loop0: detected capacity change from 0 to 32768 [ 137.533166][ T5919] loop0: detected capacity change from 0 to 32768 [ 137.973372][ T5920] loop0: detected capacity change from 0 to 32768 [ 138.061156][ T1166] =========================================================[ 138.061156][ T1166] ================================================================== [ 138.061173][ T1166] BUG: KASAN: use-after-free in copy_folio_from_iter_atomic+0xbbf/0x1a30 [ 138.061229][ T1166] Read of size 4096 at addr ffff88803d566000 by task kworker/u8:9/1166 [ 138.061248][ T1166] [ 138.061272][ T1166] CPU: 1 UID: 0 PID: 1166 Comm: kworker/u8:9 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 138.061303][ T1166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 138.061318][ T1166] Workqueue: loop0 loop_workfn [ 138.061367][ T1166] Call Trace: [ 138.061375][ T1166] [ 138.061384][ T1166] dump_stack_lvl+0xe8/0x150 [ 138.061418][ T1166] print_address_description+0x55/0x1e0 [ 138.061457][ T1166] ? copy_folio_from_iter_atomic+0xbbf/0x1a30 [ 138.061492][ T1166] print_report+0x58/0x70 [ 138.061521][ T1166] kasan_report+0x117/0x150 [ 138.061547][ T1166] ? copy_folio_from_iter_atomic+0xbbf/0x1a30 [ 138.061587][ T1166] kasan_check_range+0x264/0x2c0 [ 138.061612][ T1166] ? copy_folio_from_iter_atomic+0xbbf/0x1a30 [ 138.061649][ T1166] __asan_memcpy+0x29/0x70 [ 138.061681][ T1166] copy_folio_from_iter_atomic+0xbbf/0x1a30 [ 138.061729][ T1166] ? __pfx_copy_folio_from_iter_atomic+0x10/0x10 [ 138.061766][ T1166] ? rcu_is_watching+0x15/0xb0 [ 138.061794][ T1166] ? shmem_write_begin+0x1ce/0x320 [ 138.061832][ T1166] generic_perform_write+0x5a8/0x8b0 [ 138.061873][ T1166] ? __pfx_generic_perform_write+0x10/0x10 [ 138.061906][ T1166] ? __mark_inode_dirty+0x4e7/0x13b0 [ 138.061936][ T1166] ? preempt_count_add+0x91/0x190 [ 138.061961][ T1166] ? mnt_put_write_access_file+0xbf/0x100 [ 138.061990][ T1166] ? file_update_time_flags+0x406/0x4b0 [ 138.062019][ T1166] shmem_file_write_iter+0xfb/0x120 [ 138.062047][ T1166] lo_rw_aio+0xc78/0xf30 [ 138.062087][ T1166] ? __pfx_lo_rw_aio+0x10/0x10 [ 138.062123][ T1166] ? kthread_associate_blkcg+0x490/0x600 [ 138.062156][ T1166] ? rt_spin_unlock+0x163/0x200 [ 138.062182][ T1166] loop_process_work+0x638/0x11d0 [ 138.062225][ T1166] ? __pfx_loop_process_work+0x10/0x10 [ 138.062257][ T1166] ? look_up_lock_class+0x57/0x110 [ 138.062288][ T1166] ? register_lock_class+0x31/0x2e0 [ 138.062324][ T1166] ? __lock_acquire+0x683/0x2ce0 [ 138.062348][ T1166] ? irqentry_exit+0x218/0x8f0 [ 138.062379][ T1166] ? lockdep_hardirqs_on+0x7a/0x110 [ 138.062406][ T1166] ? irqentry_exit+0x218/0x8f0 [ 138.062439][ T1166] ? trace_irq_disable+0x3b/0x140 [ 138.062476][ T1166] ? do_raw_spin_lock+0x12b/0x2f0 [ 138.062509][ T1166] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 138.062539][ T1166] ? process_scheduled_works+0xa20/0x14e0 [ 138.062564][ T1166] ? process_scheduled_works+0xa20/0x14e0 [ 138.062590][ T1166] ? rcu_is_watching+0x15/0xb0 [ 138.062616][ T1166] ? process_scheduled_works+0xa20/0x14e0 [ 138.062639][ T1166] process_scheduled_works+0xa8e/0x14e0 [ 138.062678][ T1166] ? __pfx_process_scheduled_works+0x10/0x10 [ 138.062705][ T1166] ? assign_work+0x3cf/0x5d0 [ 138.062730][ T1166] worker_thread+0xa47/0xfb0 [ 138.062762][ T1166] ? __kthread_parkme+0x71/0x1f0 [ 138.062793][ T1166] kthread+0x388/0x470 [ 138.062824][ T1166] ? __pfx_worker_thread+0x10/0x10 [ 138.062848][ T1166] ? __pfx_kthread+0x10/0x10 [ 138.062880][ T1166] ret_from_fork+0x514/0xb70 [ 138.062912][ T1166] ? __pfx_ret_from_fork+0x10/0x10 [ 138.062943][ T1166] ? __switch_to+0xc89/0x1420 [ 138.062971][ T1166] ? __pfx_kthread+0x10/0x10 [ 138.063001][ T1166] ret_from_fork_asm+0x1a/0x30 [ 138.063052][ T1166] [ 138.063060][ T1166] [ 138.063065][ T1166] The buggy address belongs to the physical page: [ 138.063085][ T1166] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803d5663c0 pfn:0x3d566 [ 138.063107][ T1166] flags: 0x80000000000000(node=0|zone=1) [ 138.063134][ T1166] raw: 0080000000000000 ffffea0000cf8088 ffffea0000f89f08 0000000000000000 [ 138.063150][ T1166] raw: ffff88803d5663c0 0000000000000000 00000000ffffffff 0000000000000000 [ 138.063159][ T1166] page dumped because: kasan: bad access detected [ 138.063171][ T1166] page_owner tracks the page as freed [ 138.063177][ T1166] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xdc0(GFP_KERNEL|__GFP_ZERO), pid 5920, tgid 5920 (syz.0.36), ts 138003970206, free_ts 138058311336 [ 138.063206][ T1166] post_alloc_hook+0x1f9/0x250 [ 138.063233][ T1166] get_page_from_freelist+0x262a/0x26a0 [ 138.063252][ T1166] __alloc_frozen_pages_noprof+0x18d/0x380 [ 138.063273][ T1166] alloc_pages_mpol+0xce/0x280 [ 138.063293][ T1166] alloc_pages_noprof+0xd2/0x2f0 [ 138.063312][ T1166] lmLogInit+0x357/0x1a20 [ 138.063336][ T1166] lmLogOpen+0x4e3/0xf90 [ 138.063359][ T1166] jfs_mount_rw+0xf3/0x670 [ 138.063382][ T1166] jfs_fill_super+0x769/0xda0 [ 138.063420][ T1166] get_tree_bdev_flags+0x430/0x4f0 [ 138.063452][ T1166] vfs_get_tree+0x92/0x2a0 [ 138.063474][ T1166] do_new_mount+0x319/0xdc0 [ 138.063505][ T1166] __se_sys_mount+0x31d/0x420 [ 138.063522][ T1166] do_syscall_64+0x174/0x580 [ 138.063552][ T1166] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 138.063573][ T1166] page last free pid 5750 tgid 5750 stack trace: [ 138.063586][ T1166] __free_frozen_pages+0x10e7/0x11c0 [ 138.063617][ T1166] lmLogShutdown+0x44e/0x850 [ 138.063642][ T1166] lmLogClose+0x28c/0x530 [ 138.063666][ T1166] jfs_umount+0x2da/0x3b0 [ 138.063689][ T1166] jfs_put_super+0x8c/0x190 [ 138.063718][ T1166] generic_shutdown_super+0x13d/0x2d0 [ 138.063739][ T1166] kill_block_super+0x44/0x90 [ 138.063781][ T1166] deactivate_locked_super+0xbc/0x130 [ 138.063801][ T1166] cleanup_mnt+0x3d3/0x460 [ 138.063822][ T1166] task_work_run+0x1d9/0x270 [ 138.063852][ T1166] exit_to_user_mode_loop+0x1fa/0x730 [ 138.063885][ T1166] do_syscall_64+0x353/0x580 [ 138.063913][ T1166] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 138.063934][ T1166] [ 138.063940][ T1166] Memory state around the buggy address: [ 138.063952][ T1166] ffff88803d565f00: 00 fc fc 00 00 00 00 00 fc fc 00 00 00 00 00 fc [ 138.063967][ T1166] ffff88803d565f80: fc 00 00 00 00 00 fc fc 00 00 00 00 00 fc fc fc [ 138.063982][ T1166] >ffff88803d566000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 138.063998][ T1166] ^ [ 138.064009][ T1166] ffff88803d566080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 138.064024][ T1166] ffff88803d566100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 138.064035][ T1166] ================================================================== [ 138.069163][ T1166] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 138.069191][ T1166] CPU: 1 UID: 0 PID: 1166 Comm: kworker/u8:9 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 138.069217][ T1166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 138.069266][ T1166] Workqueue: loop0 loop_workfn [ 138.069373][ T1166] Call Trace: [ 138.069382][ T1166] [ 138.069399][ T1166] vpanic+0x56c/0xa60 [ 138.069499][ T1166] ? rcu_is_watching+0x15/0xb0 [ 138.069563][ T1166] ? __pfx_vpanic+0x10/0x10 [ 138.069658][ T1166] panic+0xc5/0xd0 [ 138.069740][ T1166] ? __pfx_panic+0x10/0x10 [ 138.069825][ T1166] ? preempt_schedule_thunk+0x16/0x40 [ 138.069891][ T1166] ? copy_folio_from_iter_atomic+0xbbf/0x1a30 [ 138.069979][ T1166] ? preempt_schedule_thunk+0x16/0x40 [ 138.070043][ T1166] ? copy_folio_from_iter_atomic+0xbbf/0x1a30 [ 138.070130][ T1166] check_panic_on_warn+0x89/0xb0 [ 138.070221][ T1166] ? copy_folio_from_iter_atomic+0xbbf/0x1a30 [ 138.070306][ T1166] end_report+0x73/0x170 [ 138.070368][ T1166] ? copy_folio_from_iter_atomic+0xbbf/0x1a30 [ 138.070461][ T1166] kasan_report+0x128/0x150 [ 138.070523][ T1166] ? copy_folio_from_iter_atomic+0xbbf/0x1a30 [ 138.070626][ T1166] kasan_check_range+0x264/0x2c0 [ 138.070703][ T1166] ? copy_folio_from_iter_atomic+0xbbf/0x1a30 [ 138.070814][ T1166] __asan_memcpy+0x29/0x70 [ 138.070890][ T1166] copy_folio_from_iter_atomic+0xbbf/0x1a30 [ 138.071000][ T1166] ? __pfx_copy_folio_from_iter_atomic+0x10/0x10 [ 138.071093][ T1166] ? rcu_is_watching+0x15/0xb0 [ 138.071157][ T1166] ? shmem_write_begin+0x1ce/0x320 [ 138.071251][ T1166] generic_perform_write+0x5a8/0x8b0 [ 138.071356][ T1166] ? __pfx_generic_perform_write+0x10/0x10 [ 138.071446][ T1166] ? __mark_inode_dirty+0x4e7/0x13b0 [ 138.071519][ T1166] ? preempt_count_add+0x91/0x190 [ 138.071582][ T1166] ? mnt_put_write_access_file+0xbf/0x100 [ 138.071656][ T1166] ? file_update_time_flags+0x406/0x4b0 [ 138.071723][ T1166] shmem_file_write_iter+0xfb/0x120 [ 138.071795][ T1166] lo_rw_aio+0xc78/0xf30 [ 138.071889][ T1166] ? __pfx_lo_rw_aio+0x10/0x10 [ 138.071974][ T1166] ? kthread_associate_blkcg+0x490/0x600 [ 138.072063][ T1166] ? rt_spin_unlock+0x163/0x200 [ 138.072187][ T1166] loop_process_work+0x638/0x11d0 [ 138.072309][ T1166] ? __pfx_loop_process_work+0x10/0x10 [ 138.072391][ T1166] ? look_up_lock_class+0x57/0x110 [ 138.072476][ T1166] ? register_lock_class+0x31/0x2e0 [ 138.072572][ T1166] ? __lock_acquire+0x683/0x2ce0 [ 138.072633][ T1166] ? irqentry_exit+0x218/0x8f0 [ 138.072707][ T1166] ? lockdep_hardirqs_on+0x7a/0x110 [ 138.072782][ T1166] ? irqentry_exit+0x218/0x8f0 [ 138.072856][ T1166] ? trace_irq_disable+0x3b/0x140 [ 138.072952][ T1166] ? do_raw_spin_lock+0x12b/0x2f0 [ 138.073035][ T1166] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 138.073118][ T1166] ? process_scheduled_works+0xa20/0x14e0 [ 138.073180][ T1166] ? process_scheduled_works+0xa20/0x14e0 [ 138.073244][ T1166] ? rcu_is_watching+0x15/0xb0 [ 138.073308][ T1166] ? process_scheduled_works+0xa20/0x14e0 [ 138.073372][ T1166] process_scheduled_works+0xa8e/0x14e0 [ 138.073495][ T1166] ? __pfx_process_scheduled_works+0x10/0x10 [ 138.073580][ T1166] ? assign_work+0x3cf/0x5d0 [ 138.073643][ T1166] worker_thread+0xa47/0xfb0 [ 138.073724][ T1166] ? __kthread_parkme+0x71/0x1f0 [ 138.073806][ T1166] kthread+0x388/0x470 [ 138.073882][ T1166] ? __pfx_worker_thread+0x10/0x10 [ 138.073939][ T1166] ? __pfx_kthread+0x10/0x10 [ 138.074013][ T1166] ret_from_fork+0x514/0xb70 [ 138.074098][ T1166] ? __pfx_ret_from_fork+0x10/0x10 [ 138.074180][ T1166] ? __switch_to+0xc89/0x1420 [ 138.074245][ T1166] ? __pfx_kthread+0x10/0x10 [ 138.074326][ T1166] ret_from_fork_asm+0x1a/0x30 [ 138.074431][ T1166] [ 138.074615][ T1166] Kernel Offset: disabled