ci2-upstream-fs/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-upstream-fs/syz-executor822457021 <...> Warning: Permanently added '10.128.0.9' (ED25519) to the list of known hosts. execve("ci2-upstream-fs/syz-executor822457021", ["ci2-upstream-fs/syz-executor822457021"], 0x7ffeb69d36f0 /* 10 vars */) = 0 brk(NULL) = 0x5555884a4000 brk(0x5555884a4d80) = 0x5555884a4d80 arch_prctl(ARCH_SET_FS, 0x5555884a4400) = 0 set_tid_address(0x5555884a46d0) = 5611 set_robust_list(0x5555884a46e0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-upstream-fs/syz-executor822457021", 4096) = 43 getrandom("\x6d\x51\x30\x71\xf1\x5e\xc1\xbd", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555884a4d80 brk(0x5555884c5d80) = 0x5555884c5d80 brk(0x5555884c6000) = 0x5555884c6000 mprotect(0x7fcb88bad000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5612 attached , child_tidptr=0x5555884a46d0) = 5612 [pid 5612] set_robust_list(0x5555884a46e0, 24 [pid 5611] rt_sigprocmask(SIG_SETMASK, [] [pid 5612] <... set_robust_list resumed>) = 0 [pid 5611] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5612] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5612] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5612] setpgid(0, 0) = 0 [pid 5612] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5612] write(3, "1000", 4) = 4 [pid 5612] close(3) = 0 [pid 5612] write(1, "executing program\n", 18) = 18 executing program [pid 5612] memfd_create("syzkaller", 0) = 3 [pid 5612] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcb806ef000 [pid 5612] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5612] munmap(0x7fcb806ef000, 138412032) = 0 [pid 5612] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5612] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5612] close(3) = 0 [pid 5612] close(4) = 0 [pid 5612] mkdir("./file1", 0777) = 0 [ 100.560855][ T5612] loop0: detected capacity change from 0 to 32768 [pid 5612] mount("/dev/loop0", "./file1", "jfs", 0, "discard,quota,errors=remount-ro,iocharset=macturkish,errors=remount-ro,quota,iocharset=maccroatian") = -1 EIO (Input/output error) [pid 5612] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 5612] ioctl(3, LOOP_CLR_FD) = 0 [ 100.666076][ T5612] Bad index:-89 of stbl[3] in dtroot [ 100.666076][ T5612] [ 100.666101][ T5612] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 100.666101][ T5612] [ 100.666659][ T5612] ERROR: (device loop0): remounting filesystem as read-only [pid 5612] close(3) = 0 [pid 5612] exit_group(0) = ? [pid 5612] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5612, si_uid=0, si_status=0, si_utime=1 /* 0.01 s */, si_stime=42 /* 0.42 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5614 attached , child_tidptr=0x5555884a46d0) = 5614 [pid 5614] set_robust_list(0x5555884a46e0, 24 [pid 5611] rt_sigprocmask(SIG_SETMASK, [] [pid 5614] <... set_robust_list resumed>) = 0 [pid 5611] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5614] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5614] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5614] setpgid(0, 0) = 0 [pid 5614] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5614] write(3, "1000", 4) = 4 [pid 5614] close(3) = 0 [pid 5614] write(1, "executing program\n", 18) = 18 executing program [pid 5614] memfd_create("syzkaller", 0) = 3 [pid 5614] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcb806ef000 [pid 5614] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5614] munmap(0x7fcb806ef000, 138412032) = 0 [pid 5614] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5614] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5614] close(3) = 0 [pid 5614] close(4) = 0 [pid 5614] mkdir("./file1", 0777) = -1 EEXIST (File exists) [ 101.186420][ T5614] loop0: detected capacity change from 0 to 32768 [ 101.228682][ T5614] Bad index:-89 of stbl[3] in dtroot [ 101.228682][ T5614] [pid 5614] mount("/dev/loop0", "./file1", "jfs", 0, "discard,quota,errors=remount-ro,iocharset=macturkish,errors=remount-ro,quota,iocharset=maccroatian") = -1 EIO (Input/output error) [pid 5614] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 5614] ioctl(3, LOOP_CLR_FD) = 0 [pid 5614] close(3) = 0 [pid 5614] exit_group(0) = ? [pid 5614] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5614, si_uid=0, si_status=0, si_utime=2 /* 0.02 s */, si_stime=20 /* 0.20 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555884a46d0) = 5617 ci2-upstream-fs/strace-static-x86_64: Process 5617 attached [ 101.228706][ T5614] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 101.228706][ T5614] [ 101.229739][ T5614] ERROR: (device loop0): remounting filesystem as read-only [pid 5611] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5617] set_robust_list(0x5555884a46e0, 24) = 0 [pid 5617] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5617] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5617] setpgid(0, 0) = 0 [pid 5617] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5617] write(3, "1000", 4) = 4 [pid 5617] close(3) = 0 [pid 5617] write(1, "executing program\n", 18) = 18 [pid 5617] memfd_create("syzkaller", 0) = 3 executing program [pid 5617] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcb806ef000 [pid 5617] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5617] munmap(0x7fcb806ef000, 138412032) = 0 [pid 5617] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5617] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5617] close(3) = 0 [pid 5617] close(4) = 0 [pid 5617] mkdir("./file1", 0777) = -1 EEXIST (File exists) [ 101.650071][ T5617] loop0: detected capacity change from 0 to 32768 [pid 5617] mount("/dev/loop0", "./file1", "jfs", 0, "discard,quota,errors=remount-ro,iocharset=macturkish,errors=remount-ro,quota,iocharset=maccroatian") = -1 EIO (Input/output error) [pid 5617] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 5617] ioctl(3, LOOP_CLR_FD) = 0 [pid 5617] close(3) = 0 [pid 5617] exit_group(0) = ? [pid 5617] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5617, si_uid=0, si_status=0, si_utime=6 /* 0.06 s */, si_stime=22 /* 0.22 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5619 attached [pid 5619] set_robust_list(0x5555884a46e0, 24 [pid 5611] <... clone resumed>, child_tidptr=0x5555884a46d0) = 5619 [pid 5619] <... set_robust_list resumed>) = 0 [pid 5611] rt_sigprocmask(SIG_SETMASK, [] [pid 5619] rt_sigprocmask(SIG_SETMASK, [] [pid 5611] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5619] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5619] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5619] setpgid(0, 0) = 0 [pid 5619] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5619] write(3, "1000", 4) = 4 [pid 5619] close(3) = 0 [pid 5619] write(1, "executing program\n", 18) = 18 executing program [pid 5619] memfd_create("syzkaller", 0) = 3 [ 101.704828][ T5617] Bad index:-89 of stbl[3] in dtroot [ 101.704828][ T5617] [ 101.704851][ T5617] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 101.704851][ T5617] [ 101.705169][ T5617] ERROR: (device loop0): remounting filesystem as read-only [pid 5619] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcb806ef000 [pid 5619] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5619] munmap(0x7fcb806ef000, 138412032) = 0 [pid 5619] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5619] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5619] close(3) = 0 [pid 5619] close(4) = 0 [pid 5619] mkdir("./file1", 0777) = -1 EEXIST (File exists) [ 102.052115][ T5619] loop0: detected capacity change from 0 to 32768 [ 102.085661][ T5619] Bad index:-89 of stbl[3] in dtroot [ 102.085661][ T5619] [ 102.085687][ T5619] ERROR: (device loop0): copy_from_dinode: Corrupt dtroot [ 102.085687][ T5619] [ 102.085962][ T5619] ERROR: (d ** replaying previous printk message ** [ 102.085962][ T5619] ERROR: (device loop0): remounting filesystem as read-only [ 102.109723][ T57] ================================================================== [ 102.109742][ T57] BUG: KASAN: use-after-free in copy_folio_from_iter_atomic+0xbbf/0x1a30 [ 102.109777][ T57] Read of size 4096 at addr ffff888032429000 by task kworker/u8:3/57 [ 102.109795][ T57] [ 102.109807][ T57] CPU: 0 UID: 0 PID: 57 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 102.109829][ T57] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 102.109841][ T57] Workqueue: loop0 loop_rootcg_workfn [ 102.109879][ T57] Call Trace: [ 102.109887][ T57] [ 102.109895][ T57] dump_stack_lvl+0xe8/0x150 [ 102.109922][ T57] print_address_description+0x55/0x1e0 [ 102.109947][ T57] ? copy_folio_from_iter_atomic+0xbbf/0x1a30 [ 102.109970][ T57] print_report+0x58/0x70 [ 102.109993][ T57] kasan_report+0x117/0x150 [ 102.110020][ T57] ? copy_folio_from_iter_atomic+0xbbf/0x1a30 [ 102.110046][ T57] kasan_check_range+0x264/0x2c0 [ 102.110072][ T57] ? copy_folio_from_iter_atomic+0xbbf/0x1a30 [ 102.110096][ T57] __asan_memcpy+0x29/0x70 [ 102.110117][ T57] copy_folio_from_iter_atomic+0xbbf/0x1a30 [ 102.110148][ T57] ? __pfx_copy_folio_from_iter_atomic+0x10/0x10 [ 102.110172][ T57] ? rcu_is_watching+0x16/0xb0 [ 102.110200][ T57] ? shmem_write_begin+0x1ce/0x320 [ 102.110223][ T57] generic_perform_write+0x5a8/0x8b0 [ 102.110249][ T57] ? __pfx_generic_perform_write+0x10/0x10 [ 102.110270][ T57] ? __mark_inode_dirty+0x4e7/0x13b0 [ 102.110293][ T57] ? preempt_count_add+0x6a/0x140 [ 102.110317][ T57] ? mnt_put_write_access_file+0xc2/0x100 [ 102.110341][ T57] ? file_update_time_flags+0x3b1/0x450 [ 102.110364][ T57] shmem_file_write_iter+0xfb/0x120 [ 102.110391][ T57] lo_rw_aio+0xc78/0xf30 [ 102.110413][ T57] ? reacquire_held_locks+0x117/0x1a0 [ 102.110439][ T57] ? __pfx_lo_rw_aio+0x10/0x10 [ 102.110461][ T57] ? rt_spin_unlock+0x159/0x200 [ 102.110490][ T57] ? kthread_associate_blkcg+0x359/0x600 [ 102.110508][ T57] ? rt_spin_unlock+0x165/0x200 [ 102.110530][ T57] loop_process_work+0x638/0x11d0 [ 102.110559][ T57] ? __lock_acquire+0x747/0x2de0 [ 102.110584][ T57] ? kthread+0x38b/0x470 [ 102.110603][ T57] ? __pfx_loop_process_work+0x10/0x10 [ 102.110622][ T57] ? look_up_lock_class+0x57/0x110 [ 102.110648][ T57] ? register_lock_class+0x31/0x2e0 [ 102.110671][ T57] ? __lock_acquire+0x747/0x2de0 [ 102.110698][ T57] ? do_raw_spin_lock+0x12b/0x2f0 [ 102.110720][ T57] ? lock_acquire+0x115/0x350 [ 102.110745][ T57] ? rcu_is_watching+0x16/0xb0 [ 102.110771][ T57] ? process_scheduled_works+0x97a/0x1630 [ 102.110794][ T57] process_scheduled_works+0xc3d/0x1630 [pid 5619] mount("/dev/loop0", "./file1", "jfs", 0, "discard,quota,errors=remount-ro,iocharset=macturkish,errors=remount-ro,quota,iocharset=maccroatian") = -1 EIO (Input/output error) [ 102.110829][ T57] ? __pfx_process_scheduled_works+0x10/0x10 [ 102.110855][ T57] ? assign_work+0x3cf/0x5d0 [ 102.110878][ T57] worker_thread+0xa47/0xfb0 [ 102.110913][ T57] kthread+0x38b/0x470 [ 102.110930][ T57] ? __pfx_worker_thread+0x10/0x10 [ 102.110953][ T57] ? __pfx_kthread+0x10/0x10 [ 102.110971][ T57] ret_from_fork+0x514/0xb70 [ 102.110991][ T57] ? __pfx_ret_from_fork+0x10/0x10 [ 102.111008][ T57] ? __switch_to+0xc89/0x1420 [ 102.111033][ T57] ? __pfx_kthread+0x10/0x10 [pid 5619] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 5619] ioctl(3, LOOP_CLR_FD) = 0 [pid 5619] close(3) = 0 [pid 5619] exit_group(0) = ? [ 102.111056][ T57] ret_from_fork_asm+0x1a/0x30 [ 102.111081][ T57] [ 102.111088][ T57] [ 102.111094][ T57] The buggy address belongs to the physical page: [ 102.111103][ T57] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x32429 [ 102.111121][ T57] flags: 0x80000000000000(node=0|zone=1) [ 102.111143][ T57] raw: 0080000000000000 ffffea0000cd2908 ffffea0000c90a88 0000000000000000 [ 102.111158][ T57] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 102.111167][ T57] page dumped because: kasan: bad access detected [ 102.111175][ T57] page_owner tracks the page as freed [ 102.111182][ T57] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xdc0(GFP_KERNEL|__GFP_ZERO), pid 5619, tgid 5619 (syz-executor822), ts 102081355523 [ 102.111210][ T57] post_alloc_hook+0x1f9/0x250 [ 102.111231][ T57] get_page_from_freelist+0x2591/0x2600 [ 102.111255][ T57] __alloc_frozen_pages_noprof+0x230/0x5c0 [ 102.111278][ T57] alloc_pages_mpol+0xd4/0x280 [ 102.111293][ T57] alloc_pages_noprof+0xd2/0x2f0 [ 102.111307][ T57] lmLogInit+0x357/0x1a20 [ 102.111329][ T57] lmLogOpen+0x4e3/0xf90 [ 102.111350][ T57] jfs_mount_rw+0xf3/0x670 [ 102.111370][ T57] jfs_fill_super+0x769/0xda0 [ 102.111388][ T57] get_tree_bdev_flags+0x430/0x4f0 [ 102.111407][ T57] vfs_get_tree+0x92/0x2a0 [ 102.111426][ T57] do_new_mount+0x319/0xdc0 [ 102.111441][ T57] __se_sys_mount+0x31d/0x420 [ 102.111456][ T57] do_syscall_64+0x166/0x520 [ 102.111470][ T57] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.111487][ T57] page last free pid 5619 tgid 5619 ts 102108064552 stack trace: [ 102.111499][ T57] __free_frozen_pages+0xf8e/0x1070 [ 102.111519][ T57] lmLogShutdown+0x44e/0x850 [ 102.111541][ T57] lmLogClose+0x28c/0x530 [ 102.111574][ T57] jfs_umount+0x2da/0x3b0 [ 102.111594][ T57] jfs_fill_super+0x9e7/0xda0 [ 102.111611][ T57] get_tree_bdev_flags+0x430/0x4f0 [ 102.111629][ T57] vfs_get_tree+0x92/0x2a0 [ 102.111647][ T57] do_new_mount+0x319/0xdc0 [ 102.111661][ T57] __se_sys_mount+0x31d/0x420 [ 102.111676][ T57] do_syscall_64+0x166/0x520 [ 102.111690][ T57] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.111706][ T57] [ 102.111710][ T57] Memory state around the buggy address: [ 102.111720][ T57] ffff888032428f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 102.111732][ T57] ffff888032428f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 102.111743][ T57] >ffff888032429000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 102.111752][ T57] ^ [ 102.111761][ T57] ffff888032429080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 102.111772][ T57] ffff888032429100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 102.111780][ T57] ================================================================== [ 102.112250][ T57] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 102.747349][ T57] CPU: 0 UID: 0 PID: 57 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 102.757686][ T57] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 102.767845][ T57] Workqueue: loop0 loop_rootcg_workfn [ 102.773353][ T57] Call Trace: [ 102.776751][ T57] [ 102.779717][ T57] vpanic+0x56d/0xa60 [ 102.783822][ T57] ? rcu_is_watching+0x16/0xb0 [ 102.789056][ T57] ? __pfx_vpanic+0x10/0x10 [ 102.793579][ T57] panic+0xc5/0xd0 [ 102.797404][ T57] ? __pfx_panic+0x10/0x10 [ 102.802291][ T57] ? preempt_schedule_thunk+0x16/0x40 [ 102.807991][ T57] ? copy_folio_from_iter_atomic+0xbbf/0x1a30 [ 102.815162][ T57] ? preempt_schedule_thunk+0x16/0x40 [ 102.821665][ T57] ? copy_folio_from_iter_atomic+0xbbf/0x1a30 [ 102.828325][ T57] check_panic_on_warn+0x89/0xb0 [ 102.833581][ T57] ? copy_folio_from_iter_atomic+0xbbf/0x1a30 [ 102.840317][ T57] end_report+0x73/0x170 [ 102.844600][ T57] ? copy_folio_from_iter_atomic+0xbbf/0x1a30 [ 102.850910][ T57] kasan_report+0x128/0x150 [ 102.856262][ T57] ? copy_folio_from_iter_atomic+0xbbf/0x1a30 [ 102.862737][ T57] kasan_check_range+0x264/0x2c0 [ 102.868397][ T57] ? copy_folio_from_iter_atomic+0xbbf/0x1a30 [ 102.874844][ T57] __asan_memcpy+0x29/0x70 [ 102.879639][ T57] copy_folio_from_iter_atomic+0xbbf/0x1a30 [ 102.885741][ T57] ? __pfx_copy_folio_from_iter_atomic+0x10/0x10 [ 102.892438][ T57] ? rcu_is_watching+0x16/0xb0 [ 102.897317][ T57] ? shmem_write_begin+0x1ce/0x320 [ 102.902460][ T57] generic_perform_write+0x5a8/0x8b0 [ 102.907862][ T57] ? __pfx_generic_perform_write+0x10/0x10 [ 102.913974][ T57] ? __mark_inode_dirty+0x4e7/0x13b0 [ 102.919832][ T57] ? preempt_count_add+0x6a/0x140 [ 102.925143][ T57] ? mnt_put_write_access_file+0xc2/0x100 [ 102.931156][ T57] ? file_update_time_flags+0x3b1/0x450 [ 102.936989][ T57] shmem_file_write_iter+0xfb/0x120 [ 102.942239][ T57] lo_rw_aio+0xc78/0xf30 [ 102.946534][ T57] ? reacquire_held_locks+0x117/0x1a0 [ 102.952034][ T57] ? __pfx_lo_rw_aio+0x10/0x10 [ 102.956995][ T57] ? rt_spin_unlock+0x159/0x200 [ 102.962152][ T57] ? kthread_associate_blkcg+0x359/0x600 [ 102.968180][ T57] ? rt_spin_unlock+0x165/0x200 [ 102.973146][ T57] loop_process_work+0x638/0x11d0 [ 102.978224][ T57] ? __lock_acquire+0x747/0x2de0 [ 102.983383][ T57] ? kthread+0x38b/0x470 [ 102.987654][ T57] ? __pfx_loop_process_work+0x10/0x10 [ 102.993160][ T57] ? look_up_lock_class+0x57/0x110 [ 102.998322][ T57] ? register_lock_class+0x31/0x2e0 [ 103.003648][ T57] ? __lock_acquire+0x747/0x2de0 [ 103.008980][ T57] ? do_raw_spin_lock+0x12b/0x2f0 [ 103.014227][ T57] ? lock_acquire+0x115/0x350 [ 103.019069][ T57] ? rcu_is_watching+0x16/0xb0 [ 103.024576][ T57] ? process_scheduled_works+0x97a/0x1630 [ 103.030514][ T57] process_scheduled_works+0xc3d/0x1630 [ 103.036282][ T57] ? __pfx_process_scheduled_works+0x10/0x10 [ 103.042397][ T57] ? assign_work+0x3cf/0x5d0 [ 103.047041][ T57] worker_thread+0xa47/0xfb0 [ 103.052222][ T57] kthread+0x38b/0x470 [ 103.056369][ T57] ? __pfx_worker_thread+0x10/0x10 [ 103.061678][ T57] ? __pfx_kthread+0x10/0x10 [ 103.066397][ T57] ret_from_fork+0x514/0xb70 [ 103.071101][ T57] ? __pfx_ret_from_fork+0x10/0x10 [ 103.076375][ T57] ? __switch_to+0xc89/0x1420 [ 103.081103][ T57] ? __pfx_kthread+0x10/0x10 [ 103.085909][ T57] ret_from_fork_asm+0x1a/0x30 [ 103.090870][ T57] [ 103.094450][ T57] Kernel Offset: disabled [ 103.099027][ T57] Rebooting in 86400 seconds..