Warning: Permanently added '[localhost]:9323' (ED25519) to the list of known hosts. syzkaller login: [ 97.086728][ T9] cfg80211: failed to load regulatory.db 2026/06/26 13:27:29 parsed 1 programs 2026/06/26 13:27:29 serving rpc on tcp://40777 [ 100.233574][ T5296] cgroup: Unknown subsys name 'net' [ 100.311743][ T5296] cgroup: Unknown subsys name 'cpuset' [ 100.318181][ T5296] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 101.967951][ T5296] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x400000) [ 104.131370][ T1029] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1 [ 104.149100][ T1029] ata1: failed to read log page 10h (errno=-5) [ 104.165708][ T1029] ata1.00: exception Emask 0x1 SAct 0x100 SErr 0x0 action 0x0 [ 104.186620][ T1029] ata1.00: irq_stat 0x41000008 [ 104.200113][ T1029] ata1.00: failed command: WRITE FPDMA QUEUED [ 104.213562][ T1029] ata1.00: cmd 61/00:40:36:61:0c/20:00:00:00:00/40 tag 8 ncq dma 4194304 ou [ 104.213562][ T1029] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 104.259437][ T1029] ata1.00: status: { DRDY } [ 104.270098][ T1029] ata1.00: error: { ABRT } [ 104.292509][ T1029] ata1.00: configured for UDMA/100 [ 104.316223][ T1029] ata1: EH complete [ 108.350899][ T5314] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 111.513931][ T5350] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 111.524482][ T44] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 111.530472][ T44] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 111.538842][ T44] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 111.542454][ T44] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 112.065852][ T1158] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.076446][ T1158] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.117023][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.121381][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.984010][ T5382] bridge0: port 1(bridge_slave_0) entered blocking state [ 116.989282][ T5382] bridge0: port 1(bridge_slave_0) entered disabled state [ 116.993041][ T5382] bridge_slave_0: entered allmulticast mode [ 116.997998][ T5382] bridge_slave_0: entered promiscuous mode [ 117.006745][ T5382] bridge0: port 2(bridge_slave_1) entered blocking state [ 117.010756][ T5382] bridge0: port 2(bridge_slave_1) entered disabled state [ 117.014094][ T5382] bridge_slave_1: entered allmulticast mode [ 117.018896][ T5382] bridge_slave_1: entered promiscuous mode [ 117.051911][ T5382] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 117.060012][ T5382] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 117.085314][ T5382] team0: Port device team_slave_0 added [ 117.090425][ T5382] team0: Port device team_slave_1 added [ 117.121652][ T5382] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 117.125052][ T5382] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 117.137148][ T5382] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 117.143053][ T5382] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 117.146364][ T5382] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 117.158777][ T5382] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 117.206581][ T5382] hsr_slave_0: entered promiscuous mode [ 117.210621][ T5382] hsr_slave_1: entered promiscuous mode [ 117.527232][ T5382] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 117.554552][ T5382] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 117.567138][ T5382] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 117.586411][ T5382] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 117.599462][ T5382] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 117.618121][ T5382] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 117.621966][ T5382] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 117.641138][ T5382] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 117.750689][ T5382] bridge0: port 2(bridge_slave_1) entered blocking state [ 117.753934][ T5382] bridge0: port 2(bridge_slave_1) entered forwarding state [ 117.758680][ T5382] bridge0: port 1(bridge_slave_0) entered blocking state [ 117.763064][ T5382] bridge0: port 1(bridge_slave_0) entered forwarding state [ 117.796537][ T131] bridge0: port 1(bridge_slave_0) entered disabled state [ 117.800639][ T131] bridge0: port 2(bridge_slave_1) entered disabled state [ 117.902035][ T5382] 8021q: adding VLAN 0 to HW filter on device bond0 [ 117.936250][ T5382] 8021q: adding VLAN 0 to HW filter on device team0 [ 117.948602][ T131] bridge0: port 1(bridge_slave_0) entered blocking state [ 117.953063][ T131] bridge0: port 1(bridge_slave_0) entered forwarding state [ 117.981296][ T131] bridge0: port 2(bridge_slave_1) entered blocking state [ 117.984533][ T131] bridge0: port 2(bridge_slave_1) entered forwarding state [ 118.390690][ T5382] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 118.469856][ T5382] veth0_vlan: entered promiscuous mode [ 118.483706][ T5382] veth1_vlan: entered promiscuous mode [ 118.530898][ T5382] veth0_macvtap: entered promiscuous mode [ 118.539648][ T5382] veth1_macvtap: entered promiscuous mode [ 118.565551][ T5382] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 118.580874][ T5382] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 118.600827][ T131] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 118.617829][ T131] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 118.641152][ T131] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 118.657417][ T131] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.091078][ T55] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.167925][ T55] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.247684][ T55] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2026/06/26 13:27:51 executed programs: 0 [ 119.845473][ T4653] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 119.853535][ T4653] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 119.858429][ T4653] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 119.862247][ T4653] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 119.868333][ T4653] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 120.073720][ T55] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 120.597053][ T5426] bridge0: port 1(bridge_slave_0) entered blocking state [ 120.604666][ T5426] bridge0: port 1(bridge_slave_0) entered disabled state [ 120.608212][ T5426] bridge_slave_0: entered allmulticast mode [ 120.621321][ T5426] bridge_slave_0: entered promiscuous mode [ 120.629224][ T5426] bridge0: port 2(bridge_slave_1) entered blocking state [ 120.644871][ T5426] bridge0: port 2(bridge_slave_1) entered disabled state [ 120.647991][ T5426] bridge_slave_1: entered allmulticast mode [ 120.655081][ T5426] bridge_slave_1: entered promiscuous mode [ 120.722608][ T5426] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 120.736672][ T5426] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 120.771969][ T5426] team0: Port device team_slave_0 added [ 120.783200][ T5426] team0: Port device team_slave_1 added [ 120.808886][ T5426] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 120.812344][ T5426] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 120.824564][ T5426] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 120.830854][ T5426] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 120.840086][ T5426] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 120.850906][ T5426] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 120.900225][ T5426] hsr_slave_0: entered promiscuous mode [ 120.903517][ T5426] hsr_slave_1: entered promiscuous mode [ 120.907249][ T5426] debugfs: 'hsr0' already exists in 'hsr' [ 120.910397][ T5426] Cannot create hsr debugfs directory [ 121.317902][ T55] bridge_slave_1: left allmulticast mode [ 121.326508][ T55] bridge_slave_1: left promiscuous mode [ 121.333362][ T55] bridge0: port 2(bridge_slave_1) entered disabled state [ 121.366842][ T55] bridge_slave_0: left allmulticast mode [ 121.369407][ T55] bridge_slave_0: left promiscuous mode [ 121.373528][ T55] bridge0: port 1(bridge_slave_0) entered disabled state [ 121.626959][ T55] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 121.633857][ T55] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 121.652522][ T55] bond0 (unregistering): Released all slaves [ 121.856281][ T55] hsr_slave_0: left promiscuous mode [ 121.869771][ T55] hsr_slave_1: left promiscuous mode [ 121.885037][ T55] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 121.906394][ T55] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 121.931705][ T55] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 121.953163][ T55] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 121.962366][ T4653] Bluetooth: hci0: command tx timeout [ 122.083389][ T55] veth1_macvtap: left promiscuous mode [ 122.097827][ T55] veth0_macvtap: left promiscuous mode [ 122.108990][ T55] veth1_vlan: left promiscuous mode [ 122.124039][ T55] veth0_vlan: left promiscuous mode [ 122.542429][ T55] team0 (unregistering): Port device team_slave_1 removed [ 122.552263][ T55] team0 (unregistering): Port device team_slave_0 removed [ 122.742923][ T4999] 8021q: adding VLAN 0 to HW filter on device eth2 [ 123.454944][ T5426] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 123.471108][ T5426] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 123.485720][ T5426] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 123.499054][ T5426] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 123.509654][ T5426] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 123.529551][ T5426] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 123.537851][ T5426] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 123.556572][ T5426] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 123.681982][ T5426] 8021q: adding VLAN 0 to HW filter on device bond0 [ 123.701259][ T5426] 8021q: adding VLAN 0 to HW filter on device team0 [ 123.712524][ T55] bridge0: port 1(bridge_slave_0) entered blocking state [ 123.715832][ T55] bridge0: port 1(bridge_slave_0) entered forwarding state [ 123.732966][ T55] bridge0: port 2(bridge_slave_1) entered blocking state [ 123.736829][ T55] bridge0: port 2(bridge_slave_1) entered forwarding state [ 124.034617][ T4653] Bluetooth: hci0: command tx timeout [ 124.105590][ T5426] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 124.151076][ T5426] veth0_vlan: entered promiscuous mode [ 124.162163][ T5426] veth1_vlan: entered promiscuous mode [ 124.203679][ T5426] veth0_macvtap: entered promiscuous mode [ 124.219766][ T5426] veth1_macvtap: entered promiscuous mode [ 124.239527][ T5426] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 124.252469][ T5426] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 124.265912][ T177] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 124.282408][ T177] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 124.291858][ T177] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 124.306432][ T177] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 124.401095][ T1158] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 124.408666][ T1158] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 124.463321][ T55] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 124.468995][ T55] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 124.606557][ T5474] loop0: detected capacity change from 0 to 128 [ 124.617056][ T5474] ======================================================= [ 124.617056][ T5474] WARNING: The mand mount option has been deprecated and [ 124.617056][ T5474] and is ignored by this kernel. Remove the mand [ 124.617056][ T5474] option from the mount to silence this warning. [ 124.617056][ T5474] ======================================================= [ 124.671272][ T5474] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 124.686791][ T5474] hpfs: filesystem error: improperly stopped [ 124.691366][ T5474] hpfs: You really don't want any checks? You are crazy... [ 124.697205][ T5474] hpfs: hpfs_map_sector(): read error [ 124.699620][ T5474] hpfs: code page support is disabled [ 124.702602][ T5474] ================================================================== [ 124.705649][ T5474] BUG: KASAN: use-after-free in strcmp+0x6b/0xc0 [ 124.708293][ T5474] Read of size 1 at addr ffff88804538c8a6 by task syz.0.17/5474 [ 124.711274][ T5474] [ 124.712238][ T5474] CPU: 0 UID: 0 PID: 5474 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 124.712251][ T5474] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 124.712258][ T5474] Call Trace: [ 124.712263][ T5474] [ 124.712268][ T5474] dump_stack_lvl+0xe8/0x150 [ 124.712285][ T5474] print_address_description+0x55/0x1e0 [ 124.712297][ T5474] ? strcmp+0x6b/0xc0 [ 124.712307][ T5474] print_report+0x58/0x70 [ 124.712319][ T5474] kasan_report+0x117/0x150 [ 124.712330][ T5474] ? strcmp+0x6b/0xc0 [ 124.712346][ T5474] strcmp+0x6b/0xc0 [ 124.712356][ T5474] hpfs_get_ea+0x137/0xeb0 [ 124.712369][ T5474] ? __pfx_hpfs_get_ea+0x10/0x10 [ 124.712384][ T5474] ? __bread_gfp+0x2d2/0x380 [ 124.712397][ T5474] ? hpfs_map_sector+0x149/0x370 [ 124.712410][ T5474] hpfs_read_inode+0x1a9/0x1060 [ 124.712424][ T5474] ? __pfx_hpfs_read_inode+0x10/0x10 [ 124.712434][ T5474] ? inode_set_ctime_to_ts+0x116/0x2e0 [ 124.712448][ T5474] ? __pfx_inode_set_ctime_to_ts+0x10/0x10 [ 124.712460][ T5474] ? do_raw_spin_unlock+0x4d/0x210 [ 124.712479][ T5474] ? hpfs_init_inode+0x216/0x350 [ 124.712493][ T5474] hpfs_fill_super+0x1275/0x1fa0 [ 124.712511][ T5474] ? __pfx_hpfs_fill_super+0x10/0x10 [ 124.712526][ T5474] ? __pfx_snprintf+0x10/0x10 [ 124.712539][ T5474] ? set_blocksize+0x1c9/0x440 [ 124.712603][ T5474] ? sb_set_blocksize+0x155/0x240 [ 124.712617][ T5474] ? setup_bdev_super+0x4c1/0x5b0 [ 124.712631][ T5474] get_tree_bdev_flags+0x430/0x4f0 [ 124.712642][ T5474] ? __pfx_hpfs_fill_super+0x10/0x10 [ 124.712655][ T5474] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 124.712668][ T5474] vfs_get_tree+0x92/0x2a0 [ 124.712679][ T5474] do_new_mount+0x319/0xdc0 [ 124.712693][ T5474] ? __pfx__printk+0x10/0x10 [ 124.712710][ T5474] ? __pfx_do_new_mount+0x10/0x10 [ 124.712726][ T5474] ? path_mount+0x647/0x1040 [ 124.712740][ T5474] ? user_path_at+0xd4/0x160 [ 124.712786][ T5474] __se_sys_mount+0x31d/0x420 [ 124.712802][ T5474] ? __pfx___se_sys_mount+0x10/0x10 [ 124.712818][ T5474] ? __x64_sys_mount+0x20/0xc0 [ 124.712832][ T5474] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.712856][ T5474] do_syscall_64+0x174/0x580 [ 124.712873][ T5474] ? trace_irq_disable+0x3b/0x140 [ 124.712884][ T5474] ? clear_bhb_loop+0x40/0x90 [ 124.712897][ T5474] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.712909][ T5474] RIP: 0033:0x7fd89cd9e0ca [ 124.712922][ T5474] Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 124.712932][ T5474] RSP: 002b:00007fd89dcc6e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 124.712946][ T5474] RAX: ffffffffffffffda RBX: 00007fd89dcc6ee0 RCX: 00007fd89cd9e0ca [ 124.712955][ T5474] RDX: 0000200000009e80 RSI: 0000200000009ec0 RDI: 00007fd89dcc6ea0 [ 124.712963][ T5474] RBP: 0000200000009e80 R08: 00007fd89dcc6ee0 R09: 0000000000000041 [ 124.712970][ T5474] R10: 0000000000000041 R11: 0000000000000246 R12: 0000200000009ec0 [ 124.712978][ T5474] R13: 00007fd89dcc6ea0 R14: 0000000000009e05 R15: 0000200000009f00 [ 124.712991][ T5474] [ 124.712995][ T5474] [ 124.844869][ T5474] The buggy address belongs to the physical page: [ 124.847694][ T5474] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x7fcbb51f6 pfn:0x4538c [ 124.852227][ T5474] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 124.856079][ T5474] raw: 04fff00000000000 ffffea000114e348 ffffea000114e2c8 0000000000000000 [ 124.859825][ T5474] raw: 00000007fcbb51f6 0000000000000000 00000000ffffffff 0000000000000000 [ 124.863608][ T5474] page dumped because: kasan: bad access detected [ 124.866340][ T5474] page_owner tracks the page as freed [ 124.868706][ T5474] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO|__GFP_COMP), pid 5296, tgid 5296 (syz-executor), ts 103099142858, free_ts 105492285470 [ 124.877620][ T5474] post_alloc_hook+0x1f9/0x250 [ 124.879759][ T5474] get_page_from_freelist+0x21fa/0x2270 [ 124.882136][ T5474] __alloc_frozen_pages_noprof+0x18d/0x380 [ 124.884697][ T5474] alloc_pages_mpol+0x212/0x380 [ 124.887047][ T5474] folio_alloc_mpol_noprof+0x39/0x160 [ 124.890063][ T5474] vma_alloc_folio_noprof+0xe1/0x1e0 [ 124.892693][ T5474] do_pte_missing+0x173a/0x34b0 [ 124.895062][ T5474] handle_mm_fault+0x1b36/0x3080 [ 124.897324][ T5474] do_user_addr_fault+0xa4d/0x1340 [ 124.899618][ T5474] exc_page_fault+0x6a/0xc0 [ 124.901641][ T5474] asm_exc_page_fault+0x26/0x30 [ 124.903896][ T5474] page last free pid 5296 tgid 5296 stack trace: [ 124.907044][ T5474] free_unref_folios+0xd84/0x14a0 [ 124.909808][ T5474] folios_put_refs+0x9e9/0xb30 [ 124.911971][ T5474] free_pages_and_swap_cache+0x2ba/0x490 [ 124.914390][ T5474] tlb_flush_mmu+0x6d3/0xa30 [ 124.916456][ T5474] tlb_finish_mmu+0xf4/0x220 [ 124.918497][ T5474] unmap_region+0x2a5/0x330 [ 124.920908][ T5474] vms_complete_munmap_vmas+0x427/0xbe0 [ 124.924065][ T5474] do_vmi_align_munmap+0x3b7/0x4b0 [ 124.926953][ T5474] do_vmi_munmap+0x252/0x2d0 [ 124.928875][ T5474] __vm_munmap+0x241/0x3e0 [ 124.930866][ T5474] __x64_sys_munmap+0x60/0x70 [ 124.932894][ T5474] do_syscall_64+0x174/0x580 [ 124.934825][ T5474] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.937376][ T5474] [ 124.938416][ T5474] Memory state around the buggy address: [ 124.940869][ T5474] ffff88804538c780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 124.944322][ T5474] ffff88804538c800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 124.949627][ T5474] >ffff88804538c880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 124.953965][ T5474] ^ [ 124.956099][ T5474] ffff88804538c900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 124.959352][ T5474] ffff88804538c980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 124.962788][ T5474] ================================================================== [ 124.982094][ T5474] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 124.985625][ T5474] CPU: 0 UID: 0 PID: 5474 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 124.989770][ T5474] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 124.995059][ T5474] Call Trace: [ 124.996903][ T5474] [ 124.998419][ T5474] vpanic+0x56c/0xa60 [ 125.000251][ T5474] ? __pfx_vpanic+0x10/0x10 [ 125.002295][ T5474] ? __pfx___schedule+0x10/0x10 [ 125.004402][ T5474] panic+0xc5/0xd0 [ 125.006086][ T5474] ? __pfx_panic+0x10/0x10 [ 125.008047][ T5474] ? preempt_schedule_thunk+0x16/0x40 [ 125.010502][ T5474] ? strcmp+0x6b/0xc0 [ 125.012412][ T5474] check_panic_on_warn+0x89/0xb0 [ 125.014822][ T5474] ? strcmp+0x6b/0xc0 [ 125.016778][ T5474] end_report+0x73/0x170 [ 125.018709][ T5474] ? strcmp+0x6b/0xc0 [ 125.020519][ T5474] kasan_report+0x128/0x150 [ 125.022425][ T5474] ? strcmp+0x6b/0xc0 [ 125.024098][ T5474] strcmp+0x6b/0xc0 [ 125.025802][ T5474] hpfs_get_ea+0x137/0xeb0 [ 125.028092][ T5474] ? __pfx_hpfs_get_ea+0x10/0x10 [ 125.031251][ T5474] ? __bread_gfp+0x2d2/0x380 [ 125.033356][ T5474] ? hpfs_map_sector+0x149/0x370 [ 125.035464][ T5474] hpfs_read_inode+0x1a9/0x1060 [ 125.037611][ T5474] ? __pfx_hpfs_read_inode+0x10/0x10 [ 125.039990][ T5474] ? inode_set_ctime_to_ts+0x116/0x2e0 [ 125.042523][ T5474] ? __pfx_inode_set_ctime_to_ts+0x10/0x10 [ 125.045371][ T5474] ? do_raw_spin_unlock+0x4d/0x210 [ 125.047864][ T5474] ? hpfs_init_inode+0x216/0x350 [ 125.050318][ T5474] hpfs_fill_super+0x1275/0x1fa0 [ 125.052658][ T5474] ? __pfx_hpfs_fill_super+0x10/0x10 [ 125.054860][ T5474] ? __pfx_snprintf+0x10/0x10 [ 125.056957][ T5474] ? set_blocksize+0x1c9/0x440 [ 125.059003][ T5474] ? sb_set_blocksize+0x155/0x240 [ 125.061407][ T5474] ? setup_bdev_super+0x4c1/0x5b0 [ 125.064131][ T5474] get_tree_bdev_flags+0x430/0x4f0 [ 125.066928][ T5474] ? __pfx_hpfs_fill_super+0x10/0x10 [ 125.069168][ T5474] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 125.071494][ T5474] vfs_get_tree+0x92/0x2a0 [ 125.073453][ T5474] do_new_mount+0x319/0xdc0 [ 125.075379][ T5474] ? __pfx__printk+0x10/0x10 [ 125.077472][ T5474] ? __pfx_do_new_mount+0x10/0x10 [ 125.079833][ T5474] ? path_mount+0x647/0x1040 [ 125.082529][ T5474] ? user_path_at+0xd4/0x160 [ 125.085118][ T5474] __se_sys_mount+0x31d/0x420 [ 125.087464][ T5474] ? __pfx___se_sys_mount+0x10/0x10 [ 125.089656][ T5474] ? __x64_sys_mount+0x20/0xc0 [ 125.091727][ T5474] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.094284][ T5474] do_syscall_64+0x174/0x580 [ 125.096257][ T5474] ? trace_irq_disable+0x3b/0x140 [ 125.098533][ T5474] ? clear_bhb_loop+0x40/0x90 [ 125.100659][ T5474] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.103695][ T5474] RIP: 0033:0x7fd89cd9e0ca [ 125.105692][ T5474] Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 125.114095][ T5474] RSP: 002b:00007fd89dcc6e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 125.118011][ T5474] RAX: ffffffffffffffda RBX: 00007fd89dcc6ee0 RCX: 00007fd89cd9e0ca [ 125.121985][ T5474] RDX: 0000200000009e80 RSI: 0000200000009ec0 RDI: 00007fd89dcc6ea0 [ 125.126827][ T5474] RBP: 0000200000009e80 R08: 00007fd89dcc6ee0 R09: 0000000000000041 [ 125.130945][ T5474] R10: 0000000000000041 R11: 0000000000000246 R12: 0000200000009ec0 [ 125.134215][ T5474] R13: 00007fd89dcc6ea0 R14: 0000000000009e05 R15: 0000200000009f00 [ 125.137605][ T5474] [ 125.139307][ T5474] Kernel Offset: disabled [ 125.141191][ T5474] Rebooting in 86400 seconds.. VM DIAGNOSIS: 13:27:56 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000050 RBX=0000000000000050 RCX=0000000000000000 RDX=00000000000003f8 RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc9000398efb0 R8 =ffff888034478237 R9 =1ffff1100688f046 R10=dffffc0000000000 R11=ffffffff854ce0d0 R12=dffffc0000000000 R13=ffffffff9a8101c0 R14=ffffffff9a810200 R15=0000000000000000 RIP=ffffffff854ce14c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00007fd89dcc76c0 ffffffff 00c00000 GS =0000 ffff88808c81b000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007ffe605bdb8c CR3=0000000044039000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000001000000 Opmask01=0000000001000003 Opmask02=00000000ffffffef Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 307a79732f74656e 2f70756f7267637a ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffd11dd97a6 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffd11dd97a6 00007ffd11dd97ac ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd89ce33452 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd89ce33492 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd89ce335f6 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd89ce33484 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6379656b00657461 69746e6174736e69 246c746379656b00 7974697275636573 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000004 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000154 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000004 0000000000000000 0000000000000000 0000000000000154 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000