syzkaller login: [ 92.036042][ T9] cfg80211: failed to load regulatory.db
Warning: Permanently added '[localhost]:45233' (ED25519) to the list of known hosts.
2026/10/22 02:31:41 parsed 1 programs
2026/10/22 02:31:41 serving rpc on tcp://46607
qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x400000)
[ 98.045885][ T1025] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1
[ 98.045903][ T1025] ata1: failed to read log page 10h (errno=-5)
[ 98.045915][ T1025] ata1.00: exception Emask 0x1 SAct 0xf000 SErr 0x0 action 0x0
[ 98.045926][ T1025] ata1.00: irq_stat 0x41000000
[ 98.045935][ T1025] ata1.00: failed command: WRITE FPDMA QUEUED
[ 98.045943][ T1025] ata1.00: cmd 61/00:60:c6:54:04/20:00:00:00:00/40 tag 12 ncq dma 4194304 ou
[ 98.045943][ T1025] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 98.045973][ T1025] ata1.00: status: { DRDY }
[ 98.045983][ T1025] ata1.00: failed command: WRITE FPDMA QUEUED
[ 98.045989][ T1025] ata1.00: cmd 61/70:68:c6:74:04/0c:00:00:00:00/40 tag 13 ncq dma 1630208 ou
[ 98.045989][ T1025] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 98.046019][ T1025] ata1.00: status: { DRDY }
[ 98.046028][ T1025] ata1.00: failed command: WRITE FPDMA QUEUED
[ 98.046034][ T1025] ata1.00: cmd 61/00:70:36:81:04/20:00:00:00:00/40 tag 14 ncq dma 4194304 ou
[ 98.046034][ T1025] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 98.046063][ T1025] ata1.00: status: { DRDY }
[ 98.046073][ T1025] ata1.00: failed command: WRITE FPDMA QUEUED
[ 98.046079][ T1025] ata1.00: cmd 61/00:78:36:a1:04/20:00:00:00:00/40 tag 15 ncq dma 4194304 ou
[ 98.046079][ T1025] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 98.046109][ T1025] ata1.00: status: { DRDY }
[ 98.047855][ T1025] ata1.00: configured for UDMA/100
[ 98.049617][ T1025] ata1: EH complete
[ 99.912328][ T5286] cgroup: Unknown subsys name 'net'
[ 99.983302][ T5286] cgroup: Unknown subsys name 'cpuset'
[ 99.990045][ T5286] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 101.645190][ T5286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0xca000)
[ 103.126266][ T1025] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1
[ 103.126300][ T1025] ata1: failed to read log page 10h (errno=-5)
[ 103.126313][ T1025] ata1.00: exception Emask 0x1 SAct 0x40000001 SErr 0x0 action 0x0
[ 103.126324][ T1025] ata1.00: irq_stat 0x41000000
[ 103.126333][ T1025] ata1.00: failed command: WRITE FPDMA QUEUED
[ 103.126340][ T1025] ata1.00: cmd 61/b0:00:7e:20:05/04:00:00:00:00/40 tag 0 ncq dma 614400 out
[ 103.126340][ T1025] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 103.126371][ T1025] ata1.00: status: { DRDY }
[ 103.126382][ T1025] ata1.00: failed command: WRITE FPDMA QUEUED
[ 103.126388][ T1025] ata1.00: cmd 61/50:f0:2e:1a:05/06:00:00:00:00/40 tag 30 ncq dma 827392 out
[ 103.126388][ T1025] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 103.126417][ T1025] ata1.00: status: { DRDY }
[ 103.130160][ T1025] ata1.00: configured for UDMA/100
[ 103.130598][ T1025] ata1: EH complete
[ 105.854686][ T5305] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 106.129943][ T4644] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 106.131240][ T4644] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 106.131648][ T4644] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 106.132420][ T4644] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 106.132871][ T4644] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 111.233261][ T5345] rxe_eth0 speed is unknown, defaulting to 1000
[ 111.240130][ T5345] rxe_eth0 speed is unknown, defaulting to 1000
[ 111.255390][ T5345] rxe_eth0 speed is unknown, defaulting to 1000
[ 111.546152][ T5345] infiniband rxe0: set active
[ 111.548910][ T5345] infiniband rxe0: added rxe_eth0
[ 111.560283][ T9] rxe_eth0 speed is unknown, defaulting to 1000
[ 111.594020][ T5345] smbdirect: ib_dev[rxe0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000
[ 111.594050][ T5345] smbdirect: ib_dev[rxe0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32
[ 111.594065][ T5345] smbdirect: ib_dev[rxe0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005
[ 111.650430][ T5345] RDS/IB: rxe0: added
[ 111.652543][ T5345] smc: adding ib device rxe0 with port count 1
[ 111.652633][ T5345] smc: ib device rxe0 port 1 has no pnetid
[ 111.653453][ T9] rxe_eth0 speed is unknown, defaulting to 1000
[ 111.690718][ T5345] rxe_eth0 speed is unknown, defaulting to 1000
[ 112.298430][ T5345] bridge0: port 1(bridge_slave_0) entered blocking state
[ 112.299368][ T5345] bridge0: port 1(bridge_slave_0) entered disabled state
[ 112.299440][ T5345] bridge_slave_0: entered allmulticast mode
[ 112.300902][ T5345] bridge_slave_0: entered promiscuous mode
[ 112.317591][ T5345] bridge0: port 2(bridge_slave_1) entered blocking state
[ 112.317666][ T5345] bridge0: port 2(bridge_slave_1) entered disabled state
[ 112.317792][ T5345] bridge_slave_1: entered allmulticast mode
[ 112.319039][ T5345] bridge_slave_1: entered promiscuous mode
[ 112.389462][ T5345] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 112.403557][ T5345] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 112.461825][ T5345] team0: Port device team_slave_0 added
[ 112.470144][ T5345] team0: Port device team_slave_1 added
[ 112.524718][ T5345] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 112.525531][ T5345] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 112.525549][ T5345] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 112.531095][ T5345] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 112.531105][ T5345] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 112.531117][ T5345] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 112.665088][ T5345] hsr_slave_0: entered promiscuous mode
[ 112.667028][ T5345] hsr_slave_1: entered promiscuous mode
[ 113.067129][ T5345] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 113.081706][ T5345] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 113.083451][ T5345] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 113.093903][ T5345] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 113.094858][ T5345] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 113.098375][ T5345] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 113.099177][ T5345] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 113.103032][ T5345] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 113.219241][ T5345] 8021q: adding VLAN 0 to HW filter on device bond0
[ 113.242059][ T5345] 8021q: adding VLAN 0 to HW filter on device team0
[ 113.254068][ T54] bridge0: port 1(bridge_slave_0) entered blocking state
[ 113.254185][ T54] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 113.262840][ T1055] bridge0: port 2(bridge_slave_1) entered blocking state
[ 113.262976][ T1055] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 113.699352][ T5345] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 113.746683][ T5345] veth0_vlan: entered promiscuous mode
[ 113.760367][ T5345] veth1_vlan: entered promiscuous mode
[ 113.798012][ T5345] veth0_macvtap: entered promiscuous mode
[ 113.811792][ T5345] veth1_macvtap: entered promiscuous mode
[ 113.832553][ T5345] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 113.844660][ T5345] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 113.864935][ T1055] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 113.934943][ T93] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 113.939978][ T1055] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 113.940140][ T1055] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 114.118592][ T93] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 114.186318][ T93] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 114.237777][ T93] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 114.350281][ T93] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 114.440567][ T5386] rxe_eth0 speed is unknown, defaulting to 1000
[ 115.213296][ T5391] rxe_eth0 speed is unknown, defaulting to 1000
[ 115.683998][ T5396] rxe_eth0 speed is unknown, defaulting to 1000
[ 116.155351][ T93] bridge_slave_1: left allmulticast mode
[ 116.155387][ T93] bridge_slave_1: left promiscuous mode
[ 116.156104][ T93] bridge0: port 2(bridge_slave_1) entered disabled state
[ 116.173415][ T93] bridge_slave_0: left allmulticast mode
[ 116.173433][ T93] bridge_slave_0: left promiscuous mode
[ 116.173589][ T93] bridge0: port 1(bridge_slave_0) entered disabled state
[ 116.330681][ T93] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 116.333253][ T93] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 116.343217][ T93] bond0 (unregistering): Released all slaves
[ 116.400136][ T5401] rxe_eth0 speed is unknown, defaulting to 1000
[ 116.918288][ T4990] 8021q: adding VLAN 0 to HW filter on device eth2
[ 117.079842][ T93] hsr_slave_0: left promiscuous mode
[ 117.080322][ T93] hsr_slave_1: left promiscuous mode
[ 117.081459][ T93] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 117.081479][ T93] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 117.082313][ T93] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 117.082326][ T93] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 117.115556][ T93] veth1_macvtap: left promiscuous mode
[ 117.115620][ T93] veth0_macvtap: left promiscuous mode
[ 117.115729][ T93] veth1_vlan: left promiscuous mode
[ 117.115982][ T93] veth0_vlan: left promiscuous mode
[ 117.354503][ T93] team0 (unregistering): Port device team_slave_1 removed
[ 117.362416][ T93] team0 (unregistering): Port device team_slave_0 removed
[ 117.525996][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 117.526014][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 117.678527][ T54] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 117.678546][ T54] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 118.251403][ T4990] 8021q: adding VLAN 0 to HW filter on device eth3
[ 118.302629][ T5417] rxe_eth0 speed is unknown, defaulting to 1000
[ 118.997329][ T4990] 8021q: adding VLAN 0 to HW filter on device eth4
[ 119.333541][ T5432] rxe_eth0 speed is unknown, defaulting to 1000
[ 119.669176][ T4990] 8021q: adding VLAN 0 to HW filter on device eth5
[ 120.292110][ T5446] rxe_eth0 speed is unknown, defaulting to 1000
2026/10/22 02:32:07 executed programs: 0
[ 121.841910][ T4644] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 121.843186][ T4644] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 121.852416][ T4644] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 121.857599][ T4644] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 121.860990][ T4644] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 122.343435][ T5452] rxe_eth0 speed is unknown, defaulting to 1000
[ 122.648090][ T5452] bridge0: port 1(bridge_slave_0) entered blocking state
[ 122.648227][ T5452] bridge0: port 1(bridge_slave_0) entered disabled state
[ 122.648478][ T5452] bridge_slave_0: entered allmulticast mode
[ 122.649621][ T5452] bridge_slave_0: entered promiscuous mode
[ 122.664933][ T5452] bridge0: port 2(bridge_slave_1) entered blocking state
[ 122.665106][ T5452] bridge0: port 2(bridge_slave_1) entered disabled state
[ 122.665389][ T5452] bridge_slave_1: entered allmulticast mode
[ 122.666583][ T5452] bridge_slave_1: entered promiscuous mode
[ 122.701896][ T5452] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 122.710799][ T5452] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 122.736642][ T5452] team0: Port device team_slave_0 added
[ 122.739814][ T5452] team0: Port device team_slave_1 added
[ 122.766621][ T5452] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 122.766634][ T5452] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 122.766665][ T5452] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 122.768318][ T5452] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 122.768327][ T5452] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 122.768341][ T5452] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 122.837253][ T5452] hsr_slave_0: entered promiscuous mode
[ 122.838152][ T5452] hsr_slave_1: entered promiscuous mode
[ 123.479881][ T5452] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 123.490744][ T5452] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 123.492346][ T5452] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 123.507763][ T5452] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 123.509407][ T5452] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 123.521978][ T5452] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 123.527883][ T5452] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 123.539414][ T5452] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 123.683091][ T5452] 8021q: adding VLAN 0 to HW filter on device bond0
[ 123.721863][ T1188] rxe_eth0 speed is unknown, defaulting to 1000
[ 123.733436][ T5452] 8021q: adding VLAN 0 to HW filter on device team0
[ 123.752234][ T1055] bridge0: port 1(bridge_slave_0) entered blocking state
[ 123.752302][ T1055] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 123.776512][ T13] bridge0: port 2(bridge_slave_1) entered blocking state
[ 123.776748][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 123.937372][ T4644] Bluetooth: hci0: command tx timeout
[ 124.553190][ T5452] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 124.635678][ T5452] veth0_vlan: entered promiscuous mode
[ 124.655949][ T5452] veth1_vlan: entered promiscuous mode
[ 124.713049][ T5452] veth0_macvtap: entered promiscuous mode
[ 124.726680][ T5452] veth1_macvtap: entered promiscuous mode
[ 124.772826][ T5452] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 124.790847][ T5452] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 124.844042][ T1055] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 124.873955][ T54] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 124.873986][ T54] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 124.874007][ T54] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 124.991452][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 124.991470][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 125.088741][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 125.088758][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 125.250094][ T5515] ==================================================================
[ 125.250107][ T5515] BUG: KASAN: slab-use-after-free in pool_ctr+0x874/0xd60
[ 125.252597][ T5515] Read of size 8 at addr ffff888038bb3718 by task syz.0.17/5515
[ 125.252607][ T5515]
[ 125.252679][ T5515] CPU: 0 UID: 0 PID: 5515 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 125.252693][ T5515] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 125.252700][ T5515] Call Trace:
[ 125.252710][ T5515]
[ 125.252717][ T5515] dump_stack_lvl+0xe8/0x150
[ 125.252735][ T5515] print_address_description+0x55/0x1e0
[ 125.252755][ T5515] ? pool_ctr+0x874/0xd60
[ 125.252770][ T5515] print_report+0x58/0x70
[ 125.252784][ T5515] kasan_report+0x117/0x150
[ 125.252803][ T5515] ? pool_ctr+0x874/0xd60
[ 125.252820][ T5515] pool_ctr+0x874/0xd60
[ 125.252836][ T5515] ? __pfx_pool_ctr+0x10/0x10
[ 125.252856][ T5515] ? rcu_is_watching+0x16/0xb0
[ 125.252870][ T5515] ? kfree+0x4d/0x650
[ 125.252889][ T5515] ? skip_spaces+0x8a/0xa0
[ 125.252950][ T5515] ? dm_split_args+0x50b/0x5d0
[ 125.252963][ T5515] dm_table_add_target+0x58d/0xc70
[ 125.252982][ T5515] table_load+0x325/0x8a0
[ 125.252995][ T5515] ? __pfx_table_load+0x10/0x10
[ 125.253009][ T5515] dm_ctl_ioctl+0x9ec/0xe10
[ 125.253027][ T5515] ? __pfx_table_load+0x10/0x10
[ 125.253036][ T5515] ? __pfx_dm_ctl_ioctl+0x10/0x10
[ 125.253061][ T5515] ? __pfx___se_sys_futex+0x10/0x10
[ 125.253076][ T5515] ? bpf_lsm_file_ioctl+0x9/0x20
[ 125.253091][ T5515] ? __pfx_dm_ctl_ioctl+0x10/0x10
[ 125.253107][ T5515] __se_sys_ioctl+0xfc/0x170
[ 125.253118][ T5515] do_syscall_64+0x166/0x520
[ 125.253131][ T5515] ? trace_irq_disable+0x3b/0x140
[ 125.253142][ T5515] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 125.253154][ T5515] ? clear_bhb_loop+0x70/0xc0
[ 125.253171][ T5515] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 125.253183][ T5515] RIP: 0033:0x7f552a99f559
[ 125.253211][ T5515] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 125.253229][ T5515] RSP: 002b:00007ffdb14e8798 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 125.253243][ T5515] RAX: ffffffffffffffda RBX: 00007f552ac25fa0 RCX: 00007f552a99f559
[ 125.253252][ T5515] RDX: 00002000000003c0 RSI: 00000000c138fd09 RDI: 0000000000000003
[ 125.253260][ T5515] RBP: 00007f552aa36b20 R08: 0000000000000000 R09: 0000000000000000
[ 125.253267][ T5515] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 125.253273][ T5515] R13: 00007f552ac25fac R14: 00007f552ac25fa0 R15: 00007f552ac25fa0
[ 125.253286][ T5515]
[ 125.253290][ T5515]
[ 125.253294][ T5515] Allocated by task 5515:
[ 125.253310][ T5515] kasan_save_track+0x3e/0x80
[ 125.253321][ T5515] __kasan_kmalloc+0x93/0xb0
[ 125.253331][ T5515] __kmalloc_cache_node_noprof+0x3cc/0x620
[ 125.253347][ T5515] dm_get_table_device+0x23e/0x730
[ 125.253359][ T5515] dm_get_device+0x327/0x760
[ 125.253369][ T5515] pool_ctr+0x4ae/0xd60
[ 125.253383][ T5515] dm_table_add_target+0x58d/0xc70
[ 125.253392][ T5515] table_load+0x325/0x8a0
[ 125.253401][ T5515] dm_ctl_ioctl+0x9ec/0xe10
[ 125.253415][ T5515] __se_sys_ioctl+0xfc/0x170
[ 125.253424][ T5515] do_syscall_64+0x166/0x520
[ 125.253436][ T5515] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 125.253447][ T5515]
[ 125.253450][ T5515] Freed by task 5515:
[ 125.253455][ T5515] kasan_save_track+0x3e/0x80
[ 125.253464][ T5515] kasan_save_free_info+0x40/0x50
[ 125.253477][ T5515] __kasan_slab_free+0x5c/0x80
[ 125.253487][ T5515] kfree+0x1c5/0x650
[ 125.253499][ T5515] dm_put_table_device+0x255/0x2a0
[ 125.253511][ T5515] dm_get_device+0x56f/0x760
[ 125.253520][ T5515] pool_ctr+0x585/0xd60
[ 125.253533][ T5515] dm_table_add_target+0x58d/0xc70
[ 125.253542][ T5515] table_load+0x325/0x8a0
[ 125.253551][ T5515] dm_ctl_ioctl+0x9ec/0xe10
[ 125.253566][ T5515] __se_sys_ioctl+0xfc/0x170
[ 125.253575][ T5515] do_syscall_64+0x166/0x520
[ 125.253587][ T5515] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 125.253597][ T5515]
[ 125.253600][ T5515] The buggy address belongs to the object at ffff888038bb3700
[ 125.253600][ T5515] which belongs to the cache kmalloc-96 of size 96
[ 125.253609][ T5515] The buggy address is located 24 bytes inside of
[ 125.253609][ T5515] freed 96-byte region [ffff888038bb3700, ffff888038bb3760)
[ 125.253620][ T5515]
[ 125.253623][ T5515] The buggy address belongs to the physical page:
[ 125.253629][ T5515] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x38bb3
[ 125.253640][ T5515] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 125.253650][ T5515] page_type: f5(slab)
[ 125.253660][ T5515] raw: 04fff00000000000 ffff88801c041280 dead000000000100 dead000000000122
[ 125.253669][ T5515] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000
[ 125.253675][ T5515] page dumped because: kasan: bad access detected
[ 125.253680][ T5515] page_owner tracks the page as allocated
[ 125.253685][ T5515] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1055, tgid 1055 (kworker/u4:8), ts 21948088613
[ 125.253703][ T5515] post_alloc_hook+0x1f9/0x250
[ 125.253717][ T5515] get_page_from_freelist+0x2209/0x2280
[ 125.253726][ T5515] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 125.253737][ T5515] allocate_slab+0x7d/0x620
[ 125.253749][ T5515] refill_objects+0x2d5/0x350
[ 125.253761][ T5515] __pcs_replace_empty_main+0x2c8/0x6c0
[ 125.253772][ T5515] __kmalloc_cache_node_noprof+0x446/0x620
[ 125.253788][ T5515] __get_vm_area_node+0x155/0x2f0
[ 125.253801][ T5515] __vmalloc_node_range_noprof+0x343/0x1540
[ 125.253814][ T5515] __vmalloc_node_noprof+0xc2/0x100
[ 125.253828][ T5515] dup_task_struct+0x2c6/0xa00
[ 125.253840][ T5515] copy_process+0x7ea/0x44b0
[ 125.253851][ T5515] kernel_clone+0x2d7/0x940
[ 125.253863][ T5515] user_mode_thread+0x115/0x180
[ 125.253875][ T5515] call_usermodehelper_exec_work+0x5c/0x230
[ 125.253886][ T5515] process_scheduled_works+0xc3d/0x1630
[ 125.253897][ T5515] page_owner free stack trace missing
[ 125.253901][ T5515]
[ 125.253904][ T5515] Memory state around the buggy address:
[ 125.253910][ T5515] ffff888038bb3600: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc
[ 125.253917][ T5515] ffff888038bb3680: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 125.253924][ T5515] >ffff888038bb3700: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 125.253929][ T5515] ^
[ 125.253935][ T5515] ffff888038bb3780: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[ 125.253942][ T5515] ffff888038bb3800: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 125.253947][ T5515] ==================================================================
[ 125.572970][ T5515] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 125.576409][ T5515] CPU: 0 UID: 0 PID: 5515 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 125.580181][ T5515] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 125.584342][ T5515] Call Trace:
[ 125.585769][ T5515]
[ 125.587023][ T5515] vpanic+0x56d/0xa60
[ 125.588819][ T5515] ? __pfx_vpanic+0x10/0x10
[ 125.590754][ T5515] panic+0xc5/0xd0
[ 125.592372][ T5515] ? __pfx_panic+0x10/0x10
[ 125.594271][ T5515] ? preempt_schedule_thunk+0x16/0x40
[ 125.596540][ T5515] ? pool_ctr+0x874/0xd60
[ 125.598363][ T5515] ? preempt_schedule_thunk+0x16/0x40
[ 125.600620][ T5515] ? pool_ctr+0x874/0xd60
[ 125.602472][ T5515] check_panic_on_warn+0x89/0xb0
[ 125.604758][ T5515] ? pool_ctr+0x874/0xd60
[ 125.606901][ T5515] end_report+0x73/0x170
[ 125.608731][ T5515] ? pool_ctr+0x874/0xd60
[ 125.610615][ T5515] kasan_report+0x128/0x150
[ 125.612573][ T5515] ? pool_ctr+0x874/0xd60
[ 125.614409][ T5515] pool_ctr+0x874/0xd60
[ 125.616192][ T5515] ? __pfx_pool_ctr+0x10/0x10
[ 125.618275][ T5515] ? rcu_is_watching+0x16/0xb0
[ 125.620313][ T5515] ? kfree+0x4d/0x650
[ 125.622010][ T5515] ? skip_spaces+0x8a/0xa0
[ 125.623704][ T5515] ? dm_split_args+0x50b/0x5d0
[ 125.625805][ T5515] dm_table_add_target+0x58d/0xc70
[ 125.628108][ T5515] table_load+0x325/0x8a0
[ 125.629922][ T5515] ? __pfx_table_load+0x10/0x10
[ 125.632034][ T5515] dm_ctl_ioctl+0x9ec/0xe10
[ 125.633873][ T5515] ? __pfx_table_load+0x10/0x10
[ 125.635738][ T5515] ? __pfx_dm_ctl_ioctl+0x10/0x10
[ 125.637735][ T5515] ? __pfx___se_sys_futex+0x10/0x10
[ 125.639868][ T5515] ? bpf_lsm_file_ioctl+0x9/0x20
[ 125.642056][ T5515] ? __pfx_dm_ctl_ioctl+0x10/0x10
[ 125.644221][ T5515] __se_sys_ioctl+0xfc/0x170
[ 125.646198][ T5515] do_syscall_64+0x166/0x520
[ 125.648207][ T5515] ? trace_irq_disable+0x3b/0x140
[ 125.650238][ T5515] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 125.652623][ T5515] ? clear_bhb_loop+0x70/0xc0
[ 125.654503][ T5515] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 125.656900][ T5515] RIP: 0033:0x7f552a99f559
[ 125.658869][ T5515] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 125.667958][ T5515] RSP: 002b:00007ffdb14e8798 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 125.671445][ T5515] RAX: ffffffffffffffda RBX: 00007f552ac25fa0 RCX: 00007f552a99f559
[ 125.674931][ T5515] RDX: 00002000000003c0 RSI: 00000000c138fd09 RDI: 0000000000000003
[ 125.678267][ T5515] RBP: 00007f552aa36b20 R08: 0000000000000000 R09: 0000000000000000
[ 125.681577][ T5515] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 125.685048][ T5515] R13: 00007f552ac25fac R14: 00007f552ac25fa0 R15: 00007f552ac25fa0
[ 125.688452][ T5515]
[ 125.690319][ T5515] Kernel Offset: disabled
[ 125.692205][ T5515] Rebooting in 86400 seconds..
VM DIAGNOSIS:
02:32:10 Registers:
info registers vcpu 0
CPU#0
RAX=0000000000000020 RBX=0000000000000020 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90000337900
R8 =0000000000000003 R9 =0000000000000004 R10=dffffc0000000000 R11=ffffffff8577d4e0
R12=dffffc0000000000 R13=0000000000000020 R14=ffffffff9bd66560 R15=0000000000000000
RIP=ffffffff8577d55c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff88808b0a5000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007f4831b24eb8 CR3=000000004d4e4000 CR4=00352ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000
Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00312e6f732e7875 6e696c657362696c
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00312e6f732e7875 6e696c657362696c
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ff00000000000000 0000000000000000
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000001da0 0000000000033260
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000