Warning: Permanently added '10.128.1.45' (ED25519) to the list of known hosts. 2026/07/15 19:09:37 parsed 1 programs 2026/07/15 19:09:37 serving rpc on tcp://45781 [ 106.024139][ T5640] cgroup: Unknown subsys name 'net' [ 106.173131][ T5640] cgroup: Unknown subsys name 'cpuset' [ 106.183190][ T5640] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 107.929066][ T5640] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 110.962191][ T5650] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 113.568051][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.576204][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.622450][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.633674][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.169697][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 114.178865][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 114.186379][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 114.195073][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 114.207306][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 115.633617][ T5716] bridge0: port 1(bridge_slave_0) entered blocking state [ 115.641490][ T5716] bridge0: port 1(bridge_slave_0) entered disabled state [ 115.649587][ T5716] bridge_slave_0: entered allmulticast mode [ 115.657740][ T5716] bridge_slave_0: entered promiscuous mode [ 115.668658][ T5716] bridge0: port 2(bridge_slave_1) entered blocking state [ 115.675839][ T5716] bridge0: port 2(bridge_slave_1) entered disabled state [ 115.683268][ T5716] bridge_slave_1: entered allmulticast mode [ 115.690976][ T5716] bridge_slave_1: entered promiscuous mode [ 115.726282][ T5716] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 115.740590][ T5716] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 115.777370][ T5716] team0: Port device team_slave_0 added [ 115.785524][ T5716] team0: Port device team_slave_1 added [ 115.817544][ T5716] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 115.824506][ T5716] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 115.850501][ T5716] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 115.863980][ T5716] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 115.871083][ T5716] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 115.897090][ T5716] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 115.955181][ T5716] hsr_slave_0: entered promiscuous mode [ 115.963118][ T5716] hsr_slave_1: entered promiscuous mode [ 116.163881][ T5716] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 116.178655][ T5716] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 116.188349][ T5716] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 116.201090][ T5716] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 116.211853][ T5716] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 116.224934][ T5716] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 116.234714][ T5716] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 116.248943][ T5716] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 116.351239][ T5716] 8021q: adding VLAN 0 to HW filter on device bond0 [ 116.380281][ T5716] 8021q: adding VLAN 0 to HW filter on device team0 [ 116.395822][ T64] bridge0: port 1(bridge_slave_0) entered blocking state [ 116.403346][ T64] bridge0: port 1(bridge_slave_0) entered forwarding state [ 116.421467][ T1106] bridge0: port 2(bridge_slave_1) entered blocking state [ 116.428646][ T1106] bridge0: port 2(bridge_slave_1) entered forwarding state [ 116.962716][ T5716] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 117.040130][ T5716] veth0_vlan: entered promiscuous mode [ 117.055660][ T5716] veth1_vlan: entered promiscuous mode [ 117.100386][ T5716] veth0_macvtap: entered promiscuous mode [ 117.112170][ T5716] veth1_macvtap: entered promiscuous mode [ 117.136374][ T5716] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 117.161337][ T5716] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 117.187314][ T1106] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.215507][ T1106] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.226234][ T1106] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.255077][ T1106] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.461001][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 117.581692][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2026/07/15 19:09:55 executed programs: 0 [ 118.253337][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 118.262670][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 118.271353][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 118.279408][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 118.287900][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 118.613692][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 118.957239][ T5761] bridge0: port 1(bridge_slave_0) entered blocking state [ 118.964502][ T5761] bridge0: port 1(bridge_slave_0) entered disabled state [ 118.971942][ T5761] bridge_slave_0: entered allmulticast mode [ 118.979974][ T5761] bridge_slave_0: entered promiscuous mode [ 118.990128][ T5761] bridge0: port 2(bridge_slave_1) entered blocking state [ 118.997377][ T5761] bridge0: port 2(bridge_slave_1) entered disabled state [ 119.004548][ T5761] bridge_slave_1: entered allmulticast mode [ 119.012448][ T5761] bridge_slave_1: entered promiscuous mode [ 119.050973][ T5761] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 119.064498][ T5761] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 119.102249][ T5761] team0: Port device team_slave_0 added [ 119.110789][ T5761] team0: Port device team_slave_1 added [ 119.143491][ T5761] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 119.150564][ T5761] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 119.176667][ T5761] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 119.189611][ T5761] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 119.196675][ T5761] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 119.222661][ T5761] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 119.279412][ T5761] hsr_slave_0: entered promiscuous mode [ 119.286132][ T5761] hsr_slave_1: entered promiscuous mode [ 119.292590][ T5761] debugfs: 'hsr0' already exists in 'hsr' [ 119.298614][ T5761] Cannot create hsr debugfs directory [ 119.775838][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 120.328313][ T4937] Bluetooth: hci0: command tx timeout [ 120.554712][ T12] bridge_slave_1: left allmulticast mode [ 120.579378][ T12] bridge_slave_1: left promiscuous mode [ 120.587662][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 120.602706][ T12] bridge_slave_0: left allmulticast mode [ 120.610116][ T12] bridge_slave_0: left promiscuous mode [ 120.615958][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 120.834621][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 120.852056][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 120.862675][ T12] bond0 (unregistering): Released all slaves [ 120.985597][ T12] hsr_slave_0: left promiscuous mode [ 120.992640][ T12] hsr_slave_1: left promiscuous mode [ 121.007393][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 121.019211][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 121.030338][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 121.041146][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 121.061895][ T12] veth1_macvtap: left promiscuous mode [ 121.068161][ T12] veth0_macvtap: left promiscuous mode [ 121.073900][ T12] veth1_vlan: left promiscuous mode [ 121.080129][ T12] veth0_vlan: left promiscuous mode [ 121.381800][ T12] team0 (unregistering): Port device team_slave_1 removed [ 121.401295][ T12] team0 (unregistering): Port device team_slave_0 removed [ 121.543367][ T5282] 8021q: adding VLAN 0 to HW filter on device eth1 [ 121.895025][ T5761] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 121.910613][ T5761] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 121.923475][ T5761] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 121.945864][ T5761] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 121.963224][ T5761] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 121.977589][ T5761] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 121.986156][ T5761] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 122.010489][ T5761] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 122.310341][ T5761] 8021q: adding VLAN 0 to HW filter on device bond0 [ 122.345899][ T5761] 8021q: adding VLAN 0 to HW filter on device team0 [ 122.364353][ T1012] bridge0: port 1(bridge_slave_0) entered blocking state [ 122.371533][ T1012] bridge0: port 1(bridge_slave_0) entered forwarding state [ 122.394490][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 122.401656][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 122.410200][ T4937] Bluetooth: hci0: command tx timeout [ 123.095714][ T5761] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 123.161404][ T5761] veth0_vlan: entered promiscuous mode [ 123.180797][ T5761] veth1_vlan: entered promiscuous mode [ 123.234676][ T5761] veth0_macvtap: entered promiscuous mode [ 123.248050][ T5761] veth1_macvtap: entered promiscuous mode [ 123.276030][ T5761] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 123.296008][ T5761] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 123.319305][ T1106] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.339759][ T1106] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.362448][ T1106] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.374816][ T1106] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.489537][ T1106] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 123.505746][ T1106] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 123.549027][ T1106] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 123.558774][ T1106] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2026/07/15 19:10:00 executed programs: 2 [ 123.935049][ T5850] loop0: detected capacity change from 0 to 32768 [ 123.943532][ T5850] ======================================================= [ 123.943532][ T5850] WARNING: The mand mount option has been deprecated and [ 123.943532][ T5850] and is ignored by this kernel. Remove the mand [ 123.943532][ T5850] option from the mount to silence this warning. [ 123.943532][ T5850] ======================================================= [ 124.031916][ T154] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 124.031916][ T154] [ 124.044787][ T154] ERROR: (device loop0): remounting filesystem as read-only [ 124.052278][ T154] kworker/u8:6: attempt to access beyond end of device [ 124.052278][ T154] loop0: rw=1, sector=2621792, nr_sectors = 8 limit=32768 [ 124.069648][ T154] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 124.069648][ T154] [ 124.082225][ T118] blkno = 5002c, nblocks = 1 [ 124.086362][ T154] kworker/u8:6: attempt to access beyond end of device [ 124.086362][ T154] loop0: rw=2049, sector=2621800, nr_sectors = 8 limit=32768 [ 124.096431][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 124.096431][ T118] [ 124.112824][ T118] blkno = 5002d, nblocks = 1 [ 124.120242][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 124.120242][ T118] [ 124.450165][ T5852] loop0: detected capacity change from 0 to 32768 [ 124.476650][ T4937] Bluetooth: hci0: command tx timeout [ 124.497806][ T12] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 124.497806][ T12] [ 124.508125][ T12] ERROR: (device loop0): remounting filesystem as read-only [ 124.515444][ T12] kworker/u8:0: attempt to access beyond end of device [ 124.515444][ T12] loop0: rw=1, sector=2621792, nr_sectors = 8 limit=32768 [ 124.532610][ T12] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 124.532610][ T12] [ 124.545238][ T12] kworker/u8:0: attempt to access beyond end of device [ 124.545238][ T12] loop0: rw=2049, sector=2621800, nr_sectors = 8 limit=32768 [ 124.551404][ T118] blkno = 5002c, nblocks = 1 [ 124.563939][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 124.563939][ T118] [ 124.575336][ T118] blkno = 5002d, nblocks = 1 [ 124.583464][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 124.583464][ T118] [ 124.952408][ T5854] loop0: detected capacity change from 0 to 32768 [ 124.986654][ T154] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 124.986654][ T154] [ 124.998802][ T154] ERROR: (device loop0): remounting filesystem as read-only [ 125.006162][ T154] kworker/u8:6: attempt to access beyond end of device [ 125.006162][ T154] loop0: rw=1, sector=2621792, nr_sectors = 8 limit=32768 [ 125.023500][ T154] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 125.023500][ T154] [ 125.035829][ T154] kworker/u8:6: attempt to access beyond end of device [ 125.035829][ T154] loop0: rw=2049, sector=2621800, nr_sectors = 8 limit=32768 [ 125.038062][ T118] blkno = 5002c, nblocks = 1 [ 125.056952][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 125.056952][ T118] [ 125.070507][ T119] blkno = 5002d, nblocks = 1 [ 125.075143][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 125.075143][ T119] [ 125.425173][ T5856] loop0: detected capacity change from 0 to 32768 [ 125.455520][ T64] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 125.455520][ T64] [ 125.468883][ T64] ERROR: (device loop0): remounting filesystem as read-only [ 125.476242][ T64] kworker/u8:4: attempt to access beyond end of device [ 125.476242][ T64] loop0: rw=1, sector=2621792, nr_sectors = 8 limit=32768 [ 125.491941][ T64] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 125.491941][ T64] [ 125.504457][ T64] kworker/u8:4: attempt to access beyond end of device [ 125.504457][ T64] loop0: rw=2049, sector=2621800, nr_sectors = 8 limit=32768 [ 125.504476][ T118] blkno = 5002c, nblocks = 1 [ 125.524367][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 125.524367][ T118] [ 125.535209][ T118] blkno = 5002d, nblocks = 1 [ 125.539991][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 125.539991][ T118] [ 125.933194][ T5858] loop0: detected capacity change from 0 to 32768 [ 125.968051][ T64] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 125.968051][ T64] [ 125.978199][ T64] ERROR: (device loop0): remounting filesystem as read-only [ 125.986183][ T64] kworker/u8:4: attempt to access beyond end of device [ 125.986183][ T64] loop0: rw=1, sector=2621792, nr_sectors = 8 limit=32768 [ 126.010397][ T64] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 126.010397][ T64] [ 126.030579][ T119] blkno = 5002c, nblocks = 1 [ 126.031431][ T64] kworker/u8:4: attempt to access beyond end of device [ 126.031431][ T64] loop0: rw=2049, sector=2621800, nr_sectors = 8 limit=32768 [ 126.035262][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 126.035262][ T119] [ 126.062890][ T119] blkno = 5002d, nblocks = 1 [ 126.067790][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 126.067790][ T119] [ 126.412930][ T5860] loop0: detected capacity change from 0 to 32768 [ 126.449345][ T1106] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 126.449345][ T1106] [ 126.460037][ T1106] ERROR: (device loop0): remounting filesystem as read-only [ 126.467661][ T1106] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 126.467661][ T1106] [ 126.481715][ T118] blkno = 5002c, nblocks = 1 [ 126.486704][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 126.486704][ T118] [ 126.502570][ T118] blkno = 5002d, nblocks = 1 [ 126.507760][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 126.507760][ T118] [ 126.557625][ T4937] Bluetooth: hci0: command tx timeout [ 126.844714][ T5861] loop0: detected capacity change from 0 to 32768 [ 126.882736][ T1106] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 126.882736][ T1106] [ 126.893077][ T1106] ERROR: (device loop0): remounting filesystem as read-only [ 126.903356][ T1106] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 126.903356][ T1106] [ 126.915492][ T119] blkno = 5002c, nblocks = 1 [ 126.923615][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 126.923615][ T119] [ 126.940632][ T119] blkno = 5002d, nblocks = 1 [ 126.945314][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 126.945314][ T119] [ 127.296469][ T5863] loop0: detected capacity change from 0 to 32768 [ 127.337543][ T64] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 127.337543][ T64] [ 127.347811][ T64] ERROR: (device loop0): remounting filesystem as read-only [ 127.355300][ T64] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 127.355300][ T64] [ 127.370692][ T118] blkno = 5002c, nblocks = 1 [ 127.375346][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 127.375346][ T118] [ 127.389995][ T118] blkno = 5002d, nblocks = 1 [ 127.394635][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 127.394635][ T118] [ 127.744713][ T5864] loop0: detected capacity change from 0 to 32768 [ 127.787147][ T12] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 127.787147][ T12] [ 127.798845][ T12] ERROR: (device loop0): remounting filesystem as read-only [ 127.806350][ T12] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 127.806350][ T12] [ 127.820617][ T119] blkno = 5002c, nblocks = 1 [ 127.829070][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 127.829070][ T119] [ 127.841612][ T119] blkno = 5002d, nblocks = 1 [ 127.846257][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 127.846257][ T119] [ 128.183050][ T5866] loop0: detected capacity change from 0 to 32768 [ 128.216074][ T64] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 128.216074][ T64] [ 128.226214][ T64] ERROR: (device loop0): remounting filesystem as read-only [ 128.235414][ T64] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 128.235414][ T64] [ 128.249840][ T118] blkno = 5002c, nblocks = 1 [ 128.255176][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 128.255176][ T118] [ 128.267875][ T119] blkno = 5002d, nblocks = 1 [ 128.272548][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 128.272548][ T119] [ 128.293480][ T119] ================================================================== [ 128.301583][ T119] BUG: KASAN: slab-use-after-free in jfs_lazycommit+0x9a8/0xab0 [ 128.309263][ T119] Read of size 4 at addr ffff88807a425894 by task jfsCommit/119 [ 128.316904][ T119] [ 128.319233][ T119] CPU: 1 UID: 0 PID: 119 Comm: jfsCommit Not tainted syzkaller #0 PREEMPT(full) [ 128.319284][ T119] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 128.319306][ T119] Call Trace: [ 128.319318][ T119] [ 128.319330][ T119] dump_stack_lvl+0x100/0x190 [ 128.319372][ T119] print_report+0x13d/0x4b0 [ 128.319428][ T119] ? srso_alias_return_thunk+0x5/0xfbef5 [ 128.319474][ T119] ? __virt_addr_valid+0x239/0x430 [ 128.319517][ T119] ? jfs_lazycommit+0x9a8/0xab0 [ 128.319577][ T119] kasan_report+0xdf/0x1c0 [ 128.319641][ T119] ? jfs_lazycommit+0x9a8/0xab0 [ 128.319707][ T119] jfs_lazycommit+0x9a8/0xab0 [ 128.319772][ T119] ? __pfx_jfs_lazycommit+0x10/0x10 [ 128.319833][ T119] ? srso_alias_return_thunk+0x5/0xfbef5 [ 128.319878][ T119] ? rcu_is_watching+0x12/0xc0 [ 128.319929][ T119] ? __pfx_default_wake_function+0x10/0x10 [ 128.319978][ T119] ? srso_alias_return_thunk+0x5/0xfbef5 [ 128.320024][ T119] ? srso_alias_return_thunk+0x5/0xfbef5 [ 128.320069][ T119] ? __kthread_parkme+0x18c/0x230 [ 128.320118][ T119] ? kthread+0x13a/0x450 [ 128.320170][ T119] ? __pfx_jfs_lazycommit+0x10/0x10 [ 128.320230][ T119] kthread+0x370/0x450 [ 128.320287][ T119] ? __pfx_kthread+0x10/0x10 [ 128.320343][ T119] ret_from_fork+0x72b/0xd50 [ 128.320389][ T119] ? __pfx_ret_from_fork+0x10/0x10 [ 128.320436][ T119] ? srso_alias_return_thunk+0x5/0xfbef5 [ 128.320482][ T119] ? __switch_to+0x800/0x10f0 [ 128.320538][ T119] ? __switch_to_asm+0x39/0x70 [ 128.320589][ T119] ? __pfx_kthread+0x10/0x10 [ 128.320645][ T119] ret_from_fork_asm+0x1a/0x30 [ 128.320709][ T119] [ 128.320722][ T119] [ 128.479315][ T119] Allocated by task 5866: [ 128.483642][ T119] kasan_save_stack+0x30/0x50 [ 128.488359][ T119] kasan_save_track+0x14/0x30 [ 128.493066][ T119] __kasan_kmalloc+0xaa/0xb0 [ 128.497683][ T119] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 128.503074][ T119] jfs_fill_super+0xca/0xf70 [ 128.507675][ T119] get_tree_bdev_flags+0x38c/0x620 [ 128.512799][ T119] vfs_get_tree+0x92/0x320 [ 128.517217][ T119] path_mount+0x7d0/0x23d0 [ 128.521659][ T119] __x64_sys_mount+0x293/0x310 [ 128.526447][ T119] do_syscall_64+0x115/0x870 [ 128.531038][ T119] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.536934][ T119] [ 128.539247][ T119] Freed by task 5761: [ 128.543218][ T119] kasan_save_stack+0x30/0x50 [ 128.547921][ T119] kasan_save_track+0x14/0x30 [ 128.552618][ T119] kasan_save_free_info+0x3b/0x70 [ 128.557651][ T119] __kasan_slab_free+0x5f/0x80 [ 128.562439][ T119] kfree+0x22b/0x6c0 [ 128.566342][ T119] generic_shutdown_super+0x167/0x360 [ 128.571720][ T119] kill_block_super+0x3b/0xa0 [ 128.576401][ T119] deactivate_locked_super+0xc1/0x1b0 [ 128.581787][ T119] deactivate_super+0xe7/0x110 [ 128.586555][ T119] cleanup_mnt+0x21f/0x450 [ 128.590983][ T119] task_work_run+0x150/0x240 [ 128.595597][ T119] exit_to_user_mode_loop+0x1d8/0x6f0 [ 128.600975][ T119] do_syscall_64+0x666/0x870 [ 128.605567][ T119] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.611465][ T119] [ 128.613778][ T119] The buggy address belongs to the object at ffff88807a425800 [ 128.613778][ T119] which belongs to the cache kmalloc-256 of size 256 [ 128.627829][ T119] The buggy address is located 148 bytes inside of [ 128.627829][ T119] freed 256-byte region [ffff88807a425800, ffff88807a425900) [ 128.641629][ T119] [ 128.643943][ T119] The buggy address belongs to the physical page: [ 128.650342][ T119] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7a424 [ 128.659100][ T119] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 128.667596][ T119] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 128.675140][ T119] page_type: f5(slab) [ 128.679127][ T119] raw: 00fff00000000040 ffff88813fe1fb40 dead000000000100 dead000000000122 [ 128.687714][ T119] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 128.696307][ T119] head: 00fff00000000040 ffff88813fe1fb40 dead000000000100 dead000000000122 [ 128.704978][ T119] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 128.713657][ T119] head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 128.722335][ T119] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 128.730999][ T119] page dumped because: kasan: bad access detected [ 128.737402][ T119] page_owner tracks the page as allocated [ 128.743107][ T119] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5761, tgid 5761 (syz-executor), ts 123295058693, free_ts 123178910398 [ 128.764665][ T119] post_alloc_hook+0xfd/0x120 [ 128.769357][ T119] get_page_from_freelist+0xf48/0x3530 [ 128.774831][ T119] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 128.780738][ T119] new_slab+0xa2/0x650 [ 128.784819][ T119] refill_objects+0xe3/0x410 [ 128.789418][ T119] __pcs_replace_empty_main+0x376/0x680 [ 128.794975][ T119] __kmalloc_cache_noprof+0x479/0x6c0 [ 128.800356][ T119] ____ip_mc_inc_group+0x40b/0x10d0 [ 128.805575][ T119] ip_mc_up+0x154/0x390 [ 128.809748][ T119] inetdev_event+0x6c3/0x17f0 [ 128.814451][ T119] notifier_call_chain+0x99/0x3f0 [ 128.819494][ T119] call_netdevice_notifiers_info+0xbe/0x110 [ 128.825408][ T119] __dev_notify_flags+0x12c/0x2e0 [ 128.830435][ T119] netif_change_flags+0x108/0x160 [ 128.835464][ T119] do_setlink.isra.0+0x1ac4/0x3e60 [ 128.840585][ T119] rtnl_newlink+0x11c2/0x2380 [ 128.845274][ T119] page last free pid 64 tgid 64 stack trace: [ 128.851241][ T119] __free_frozen_pages+0x79f/0x1090 [ 128.856453][ T119] qlist_free_all+0x47/0xf0 [ 128.860972][ T119] kasan_quarantine_reduce+0x1a0/0x1f0 [ 128.866488][ T119] __kasan_slab_alloc+0x69/0x90 [ 128.871363][ T119] __kmalloc_cache_noprof+0x265/0x6c0 [ 128.876744][ T119] __ipv6_dev_mc_inc+0x2f1/0xbd0 [ 128.881700][ T119] addrconf_dad_work+0x276/0x1360 [ 128.886729][ T119] process_one_work+0xa23/0x1940 [ 128.891692][ T119] worker_thread+0x5ef/0xe50 [ 128.896304][ T119] kthread+0x370/0x450 [ 128.900393][ T119] ret_from_fork+0x72b/0xd50 [ 128.904994][ T119] ret_from_fork_asm+0x1a/0x30 [ 128.909777][ T119] [ 128.912088][ T119] Memory state around the buggy address: [ 128.917708][ T119] ffff88807a425780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 128.925768][ T119] ffff88807a425800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 128.933826][ T119] >ffff88807a425880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 128.941879][ T119] ^ [ 128.946459][ T119] ffff88807a425900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 128.954519][ T119] ffff88807a425980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 128.962572][ T119] ================================================================== [ 128.970623][ T119] Disabling lock debugging due to kernel taint [ 129.137085][ T5867] loop0: detected capacity change from 0 to 32768 [ 129.162423][ T1106] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 129.162423][ T1106] [ 129.172629][ T1106] ERROR: (device loop0): remounting filesystem as read-only [ 129.180329][ T1106] bio_check_eod: 10 callbacks suppressed 2026/07/15 19:10:06 executed programs: 13 [ 129.180349][ T1106] kworker/u8:8: attempt to access beyond end of device [ 129.180349][ T1106] loop0: rw=1, sector=2621792, nr_sectors = 8 limit=32768 [ 129.201059][ T1106] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 129.201059][ T1106] [ 129.213016][ T118] blkno = 5002c, nblocks = 1 [ 129.218133][ T1106] kworker/u8:8: attempt to access beyond end of device [ 129.218133][ T1106] loop0: rw=2049, sector=2621800, nr_sectors = 8 limit=32768 [ 129.218414][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 129.218414][ T118] [ 129.243040][ T118] blkno = 5002d, nblocks = 1 [ 129.247904][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 129.247904][ T118] [ 129.462346][ T5868] loop0: detected capacity change from 0 to 32768 [ 129.486324][ T154] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 129.486324][ T154] [ 129.497891][ T154] ERROR: (device loop0): remounting filesystem as read-only [ 129.505201][ T154] kworker/u8:6: attempt to access beyond end of device [ 129.505201][ T154] loop0: rw=1, sector=2621792, nr_sectors = 8 limit=32768 [ 129.519180][ T154] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 129.519180][ T154] [ 129.531002][ T119] blkno = 5002c, nblocks = 1 [ 129.531354][ T12] kworker/u8:0: attempt to access beyond end of device [ 129.531354][ T12] loop0: rw=2049, sector=2621800, nr_sectors = 8 limit=32768 [ 129.539383][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 129.539383][ T119] [ 129.561166][ T119] blkno = 5002d, nblocks = 1 [ 129.566037][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 129.566037][ T119] [ 129.782836][ T5869] loop0: detected capacity change from 0 to 32768 [ 129.807643][ T12] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 129.807643][ T12] [ 129.817755][ T12] ERROR: (device loop0): remounting filesystem as read-only [ 129.825059][ T12] kworker/u8:0: attempt to access beyond end of device [ 129.825059][ T12] loop0: rw=1, sector=2621792, nr_sectors = 8 limit=32768 [ 129.839172][ T12] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 129.839172][ T12] [ 129.849450][ T118] blkno = 5002c, nblocks = 1 [ 129.849511][ T1106] kworker/u8:8: attempt to access beyond end of device [ 129.849511][ T1106] loop0: rw=2049, sector=2621800, nr_sectors = 8 limit=32768 [ 129.854054][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 129.854054][ T118] [ 129.881450][ T118] blkno = 5002d, nblocks = 1 [ 129.886062][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 129.886062][ T118] [ 130.103419][ T5870] loop0: detected capacity change from 0 to 32768 [ 130.124920][ T1106] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 130.124920][ T1106] [ 130.135019][ T1106] ERROR: (device loop0): remounting filesystem as read-only [ 130.142373][ T1106] kworker/u8:8: attempt to access beyond end of device [ 130.142373][ T1106] loop0: rw=1, sector=2621792, nr_sectors = 8 limit=32768 [ 130.156373][ T1106] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 130.156373][ T1106] [ 130.169967][ T1106] kworker/u8:8: attempt to access beyond end of device [ 130.169967][ T1106] loop0: rw=2049, sector=2621800, nr_sectors = 8 limit=32768 [ 130.170001][ T119] blkno = 5002c, nblocks = 1 [ 130.189398][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 130.189398][ T119] [ 130.199959][ T119] blkno = 5002d, nblocks = 1 [ 130.204553][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 130.204553][ T119] [ 130.424546][ T5871] loop0: detected capacity change from 0 to 32768 [ 130.448853][ T1106] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 130.448853][ T1106] [ 130.458833][ T1106] ERROR: (device loop0): remounting filesystem as read-only [ 130.466185][ T1106] kworker/u8:8: attempt to access beyond end of device [ 130.466185][ T1106] loop0: rw=1, sector=2621792, nr_sectors = 8 limit=32768 [ 130.480644][ T1106] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 130.480644][ T1106] [ 130.492468][ T12] kworker/u8:0: attempt to access beyond end of device [ 130.492468][ T12] loop0: rw=2049, sector=2621800, nr_sectors = 8 limit=32768 [ 130.493695][ T118] blkno = 5002c, nblocks = 1 [ 130.512157][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 130.512157][ T118] [ 130.523753][ T118] blkno = 5002d, nblocks = 1 [ 130.528553][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 130.528553][ T118] [ 130.737078][ T5872] loop0: detected capacity change from 0 to 32768 [ 130.759257][ T12] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 130.759257][ T12] [ 130.769557][ T12] ERROR: (device loop0): remounting filesystem as read-only [ 130.777362][ T12] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 130.777362][ T12] [ 130.789425][ T119] blkno = 5002c, nblocks = 1 [ 130.794041][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 130.794041][ T119] [ 130.805780][ T118] blkno = 5002d, nblocks = 1 [ 130.811143][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 130.811143][ T118] [ 131.031758][ T5873] loop0: detected capacity change from 0 to 32768 [ 131.054764][ T64] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 131.054764][ T64] [ 131.064717][ T64] ERROR: (device loop0): remounting filesystem as read-only [ 131.072527][ T64] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 131.072527][ T64] [ 131.082916][ T119] blkno = 5002c, nblocks = 1 [ 131.089328][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 131.089328][ T119] [ 131.101086][ T119] blkno = 5002d, nblocks = 1 [ 131.105941][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 131.105941][ T119] [ 131.328394][ T5874] loop0: detected capacity change from 0 to 32768 [ 131.352550][ T12] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 131.352550][ T12] [ 131.362512][ T12] ERROR: (device loop0): remounting filesystem as read-only [ 131.376635][ T12] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 131.376635][ T12] [ 131.387253][ T118] blkno = 5002c, nblocks = 1 [ 131.392437][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 131.392437][ T118] [ 131.403263][ T118] blkno = 5002d, nblocks = 1 [ 131.409271][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 131.409271][ T118] [ 131.625145][ T5875] loop0: detected capacity change from 0 to 32768 [ 131.651541][ T12] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 131.651541][ T12] [ 131.661549][ T12] ERROR: (device loop0): remounting filesystem as read-only [ 131.668981][ T12] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 131.668981][ T12] [ 131.680215][ T119] blkno = 5002c, nblocks = 1 [ 131.684846][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 131.684846][ T119] [ 131.695443][ T119] blkno = 5002d, nblocks = 1 [ 131.703550][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 131.703550][ T119] [ 131.916073][ T5876] loop0: detected capacity change from 0 to 32768 [ 131.945637][ T1106] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 131.945637][ T1106] [ 131.955962][ T1106] ERROR: (device loop0): remounting filesystem as read-only [ 131.963458][ T1106] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 131.963458][ T1106] [ 131.975573][ T118] blkno = 5002c, nblocks = 1 [ 131.980238][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 131.980238][ T118] [ 131.992073][ T119] blkno = 5002d, nblocks = 1 [ 131.996737][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 131.996737][ T119] [ 132.157525][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.164305][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.236180][ T64] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 132.236180][ T64] [ 132.247634][ T64] ERROR: (device loop0): remounting filesystem as read-only [ 132.257130][ T64] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 132.257130][ T64] [ 132.267545][ T118] blkno = 5002c, nblocks = 1 [ 132.272163][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 132.272163][ T118] [ 132.283010][ T118] blkno = 5002d, nblocks = 1 [ 132.289067][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 132.289067][ T118] [ 132.549703][ T154] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 132.549703][ T154] [ 132.560292][ T154] ERROR: (device loop0): remounting filesystem as read-only [ 132.567783][ T154] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 132.567783][ T154] [ 132.578050][ T119] blkno = 5002c, nblocks = 1 [ 132.582742][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 132.582742][ T119] [ 132.593462][ T119] blkno = 5002d, nblocks = 1 [ 132.599654][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 132.599654][ T119] [ 132.860310][ T12] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 132.860310][ T12] [ 132.870352][ T12] ERROR: (device loop0): remounting filesystem as read-only [ 132.877941][ T12] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 132.877941][ T12] [ 132.888360][ T119] blkno = 5002c, nblocks = 1 [ 132.893048][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 132.893048][ T119] [ 132.903693][ T119] blkno = 5002d, nblocks = 1 [ 132.908552][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 132.908552][ T119] [ 133.173083][ T1106] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 133.173083][ T1106] [ 133.183488][ T1106] ERROR: (device loop0): remounting filesystem as read-only [ 133.191353][ T1106] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 133.191353][ T1106] [ 133.201730][ T118] blkno = 5002c, nblocks = 1 [ 133.207836][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 133.207836][ T118] [ 133.220316][ T119] blkno = 5002d, nblocks = 1 [ 133.224969][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 133.224969][ T119] [ 133.459327][ T1106] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 133.459327][ T1106] [ 133.469265][ T1106] ERROR: (device loop0): remounting filesystem as read-only [ 133.477267][ T1106] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 133.477267][ T1106] [ 133.487851][ T118] blkno = 5002c, nblocks = 1 [ 133.492944][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 133.492944][ T118] [ 133.505110][ T118] blkno = 5002d, nblocks = 1 [ 133.511398][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 133.511398][ T118] [ 133.740336][ T1106] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 133.740336][ T1106] [ 133.751428][ T1106] ERROR: (device loop0): remounting filesystem as read-only [ 133.759565][ T1106] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 133.759565][ T1106] [ 133.770711][ T119] blkno = 5002c, nblocks = 1 [ 133.775859][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 133.775859][ T119] [ 133.787821][ T119] blkno = 5002d, nblocks = 1 [ 133.792433][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 133.792433][ T119] [ 134.063526][ T1106] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 134.063526][ T1106] [ 134.073614][ T1106] ERROR: (device loop0): remounting filesystem as read-only [ 134.082115][ T1106] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 134.082115][ T1106] [ 134.094591][ T118] blkno = 5002c, nblocks = 1 [ 134.099324][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 134.099324][ T118] [ 134.111292][ T119] blkno = 5002d, nblocks = 1 [ 134.115955][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 134.115955][ T119] [ 134.136493][ T119] ================================================================== [ 134.144585][ T119] BUG: KASAN: slab-use-after-free in jfs_lazycommit+0x9a8/0xab0 [ 134.152266][ T119] Read of size 4 at addr ffff88802a3bc294 by task jfsCommit/119 [ 134.159910][ T119] [ 134.162243][ T119] CPU: 0 UID: 0 PID: 119 Comm: jfsCommit Tainted: G B syzkaller #0 PREEMPT(full) [ 134.162292][ T119] Tainted: [B]=BAD_PAGE [ 134.162305][ T119] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 134.162326][ T119] Call Trace: [ 134.162338][ T119] [ 134.162350][ T119] dump_stack_lvl+0x100/0x190 [ 134.162395][ T119] print_report+0x13d/0x4b0 [ 134.162454][ T119] ? srso_alias_return_thunk+0x5/0xfbef5 [ 134.162497][ T119] ? __virt_addr_valid+0x239/0x430 [ 134.162536][ T119] ? jfs_lazycommit+0x9a8/0xab0 [ 134.162591][ T119] kasan_report+0xdf/0x1c0 [ 134.162649][ T119] ? jfs_lazycommit+0x9a8/0xab0 [ 134.162709][ T119] jfs_lazycommit+0x9a8/0xab0 [ 134.162767][ T119] ? __pfx_jfs_lazycommit+0x10/0x10 [ 134.162821][ T119] ? srso_alias_return_thunk+0x5/0xfbef5 [ 134.162863][ T119] ? rcu_is_watching+0x12/0xc0 [ 134.162910][ T119] ? __pfx_default_wake_function+0x10/0x10 [ 134.162955][ T119] ? srso_alias_return_thunk+0x5/0xfbef5 [ 134.162997][ T119] ? srso_alias_return_thunk+0x5/0xfbef5 [ 134.163039][ T119] ? __kthread_parkme+0x18c/0x230 [ 134.163084][ T119] ? kthread+0x13a/0x450 [ 134.163131][ T119] ? __pfx_jfs_lazycommit+0x10/0x10 [ 134.163186][ T119] kthread+0x370/0x450 [ 134.163234][ T119] ? __pfx_kthread+0x10/0x10 [ 134.163285][ T119] ret_from_fork+0x72b/0xd50 [ 134.163327][ T119] ? __pfx_ret_from_fork+0x10/0x10 [ 134.163373][ T119] ? srso_alias_return_thunk+0x5/0xfbef5 [ 134.163419][ T119] ? __switch_to+0x800/0x10f0 [ 134.163470][ T119] ? __switch_to_asm+0x39/0x70 [ 134.163516][ T119] ? __pfx_kthread+0x10/0x10 [ 134.163567][ T119] ret_from_fork_asm+0x1a/0x30 [ 134.163624][ T119] [ 134.163636][ T119] [ 134.327720][ T119] Allocated by task 5883: [ 134.332042][ T119] kasan_save_stack+0x30/0x50 [ 134.336745][ T119] kasan_save_track+0x14/0x30 [ 134.341445][ T119] __kasan_kmalloc+0xaa/0xb0 [ 134.346053][ T119] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 134.351439][ T119] jfs_fill_super+0xca/0xf70 [ 134.356042][ T119] get_tree_bdev_flags+0x38c/0x620 [ 134.361167][ T119] vfs_get_tree+0x92/0x320 [ 134.365587][ T119] path_mount+0x7d0/0x23d0 [ 134.370026][ T119] __x64_sys_mount+0x293/0x310 [ 134.374814][ T119] do_syscall_64+0x115/0x870 [ 134.379411][ T119] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.385312][ T119] [ 134.387625][ T119] Freed by task 5761: [ 134.391598][ T119] kasan_save_stack+0x30/0x50 [ 134.396297][ T119] kasan_save_track+0x14/0x30 [ 134.400997][ T119] kasan_save_free_info+0x3b/0x70 [ 134.406031][ T119] __kasan_slab_free+0x5f/0x80 [ 134.410819][ T119] kfree+0x22b/0x6c0 [ 134.414725][ T119] generic_shutdown_super+0x167/0x360 [ 134.420106][ T119] kill_block_super+0x3b/0xa0 [ 134.424790][ T119] deactivate_locked_super+0xc1/0x1b0 [ 134.430171][ T119] deactivate_super+0xe7/0x110 [ 134.434942][ T119] cleanup_mnt+0x21f/0x450 [ 134.439372][ T119] task_work_run+0x150/0x240 [ 134.444001][ T119] exit_to_user_mode_loop+0x1d8/0x6f0 [ 134.449410][ T119] do_syscall_64+0x666/0x870 [ 134.454004][ T119] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.459901][ T119] [ 134.462215][ T119] The buggy address belongs to the object at ffff88802a3bc200 [ 134.462215][ T119] which belongs to the cache kmalloc-256 of size 256 [ 134.476267][ T119] The buggy address is located 148 bytes inside of [ 134.476267][ T119] freed 256-byte region [ffff88802a3bc200, ffff88802a3bc300) [ 134.490071][ T119] [ 134.492387][ T119] The buggy address belongs to the physical page: [ 134.498788][ T119] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802a3bc800 pfn:0x2a3bc [ 134.508853][ T119] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 134.517353][ T119] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 134.525858][ T119] page_type: f5(slab) [ 134.529852][ T119] raw: 00fff00000000240 ffff88813fe1fb40 ffffea0001de6490 ffffea000074b910 [ 134.538440][ T119] raw: ffff88802a3bc800 000000080010000f 00000000f5000000 0000000000000000 [ 134.547034][ T119] head: 00fff00000000240 ffff88813fe1fb40 ffffea0001de6490 ffffea000074b910 [ 134.555716][ T119] head: ffff88802a3bc800 000000080010000f 00000000f5000000 0000000000000000 [ 134.564408][ T119] head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 134.573088][ T119] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 134.581755][ T119] page dumped because: kasan: bad access detected [ 134.588164][ T119] page_owner tracks the page as allocated [ 134.593871][ T119] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2000(__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 12389696697, free_ts 0 [ 134.612044][ T119] post_alloc_hook+0xfd/0x120 [ 134.616744][ T119] get_page_from_freelist+0xf48/0x3530 [ 134.622223][ T119] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 134.628131][ T119] new_slab+0xa2/0x650 [ 134.632209][ T119] refill_objects+0xe3/0x410 [ 134.636809][ T119] __pcs_replace_empty_main+0x376/0x680 [ 134.642368][ T119] __kmalloc_cache_noprof+0x479/0x6c0 [ 134.647752][ T119] usb_string+0x10f/0x570 [ 134.652082][ T119] usb_cache_string+0x7c/0x100 [ 134.656846][ T119] usb_new_device+0x239/0x7d0 [ 134.661530][ T119] register_root_hub+0x4e6/0x639 [ 134.666532][ T119] usb_add_hcd.cold+0xccd/0x1158 [ 134.671481][ T119] dummy_hcd_probe+0x189/0x2fa [ 134.676277][ T119] platform_probe+0x106/0x1d0 [ 134.681026][ T119] really_probe+0x241/0xa60 [ 134.685541][ T119] __driver_probe_device+0x20e/0x450 [ 134.690869][ T119] page_owner free stack trace missing [ 134.696223][ T119] [ 134.698536][ T119] Memory state around the buggy address: [ 134.704157][ T119] ffff88802a3bc180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 134.712212][ T119] ffff88802a3bc200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 134.720271][ T119] >ffff88802a3bc280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 134.728321][ T119] ^ [ 134.732898][ T119] ffff88802a3bc300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 134.740953][ T119] ffff88802a3bc380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 134.749003][ T119] ================================================================== [ 134.948611][ T5884] set_capacity_and_notify: 7 callbacks suppressed [ 134.948631][ T5884] loop0: detected capacity change from 0 to 32768 [ 134.984855][ T64] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 134.984855][ T64] 2026/07/15 19:10:12 executed programs: 30 [ 134.995256][ T64] ERROR: (device loop0): remounting filesystem as read-only [ 135.002733][ T64] bio_check_eod: 24 callbacks suppressed [ 135.002753][ T64] kworker/u8:4: attempt to access beyond end of device [ 135.002753][ T64] loop0: rw=1, sector=2621792, nr_sectors = 8 limit=32768 [ 135.022381][ T64] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 135.022381][ T64] [ 135.034187][ T118] blkno = 5002c, nblocks = 1 [ 135.039088][ T64] kworker/u8:4: attempt to access beyond end of device [ 135.039088][ T64] loop0: rw=2049, sector=2621800, nr_sectors = 8 limit=32768 [ 135.054026][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 135.054026][ T118] [ 135.064986][ T119] blkno = 5002d, nblocks = 1 [ 135.069760][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 135.069760][ T119] [ 135.283770][ T5885] loop0: detected capacity change from 0 to 32768 [ 135.312275][ T64] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 135.312275][ T64] [ 135.322521][ T64] ERROR: (device loop0): remounting filesystem as read-only [ 135.329882][ T64] kworker/u8:4: attempt to access beyond end of device [ 135.329882][ T64] loop0: rw=1, sector=2621792, nr_sectors = 8 limit=32768 [ 135.344006][ T64] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 135.344006][ T64] [ 135.355674][ T118] blkno = 5002c, nblocks = 1 [ 135.355791][ T1106] kworker/u8:8: attempt to access beyond end of device [ 135.355791][ T1106] loop0: rw=2049, sector=2621800, nr_sectors = 8 limit=32768 [ 135.362594][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 135.362594][ T118] [ 135.386669][ T118] blkno = 5002d, nblocks = 1 [ 135.391411][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 135.391411][ T118] [ 135.603472][ T5886] loop0: detected capacity change from 0 to 32768 [ 135.628512][ T64] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 135.628512][ T64] [ 135.639127][ T64] ERROR: (device loop0): remounting filesystem as read-only [ 135.646891][ T64] kworker/u8:4: attempt to access beyond end of device [ 135.646891][ T64] loop0: rw=1, sector=2621792, nr_sectors = 8 limit=32768 [ 135.661087][ T64] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 135.661087][ T64] [ 135.671666][ T119] blkno = 5002c, nblocks = 1 [ 135.676293][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 135.676293][ T119] [ 135.691112][ T154] kworker/u8:6: attempt to access beyond end of device [ 135.691112][ T154] loop0: rw=2049, sector=2621800, nr_sectors = 8 limit=32768 [ 135.705832][ T119] blkno = 5002d, nblocks = 1 [ 135.711168][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 135.711168][ T119] [ 135.924300][ T5887] loop0: detected capacity change from 0 to 32768 [ 135.953509][ T154] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 135.953509][ T154] [ 135.963472][ T154] ERROR: (device loop0): remounting filesystem as read-only [ 135.971943][ T154] kworker/u8:6: attempt to access beyond end of device [ 135.971943][ T154] loop0: rw=1, sector=2621792, nr_sectors = 8 limit=32768 [ 135.986182][ T154] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 135.986182][ T154] [ 136.001877][ T118] blkno = 5002c, nblocks = 1 [ 136.008885][ T154] kworker/u8:6: attempt to access beyond end of device [ 136.008885][ T154] loop0: rw=2049, sector=2621800, nr_sectors = 8 limit=32768 [ 136.024776][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 136.024776][ T118] [ 136.035672][ T118] blkno = 5002d, nblocks = 1 [ 136.040743][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 136.040743][ T118] [ 136.290272][ T5888] loop0: detected capacity change from 0 to 32768 [ 136.314152][ T154] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 136.314152][ T154] [ 136.324312][ T154] ERROR: (device loop0): remounting filesystem as read-only [ 136.332006][ T154] kworker/u8:6: attempt to access beyond end of device [ 136.332006][ T154] loop0: rw=1, sector=2621792, nr_sectors = 8 limit=32768 [ 136.346198][ T154] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 136.346198][ T154] [ 136.357155][ T119] blkno = 5002c, nblocks = 1 [ 136.357237][ T154] kworker/u8:6: attempt to access beyond end of device [ 136.357237][ T154] loop0: rw=2049, sector=2621800, nr_sectors = 8 limit=32768 [ 136.363436][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 136.363436][ T119] [ 136.387603][ T119] blkno = 5002d, nblocks = 1 [ 136.392220][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 136.392220][ T119] [ 136.602180][ T5889] loop0: detected capacity change from 0 to 32768 [ 136.626084][ T154] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 136.626084][ T154] [ 136.637132][ T154] ERROR: (device loop0): remounting filesystem as read-only [ 136.644532][ T154] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 136.644532][ T154] [ 136.655789][ T118] blkno = 5002c, nblocks = 1 [ 136.662398][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 136.662398][ T118] [ 136.673266][ T119] blkno = 5002d, nblocks = 1 [ 136.678669][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 136.678669][ T119] [ 136.900922][ T5890] loop0: detected capacity change from 0 to 32768 [ 136.925203][ T154] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 136.925203][ T154] [ 136.935366][ T154] ERROR: (device loop0): remounting filesystem as read-only [ 136.943080][ T154] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 136.943080][ T154] [ 136.953365][ T119] blkno = 5002c, nblocks = 1 [ 136.959999][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 136.959999][ T119] [ 136.971985][ T119] blkno = 5002d, nblocks = 1 [ 136.976720][ T119] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 136.976720][ T119] [ 136.991581][ T119] ================================================================== [ 136.999647][ T119] BUG: KASAN: slab-use-after-free in jfs_lazycommit+0x9a8/0xab0 [ 137.007414][ T119] Read of size 4 at addr ffff8880319bac94 by task jfsCommit/119 [ 137.015053][ T119] [ 137.017385][ T119] CPU: 0 UID: 0 PID: 119 Comm: jfsCommit Tainted: G B syzkaller #0 PREEMPT(full) [ 137.017440][ T119] Tainted: [B]=BAD_PAGE [ 137.017454][ T119] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 137.017476][ T119] Call Trace: [ 137.017488][ T119] [ 137.017501][ T119] dump_stack_lvl+0x100/0x190 [ 137.017544][ T119] print_report+0x13d/0x4b0 [ 137.017600][ T119] ? srso_alias_return_thunk+0x5/0xfbef5 [ 137.017647][ T119] ? __virt_addr_valid+0x239/0x430 [ 137.017690][ T119] ? jfs_lazycommit+0x9a8/0xab0 [ 137.017779][ T119] kasan_report+0xdf/0x1c0 [ 137.017844][ T119] ? jfs_lazycommit+0x9a8/0xab0 [ 137.017910][ T119] jfs_lazycommit+0x9a8/0xab0 [ 137.017975][ T119] ? __pfx_jfs_lazycommit+0x10/0x10 [ 137.018035][ T119] ? srso_alias_return_thunk+0x5/0xfbef5 [ 137.018082][ T119] ? rcu_is_watching+0x12/0xc0 [ 137.018137][ T119] ? __pfx_default_wake_function+0x10/0x10 [ 137.018186][ T119] ? srso_alias_return_thunk+0x5/0xfbef5 [ 137.018233][ T119] ? srso_alias_return_thunk+0x5/0xfbef5 [ 137.018279][ T119] ? __kthread_parkme+0x18c/0x230 [ 137.018329][ T119] ? kthread+0x13a/0x450 [ 137.018381][ T119] ? __pfx_jfs_lazycommit+0x10/0x10 [ 137.018441][ T119] kthread+0x370/0x450 [ 137.018495][ T119] ? __pfx_kthread+0x10/0x10 [ 137.018551][ T119] ret_from_fork+0x72b/0xd50 [ 137.018598][ T119] ? __pfx_ret_from_fork+0x10/0x10 [ 137.018644][ T119] ? srso_alias_return_thunk+0x5/0xfbef5 [ 137.018690][ T119] ? __switch_to+0x800/0x10f0 [ 137.018747][ T119] ? __switch_to_asm+0x39/0x70 [ 137.018808][ T119] ? __pfx_kthread+0x10/0x10 [ 137.018864][ T119] ret_from_fork_asm+0x1a/0x30 [ 137.018927][ T119] [ 137.018940][ T119] [ 137.183069][ T119] Allocated by task 5890: [ 137.187414][ T119] kasan_save_stack+0x30/0x50 [ 137.192116][ T119] kasan_save_track+0x14/0x30 [ 137.196813][ T119] __kasan_kmalloc+0xaa/0xb0 [ 137.201423][ T119] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 137.206808][ T119] jfs_fill_super+0xca/0xf70 [ 137.211408][ T119] get_tree_bdev_flags+0x38c/0x620 [ 137.216530][ T119] vfs_get_tree+0x92/0x320 [ 137.220948][ T119] path_mount+0x7d0/0x23d0 [ 137.225392][ T119] __x64_sys_mount+0x293/0x310 [ 137.230185][ T119] do_syscall_64+0x115/0x870 [ 137.234782][ T119] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 137.240710][ T119] [ 137.243036][ T119] Freed by task 5761: [ 137.247008][ T119] kasan_save_stack+0x30/0x50 [ 137.251713][ T119] kasan_save_track+0x14/0x30 [ 137.256417][ T119] kasan_save_free_info+0x3b/0x70 [ 137.261473][ T119] __kasan_slab_free+0x5f/0x80 [ 137.266280][ T119] kfree+0x22b/0x6c0 [ 137.270194][ T119] generic_shutdown_super+0x167/0x360 [ 137.275661][ T119] kill_block_super+0x3b/0xa0 [ 137.280341][ T119] deactivate_locked_super+0xc1/0x1b0 [ 137.285728][ T119] deactivate_super+0xe7/0x110 [ 137.290497][ T119] cleanup_mnt+0x21f/0x450 [ 137.295017][ T119] task_work_run+0x150/0x240 [ 137.299634][ T119] exit_to_user_mode_loop+0x1d8/0x6f0 [ 137.305061][ T119] do_syscall_64+0x666/0x870 [ 137.309657][ T119] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 137.315574][ T119] [ 137.317900][ T119] The buggy address belongs to the object at ffff8880319bac00 [ 137.317900][ T119] which belongs to the cache kmalloc-256 of size 256 [ 137.331951][ T119] The buggy address is located 148 bytes inside of [ 137.331951][ T119] freed 256-byte region [ffff8880319bac00, ffff8880319bad00) [ 137.346542][ T119] [ 137.348862][ T119] The buggy address belongs to the physical page: [ 137.355261][ T119] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x319ba [ 137.364021][ T119] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 137.372515][ T119] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 137.380058][ T119] page_type: f5(slab) [ 137.384042][ T119] raw: 00fff00000000040 ffff88813fe1fb40 dead000000000100 dead000000000122 [ 137.392629][ T119] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 137.401216][ T119] head: 00fff00000000040 ffff88813fe1fb40 dead000000000100 dead000000000122 [ 137.409891][ T119] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 137.418567][ T119] head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 137.427238][ T119] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 137.435900][ T119] page dumped because: kasan: bad access detected [ 137.442304][ T119] page_owner tracks the page as allocated [ 137.448008][ T119] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 22136679680, free_ts 0 [ 137.467761][ T119] post_alloc_hook+0xfd/0x120 [ 137.472468][ T119] get_page_from_freelist+0xf48/0x3530 [ 137.477955][ T119] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 137.483869][ T119] new_slab+0xa2/0x650 [ 137.487994][ T119] refill_objects+0xe3/0x410 [ 137.492598][ T119] __pcs_replace_empty_main+0x376/0x680 [ 137.498154][ T119] __kvmalloc_node_noprof+0x793/0x970 [ 137.503545][ T119] v4l2_ctrl_new+0x4a6/0x23a0 [ 137.508237][ T119] v4l2_ctrl_new_std+0x1bb/0x290 [ 137.513190][ T119] handler_new_ref+0x82f/0xc60 [ 137.517969][ T119] v4l2_ctrl_add_handler+0x223/0x300 [ 137.523274][ T119] vivid_create_controls+0x351e/0x3e80 [ 137.528740][ T119] vivid_probe.cold+0x4f1e/0x921e [ 137.533773][ T119] platform_probe+0x106/0x1d0 [ 137.538474][ T119] really_probe+0x241/0xa60 [ 137.542989][ T119] __driver_probe_device+0x20e/0x450 [ 137.548284][ T119] page_owner free stack trace missing [ 137.553642][ T119] [ 137.555955][ T119] Memory state around the buggy address: [ 137.561577][ T119] ffff8880319bab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 137.569636][ T119] ffff8880319bac00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 137.577695][ T119] >ffff8880319bac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 137.585751][ T119] ^ [ 137.590333][ T119] ffff8880319bad00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 137.598398][ T119] ffff8880319bad80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 137.606455][ T119] ================================================================== [ 137.861374][ T5891] loop0: detected capacity change from 0 to 32768 [ 137.885699][ T154] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 137.885699][ T154] [ 137.896015][ T154] ERROR: (device loop0): remounting filesystem as read-only [ 137.905269][ T154] ERROR: (device loop0): dbAlloc: the hint is outside the map [ 137.905269][ T154] [ 137.921667][ T118] blkno = 5002c, nblocks = 1 [ 137.926717][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 137.926717][ T118] [ 137.937340][ T118] blkno = 5002d, nblocks = 1 [ 137.941956][ T118] ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map [ 137.941956][ T118] [ 137.957451][ T118] ================================================================== [ 137.965514][ T118] BUG: KASAN: slab-use-after-free in jfs_lazycommit+0x9a8/0xab0 [ 137.973534][ T118] Read of size 4 at addr ffff8880356d7094 by task jfsCommit/118 [ 137.981170][ T118] [ 137.983492][ T118] CPU: 1 UID: 0 PID: 118 Comm: jfsCommit Tainted: G B syzkaller #0 PREEMPT(full) [ 137.983541][ T118] Tainted: [B]=BAD_PAGE [ 137.983553][ T118] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 137.983574][ T118] Call Trace: [ 137.983585][ T118] [ 137.983597][ T118] dump_stack_lvl+0x100/0x190 [ 137.983636][ T118] print_report+0x13d/0x4b0 [ 137.983687][ T118] ? srso_alias_return_thunk+0x5/0xfbef5 [ 137.983729][ T118] ? __virt_addr_valid+0x239/0x430 [ 137.983773][ T118] ? jfs_lazycommit+0x9a8/0xab0 [ 137.983829][ T118] kasan_report+0xdf/0x1c0 [ 137.983886][ T118] ? jfs_lazycommit+0x9a8/0xab0 [ 137.983946][ T118] jfs_lazycommit+0x9a8/0xab0 [ 137.984005][ T118] ? __pfx_jfs_lazycommit+0x10/0x10 [ 137.984060][ T118] ? srso_alias_return_thunk+0x5/0xfbef5 [ 137.984102][ T118] ? rcu_is_watching+0x12/0xc0 [ 137.984149][ T118] ? __pfx_default_wake_function+0x10/0x10 [ 137.984194][ T118] ? srso_alias_return_thunk+0x5/0xfbef5 [ 137.984236][ T118] ? srso_alias_return_thunk+0x5/0xfbef5 [ 137.984278][ T118] ? __kthread_parkme+0x18c/0x230 [ 137.984323][ T118] ? kthread+0x13a/0x450 [ 137.984371][ T118] ? __pfx_jfs_lazycommit+0x10/0x10 [ 137.984427][ T118] kthread+0x370/0x450 [ 137.984475][ T118] ? __pfx_kthread+0x10/0x10 [ 137.984526][ T118] ret_from_fork+0x72b/0xd50 [ 137.984569][ T118] ? __pfx_ret_from_fork+0x10/0x10 [ 137.984611][ T118] ? srso_alias_return_thunk+0x5/0xfbef5 [ 137.984653][ T118] ? __switch_to+0x800/0x10f0 [ 137.984704][ T118] ? __switch_to_asm+0x39/0x70 [ 137.984755][ T118] ? __pfx_kthread+0x10/0x10 [ 137.984807][ T118] ret_from_fork_asm+0x1a/0x30 [ 137.984864][ T118] [ 137.984876][ T118] [ 138.149166][ T118] Allocated by task 5891: [ 138.153493][ T118] kasan_save_stack+0x30/0x50 [ 138.158194][ T118] kasan_save_track+0x14/0x30 [ 138.162889][ T118] __kasan_kmalloc+0xaa/0xb0 [ 138.167502][ T118] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 138.172886][ T118] jfs_fill_super+0xca/0xf70 [ 138.177665][ T118] get_tree_bdev_flags+0x38c/0x620 [ 138.182789][ T118] vfs_get_tree+0x92/0x320 [ 138.187206][ T118] path_mount+0x7d0/0x23d0 [ 138.191662][ T118] __x64_sys_mount+0x293/0x310 [ 138.196446][ T118] do_syscall_64+0x115/0x870 [ 138.201037][ T118] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 138.206931][ T118] [ 138.209243][ T118] Freed by task 5761: [ 138.213212][ T118] kasan_save_stack+0x30/0x50 [ 138.217911][ T118] kasan_save_track+0x14/0x30 [ 138.222605][ T118] kasan_save_free_info+0x3b/0x70 [ 138.227636][ T118] __kasan_slab_free+0x5f/0x80 [ 138.232419][ T118] kfree+0x22b/0x6c0 [ 138.236342][ T118] generic_shutdown_super+0x167/0x360 [ 138.241807][ T118] kill_block_super+0x3b/0xa0 [ 138.246483][ T118] deactivate_locked_super+0xc1/0x1b0 [ 138.251859][ T118] deactivate_super+0xe7/0x110 [ 138.256623][ T118] cleanup_mnt+0x21f/0x450 [ 138.261047][ T118] task_work_run+0x150/0x240 [ 138.265656][ T118] exit_to_user_mode_loop+0x1d8/0x6f0 [ 138.271034][ T118] do_syscall_64+0x666/0x870 [ 138.275625][ T118] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 138.281520][ T118] [ 138.283831][ T118] The buggy address belongs to the object at ffff8880356d7000 [ 138.283831][ T118] which belongs to the cache kmalloc-256 of size 256 [ 138.297880][ T118] The buggy address is located 148 bytes inside of [ 138.297880][ T118] freed 256-byte region [ffff8880356d7000, ffff8880356d7100)