Warning: Permanently added '10.128.0.62' (ED25519) to the list of known hosts.
[*] Starting reproducer for refcount bug in remove_inode_hugepages...
[+] open /proc/sys/vm/nr_hugepages successful.
[+] write to /proc/sys/vm/nr_hugepages successful.
[+] close /proc/sys/vm/nr_hugepages successful.
[+] SIGBUS handler installed successfully.
[+] memfd_create with MFD_HUGETLB successful.
[+] Initial ftruncate to 8388608 bytes successful.
[+] mmap MAP_SHARED successful.
[+] Initial write to MAP_SHARED pages successful.
[+] Created 4 MAP_PRIVATE mappings and faulted initial pages.
[+] Launched 8 worker contention threads successfully.
[*] Starting main ftruncate race loop for 15 seconds...
[  125.109823][ T5930] refcount_t: addition on 0; use-after-free.
[  125.110109][ T5930] ------------[ cut here ]------------
[  125.110116][ T5930] kernel BUG at lib/refcount.c:34!
[  125.110151][ T5930] Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
[  125.133871][ T5930] CPU: 0 UID: 0 PID: 5930 Comm: syz-executor856 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
[  125.144125][ T5930] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
[  125.154353][ T5930] RIP: 0010:refcount_warn_saturate+0xf0/0x110
[  125.160440][ T5930] Code: 80 c1 03 38 c1 0f 8c 6a ff ff ff 4c 89 f7 e8 d7 92 63 fd e9 5d ff ff ff e8 ad b2 f6 fc 48 c7 c7 60 82 ea 8b e8 11 5c 57 fc 90 <0f> 0b e8 99 b2 f6 fc 48 c7 c7 e0 82 ea 8b e8 fd 5b 57 fc 90 0f 0b
[  125.180670][ T5930] RSP: 0018:ffffc90004a37928 EFLAGS: 00010246
[  125.186830][ T5930] RAX: 000000000000002a RBX: 0000000000000002 RCX: 3a69e62f58ffd700
[  125.194877][ T5930] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[  125.202858][ T5930] RBP: ffffc90004a37be8 R08: 0000000000000000 R09: 0000000000000000
[  125.210935][ T5930] R10: dffffc0000000000 R11: fffff52000946ed5 R12: ffffea0001610000
[  125.218994][ T5930] R13: dffffc0000000000 R14: ffff888036ec0c01 R15: ffff88803af58430
[  125.226965][ T5930] FS:  000055558950d4c0(0000) GS:ffff8881247ad000(0000) knlGS:0000000000000000
[  125.235988][ T5930] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  125.242578][ T5930] CR2: 00007fa042400000 CR3: 000000003486e000 CR4: 00000000003526f0
[  125.250713][ T5930] Call Trace:
[  125.253991][ T5930]  <TASK>
[  125.256941][ T5930]  remove_inode_hugepages+0xbdb/0x10f0
[  125.262493][ T5930]  ? __pfx_remove_inode_hugepages+0x10/0x10
[  125.268604][ T5930]  ? __pfx_rt_mutex_slowunlock+0x10/0x10
[  125.274405][ T5930]  ? up_write+0x5a/0x190
[  125.278737][ T5930]  hugetlbfs_setattr+0x4f0/0x6d0
[  125.284024][ T5930]  ? __pfx_hugetlbfs_setattr+0x10/0x10
[  125.289484][ T5930]  notify_change+0xbb8/0xec0
[  125.294086][ T5930]  do_truncate+0x1c2/0x250
[  125.298633][ T5930]  ? __pfx_do_truncate+0x10/0x10
[  125.303611][ T5930]  do_ftruncate+0x4e0/0x590
[  125.308118][ T5930]  ? __pfx_do_ftruncate+0x10/0x10
[  125.313407][ T5930]  ? __fget_files+0x3a8/0x420
[  125.318195][ T5930]  ? __fget_files+0x2a/0x420
[  125.322869][ T5930]  ? fdget+0x1b2/0x250
[  125.326948][ T5930]  __x64_sys_ftruncate+0x8f/0xe0
[  125.331895][ T5930]  do_syscall_64+0x166/0x520
[  125.336722][ T5930]  ? trace_irq_disable+0x3b/0x140
[  125.341754][ T5930]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  125.347912][ T5930]  ? clear_bhb_loop+0x70/0xc0
[  125.352582][ T5930]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  125.358506][ T5930] RIP: 0033:0x7fa04350daa7
[  125.362942][ T5930] Code: 00 00 00 48 c7 c0 d0 ff ff ff 64 c7 00 0c 00 00 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 4d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 d0 ff ff ff f7 d8 64 89 02 b8
[  125.382715][ T5930] RSP: 002b:00007fffbd25aeb8 EFLAGS: 00000246 ORIG_RAX: 000000000000004d
[  125.391128][ T5930] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fa04350daa7
[  125.399096][ T5930] RDX: 0000000000000044 RSI: 0000000000000000 RDI: 0000000000000003
[  125.407060][ T5930] RBP: 00007fa0435adb60 R08: 0000000029b4ae16 R09: 3fffffffffffffff
[  125.415035][ T5930] R10: 4000000000000000 R11: 0000000000000246 R12: 0000000000000003
[  125.423030][ T5930] R13: 00007fffbd25af00 R14: 00007fffbd25aef0 R15: 4ec4ec4ec4ec4ec5
[  125.431815][ T5930]  </TASK>
[  125.434932][ T5930] Modules linked in:
[  125.439659][ T5930] ---[ end trace 0000000000000000 ]---
[  125.445881][ T5930] RIP: 0010:refcount_warn_saturate+0xf0/0x110
[  125.445912][ T5930] Code: 80 c1 03 38 c1 0f 8c 6a ff ff ff 4c 89 f7 e8 d7 92 63 fd e9 5d ff ff ff e8 ad b2 f6 fc 48 c7 c7 60 82 ea 8b e8 11 5c 57 fc 90 <0f> 0b e8 99 b2 f6 fc 48 c7 c7 e0 82 ea 8b e8 fd 5b 57 fc 90 0f 0b
[  125.445925][ T5930] RSP: 0018:ffffc90004a37928 EFLAGS: 00010246
[  125.445941][ T5930] RAX: 000000000000002a RBX: 0000000000000002 RCX: 3a69e62f58ffd700
[  125.445953][ T5930] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[  125.445963][ T5930] RBP: ffffc90004a37be8 R08: 0000000000000000 R09: 0000000000000000
[  125.445973][ T5930] R10: dffffc0000000000 R11: fffff52000946ed5 R12: ffffea0001610000
[  125.445985][ T5930] R13: dffffc0000000000 R14: ffff888036ec0c01 R15: ffff88803af58430
[  125.445997][ T5930] FS:  000055558950d4c0(0000) GS:ffff8881247ad000(0000) knlGS:0000000000000000
[  125.446011][ T5930] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  125.446022][ T5930] CR2: 00007fa042400000 CR3: 000000003486e000 CR4: 00000000003526f0
[  125.446039][ T5930] Kernel panic - not syncing: Fatal exception
[  125.550169][ T5930] Kernel Offset: disabled
[  125.554714][ T5930] Rebooting in 86400 seconds..