Warning: Permanently added '[localhost]:32265' (ED25519) to the list of known hosts. 2026/10/20 16:50:14 parsed 1 programs 2026/10/20 16:50:14 serving rpc on tcp://40205 syzkaller login: [ 89.909205][ T5285] cgroup: Unknown subsys name 'net' [ 89.970866][ T5285] cgroup: Unknown subsys name 'cpuset' [ 89.974480][ T5285] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 91.611135][ T5285] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 91.978194][ T10] cfg80211: failed to load regulatory.db [ 97.136379][ T5298] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 97.783721][ T39] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.783740][ T39] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.853071][ T39] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.853090][ T39] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.213201][ T5323] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 100.219628][ T5323] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 100.221250][ T5323] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 100.222004][ T5323] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 100.223134][ T5323] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 101.349554][ T5331] rxe_eth0 speed is unknown, defaulting to 1000 [ 101.350330][ T5331] rxe_eth0 speed is unknown, defaulting to 1000 [ 101.351217][ T5331] rxe_eth0 speed is unknown, defaulting to 1000 [ 101.637806][ T5331] infiniband rxe0: set active [ 101.638534][ T10] rxe_eth0 speed is unknown, defaulting to 1000 [ 101.639875][ T5331] infiniband rxe0: added rxe_eth0 [ 101.673355][ T5331] smbdirect: ib_dev[rxe0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 101.673382][ T5331] smbdirect: ib_dev[rxe0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 101.673401][ T5331] smbdirect: ib_dev[rxe0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 101.737441][ T5331] RDS/IB: rxe0: added [ 101.737718][ T5331] smc: adding ib device rxe0 with port count 1 [ 101.737778][ T5331] smc: ib device rxe0 port 1 has no pnetid [ 101.740656][ T10] rxe_eth0 speed is unknown, defaulting to 1000 [ 101.819838][ T5331] rxe_eth0 speed is unknown, defaulting to 1000 [ 101.877862][ T10] rxe_eth0 speed is unknown, defaulting to 1000 [ 101.892716][ T10] rxe_eth0 speed is unknown, defaulting to 1000 [ 101.958312][ T10] rxe_eth0 speed is unknown, defaulting to 1000 [ 102.230040][ T5331] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.231008][ T5331] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.231100][ T5331] bridge_slave_0: entered allmulticast mode [ 102.250279][ T5331] bridge_slave_0: entered promiscuous mode [ 102.257573][ T5331] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.257673][ T5331] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.257769][ T5331] bridge_slave_1: entered allmulticast mode [ 102.259028][ T5331] bridge_slave_1: entered promiscuous mode [ 102.295619][ T5331] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.298279][ T5331] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.329292][ T5331] team0: Port device team_slave_0 added [ 102.331274][ T5331] team0: Port device team_slave_1 added [ 102.365613][ T5331] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 102.365629][ T5331] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.365644][ T5331] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 102.367481][ T5331] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 102.367487][ T5331] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.367497][ T5331] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 102.478346][ T5331] hsr_slave_0: entered promiscuous mode [ 102.479961][ T5331] hsr_slave_1: entered promiscuous mode [ 102.821398][ T5331] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 102.841775][ T5331] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 102.844098][ T5331] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 102.861318][ T5331] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 102.863419][ T5331] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 102.880546][ T5331] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 102.881160][ T5331] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 102.893407][ T5331] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 102.951532][ T5331] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.951721][ T5331] bridge0: port 2(bridge_slave_1) entered forwarding state [ 102.952097][ T5331] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.952172][ T5331] bridge0: port 1(bridge_slave_0) entered forwarding state [ 103.080947][ T5331] 8021q: adding VLAN 0 to HW filter on device bond0 [ 103.090174][ T39] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.091513][ T39] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.127127][ T5331] 8021q: adding VLAN 0 to HW filter on device team0 [ 103.134217][ T54] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.134260][ T54] bridge0: port 1(bridge_slave_0) entered forwarding state [ 103.150362][ T54] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.150432][ T54] bridge0: port 2(bridge_slave_1) entered forwarding state [ 103.818621][ T5331] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 103.872135][ T5331] veth0_vlan: entered promiscuous mode [ 103.883043][ T5331] veth1_vlan: entered promiscuous mode [ 103.919241][ T5331] veth0_macvtap: entered promiscuous mode [ 103.948291][ T5331] veth1_macvtap: entered promiscuous mode [ 103.976183][ T5331] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 103.996751][ T5331] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 104.058648][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.105309][ T39] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.105338][ T39] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.105355][ T39] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.370328][ T39] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 104.452861][ T39] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 104.508579][ T39] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 104.529615][ T5379] rxe_eth0 speed is unknown, defaulting to 1000 [ 105.017314][ T5384] rxe_eth0 speed is unknown, defaulting to 1000 [ 105.357568][ T39] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 105.623234][ T5389] rxe_eth0 speed is unknown, defaulting to 1000 [ 106.080308][ T5394] rxe_eth0 speed is unknown, defaulting to 1000 [ 106.695795][ T39] bridge_slave_1: left allmulticast mode [ 106.695832][ T39] bridge_slave_1: left promiscuous mode [ 106.705771][ T39] bridge0: port 2(bridge_slave_1) entered disabled state [ 106.726122][ T39] bridge_slave_0: left allmulticast mode [ 106.726221][ T39] bridge_slave_0: left promiscuous mode [ 106.730965][ T39] bridge0: port 1(bridge_slave_0) entered disabled state [ 107.100012][ T39] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 107.102637][ T39] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 107.103948][ T39] bond0 (unregistering): Released all slaves [ 107.122216][ T5399] rxe_eth0 speed is unknown, defaulting to 1000 [ 107.886064][ T39] hsr_slave_0: left promiscuous mode [ 107.887537][ T39] hsr_slave_1: left promiscuous mode [ 107.890580][ T39] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 107.890608][ T39] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 107.910989][ T39] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 107.911008][ T39] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 107.954174][ T39] veth1_macvtap: left promiscuous mode [ 107.959178][ T39] veth0_macvtap: left promiscuous mode [ 107.959264][ T39] veth1_vlan: left promiscuous mode [ 107.959352][ T39] veth0_vlan: left promiscuous mode [ 108.537713][ T39] team0 (unregistering): Port device team_slave_1 removed [ 108.550855][ T39] team0 (unregistering): Port device team_slave_0 removed [ 108.683604][ T4987] 8021q: adding VLAN 0 to HW filter on device eth4 [ 108.760663][ T5411] rxe_eth0 speed is unknown, defaulting to 1000 [ 109.413660][ T4987] 8021q: adding VLAN 0 to HW filter on device eth3 [ 109.961822][ T5425] rxe_eth0 speed is unknown, defaulting to 1000 [ 110.286881][ T4987] 8021q: adding VLAN 0 to HW filter on device eth2 [ 110.924005][ T5438] rxe_eth0 speed is unknown, defaulting to 1000 [ 111.166101][ T4987] 8021q: adding VLAN 0 to HW filter on device eth5 2026/10/20 16:50:39 executed programs: 0 [ 112.758640][ T4642] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 112.760638][ T4642] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 112.762545][ T4642] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 112.763163][ T4642] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 112.783455][ T4642] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 113.391211][ T5451] rxe_eth0 speed is unknown, defaulting to 1000 [ 113.736495][ T5451] bridge0: port 1(bridge_slave_0) entered blocking state [ 113.737253][ T5451] bridge0: port 1(bridge_slave_0) entered disabled state [ 113.737345][ T5451] bridge_slave_0: entered allmulticast mode [ 113.739440][ T5451] bridge_slave_0: entered promiscuous mode [ 113.767091][ T5451] bridge0: port 2(bridge_slave_1) entered blocking state [ 113.767162][ T5451] bridge0: port 2(bridge_slave_1) entered disabled state [ 113.767232][ T5451] bridge_slave_1: entered allmulticast mode [ 113.768264][ T5451] bridge_slave_1: entered promiscuous mode [ 113.838189][ T5451] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 113.840163][ T5451] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 113.890370][ T5451] team0: Port device team_slave_0 added [ 113.892262][ T5451] team0: Port device team_slave_1 added [ 113.915626][ T5451] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 113.915639][ T5451] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 113.915652][ T5451] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 113.916905][ T5451] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 113.916914][ T5451] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 113.916926][ T5451] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 114.038125][ T5451] hsr_slave_0: entered promiscuous mode [ 114.039009][ T5451] hsr_slave_1: entered promiscuous mode [ 114.655261][ T5451] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 114.662791][ T5451] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 114.664442][ T5451] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 114.680288][ T5451] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 114.680993][ T5451] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 114.695808][ T5451] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 114.696888][ T5451] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 114.702803][ T5451] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 114.847063][ T4642] Bluetooth: hci0: command tx timeout [ 114.889288][ T5451] 8021q: adding VLAN 0 to HW filter on device bond0 [ 114.922312][ T5451] 8021q: adding VLAN 0 to HW filter on device team0 [ 114.940394][ T54] bridge0: port 1(bridge_slave_0) entered blocking state [ 114.940478][ T54] bridge0: port 1(bridge_slave_0) entered forwarding state [ 114.968551][ T54] bridge0: port 2(bridge_slave_1) entered blocking state [ 114.968624][ T54] bridge0: port 2(bridge_slave_1) entered forwarding state [ 115.061644][ T10] rxe_eth0 speed is unknown, defaulting to 1000 [ 115.764251][ T5451] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 115.849328][ T5451] veth0_vlan: entered promiscuous mode [ 115.868846][ T5451] veth1_vlan: entered promiscuous mode [ 115.928361][ T5451] veth0_macvtap: entered promiscuous mode [ 115.940423][ T5451] veth1_macvtap: entered promiscuous mode [ 115.978411][ T5451] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 115.981156][ T5451] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 116.088258][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.088292][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.088311][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.088330][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.257681][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 116.257698][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.343555][ T1055] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 116.343574][ T1055] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.540590][ T5514] ================================================================== [ 116.540619][ T5514] BUG: KASAN: slab-use-after-free in snapshot_ctr+0x5cb/0x1340 [ 116.540784][ T5514] Read of size 8 at addr ffff8880327c7b18 by task syz.0.17/5514 [ 116.540794][ T5514] [ 116.540811][ T5514] CPU: 0 UID: 0 PID: 5514 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 116.540823][ T5514] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 116.540830][ T5514] Call Trace: [ 116.540836][ T5514] [ 116.540841][ T5514] dump_stack_lvl+0xe8/0x150 [ 116.540882][ T5514] print_address_description+0x55/0x1e0 [ 116.540896][ T5514] ? snapshot_ctr+0x5cb/0x1340 [ 116.540905][ T5514] print_report+0x58/0x70 [ 116.540917][ T5514] kasan_report+0x117/0x150 [ 116.540939][ T5514] ? snapshot_ctr+0x5cb/0x1340 [ 116.540952][ T5514] snapshot_ctr+0x5cb/0x1340 [ 116.540966][ T5514] ? __pfx_snapshot_ctr+0x10/0x10 [ 116.540976][ T5514] ? skip_spaces+0x8a/0xa0 [ 116.541036][ T5514] ? dm_split_args+0x50b/0x5d0 [ 116.541054][ T5514] dm_table_add_target+0x58d/0xc70 [ 116.541066][ T5514] table_load+0x325/0x8a0 [ 116.541077][ T5514] ? __pfx_table_load+0x10/0x10 [ 116.541088][ T5514] dm_ctl_ioctl+0x9ec/0xe10 [ 116.541098][ T5514] ? __pfx_table_load+0x10/0x10 [ 116.541106][ T5514] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 116.541119][ T5514] ? __pfx___se_sys_futex+0x10/0x10 [ 116.541137][ T5514] ? bpf_lsm_file_ioctl+0x9/0x20 [ 116.541149][ T5514] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 116.541161][ T5514] __se_sys_ioctl+0xfc/0x170 [ 116.541172][ T5514] do_syscall_64+0x166/0x520 [ 116.541201][ T5514] ? trace_irq_disable+0x3b/0x140 [ 116.541212][ T5514] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.541224][ T5514] ? clear_bhb_loop+0x70/0xc0 [ 116.541235][ T5514] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.541246][ T5514] RIP: 0033:0x7fc75e19f559 [ 116.541254][ T5514] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 116.541261][ T5514] RSP: 002b:00007fff9ec886a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 116.541270][ T5514] RAX: ffffffffffffffda RBX: 00007fc75e425fa0 RCX: 00007fc75e19f559 [ 116.541276][ T5514] RDX: 0000200000001640 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 116.541281][ T5514] RBP: 00007fc75e236b20 R08: 0000000000000000 R09: 0000000000000000 [ 116.541285][ T5514] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 116.541289][ T5514] R13: 00007fc75e425fac R14: 00007fc75e425fa0 R15: 00007fc75e425fa0 [ 116.541296][ T5514] [ 116.541299][ T5514] [ 116.541301][ T5514] Allocated by task 5514: [ 116.541305][ T5514] kasan_save_track+0x3e/0x80 [ 116.541312][ T5514] __kasan_kmalloc+0x93/0xb0 [ 116.541318][ T5514] __kmalloc_cache_node_noprof+0x3d1/0x620 [ 116.541324][ T5514] dm_get_table_device+0x23e/0x740 [ 116.541330][ T5514] dm_get_device+0x327/0x760 [ 116.541344][ T5514] snapshot_ctr+0x2b2/0x1340 [ 116.541350][ T5514] dm_table_add_target+0x58d/0xc70 [ 116.541358][ T5514] table_load+0x325/0x8a0 [ 116.541366][ T5514] dm_ctl_ioctl+0x9ec/0xe10 [ 116.541374][ T5514] __se_sys_ioctl+0xfc/0x170 [ 116.541407][ T5514] do_syscall_64+0x166/0x520 [ 116.541417][ T5514] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.541425][ T5514] [ 116.541427][ T5514] Freed by task 5514: [ 116.541432][ T5514] kasan_save_track+0x3e/0x80 [ 116.541440][ T5514] kasan_save_free_info+0x40/0x50 [ 116.541453][ T5514] __kasan_slab_free+0x5c/0x80 [ 116.541463][ T5514] kfree+0x1c5/0x650 [ 116.541475][ T5514] dm_put_table_device+0x255/0x2a0 [ 116.541484][ T5514] dm_get_device+0x56f/0x760 [ 116.541497][ T5514] snapshot_ctr+0x471/0x1340 [ 116.541506][ T5514] dm_table_add_target+0x58d/0xc70 [ 116.541515][ T5514] table_load+0x325/0x8a0 [ 116.541522][ T5514] dm_ctl_ioctl+0x9ec/0xe10 [ 116.541530][ T5514] __se_sys_ioctl+0xfc/0x170 [ 116.541535][ T5514] do_syscall_64+0x166/0x520 [ 116.541542][ T5514] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.541548][ T5514] [ 116.541550][ T5514] The buggy address belongs to the object at ffff8880327c7b00 [ 116.541550][ T5514] which belongs to the cache kmalloc-96 of size 96 [ 116.541563][ T5514] The buggy address is located 24 bytes inside of [ 116.541563][ T5514] freed 96-byte region [ffff8880327c7b00, ffff8880327c7b60) [ 116.541570][ T5514] [ 116.541572][ T5514] The buggy address belongs to the physical page: [ 116.541583][ T5514] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x327c7 [ 116.541593][ T5514] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 116.541602][ T5514] page_type: f5(slab) [ 116.541611][ T5514] raw: 04fff00000000000 ffff88801c041280 dead000000000100 dead000000000122 [ 116.541620][ T5514] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000 [ 116.541625][ T5514] page dumped because: kasan: bad access detected [ 116.541631][ T5514] page_owner tracks the page as allocated [ 116.541635][ T5514] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 12421684553 [ 116.541652][ T5514] post_alloc_hook+0x1f9/0x250 [ 116.541667][ T5514] get_page_from_freelist+0x2209/0x2280 [ 116.541676][ T5514] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 116.541683][ T5514] allocate_slab+0x7d/0x620 [ 116.541690][ T5514] refill_objects+0x2d5/0x350 [ 116.541698][ T5514] __pcs_replace_empty_main+0x2c8/0x6c0 [ 116.541705][ T5514] __kmalloc_cache_noprof+0x39b/0x600 [ 116.541710][ T5514] bdev_disk_changed+0x4ca/0x17a0 [ 116.541725][ T5514] blkdev_get_whole+0x372/0x510 [ 116.541732][ T5514] bdev_open+0x324/0xd70 [ 116.541739][ T5514] bdev_file_open_by_dev+0x1be/0x240 [ 116.541746][ T5514] disk_scan_partitions+0x1bb/0x2c0 [ 116.541755][ T5514] add_disk_fwnode+0x24b/0x3a0 [ 116.541763][ T5514] brd_alloc+0x5a9/0x7c0 [ 116.541779][ T5514] brd_init+0xc1/0x120 [ 116.541881][ T5514] do_one_initcall+0x250/0x870 [ 116.541894][ T5514] page last free pid 9 tgid 9 ts 12256960668 stack trace: [ 116.541910][ T5514] __free_frozen_pages+0xc93/0xd90 [ 116.541925][ T5514] __slab_free+0x274/0x2c0 [ 116.541933][ T5514] qlist_free_all+0x99/0x100 [ 116.541942][ T5514] kasan_quarantine_reduce+0x148/0x160 [ 116.541950][ T5514] __kasan_slab_alloc+0x22/0x80 [ 116.541960][ T5514] __kmalloc_cache_noprof+0x29f/0x600 [ 116.541965][ T5514] drm_atomic_commit_alloc+0xa9/0x100 [ 116.541982][ T5514] drm_atomic_helper_dirtyfb+0x129/0xfd0 [ 116.541990][ T5514] drm_fbdev_shmem_helper_fb_dirty+0x160/0x310 [ 116.541998][ T5514] drm_fb_helper_damage_work+0x84c/0xf20 [ 116.542007][ T5514] process_scheduled_works+0xc3d/0x1630 [ 116.542016][ T5514] worker_thread+0xa47/0xfb0 [ 116.542024][ T5514] kthread+0x38b/0x480 [ 116.542029][ T5514] ret_from_fork+0x514/0xb70 [ 116.542035][ T5514] ret_from_fork_asm+0x1a/0x30 [ 116.542044][ T5514] [ 116.542046][ T5514] Memory state around the buggy address: [ 116.542051][ T5514] ffff8880327c7a00: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 116.542057][ T5514] ffff8880327c7a80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 116.542064][ T5514] >ffff8880327c7b00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 116.542068][ T5514] ^ [ 116.542074][ T5514] ffff8880327c7b80: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc [ 116.542080][ T5514] ffff8880327c7c00: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 116.542085][ T5514] ================================================================== [ 116.637008][ T5514] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 116.863271][ T5514] CPU: 0 UID: 0 PID: 5514 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 116.867159][ T5514] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 116.871311][ T5514] Call Trace: [ 116.872756][ T5514] [ 116.874075][ T5514] vpanic+0x56d/0xa60 [ 116.875775][ T5514] ? __pfx_vpanic+0x10/0x10 [ 116.877687][ T5514] panic+0xc5/0xd0 [ 116.879289][ T5514] ? __pfx_panic+0x10/0x10 [ 116.881327][ T5514] ? preempt_schedule_thunk+0x16/0x40 [ 116.883670][ T5514] ? snapshot_ctr+0x5cb/0x1340 [ 116.885843][ T5514] ? preempt_schedule_thunk+0x16/0x40 [ 116.888173][ T5514] ? snapshot_ctr+0x5cb/0x1340 [ 116.890397][ T5514] check_panic_on_warn+0x89/0xb0 [ 116.892612][ T5514] ? snapshot_ctr+0x5cb/0x1340 [ 116.894797][ T5514] end_report+0x73/0x170 [ 116.896711][ T5514] ? snapshot_ctr+0x5cb/0x1340 [ 116.898888][ T5514] kasan_report+0x128/0x150 [ 116.900985][ T5514] ? snapshot_ctr+0x5cb/0x1340 [ 116.903213][ T5514] snapshot_ctr+0x5cb/0x1340 [ 116.905336][ T5514] ? __pfx_snapshot_ctr+0x10/0x10 [ 116.907622][ T5514] ? skip_spaces+0x8a/0xa0 [ 116.909567][ T5514] ? dm_split_args+0x50b/0x5d0 [ 116.911702][ T5514] dm_table_add_target+0x58d/0xc70 [ 116.914071][ T5514] table_load+0x325/0x8a0 [ 116.916004][ T5514] ? __pfx_table_load+0x10/0x10 [ 116.918245][ T5514] dm_ctl_ioctl+0x9ec/0xe10 [ 116.920248][ T5514] ? __pfx_table_load+0x10/0x10 [ 116.922364][ T5514] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 116.924473][ T5514] ? __pfx___se_sys_futex+0x10/0x10 [ 116.926651][ T5514] ? bpf_lsm_file_ioctl+0x9/0x20 [ 116.928713][ T5514] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 116.930846][ T5514] __se_sys_ioctl+0xfc/0x170 [ 116.932716][ T5514] do_syscall_64+0x166/0x520 [ 116.934651][ T5514] ? trace_irq_disable+0x3b/0x140 [ 116.936912][ T5514] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.939416][ T5514] ? clear_bhb_loop+0x70/0xc0 [ 116.941475][ T5514] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.944126][ T5514] RIP: 0033:0x7fc75e19f559 [ 116.946149][ T5514] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 116.954521][ T5514] RSP: 002b:00007fff9ec886a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 116.958244][ T5514] RAX: ffffffffffffffda RBX: 00007fc75e425fa0 RCX: 00007fc75e19f559 [ 116.961783][ T5514] RDX: 0000200000001640 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 116.965359][ T5514] RBP: 00007fc75e236b20 R08: 0000000000000000 R09: 0000000000000000 [ 116.968840][ T5514] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 116.972290][ T5514] R13: 00007fc75e425fac R14: 00007fc75e425fa0 R15: 00007fc75e425fa0 [ 116.975746][ T5514] [ 116.977610][ T5514] Kernel Offset: disabled [ 116.979522][ T5514] Rebooting in 86400 seconds.. VM DIAGNOSIS: 16:50:44 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000038 RBX=0000000000000038 RCX=0000000000000000 RDX=00000000000003f8 RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90000337900 R8 =0000000000000003 R9 =0000000000000004 R10=dffffc0000000000 R11=ffffffff8576b480 R12=dffffc0000000000 R13=0000000000000038 R14=ffffffff9bd5b220 R15=0000000000000000 RIP=ffffffff8576b4fc RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88808b0b0000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f7c3d190286 CR3=000000001425f000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=00000000fcc1c088 Opmask01=0000000000000000 Opmask02=000000007f030f07 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 c9c1e40d028f1e34 38888f0b62c0ee2b ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 9282eea07a0d7ba8 2f796705dfb60f0f ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 779f72b8916e94fa d28c422d363d4d12 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 d84e73043453f11b 9ad193850665701f ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000001b00 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000040 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ca34f221cbff795b 0000001b00000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 cb299cef00a05410 4af9438fc7a46a50 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 cb69bc610000001b 0000001b0000001b ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000001b92a61498 cd18cfe30000001b ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 e0f6ae1c787ddef1 3a4dc29cc17078ee ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 aa7ee5c74271de9b c0079c6fab16f6f2 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 a54ff53a3c6ef372 bb67ae856a09e667 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 5be0cd191f83d9ab 9b05688c510e527f ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000000000732d 0000559df5d0d100 0000559df5d0d120 00646e6100706d63 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000000000732d 0000559df5d0d100 0000559df5d0d120 00646e6100706d63 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000005c02 0000559ddad0d100 0000559ddad0d10f 004b414e005f424c ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000559df5d092f8 0000000000000000 000000000000000f 0000559df500873d ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000559df5d03b58 0000000000000000 000000000000000f 0000000000875d81 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000