no interfaces have a carrier [ 43.251239][ T3853] 8021q: adding VLAN 0 to HW filter on device bond0 [ 43.263457][ T3853] eql: remember to turn off Van-Jacobson compression on your slave devices Starting crond: OK Starting sshd: OK syzkaller Warning: Permanently added '10.128.1.20' (ED25519) to the list of known hosts. 2026/06/23 22:30:59 parsed 1 programs 2026/06/23 22:30:59 serving rpc on tcp://36861 syzkaller login: [ 70.284074][ T4199] cgroup: Unknown subsys name 'net' [ 70.392467][ T4199] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 71.346758][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.353321][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.924927][ T4199] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 75.250290][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.264543][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.278412][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 75.302917][ T155] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.310911][ T155] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.319659][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 75.741087][ T4265] chnl_net:caif_netlink_parms(): no params data found [ 75.789438][ T4265] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.797099][ T4265] bridge0: port 1(bridge_slave_0) entered disabled state [ 75.805422][ T4265] device bridge_slave_0 entered promiscuous mode [ 75.814574][ T4265] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.821696][ T4265] bridge0: port 2(bridge_slave_1) entered disabled state [ 75.830153][ T4265] device bridge_slave_1 entered promiscuous mode [ 75.850667][ T4265] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 75.861709][ T4265] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 75.884870][ T4265] team0: Port device team_slave_0 added [ 75.892135][ T4265] team0: Port device team_slave_1 added [ 75.909606][ T4265] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 75.916615][ T4265] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.942611][ T4265] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 75.955138][ T4265] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 75.962112][ T4265] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.988264][ T4265] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 76.018713][ T4265] device hsr_slave_0 entered promiscuous mode [ 76.026092][ T4265] device hsr_slave_1 entered promiscuous mode [ 76.145726][ T4265] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 76.157496][ T4265] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 76.167327][ T4265] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 76.177209][ T4265] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 76.221035][ T4265] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.228265][ T4265] bridge0: port 2(bridge_slave_1) entered forwarding state [ 76.236336][ T4265] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.243440][ T4265] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.305369][ T144] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.315367][ T144] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.357678][ T4265] 8021q: adding VLAN 0 to HW filter on device bond0 [ 76.369956][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 76.378942][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 76.390746][ T4265] 8021q: adding VLAN 0 to HW filter on device team0 [ 76.401470][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 76.410692][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 76.420131][ T154] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.427321][ T154] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.457870][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 76.466882][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 76.476515][ T154] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.483642][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 76.497665][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 76.534429][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 76.545246][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 76.554863][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 76.564953][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 76.575535][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 76.585847][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 76.618425][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 76.627261][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 76.638927][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 76.647858][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 76.661311][ T4265] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 76.804451][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 76.812036][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 76.827517][ T4265] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 76.858259][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 76.869941][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 76.899582][ T4265] device veth0_vlan entered promiscuous mode [ 76.907765][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 76.916685][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 76.926245][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 76.934627][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 76.955723][ T4265] device veth1_vlan entered promiscuous mode [ 77.000988][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 77.009451][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 77.018033][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 77.028144][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 77.039591][ T4265] device veth0_macvtap entered promiscuous mode [ 77.051485][ T4265] device veth1_macvtap entered promiscuous mode [ 77.071393][ T4265] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 77.080474][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 77.094257][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 77.102404][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 77.113185][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 77.125153][ T4265] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 77.134677][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 77.144294][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 77.155963][ T4265] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.166305][ T4265] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.177106][ T4265] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.186291][ T4265] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 2026/06/23 22:31:09 executed programs: 0 [ 78.571377][ T4305] chnl_net:caif_netlink_parms(): no params data found [ 78.627887][ T4305] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.635123][ T4305] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.643715][ T4305] device bridge_slave_0 entered promiscuous mode [ 78.653373][ T4305] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.660545][ T4305] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.669111][ T4305] device bridge_slave_1 entered promiscuous mode [ 78.695874][ T4305] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.707638][ T4305] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.742343][ T4305] team0: Port device team_slave_0 added [ 78.750573][ T4305] team0: Port device team_slave_1 added [ 78.770361][ T4305] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.777411][ T4305] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.803462][ T4305] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.816508][ T4305] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.823773][ T4305] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.849963][ T4305] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.896126][ T4305] device hsr_slave_0 entered promiscuous mode [ 78.903272][ T4305] device hsr_slave_1 entered promiscuous mode [ 78.910187][ T4305] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.918416][ T4305] Cannot create hsr debugfs directory [ 78.958104][ T3089] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 80.463428][ T4274] Bluetooth: hci0: command 0x0409 tx timeout [ 81.979543][ T3089] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 82.128388][ T3089] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 82.200303][ T3089] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 82.542883][ T4321] Bluetooth: hci0: command 0x041b tx timeout [ 83.008855][ T4305] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 83.020060][ T4305] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 83.047136][ T4305] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 83.056659][ T4305] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 83.122906][ T4305] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.147845][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 83.155732][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 83.167142][ T4305] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.177462][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 83.188393][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 83.197364][ T155] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.204501][ T155] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.212305][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 83.235034][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 83.244166][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 83.252821][ T155] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.260224][ T155] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.275621][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 83.288821][ T3089] device hsr_slave_0 left promiscuous mode [ 83.296640][ T3089] device hsr_slave_1 left promiscuous mode [ 83.304392][ T3089] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 83.311853][ T3089] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 83.321001][ T3089] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 83.329550][ T3089] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 83.337337][ T3089] device bridge_slave_1 left promiscuous mode [ 83.344772][ T3089] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.360402][ T3089] device bridge_slave_0 left promiscuous mode [ 83.366753][ T3089] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.385655][ T3089] device veth1_macvtap left promiscuous mode [ 83.391928][ T3089] device veth0_macvtap left promiscuous mode [ 83.398252][ T3089] device veth1_vlan left promiscuous mode [ 83.405314][ T3089] device veth0_vlan left promiscuous mode [ 83.575301][ T3089] team0 (unregistering): Port device team_slave_1 removed [ 83.588993][ T3089] team0 (unregistering): Port device team_slave_0 removed [ 83.603345][ T3089] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 83.620231][ T3089] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 83.678415][ T3089] bond0 (unregistering): Released all slaves [ 83.727564][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 83.740325][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 83.749928][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 83.759470][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 83.771097][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 83.780016][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 83.797484][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 83.806337][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 83.815665][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 83.824743][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 83.840117][ T4305] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 83.943599][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 83.951167][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 83.975506][ T4305] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.993612][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 84.002517][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 84.021597][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 84.029999][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 84.042733][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 84.050642][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 84.061947][ T4305] device veth0_vlan entered promiscuous mode [ 84.079894][ T4305] device veth1_vlan entered promiscuous mode [ 84.101944][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 84.112037][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 84.120501][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 84.129473][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 84.141431][ T4305] device veth0_macvtap entered promiscuous mode [ 84.152082][ T4305] device veth1_macvtap entered promiscuous mode [ 84.164368][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 84.173461][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 84.191683][ T4305] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.199658][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 84.210032][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 84.223314][ T4305] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.231091][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 84.240826][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 84.253647][ T4305] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.262433][ T4305] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.272193][ T4305] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.283180][ T4305] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.361621][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.380178][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.406710][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 84.417959][ T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.426882][ T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.435687][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 84.633024][ T4290] Bluetooth: hci0: command 0x040f tx timeout [ 84.748641][ T4352] loop0: detected capacity change from 0 to 32768 [ 84.880226][ T4352] ERROR: (device loop0): dtSearch: stack overrun! [ 84.880226][ T4352] [ 84.891709][ T4352] ERROR: (device loop0): remounting filesystem as read-only [ 84.912961][ T4352] btstack dump: [ 84.916755][ T4352] bn = 0, index = 0 [ 84.920598][ T4352] bn = 72c, index = 96 [ 84.932606][ T4352] bn = 0, index = 0 [ 84.936774][ T4352] bn = 72c, index = 96 [ 84.941070][ T4352] bn = 0, index = 0 [ 84.962993][ T4352] bn = 72c, index = 96 [ 84.967136][ T4352] bn = 0, index = 0 [ 84.970974][ T4352] bn = 0, index = 0 [ 85.000338][ T277] BUG: Bad page state in process jfsCommit pfn:7dffb [ 85.018917][ T277] page:ffffea0001f7fec0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x72c pfn:0x7dffb [ 85.042673][ T277] flags: 0xfff00000002007(locked|referenced|uptodate|private|node=0|zone=1|lastcpupid=0x7ff) [ 85.109580][ T277] raw: 00fff00000002007 dead000000000100 dead000000000122 0000000000000000 [ 85.121095][ T277] raw: 000000000000072c ffff88801ef2fba0 00000000ffffffff 0000000000000000 [ 85.152664][ T277] page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set [ 85.160025][ T277] page_owner tracks the page as allocated [ 85.212940][ T277] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x100c40(GFP_NOFS|__GFP_HARDWALL), pid 4352, ts 84876464331, free_ts 84757154678 [ 85.243195][ T277] get_page_from_freelist+0x24f6/0x2670 [ 85.248836][ T277] __alloc_pages+0x1ee/0x480 [ 85.262566][ T277] __page_cache_alloc+0xce/0x440 [ 85.267577][ T277] pagecache_get_page+0x9b8/0xf20 [ 85.282600][ T277] __get_metapage+0x282/0x1060 [ 85.287445][ T277] dtSplitRoot+0x1cb/0x14d0 [ 85.291981][ T277] dtInsert+0xe84/0x57e0 [ 85.313007][ T277] jfs_symlink+0x8bb/0xfd0 [ 85.317517][ T277] vfs_symlink+0x245/0x3d0 [ 85.321973][ T277] do_symlinkat+0x1ab/0x6b0 [ 85.347425][ T277] __x64_sys_symlinkat+0x95/0xa0 [ 85.352453][ T277] do_syscall_64+0x4c/0xa0 [ 85.373748][ T277] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 85.379729][ T277] page last free stack trace: [ 85.403569][ T277] free_unref_page_prepare+0x637/0x6c0 [ 85.409120][ T277] free_unref_page+0x8f/0x2a0 [ 85.428348][ T277] __unfreeze_partials+0x188/0x1e0 [ 85.442562][ T277] put_cpu_partial+0x12d/0x190 [ 85.447408][ T277] qlist_free_all+0x35/0x90 [ 85.451947][ T277] kasan_quarantine_reduce+0x150/0x160 [ 85.472585][ T277] __kasan_slab_alloc+0x2f/0xc0 [ 85.483960][ T277] slab_post_alloc_hook+0x4c/0x380 [ 85.489147][ T277] kmem_cache_alloc_trace+0x165/0x290 [ 85.514409][ T277] kobject_uevent_env+0x275/0x890 [ 85.519525][ T277] loop_configure+0x1113/0x1480 [ 85.532625][ T277] lo_ioctl+0x2e1/0x20e0 [ 85.536979][ T277] blkdev_ioctl+0x347/0x6f0 [ 85.541518][ T277] block_ioctl+0xac/0xf0 [ 85.562655][ T277] __se_sys_ioctl+0xfa/0x170 [ 85.567331][ T277] do_syscall_64+0x4c/0xa0 [ 85.571800][ T277] Modules linked in: [ 85.582614][ T277] CPU: 0 PID: 277 Comm: jfsCommit Not tainted syzkaller #0 [ 85.589880][ T277] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 85.599983][ T277] Call Trace: [ 85.603292][ T277] [ 85.606252][ T277] dump_stack_lvl+0x188/0x250 [ 85.610962][ T277] ? show_regs_print_info+0x20/0x20 [ 85.616187][ T277] ? clockevents_increase_min_delta+0x130/0x130 [ 85.622473][ T277] bad_page+0x14b/0x170 [ 85.626663][ T277] free_unref_page_prepare+0x383/0x6c0 [ 85.632496][ T277] free_unref_page+0x8f/0x2a0 [ 85.637211][ T277] ? mark_free_pages+0x310/0x310 [ 85.642189][ T277] ? __mem_cgroup_uncharge+0xab/0xe0 [ 85.647518][ T277] txUnlock+0x275/0xcb0 [ 85.651708][ T277] ? _raw_spin_lock_irqsave+0x100/0x100 [ 85.657301][ T277] ? lockdep_hardirqs_on+0x94/0x140 [ 85.662543][ T277] jfs_lazycommit+0x598/0xb60 [ 85.667264][ T277] ? txFreelock+0x5a0/0x5a0 [ 85.671802][ T277] ? _raw_spin_unlock_irqrestore+0x82/0x120 [ 85.677731][ T277] ? sched_dynamic_update+0x210/0x210 [ 85.683177][ T277] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 85.689114][ T277] ? __kthread_parkme+0x14e/0x1b0 [ 85.694178][ T277] kthread+0x42e/0x520 [ 85.698281][ T277] ? txFreelock+0x5a0/0x5a0 [ 85.702878][ T277] ? kthread_blkcg+0xd0/0xd0 [ 85.707499][ T277] ret_from_fork+0x1f/0x30 [ 85.711958][ T277] [ 85.874213][ T277] Disabling lock debugging due to kernel taint [ 85.880469][ T277] page:ffffea0001f7fec0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x72c pfn:0x7dffb [ 85.912593][ T277] flags: 0xfff00000002007(locked|referenced|uptodate|private|node=0|zone=1|lastcpupid=0x7ff) [ 85.923548][ T277] raw: 00fff00000002007 dead000000000100 dead000000000122 0000000000000000 [ 85.932183][ T277] raw: 000000000000072c ffff88801ef2fba0 00000000ffffffff 0000000000000000 [ 85.941377][ T277] page dumped because: VM_BUG_ON_PAGE(((unsigned int) page_ref_count(page) + 127u <= 127u)) [ 85.952212][ T277] page_owner tracks the page as allocated [ 85.958468][ T277] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x100c40(GFP_NOFS|__GFP_HARDWALL), pid 4352, ts 84876464331, free_ts 84757154678 [ 85.974841][ T277] get_page_from_freelist+0x24f6/0x2670 [ 85.980441][ T277] __alloc_pages+0x1ee/0x480 [ 85.986395][ T277] __page_cache_alloc+0xce/0x440 [ 85.991396][ T277] pagecache_get_page+0x9b8/0xf20 [ 85.997384][ T277] __get_metapage+0x282/0x1060 [ 86.002201][ T277] dtSplitRoot+0x1cb/0x14d0 [ 86.007118][ T277] dtInsert+0xe84/0x57e0 [ 86.011400][ T277] jfs_symlink+0x8bb/0xfd0 [ 86.016609][ T277] vfs_symlink+0x245/0x3d0 [ 86.021075][ T277] do_symlinkat+0x1ab/0x6b0 [ 86.025918][ T277] __x64_sys_symlinkat+0x95/0xa0 [ 86.030894][ T277] do_syscall_64+0x4c/0xa0 [ 86.036136][ T277] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 86.042077][ T277] page last free stack trace: [ 86.047290][ T277] free_unref_page_prepare+0x637/0x6c0 [ 86.053444][ T277] free_unref_page+0x8f/0x2a0 [ 86.058161][ T277] __unfreeze_partials+0x188/0x1e0 [ 86.063939][ T277] put_cpu_partial+0x12d/0x190 [ 86.068751][ T277] qlist_free_all+0x35/0x90 [ 86.074008][ T277] kasan_quarantine_reduce+0x150/0x160 [ 86.079510][ T277] __kasan_slab_alloc+0x2f/0xc0 [ 86.085180][ T277] slab_post_alloc_hook+0x4c/0x380 [ 86.090324][ T277] kmem_cache_alloc_trace+0x165/0x290 [ 86.096501][ T277] kobject_uevent_env+0x275/0x890 [ 86.101561][ T277] loop_configure+0x1113/0x1480 [ 86.113056][ T277] lo_ioctl+0x2e1/0x20e0 [ 86.117355][ T277] blkdev_ioctl+0x347/0x6f0 [ 86.121956][ T277] block_ioctl+0xac/0xf0 [ 86.126622][ T277] __se_sys_ioctl+0xfa/0x170 [ 86.131249][ T277] do_syscall_64+0x4c/0xa0 [ 86.136746][ T277] ------------[ cut here ]------------ [ 86.142232][ T277] kernel BUG at include/linux/mm.h:1224! [ 86.149428][ T277] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 86.155533][ T277] CPU: 1 PID: 277 Comm: jfsCommit Tainted: G B syzkaller #0 [ 86.164190][ T277] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 86.174287][ T277] RIP: 0010:put_metapage+0x26d/0x270 [ 86.179601][ T277] Code: 38 c1 0f 8c ff fe ff ff 4c 89 ef e8 5d 0f ed fe e9 f2 fe ff ff e8 33 ef a7 fe 48 8b 3c 24 48 c7 c6 e0 24 62 8a e8 a3 d1 da fe <0f> 0b 90 55 41 57 41 56 41 55 41 54 53 48 83 ec 38 49 89 fe 49 bc [ 86.199337][ T277] RSP: 0018:ffffc90002cffcf0 EFLAGS: 00010246 [ 86.205435][ T277] RAX: b7a485c9a196ca00 RBX: ffff88801ef2fba0 RCX: 0000000000000000 [ 86.213434][ T277] RDX: 0000000000000044 RSI: 0000000000000000 RDI: fffff5200059ff90 [ 86.221419][ T277] RBP: 000000000000007f R08: ffff8880b9133d7f R09: fffff5200059ff4c [ 86.229404][ T277] R10: dffffc0000000000 R11: ffffed10172267b0 R12: ffff88801ef2fbc8 [ 86.237392][ T277] R13: ffffea0001f7fef4 R14: 1ffff11003de5f79 R15: 1ffff11003de5f86 [ 86.245383][ T277] FS: 0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000 [ 86.254328][ T277] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 86.260933][ T277] CR2: 00000000034663c0 CR3: 000000002ae2f000 CR4: 00000000003506e0 [ 86.268924][ T277] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 86.276912][ T277] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 86.284897][ T277] Call Trace: [ 86.288191][ T277] [ 86.291137][ T277] txUnlock+0x426/0xcb0 [ 86.295321][ T277] jfs_lazycommit+0x598/0xb60 [ 86.300021][ T277] ? txFreelock+0x5a0/0x5a0 [ 86.304540][ T277] ? _raw_spin_unlock_irqrestore+0x82/0x120 [ 86.310446][ T277] ? sched_dynamic_update+0x210/0x210 [ 86.315840][ T277] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 86.321756][ T277] ? __kthread_parkme+0x14e/0x1b0