Warning: Permanently added '10.128.0.92' (ED25519) to the list of known hosts. 2026/04/30 08:32:39 parsed 1 programs [ 81.737499][ T5596] cgroup: Unknown subsys name 'net' [ 82.016092][ T5596] cgroup: Unknown subsys name 'cpuset' [ 82.061697][ T5596] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 83.700146][ T5596] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 86.897291][ T9] cfg80211: failed to load regulatory.db [ 87.643567][ T1156] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.643594][ T1156] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.863528][ T1042] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.863548][ T1042] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.280867][ T5639] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.281330][ T5639] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.281469][ T5639] bridge_slave_0: entered allmulticast mode [ 90.286673][ T5639] bridge_slave_0: entered promiscuous mode [ 90.295318][ T5639] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.295425][ T5639] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.295571][ T5639] bridge_slave_1: entered allmulticast mode [ 90.298014][ T5639] bridge_slave_1: entered promiscuous mode [ 90.349784][ T5639] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.362998][ T5639] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.397689][ T5639] team0: Port device team_slave_0 added [ 90.399595][ T5639] team0: Port device team_slave_1 added [ 90.431788][ T5639] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.431804][ T5639] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.431828][ T5639] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.438721][ T5639] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.438736][ T5639] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.438754][ T5639] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.670393][ T5639] hsr_slave_0: entered promiscuous mode [ 90.672799][ T5639] hsr_slave_1: entered promiscuous mode [ 90.984318][ T5639] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 91.033610][ T5639] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 91.036797][ T5639] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 91.074850][ T5639] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 91.078230][ T5639] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 91.130139][ T5639] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 91.138704][ T5639] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 91.166671][ T5639] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 91.202532][ T5639] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.202694][ T5639] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.294764][ T5639] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.337757][ T67] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.509203][ T5639] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.523768][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.523895][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.546831][ T67] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.550192][ T67] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.918430][ T5639] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.984204][ T5639] veth0_vlan: entered promiscuous mode [ 91.999798][ T5639] veth1_vlan: entered promiscuous mode [ 92.058904][ T5639] veth0_macvtap: entered promiscuous mode [ 92.069808][ T5639] veth1_macvtap: entered promiscuous mode [ 92.094148][ T5639] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.102984][ T5639] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.130968][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.142098][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.144201][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.169586][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.957117][ T1042] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 93.213237][ T1042] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 93.581909][ T4912] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 93.587138][ T4912] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 93.588087][ T4912] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 93.589302][ T4912] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 93.589949][ T4912] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 93.908535][ T1042] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 95.210747][ T1042] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 96.051463][ T1042] bridge_slave_1: left allmulticast mode [ 96.051691][ T1042] bridge_slave_1: left promiscuous mode [ 96.059018][ T1042] bridge0: port 2(bridge_slave_1) entered disabled state [ 96.162920][ T1042] bridge_slave_0: left allmulticast mode [ 96.162953][ T1042] bridge_slave_0: left promiscuous mode [ 96.163199][ T1042] bridge0: port 1(bridge_slave_0) entered disabled state [ 96.871740][ T1042] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 96.951673][ T1042] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 96.973276][ T1042] bond0 (unregistering): Released all slaves [ 97.019676][ T5257] 8021q: adding VLAN 0 to HW filter on device eth1 [ 97.383074][ T1042] hsr_slave_0: left promiscuous mode [ 97.421238][ T1042] hsr_slave_1: left promiscuous mode [ 97.422610][ T1042] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 97.432390][ T1042] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 97.486524][ T1042] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 97.486552][ T1042] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 97.678564][ T1042] veth1_macvtap: left promiscuous mode [ 97.678808][ T1042] veth0_macvtap: left promiscuous mode [ 97.679093][ T1042] veth1_vlan: left promiscuous mode [ 97.679389][ T1042] veth0_vlan: left promiscuous mode 2026/04/30 08:32:58 executed programs: 0 [ 98.131998][ T59] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 98.136004][ T59] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 98.137030][ T59] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 98.138054][ T59] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 98.138738][ T59] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 98.561757][ T1042] team0 (unregistering): Port device team_slave_1 removed [ 98.601680][ T1042] team0 (unregistering): Port device team_slave_0 removed [ 98.782782][ T5257] 8021q: adding VLAN 0 to HW filter on device eth2 [ 99.444040][ T5257] 8021q: adding VLAN 0 to HW filter on device eth3 [ 100.006284][ T5753] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.006460][ T5753] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.006603][ T5753] bridge_slave_0: entered allmulticast mode [ 100.008841][ T5753] bridge_slave_0: entered promiscuous mode [ 100.014443][ T5753] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.014623][ T5753] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.014789][ T5753] bridge_slave_1: entered allmulticast mode [ 100.017209][ T5753] bridge_slave_1: entered promiscuous mode [ 100.071485][ T5753] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.075272][ T5753] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.126545][ T5753] team0: Port device team_slave_0 added [ 100.129949][ T5257] 8021q: adding VLAN 0 to HW filter on device eth4 [ 100.142729][ T5753] team0: Port device team_slave_1 added [ 100.205420][ T5753] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.205432][ T5753] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.205446][ T5753] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 100.209600][ T5753] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 100.209618][ T5753] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.209642][ T5753] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 100.262662][ T4912] Bluetooth: hci0: command tx timeout [ 100.325284][ T5753] hsr_slave_0: entered promiscuous mode [ 100.325977][ T5753] hsr_slave_1: entered promiscuous mode [ 102.341173][ T4912] Bluetooth: hci0: command tx timeout [ 103.003399][ T5753] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 103.049727][ T5753] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 103.052710][ T5753] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 103.117616][ T5753] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 103.118976][ T5753] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 103.159996][ T5753] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 103.168626][ T5753] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 103.196869][ T5753] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 103.413326][ T5753] 8021q: adding VLAN 0 to HW filter on device bond0 [ 103.447875][ T5753] 8021q: adding VLAN 0 to HW filter on device team0 [ 103.466745][ T1042] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.466943][ T1042] bridge0: port 1(bridge_slave_0) entered forwarding state [ 103.504439][ T1042] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.518396][ T1042] bridge0: port 2(bridge_slave_1) entered forwarding state [ 104.207238][ T5753] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 104.297518][ T5753] veth0_vlan: entered promiscuous mode [ 104.346613][ T5753] veth1_vlan: entered promiscuous mode [ 104.405480][ T5753] veth0_macvtap: entered promiscuous mode [ 104.421412][ T4912] Bluetooth: hci0: command tx timeout [ 104.453534][ T5753] veth1_macvtap: entered promiscuous mode [ 104.480932][ T5753] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 104.529338][ T5753] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 104.564230][ T56] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.565073][ T56] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.565112][ T56] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.565145][ T56] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.071387][ T56] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.071406][ T56] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.163975][ T56] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.163995][ T56] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2026/04/30 08:33:05 executed programs: 2 [ 105.806145][ T5921] loop0: detected capacity change from 0 to 32768 [ 106.511319][ T4912] Bluetooth: hci0: command tx timeout [ 106.573355][ T5939] loop0: detected capacity change from 0 to 32768 [ 107.056475][ T5940] loop0: detected capacity change from 0 to 32768 [ 107.451578][ T5941] loop0: detected capacity change from 0 to 32768 [ 107.870445][ T5942] loop0: detected capacity change from 0 to 32768 [ 108.233518][ T5943] loop0: detected capacity change from 0 to 32768 [ 108.625391][ T5944] loop0: detected capacity change from 0 to 32768 [ 109.006440][ T5945] loop0: detected capacity change from 0 to 32768 [ 109.402512][ T5946] loop0: detected capacity change from 0 to 32768 [ 109.766408][ T5947] loop0: detected capacity change from 0 to 32768 2026/04/30 08:33:10 executed programs: 14 [ 110.868317][ T5950] set_capacity_and_notify: 2 callbacks suppressed [ 110.868329][ T5950] loop0: detected capacity change from 0 to 32768 [ 111.272347][ T5951] loop0: detected capacity change from 0 to 32768 [ 111.641999][ T5952] loop0: detected capacity change from 0 to 32768 [ 112.005053][ T5953] loop0: detected capacity change from 0 to 32768 [ 112.397465][ T5954] loop0: detected capacity change from 0 to 32768 [ 112.729270][ T5955] loop0: detected capacity change from 0 to 32768 [ 113.091541][ T5956] loop0: detected capacity change from 0 to 32768 [ 113.510104][ T5957] loop0: detected capacity change from 0 to 32768 [ 113.898285][ T5958] loop0: detected capacity change from 0 to 32768 [ 114.219638][ T5959] loop0: detected capacity change from 0 to 32768 2026/04/30 08:33:15 executed programs: 28 [ 116.069895][ T5964] set_capacity_and_notify: 4 callbacks suppressed [ 116.069908][ T5964] loop0: detected capacity change from 0 to 32768 [ 116.419074][ T5965] loop0: detected capacity change from 0 to 32768 [ 116.765678][ T5966] loop0: detected capacity change from 0 to 32768 [ 117.183119][ T5968] loop0: detected capacity change from 0 to 32768 [ 117.552183][ T5970] loop0: detected capacity change from 0 to 32768 [ 117.905207][ T5971] loop0: detected capacity change from 0 to 32768 [ 118.313501][ T5974] loop0: detected capacity change from 0 to 32768 [ 118.663479][ T5975] loop0: detected capacity change from 0 to 32768 [ 119.038366][ T5977] loop0: detected capacity change from 0 to 32768 [ 119.110092][ C1] ================================================================== [ 119.110102][ C1] BUG: KASAN: slab-use-after-free in lbmIOD[ 119.110102][ C1] BUG: KASAN: slab-use-after-free in lbmIODone+0x1312/0x16c0 [ 119.110128][ C1] Read of size 4 at addr ffff88803df9d208 by task ksoftirqd/1/30 [ 119.110137][ C1] [ 119.110155][ C1] CPU: 1 UID: 0 PID: 30 Comm: ksoftirqd/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 119.110179][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 119.110197][ C1] Call Trace: [ 119.110202][ C1] [ 119.110206][ C1] dump_stack_lvl+0xe8/0x150 [ 119.110218][ C1] print_address_description+0x55/0x1e0 [ 119.110229][ C1] ? lbmIODone+0x1312/0x16c0 [ 119.110240][ C1] print_report+0x58/0x70 [ 119.110249][ C1] kasan_report+0x117/0x150 [ 119.110259][ C1] ? lbmIODone+0x1312/0x16c0 [ 119.110272][ C1] lbmIODone+0x1312/0x16c0 [ 119.110283][ C1] ? blkg_put+0x22/0x240 [ 119.110291][ C1] ? blkg_put+0x22/0x240 [ 119.110299][ C1] ? blkg_put+0x18d/0x240 [ 119.110307][ C1] ? bio_endio+0x989/0x9d0 [ 119.110317][ C1] blk_update_request+0x57e/0xe60 [ 119.110330][ C1] blk_mq_end_request+0x3e/0x70 [ 119.110340][ C1] blk_done_softirq+0x10a/0x160 [ 119.110350][ C1] handle_softirqs+0x1de/0x6d0 [ 119.110362][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 119.110373][ C1] run_ksoftirqd+0x52/0x180 [ 119.110383][ C1] smpboot_thread_fn+0x541/0xa50 [ 119.110393][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 119.110405][ C1] kthread+0x388/0x470 [ 119.110416][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 119.110426][ C1] ? __pfx_kthread+0x10/0x10 [ 119.110437][ C1] ret_from_fork+0x514/0xb70 [ 119.110447][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 119.110457][ C1] ? __switch_to+0xc79/0x1410 [ 119.110471][ C1] ? __pfx_kthread+0x10/0x10 [ 119.110482][ C1] ret_from_fork_asm+0x1a/0x30 [ 119.110496][ C1] [ 119.110499][ C1] [ 119.110504][ C1] Allocated by task 5977: [ 119.110515][ C1] kasan_save_track+0x3e/0x80 [ 119.110523][ C1] __kasan_kmalloc+0x93/0xb0 [ 119.110531][ C1] __kmalloc_cache_noprof+0x3a6/0x690 [ 119.110540][ C1] lmLogInit+0x3e5/0x1a00 [ 119.110549][ C1] lmLogOpen+0x4e1/0xfa0 [ 119.110558][ C1] jfs_mount_rw+0xee/0x670 [ 119.110567][ C1] jfs_fill_super+0x754/0xd80 [ 119.110578][ C1] get_tree_bdev_flags+0x431/0x4f0 [ 119.110588][ C1] vfs_get_tree+0x92/0x2a0 [ 119.110596][ C1] do_new_mount+0x341/0xd30 [ 119.110607][ C1] __se_sys_mount+0x31d/0x420 [ 119.110618][ C1] do_syscall_64+0x15f/0xf80 [ 119.110626][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.110635][ C1] [ 119.110637][ C1] Freed by task 5753: [ 119.110641][ C1] kasan_save_track+0x3e/0x80 [ 119.110648][ C1] kasan_save_free_info+0x46/0x50 [ 119.110658][ C1] __kasan_slab_free+0x5c/0x80 [ 119.110666][ C1] kfree+0x1c5/0x6c0 [ 119.110673][ C1] lmLogShutdown+0x456/0x850 [ 119.110683][ C1] lmLogClose+0x28a/0x520 [ 119.110692][ C1] jfs_umount+0x2fb/0x3d0 [ 119.110700][ C1] jfs_put_super+0x8c/0x190 [ 119.110707][ C1] generic_shutdown_super+0x13d/0x2d0 [ 119.110714][ C1] kill_block_super+0x44/0x90 [ 119.110722][ C1] deactivate_locked_super+0xbc/0x130 [ 119.110729][ C1] cleanup_mnt+0x437/0x4d0 [ 119.110737][ C1] task_work_run+0x1d9/0x270 [ 119.110749][ C1] exit_to_user_mode_loop+0xed/0x480 [ 119.110759][ C1] do_syscall_64+0x33e/0xf80 [ 119.110766][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.110774][ C1] [ 119.110776][ C1] The buggy address belongs to the object at ffff88803df9d200 [ 119.110776][ C1] which belongs to the cache kmalloc-256 of size 256 [ 119.110784][ C1] The buggy address is located 8 bytes inside of [ 119.110784][ C1] freed 256-byte region [ffff88803df9d200, ffff88803df9d300) [ 119.110793][ C1] [ 119.110795][ C1] The buggy address belongs to the physical page: [ 119.110806][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803df9dc00 pfn:0x3df9c [ 119.110816][ C1] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 119.110824][ C1] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 119.110835][ C1] page_type: f5(slab) [ 119.110844][ C1] raw: 0080000000000240 ffff88801a00bb40 ffffea0000adb910 ffffea0000d14410 [ 119.110852][ C1] raw: ffff88803df9dc00 000000080010000e 00000000f5000000 0000000000000000 [ 119.110859][ C1] head: 0080000000000240 ffff88801a00bb40 ffffea0000adb910 ffffea0000d14410 [ 119.110867][ C1] head: ffff88803df9dc00 000000080010000e 00000000f5000000 0000000000000000 [ 119.110874][ C1] head: 0080000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 119.110881][ C1] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002 [ 119.110885][ C1] page dumped because: kasan: bad access detected [ 119.110893][ C1] page_owner tracks the page as allocated [ 119.110896][ C1] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5753, tgid 5753 (syz-executor), ts 118755571533, free_ts 118701787655 [ 119.110912][ C1] post_alloc_hook+0x231/0x280 [ 119.110922][ C1] get_page_from_freelist+0x27c8/0x2840 [ 119.110932][ C1] __alloc_frozen_pages_noprof+0x18d/0x380 [ 119.110942][ C1] allocate_slab+0x77/0x660 [ 119.110952][ C1] refill_objects+0x33c/0x3d0 [ 119.110962][ C1] __pcs_replace_empty_main+0x373/0x720 [ 119.110973][ C1] __kmalloc_noprof+0x530/0x7b0 [ 119.110981][ C1] tomoyo_encode+0x28b/0x550 [ 119.110993][ C1] tomoyo_realpath_from_path+0x58d/0x5d0 [ 119.111004][ C1] tomoyo_path_perm+0x283/0x560 [ 119.111013][ C1] security_inode_getattr+0x12b/0x310 [ 119.111029][ C1] vfs_getattr+0x23/0x70 [ 119.111044][ C1] vfs_statx_path+0x2b/0x230 [ 119.111055][ C1] vfs_statx+0x12e/0x200 [ 119.111070][ C1] vfs_fstatat+0x11b/0x170 [ 119.111085][ C1] __x64_sys_newfstatat+0x151/0x200 [ 119.111104][ C1] page last free pid 5975 tgid 5975 stack trace: [ 119.111112][ C1] __free_frozen_pages+0xfa6/0x10f0 [ 119.111126][ C1] __mmdrop+0xb1/0x6d0 [ 119.111138][ C1] exit_mm+0x18e/0x250 [ 119.111155][ C1] do_exit+0x6a2/0x22c0 [ 119.111172][ C1] do_group_exit+0x21b/0x2d0 [ 119.111189][ C1] __x64_sys_exit_group+0x3f/0x40 [ 119.111207][ C1] x64_sys_call+0x221a/0x2240 [ 119.111223][ C1] do_syscall_64+0x15f/0xf80 [ 119.111237][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.111252][ C1] [ 119.111255][ C1] Memory state around the buggy address: [ 119.111264][ C1] ffff88803df9d100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 119.111275][ C1] ffff88803df9d180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 119.111286][ C1] >ffff88803df9d200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 119.111295][ C1] ^ [ 119.111304][ C1] ffff88803df9d280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 119.111315][ C1] ffff88803df9d300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 119.111324][ C1] ================================================================== [ 119.124790][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 119.124811][ C1] CPU: 1 UID: 0 PID: 30 Comm: ksoftirqd/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 119.124832][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 119.124845][ C1] Call Trace: [ 119.124852][ C1] [ 119.124860][ C1] vpanic+0x56c/0xa60 [ 119.124887][ C1] ? __pfx_vpanic+0x10/0x10 [ 119.124905][ C1] ? __pfx___schedule+0x10/0x10 [ 119.124932][ C1] panic+0xc5/0xd0 [ 119.124951][ C1] ? __pfx_panic+0x10/0x10 [ 119.124970][ C1] ? preempt_schedule_thunk+0x16/0x30 [ 119.124997][ C1] ? lbmIODone+0x1312/0x16c0 [ 119.125017][ C1] check_panic_on_warn+0x89/0xb0 [ 119.125040][ C1] ? lbmIODone+0x1312/0x16c0 [ 119.125060][ C1] end_report+0x73/0x170 [ 119.125079][ C1] ? lbmIODone+0x1312/0x16c0 [ 119.125097][ C1] kasan_report+0x128/0x150 [ 119.125116][ C1] ? lbmIODone+0x1312/0x16c0 [ 119.125139][ C1] lbmIODone+0x1312/0x16c0 [ 119.125159][ C1] ? blkg_put+0x22/0x240 [ 119.125175][ C1] ? blkg_put+0x22/0x240 [ 119.125189][ C1] ? blkg_put+0x18d/0x240 [ 119.125204][ C1] ? bio_endio+0x989/0x9d0 [ 119.125220][ C1] blk_update_request+0x57e/0xe60 [ 119.125237][ C1] blk_mq_end_request+0x3e/0x70 [ 119.125247][ C1] blk_done_softirq+0x10a/0x160 [ 119.125258][ C1] handle_softirqs+0x1de/0x6d0 [ 119.125271][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 119.125287][ C1] run_ksoftirqd+0x52/0x180 [ 119.125307][ C1] smpboot_thread_fn+0x541/0xa50 [ 119.125327][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 119.125349][ C1] kthread+0x388/0x470 [ 119.125371][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 119.125389][ C1] ? __pfx_kthread+0x10/0x10 [ 119.125410][ C1] ret_from_fork+0x514/0xb70 [ 119.125430][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 119.125448][ C1] ? __switch_to+0xc79/0x1410 [ 119.125472][ C1] ? __pfx_kthread+0x10/0x10 [ 119.125492][ C1] ret_from_fork_asm+0x1a/0x30 [ 119.125527][ C1] [ 119.125669][ C1] Kernel Offset: disabled