program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='wwnn=0x3333333333333333,wwpn=0x4444444444444444', 0x2f) (fail_nth: 9)
[ 93.765276][ T44] Bluetooth: hci0: command tx timeout
[ 93.852122][ T5325] FAULT_INJECTION: forcing a failure.
[ 93.852122][ T5325] name failslab, interval 1, probability 0, space 0, times 1
[ 93.877616][ T5325] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 93.877634][ T5325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 93.877641][ T5325] Call Trace:
[ 93.877646][ T5325]
[ 93.877651][ T5325] dump_stack_lvl+0xe8/0x150
[ 93.877736][ T5325] should_fail_ex+0x40c/0x560
[ 93.877784][ T5325] should_failslab+0xa8/0x100
[ 93.877800][ T5325] __kmalloc_cache_noprof+0xa8/0x660
[ 93.877814][ T5325] ? nvmet_fc_alloc_ls_iodlist+0x334/0x940
[ 93.877830][ T5325] ? nvmet_fc_alloc_ls_iodlist+0x334/0x940
[ 93.877849][ T5325] nvmet_fc_alloc_ls_iodlist+0x334/0x940
[ 93.877873][ T5325] nvmet_fc_register_targetport+0x76a/0x9e0
[ 93.877894][ T5325] fcloop_create_target_port+0x135/0x4c0
[ 93.877910][ T5325] ? __pfx_fcloop_create_target_port+0x10/0x10
[ 93.877923][ T5325] ? sysfs_file_kobj+0x1a/0x230
[ 93.877937][ T5325] ? sysfs_file_kobj+0x1e4/0x230
[ 93.877955][ T5325] ? sysfs_kf_write+0x166/0x260
[ 93.877969][ T5325] ? __pfx_sysfs_kf_write+0x10/0x10
[ 93.877980][ T5325] kernfs_fop_write_iter+0x3a4/0x540
[ 93.877995][ T5325] vfs_write+0x612/0xba0
[ 93.878016][ T5325] ? __pfx_vfs_write+0x10/0x10
[ 93.878036][ T5325] ? __fget_files+0x2a/0x420
[ 93.878056][ T5325] ksys_write+0x150/0x270
[ 93.878073][ T5325] ? __pfx_ksys_write+0x10/0x10
[ 93.878092][ T5325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.878105][ T5325] do_syscall_64+0x174/0x580
[ 93.878150][ T5325] ? trace_irq_disable+0x3b/0x140
[ 93.878166][ T5325] ? clear_bhb_loop+0x40/0x90
[ 93.878179][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.878189][ T5325] RIP: 0033:0x7fad8719e019
[ 93.878200][ T5325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 93.878209][ T5325] RSP: 002b:00007fad88044fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 93.878222][ T5325] RAX: ffffffffffffffda RBX: 00007fad87425fa0 RCX: 00007fad8719e019
[ 93.878229][ T5325] RDX: 000000000000002f RSI: 0000200000000400 RDI: 0000000000000003
[ 93.878239][ T5325] RBP: 00007fad88045050 R08: 0000000000000000 R09: 0000000000000000
[ 93.878245][ T5325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 93.878251][ T5325] R13: 00007fad87426038 R14: 00007fad87425fa0 R15: 00007ffee36393b8
[ 93.878269][ T5325]
[ 93.994597][ T5325] ==================================================================
[ 93.997844][ T5325] BUG: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist+0x915/0x940
[ 94.000971][ T5325] Free of addr ffff8880136fff20 by task syz.0.0/5325
[ 94.003715][ T5325]
[ 94.004705][ T5325] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.004718][ T5325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.004724][ T5325] Call Trace:
[ 94.004732][ T5325]
[ 94.004737][ T5325] dump_stack_lvl+0xe8/0x150
[ 94.004755][ T5325] print_address_description+0x55/0x1e0
[ 94.004770][ T5325] print_report+0x58/0x70
[ 94.004783][ T5325] ? nvmet_fc_alloc_ls_iodlist+0x915/0x940
[ 94.004798][ T5325] kasan_report_invalid_free+0xea/0x110
[ 94.004813][ T5325] ? nvmet_fc_alloc_ls_iodlist+0x915/0x940
[ 94.004828][ T5325] ? nvmet_fc_alloc_ls_iodlist+0x915/0x940
[ 94.004843][ T5325] __kasan_slab_pre_free+0x104/0x120
[ 94.004881][ T5325] kfree+0x173/0x640
[ 94.004893][ T5325] ? nvmet_fc_alloc_ls_iodlist+0x915/0x940
[ 94.004909][ T5325] nvmet_fc_alloc_ls_iodlist+0x915/0x940
[ 94.004927][ T5325] nvmet_fc_register_targetport+0x76a/0x9e0
[ 94.004945][ T5325] fcloop_create_target_port+0x135/0x4c0
[ 94.004961][ T5325] ? __pfx_fcloop_create_target_port+0x10/0x10
[ 94.004969][ T5325] ? sysfs_file_kobj+0x1a/0x230
[ 94.004977][ T5325] ? sysfs_file_kobj+0x1e4/0x230
[ 94.004984][ T5325] ? sysfs_kf_write+0x166/0x260
[ 94.004992][ T5325] ? __pfx_sysfs_kf_write+0x10/0x10
[ 94.004999][ T5325] kernfs_fop_write_iter+0x3a4/0x540
[ 94.005007][ T5325] vfs_write+0x612/0xba0
[ 94.005018][ T5325] ? __pfx_vfs_write+0x10/0x10
[ 94.005029][ T5325] ? __fget_files+0x2a/0x420
[ 94.005039][ T5325] ksys_write+0x150/0x270
[ 94.005049][ T5325] ? __pfx_ksys_write+0x10/0x10
[ 94.005060][ T5325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.005067][ T5325] do_syscall_64+0x174/0x580
[ 94.005076][ T5325] ? trace_irq_disable+0x3b/0x140
[ 94.005085][ T5325] ? clear_bhb_loop+0x40/0x90
[ 94.005093][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.005100][ T5325] RIP: 0033:0x7fad8719e019
[ 94.005109][ T5325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.005115][ T5325] RSP: 002b:00007fad88044fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 94.005124][ T5325] RAX: ffffffffffffffda RBX: 00007fad87425fa0 RCX: 00007fad8719e019
[ 94.005129][ T5325] RDX: 000000000000002f RSI: 0000200000000400 RDI: 0000000000000003
[ 94.005133][ T5325] RBP: 00007fad88045050 R08: 0000000000000000 R09: 0000000000000000
[ 94.005138][ T5325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 94.005142][ T5325] R13: 00007fad87426038 R14: 00007fad87425fa0 R15: 00007ffee36393b8
[ 94.005149][ T5325]
[ 94.005152][ T5325]
[ 94.106342][ T5325] Allocated by task 12:
[ 94.108127][ T5325] kasan_save_track+0x3e/0x80
[ 94.110223][ T5325] __kasan_kmalloc+0x93/0xb0
[ 94.112208][ T5325] __kmalloc_noprof+0x375/0x720
[ 94.114238][ T5325] ___neigh_create+0x6d2/0x22b0
[ 94.116283][ T5325] ip6_finish_output2+0x6d6/0x13c0
[ 94.118342][ T5325] ip6_finish_output+0x292/0x770
[ 94.120405][ T5325] ip6_output+0x337/0x540
[ 94.122199][ T5325] ndisc_send_skb+0xcb2/0x1650
[ 94.124226][ T5325] ndisc_send_ns+0xd7/0x160
[ 94.126179][ T5325] addrconf_dad_work+0xa8d/0x15c0
[ 94.128241][ T5325] process_scheduled_works+0xa8e/0x14e0
[ 94.130557][ T5325] worker_thread+0xa47/0xfb0
[ 94.132477][ T5325] kthread+0x388/0x470
[ 94.134202][ T5325] ret_from_fork+0x514/0xb70
[ 94.136109][ T5325] ret_from_fork_asm+0x1a/0x30
[ 94.138053][ T5325]
[ 94.139030][ T5325] The buggy address belongs to the object at ffff8880136ff800
[ 94.139030][ T5325] which belongs to the cache kmalloc-1k of size 1024
[ 94.144760][ T5325] The buggy address is located 992 bytes to the right of
[ 94.144760][ T5325] 832-byte region [ffff8880136ff800, ffff8880136ffb40)
[ 94.150153][ T5325]
[ 94.151182][ T5325] The buggy address belongs to the physical page:
[ 94.153817][ T5325] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x136fc
[ 94.157479][ T5325] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 94.160834][ T5325] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 94.163851][ T5325] page_type: f5(slab)
[ 94.165535][ T5325] raw: 00fff00000000040 ffff88801b041dc0 dead000000000100 dead000000000122
[ 94.169098][ T5325] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[ 94.172598][ T5325] head: 00fff00000000040 ffff88801b041dc0 dead000000000100 dead000000000122
[ 94.176000][ T5325] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[ 94.179498][ T5325] head: 00fff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff
[ 94.183107][ T5325] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[ 94.186537][ T5325] page dumped because: kasan: bad access detected
[ 94.189106][ T5325] page_owner tracks the page as allocated
[ 94.191498][ T5325] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 12, tgid 12 (kworker/u4:0), ts 93793846953, free_ts 92088318708
[ 94.199346][ T5325] post_alloc_hook+0x1f9/0x250
[ 94.201356][ T5325] get_page_from_freelist+0x21fa/0x2270
[ 94.203640][ T5325] __alloc_frozen_pages_noprof+0x18d/0x380
[ 94.205988][ T5325] allocate_slab+0x79/0x5e0
[ 94.207955][ T5325] refill_objects+0x2d5/0x350
[ 94.209900][ T5325] __pcs_replace_empty_main+0x2bf/0x6b0
[ 94.212116][ T5325] __kmalloc_noprof+0x485/0x720
[ 94.214122][ T5325] ___neigh_create+0x6d2/0x22b0
[ 94.216121][ T5325] ip6_finish_output2+0x6d6/0x13c0
[ 94.218174][ T5325] ip6_finish_output+0x292/0x770
[ 94.220165][ T5325] ip6_output+0x337/0x540
[ 94.221991][ T5325] ndisc_send_skb+0xcb2/0x1650
[ 94.223928][ T5325] ndisc_send_ns+0xd7/0x160
[ 94.225787][ T5325] addrconf_dad_work+0xa8d/0x15c0
[ 94.227903][ T5325] process_scheduled_works+0xa8e/0x14e0
[ 94.230234][ T5325] worker_thread+0xa47/0xfb0
[ 94.232178][ T5325] page last free pid 15 tgid 15 stack trace:
[ 94.234534][ T5325] __free_frozen_pages+0xc1e/0xd10
[ 94.236692][ T5325] rcu_core+0x78b/0x10a0
[ 94.238467][ T5325] handle_softirqs+0x225/0x840
[ 94.240454][ T5325] run_ksoftirqd+0x36/0x60
[ 94.242461][ T5325] smpboot_thread_fn+0x57c/0xa80
[ 94.244513][ T5325] kthread+0x388/0x470
[ 94.246900][ T5325] ret_from_fork+0x514/0xb70
[ 94.248669][ T5325] ret_from_fork_asm+0x1a/0x30
[ 94.250697][ T5325]
[ 94.251666][ T5325] Memory state around the buggy address:
[ 94.254052][ T5325] ffff8880136ffe00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.257199][ T5325] ffff8880136ffe80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.260391][ T5325] >ffff8880136fff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.263459][ T5325] ^
[ 94.265469][ T5325] ffff8880136fff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.268667][ T5325] ffff888013700000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 94.271895][ T5325] ==================================================================
[ 94.312796][ T5325] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 94.315937][ T5325] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.319431][ T5325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.323430][ T5325] Call Trace:
[ 94.324816][ T5325]
[ 94.326162][ T5325] vpanic+0x56c/0xa60
[ 94.328137][ T5325] ? __pfx_vpanic+0x10/0x10
[ 94.330261][ T5325] panic+0xc5/0xd0
[ 94.331838][ T5325] ? __pfx_panic+0x10/0x10
[ 94.333787][ T5325] ? preempt_schedule_thunk+0x16/0x40
[ 94.336027][ T5325] ? preempt_schedule_thunk+0x16/0x40
[ 94.338243][ T5325] check_panic_on_warn+0x89/0xb0
[ 94.340392][ T5325] end_report+0x73/0x170
[ 94.342195][ T5325] ? nvmet_fc_alloc_ls_iodlist+0x915/0x940
[ 94.344520][ T5325] kasan_report_invalid_free+0xfa/0x110
[ 94.346796][ T5325] ? nvmet_fc_alloc_ls_iodlist+0x915/0x940
[ 94.349263][ T5325] ? nvmet_fc_alloc_ls_iodlist+0x915/0x940
[ 94.351816][ T5325] __kasan_slab_pre_free+0x104/0x120
[ 94.354045][ T5325] kfree+0x173/0x640
[ 94.355612][ T5325] ? nvmet_fc_alloc_ls_iodlist+0x915/0x940
[ 94.357953][ T5325] nvmet_fc_alloc_ls_iodlist+0x915/0x940
[ 94.360252][ T5325] nvmet_fc_register_targetport+0x76a/0x9e0
[ 94.362806][ T5325] fcloop_create_target_port+0x135/0x4c0
[ 94.365159][ T5325] ? __pfx_fcloop_create_target_port+0x10/0x10
[ 94.367853][ T5325] ? sysfs_file_kobj+0x1a/0x230
[ 94.369994][ T5325] ? sysfs_file_kobj+0x1e4/0x230
[ 94.372203][ T5325] ? sysfs_kf_write+0x166/0x260
[ 94.374265][ T5325] ? __pfx_sysfs_kf_write+0x10/0x10
[ 94.376416][ T5325] kernfs_fop_write_iter+0x3a4/0x540
[ 94.378691][ T5325] vfs_write+0x612/0xba0
[ 94.380375][ T5325] ? __pfx_vfs_write+0x10/0x10
[ 94.382257][ T5325] ? __fget_files+0x2a/0x420
[ 94.383998][ T5325] ksys_write+0x150/0x270
[ 94.385795][ T5325] ? __pfx_ksys_write+0x10/0x10
[ 94.387797][ T5325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.390340][ T5325] do_syscall_64+0x174/0x580
[ 94.392309][ T5325] ? trace_irq_disable+0x3b/0x140
[ 94.394428][ T5325] ? clear_bhb_loop+0x40/0x90
[ 94.396407][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.399019][ T5325] RIP: 0033:0x7fad8719e019
[ 94.400965][ T5325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.407911][ T5325] RSP: 002b:00007fad88044fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 94.411518][ T5325] RAX: ffffffffffffffda RBX: 00007fad87425fa0 RCX: 00007fad8719e019
[ 94.414236][ T5325] RDX: 000000000000002f RSI: 0000200000000400 RDI: 0000000000000003
[ 94.417096][ T5325] RBP: 00007fad88045050 R08: 0000000000000000 R09: 0000000000000000
[ 94.420218][ T5325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 94.423469][ T5325] R13: 00007fad87426038 R14: 00007fad87425fa0 R15: 00007ffee36393b8
[ 94.426690][ T5325]
[ 94.428361][ T5325] Kernel Offset: disabled
[ 94.430112][ T5325] Rebooting in 86400 seconds..