Warning: Permanently added '10.128.0.141' (ED25519) to the list of known hosts. 2026/06/20 23:52:01 parsed 1 programs 2026/06/20 23:52:01 serving rpc on tcp://38347 [ 67.169508][ T4199] cgroup: Unknown subsys name 'net' [ 67.300761][ T4199] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 68.809194][ T4199] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 71.188602][ T1423] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.195177][ T1423] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.257393][ T155] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.271175][ T155] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.281048][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 71.306133][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.314716][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.322981][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 72.118874][ T144] ODEBUG: Out of memory. ODEBUG disabled [ 72.176486][ T4256] chnl_net:caif_netlink_parms(): no params data found [ 72.261307][ T4256] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.268549][ T4256] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.283331][ T4256] device bridge_slave_0 entered promiscuous mode [ 72.295067][ T4256] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.302121][ T4256] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.310236][ T4256] device bridge_slave_1 entered promiscuous mode [ 72.346519][ T4256] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.357972][ T4256] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.391266][ T4256] team0: Port device team_slave_0 added [ 72.399416][ T4256] team0: Port device team_slave_1 added [ 72.416737][ T4256] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.423689][ T4256] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.449629][ T4256] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.461764][ T4256] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 72.469003][ T4256] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.494922][ T4256] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.524574][ T4256] device hsr_slave_0 entered promiscuous mode [ 72.531230][ T4256] device hsr_slave_1 entered promiscuous mode [ 72.619466][ T4256] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 72.631974][ T4256] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 72.640934][ T4256] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 72.650037][ T4256] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 72.707400][ T4256] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.720083][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 72.730278][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 72.738389][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 72.749056][ T4256] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.759724][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 72.768914][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 72.777928][ T1427] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.785189][ T1427] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.805726][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 72.813690][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 72.822923][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 72.832945][ T1427] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.840079][ T1427] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.850241][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 72.859064][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 72.871131][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 72.879276][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 72.908091][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 72.919788][ T4256] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 73.035893][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 73.043389][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 73.056892][ T4256] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.075189][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 73.111154][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 73.120333][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 73.128523][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 73.139858][ T4256] device veth0_vlan entered promiscuous mode [ 73.164724][ T4256] device veth1_vlan entered promiscuous mode [ 73.182852][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 73.191017][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 73.200273][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 73.211497][ T4256] device veth0_macvtap entered promiscuous mode [ 73.238613][ T4256] device veth1_macvtap entered promiscuous mode [ 73.254772][ T4256] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 73.262278][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 73.271819][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 73.288649][ T4256] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.297736][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 73.308619][ T4256] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.317820][ T4256] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.326971][ T4256] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.335787][ T4256] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 2026/06/20 23:52:11 executed programs: 0 [ 74.762860][ T4306] chnl_net:caif_netlink_parms(): no params data found [ 74.826815][ T4306] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.833985][ T4306] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.844894][ T4306] device bridge_slave_0 entered promiscuous mode [ 74.854403][ T4306] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.861530][ T4306] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.871093][ T4306] device bridge_slave_1 entered promiscuous mode [ 74.899043][ T4306] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 74.910568][ T4306] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 74.937931][ T4306] team0: Port device team_slave_0 added [ 74.946305][ T4306] team0: Port device team_slave_1 added [ 74.967928][ T4306] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 74.974968][ T4306] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.000907][ T4306] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 75.013245][ T4306] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 75.020284][ T4306] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.046572][ T4306] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 75.081334][ T4306] device hsr_slave_0 entered promiscuous mode [ 75.088373][ T4306] device hsr_slave_1 entered promiscuous mode [ 75.095835][ T4306] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 75.103706][ T4306] Cannot create hsr debugfs directory [ 75.180409][ T4306] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 76.715438][ T4276] Bluetooth: hci0: command 0x0409 tx timeout [ 78.539436][ T4306] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 78.690002][ T4306] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 78.736077][ T4306] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 78.785111][ T4275] Bluetooth: hci0: command 0x041b tx timeout [ 78.861299][ T4306] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 78.873922][ T4306] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 78.894770][ T4306] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 78.903341][ T4306] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 78.950559][ T4306] 8021q: adding VLAN 0 to HW filter on device bond0 [ 78.968289][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 78.976395][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 78.986799][ T4306] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.006501][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 79.015610][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 79.023920][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.031022][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.039088][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 79.064339][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 79.072915][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 79.081773][ T1427] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.089002][ T1427] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.105449][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 79.115039][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 79.123735][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 79.132877][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 79.141814][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 79.167014][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 79.176177][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 79.190729][ T4306] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 79.201489][ T4306] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 79.213847][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 79.222839][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 79.231442][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 79.240050][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 79.248441][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 79.352222][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 79.359781][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 79.373436][ T144] device hsr_slave_0 left promiscuous mode [ 79.381388][ T144] device hsr_slave_1 left promiscuous mode [ 79.388337][ T144] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 79.395884][ T144] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 79.404887][ T144] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 79.412286][ T144] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 79.420188][ T144] device bridge_slave_1 left promiscuous mode [ 79.427062][ T144] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.439882][ T144] device bridge_slave_0 left promiscuous mode [ 79.447008][ T144] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.464579][ T144] device veth1_macvtap left promiscuous mode [ 79.470766][ T144] device veth0_macvtap left promiscuous mode [ 79.476899][ T144] device veth1_vlan left promiscuous mode [ 79.482744][ T144] device veth0_vlan left promiscuous mode [ 79.633945][ T144] team0 (unregistering): Port device team_slave_1 removed [ 79.647626][ T144] team0 (unregistering): Port device team_slave_0 removed [ 79.660564][ T144] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 79.674770][ T144] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 79.726975][ T144] bond0 (unregistering): Released all slaves [ 79.791539][ T4306] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 79.811044][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 79.819955][ T1427] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 79.847631][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 79.857602][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 79.870515][ T4306] device veth0_vlan entered promiscuous mode [ 79.877817][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 79.886440][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 79.898903][ T4306] device veth1_vlan entered promiscuous mode [ 79.917418][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 79.926314][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 79.934493][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 79.942863][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 79.956341][ T4306] device veth0_macvtap entered promiscuous mode [ 79.966432][ T4306] device veth1_macvtap entered promiscuous mode [ 79.983215][ T4306] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 79.991702][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 79.999978][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 80.008140][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 80.016820][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 80.028933][ T4306] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.039843][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 80.055992][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 80.068049][ T4306] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.077321][ T4306] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.086185][ T4306] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.094930][ T4306] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.143545][ T1427] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.155874][ T1427] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.173993][ T4278] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.176736][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready 2026/06/20 23:52:16 executed programs: 2 [ 80.189200][ T4278] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.205292][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 80.572345][ T4319] loop0: detected capacity change from 0 to 32768 [ 80.646180][ T4319] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 80.681820][ T4319] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 80.726149][ T4319] gfs2: fsid=syz:syz.0: journal 0 mapped with 5 extents in 0ms [ 80.742788][ T1111] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 80.764157][ T1111] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 80.814838][ T1111] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 50ms [ 80.825154][ T1111] gfs2: fsid=syz:syz.0: jid=0: Done [ 80.831079][ T4319] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 80.864900][ T4277] Bluetooth: hci0: command 0x040f tx timeout [ 80.967732][ T4319] gfs2: fsid=syz:syz.0: found 1 quota changes [ 80.995279][ T4306] gfs2: fsid=syz:syz.0: fatal: filesystem consistency error [ 80.995279][ T4306] inode = 11 2339 [ 80.995279][ T4306] function = gfs2_dinode_in, file = fs/gfs2/glops.c, line = 414 [ 81.041272][ T4306] gfs2: fsid=syz:syz.0: about to withdraw this file system [ 81.060434][ T4306] gfs2: fsid=syz:syz.0: warning: assertion "!qd->qd_change" failed at function = gfs2_quota_cleanup, file = fs/gfs2/quota.c, line = 1485 [ 81.074807][ T4306] CPU: 0 PID: 4306 Comm: syz-executor Not tainted syzkaller #0 [ 81.082385][ T4306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 81.092471][ T4306] Call Trace: [ 81.095772][ T4306] [ 81.098720][ T4306] dump_stack_lvl+0x188/0x250 [ 81.103435][ T4306] ? show_regs_print_info+0x20/0x20 [ 81.108663][ T4306] ? load_image+0x410/0x410 [ 81.113219][ T4306] ? do_raw_spin_unlock+0x11d/0x230 [ 81.118453][ T4306] gfs2_assert_warn_i+0x187/0x2c0 [ 81.123513][ T4306] gfs2_quota_cleanup+0x48c/0x670 [ 81.128577][ T4306] gfs2_make_fs_ro+0x440/0x620 [ 81.133370][ T4306] ? __might_sleep+0xf0/0xf0 [ 81.137991][ T4306] ? gfs2_dinode_out+0xb00/0xb00 [ 81.142980][ T4306] ? _raw_spin_unlock+0x24/0x40 [ 81.147857][ T4306] ? gfs2_glock_nq+0xcaa/0x1510 [ 81.152764][ T4306] gfs2_withdraw+0x660/0x14e0 [ 81.157473][ T4306] ? gfs2_meta_new+0x160/0x160 [ 81.162274][ T4306] ? gfs2_lm+0x240/0x240 [ 81.166542][ T4306] ? gfs2_freeze_lock+0x52/0xc0 [ 81.171417][ T4306] ? gfs2_consist_inode_i+0xc0/0xe0 [ 81.176646][ T4306] gfs2_inode_refresh+0xb2d/0x11a0 [ 81.181790][ T4306] ? gfs2_inode_metasync+0xf0/0xf0 [ 81.186936][ T4306] inode_go_lock+0x127/0x450 [ 81.191554][ T4306] do_promote+0x75b/0xb20 [ 81.195923][ T4306] finish_xmote+0x4c2/0xaf0 [ 81.200475][ T4306] do_xmote+0x752/0x10a0 [ 81.204752][ T4306] gfs2_glock_nq+0xc6b/0x1510 [ 81.209473][ T4306] do_sync+0x49c/0xba0 [ 81.213573][ T4306] ? slot_put+0x1e0/0x1e0 [ 81.217943][ T4306] ? do_sync+0x494/0xba0 [ 81.222221][ T4306] ? do_raw_spin_unlock+0x11d/0x230 [ 81.227463][ T4306] gfs2_quota_sync+0x355/0x780 [ 81.232293][ T4306] gfs2_sync_fs+0x48/0xb0 [ 81.236652][ T4306] sync_filesystem+0xe6/0x220 [ 81.241354][ T4306] generic_shutdown_super+0x6b/0x300 [ 81.246673][ T4306] kill_block_super+0x7c/0xe0 [ 81.251385][ T4306] deactivate_locked_super+0x93/0xf0 [ 81.256705][ T4306] cleanup_mnt+0x426/0x4d0 [ 81.261158][ T4306] task_work_run+0x125/0x1a0 [ 81.265784][ T4306] exit_to_user_mode_loop+0x10f/0x130 [ 81.271183][ T4306] exit_to_user_mode_prepare+0xee/0x180 [ 81.276782][ T4306] syscall_exit_to_user_mode+0x16/0x40 [ 81.282270][ T4306] do_syscall_64+0x58/0xa0 [ 81.286705][ T4306] ? clear_bhb_loop+0x30/0x80 [ 81.291395][ T4306] ? clear_bhb_loop+0x30/0x80 [ 81.296102][ T4306] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 81.302058][ T4306] RIP: 0033:0x7f669051c097 [ 81.306501][ T4306] Code: a2 c7 05 5c 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 81.326126][ T4306] RSP: 002b:00007ffc04a22f28 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 81.334572][ T4306] RAX: 0000000000000000 RBX: 00007f66905b02ca RCX: 00007f669051c097 [ 81.342565][ T4306] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc04a22fe0 [ 81.350564][ T4306] RBP: 00007ffc04a22fe0 R08: 00007ffc04a23fe0 R09: 00000000ffffffff [ 81.358565][ T4306] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc04a24070 [ 81.366564][ T4306] R13: 00007f66905b02ca R14: 0000000000013952 R15: 00007ffc04a240b0 [ 81.374576][ T4306] [ 81.383849][ T4306] gfs2: fsid=syz:syz.0: Journal recovery skipped for jid 0 until next mount. [ 81.392855][ T4306] gfs2: fsid=syz:syz.0: Glock dequeues delayed: 0 [ 81.402628][ T4306] gfs2: fsid=syz:syz.0: File system withdrawn [ 81.409440][ T4306] CPU: 0 PID: 4306 Comm: syz-executor Not tainted syzkaller #0 [ 81.417012][ T4306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 81.427098][ T4306] Call Trace: [ 81.430404][ T4306] [ 81.433374][ T4306] dump_stack_lvl+0x188/0x250 [ 81.438113][ T4306] ? show_regs_print_info+0x20/0x20 [ 81.443358][ T4306] ? load_image+0x410/0x410 [ 81.447901][ T4306] ? lockref_put_or_lock+0x6e/0xb0 [ 81.453050][ T4306] gfs2_withdraw+0xb9a/0x14e0 [ 81.457806][ T4306] ? gfs2_meta_new+0x160/0x160 [ 81.462594][ T4306] ? gfs2_lm+0x240/0x240 [ 81.466873][ T4306] ? gfs2_consist_inode_i+0xc0/0xe0 [ 81.472104][ T4306] gfs2_inode_refresh+0xb2d/0x11a0 [ 81.477248][ T4306] ? gfs2_inode_metasync+0xf0/0xf0 [ 81.482393][ T4306] inode_go_lock+0x127/0x450 [ 81.487011][ T4306] do_promote+0x75b/0xb20 [ 81.491399][ T4306] finish_xmote+0x4c2/0xaf0 [ 81.495939][ T4306] do_xmote+0x752/0x10a0 [ 81.500238][ T4306] gfs2_glock_nq+0xc6b/0x1510 [ 81.504976][ T4306] do_sync+0x49c/0xba0 [ 81.509087][ T4306] ? slot_put+0x1e0/0x1e0 [ 81.513454][ T4306] ? do_sync+0x494/0xba0 [ 81.517763][ T4306] ? do_raw_spin_unlock+0x11d/0x230 [ 81.522993][ T4306] gfs2_quota_sync+0x355/0x780 [ 81.527797][ T4306] gfs2_sync_fs+0x48/0xb0 [ 81.532151][ T4306] sync_filesystem+0xe6/0x220 [ 81.536861][ T4306] generic_shutdown_super+0x6b/0x300 [ 81.542183][ T4306] kill_block_super+0x7c/0xe0 [ 81.546896][ T4306] deactivate_locked_super+0x93/0xf0 [ 81.552204][ T4306] cleanup_mnt+0x426/0x4d0 [ 81.556649][ T4306] task_work_run+0x125/0x1a0 [ 81.561280][ T4306] exit_to_user_mode_loop+0x10f/0x130 [ 81.566679][ T4306] exit_to_user_mode_prepare+0xee/0x180 [ 81.572251][ T4306] syscall_exit_to_user_mode+0x16/0x40 [ 81.577733][ T4306] do_syscall_64+0x58/0xa0 [ 81.582177][ T4306] ? clear_bhb_loop+0x30/0x80 [ 81.586879][ T4306] ? clear_bhb_loop+0x30/0x80 [ 81.591588][ T4306] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 81.597507][ T4306] RIP: 0033:0x7f669051c097 [ 81.601957][ T4306] Code: a2 c7 05 5c 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 81.621761][ T4306] RSP: 002b:00007ffc04a22f28 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 81.630198][ T4306] RAX: 0000000000000000 RBX: 00007f66905b02ca RCX: 00007f669051c097 [ 81.638189][ T4306] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc04a22fe0 [ 81.646184][ T4306] RBP: 00007ffc04a22fe0 R08: 00007ffc04a23fe0 R09: 00000000ffffffff [ 81.654185][ T4306] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc04a24070 [ 81.662188][ T4306] R13: 00007f66905b02ca R14: 0000000000013952 R15: 00007ffc04a240b0 [ 81.670210][ T4306] [ 81.683501][ T4306] ================================================================== [ 81.691830][ T4306] BUG: KASAN: use-after-free in qd_unlock+0x30/0x2d0 [ 81.698537][ T4306] Read of size 8 at addr ffff888074595090 by task syz-executor/4306 [ 81.706534][ T4306] [ 81.708871][ T4306] CPU: 0 PID: 4306 Comm: syz-executor Not tainted syzkaller #0 [ 81.716431][ T4306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 81.726507][ T4306] Call Trace: [ 81.729802][ T4306] [ 81.732750][ T4306] dump_stack_lvl+0x188/0x250 [ 81.737461][ T4306] ? show_regs_print_info+0x20/0x20 [ 81.742692][ T4306] ? load_image+0x410/0x410 [ 81.747216][ T4306] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 81.752711][ T4306] print_address_description+0x60/0x2d0 [ 81.758291][ T4306] ? qd_unlock+0x30/0x2d0 [ 81.762650][ T4306] kasan_report+0xdf/0x130 [ 81.767099][ T4306] ? qd_unlock+0x30/0x2d0 [ 81.771461][ T4306] kasan_check_range+0x235/0x290 [ 81.776426][ T4306] qd_unlock+0x30/0x2d0 [ 81.780615][ T4306] gfs2_quota_sync+0x63b/0x780 [ 81.785423][ T4306] gfs2_sync_fs+0x48/0xb0 [ 81.789786][ T4306] sync_filesystem+0xe6/0x220 [ 81.794494][ T4306] generic_shutdown_super+0x6b/0x300 [ 81.799808][ T4306] kill_block_super+0x7c/0xe0 [ 81.804518][ T4306] deactivate_locked_super+0x93/0xf0 [ 81.809831][ T4306] cleanup_mnt+0x426/0x4d0 [ 81.814289][ T4306] task_work_run+0x125/0x1a0 [ 81.818914][ T4306] exit_to_user_mode_loop+0x10f/0x130 [ 81.824311][ T4306] exit_to_user_mode_prepare+0xee/0x180 [ 81.829885][ T4306] syscall_exit_to_user_mode+0x16/0x40 [ 81.835383][ T4306] do_syscall_64+0x58/0xa0 [ 81.839823][ T4306] ? clear_bhb_loop+0x30/0x80 [ 81.844532][ T4306] ? clear_bhb_loop+0x30/0x80 [ 81.849237][ T4306] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 81.855167][ T4306] RIP: 0033:0x7f669051c097 [ 81.859607][ T4306] Code: a2 c7 05 5c 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 81.879236][ T4306] RSP: 002b:00007ffc04a22f28 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 81.887673][ T4306] RAX: 0000000000000000 RBX: 00007f66905b02ca RCX: 00007f669051c097 [ 81.895677][ T4306] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc04a22fe0 [ 81.903661][ T4306] RBP: 00007ffc04a22fe0 R08: 00007ffc04a23fe0 R09: 00000000ffffffff [ 81.911647][ T4306] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc04a24070 [ 81.919631][ T4306] R13: 00007f66905b02ca R14: 0000000000013952 R15: 00007ffc04a240b0 [ 81.927631][ T4306] [ 81.930658][ T4306] [ 81.932993][ T4306] Allocated by task 4319: [ 81.937339][ T4306] __kasan_slab_alloc+0x92/0xc0 [ 81.942218][ T4306] slab_post_alloc_hook+0x4c/0x380 [ 81.947342][ T4306] kmem_cache_alloc+0x15d/0x280 [ 81.952203][ T4306] qd_alloc+0x50/0x260 [ 81.956288][ T4306] gfs2_quota_init+0x74d/0xe80 [ 81.961067][ T4306] gfs2_make_fs_rw+0x41c/0x590 [ 81.965874][ T4306] gfs2_fill_super+0x17d1/0x1ea0 [ 81.970843][ T4306] get_tree_bdev+0x3e6/0x610 [ 81.975453][ T4306] gfs2_get_tree+0x4d/0x1e0 [ 81.979970][ T4306] vfs_get_tree+0x88/0x270 [ 81.984402][ T4306] do_new_mount+0x247/0xa40 [ 81.988919][ T4306] __se_sys_mount+0x2e3/0x3d0 [ 81.993607][ T4306] do_syscall_64+0x4c/0xa0 [ 81.998038][ T4306] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 82.003948][ T4306] [ 82.006304][ T4306] Freed by task 4306: [ 82.010296][ T4306] kasan_set_track+0x4b/0x70 [ 82.014906][ T4306] kasan_set_free_info+0x1f/0x40 [ 82.019868][ T4306] ____kasan_slab_free+0xd5/0x110 [ 82.024903][ T4306] slab_free_freelist_hook+0xec/0x170 [ 82.030288][ T4306] kmem_cache_free+0x8f/0x210 [ 82.035001][ T4306] rcu_core+0x96e/0x1650 [ 82.039257][ T4306] handle_softirqs+0x336/0x830 [ 82.044032][ T4306] __irq_exit_rcu+0x13b/0x230 [ 82.048727][ T4306] irq_exit_rcu+0x5/0x20 [ 82.052982][ T4306] sysvec_apic_timer_interrupt+0xa0/0xc0 [ 82.058645][ T4306] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 82.064651][ T4306] [ 82.066999][ T4306] Last potentially related work creation: [ 82.072721][ T4306] kasan_save_stack+0x35/0x60 [ 82.077417][ T4306] kasan_record_aux_stack+0xb8/0x100 [ 82.082715][ T4306] call_rcu+0x189/0x900 [ 82.086883][ T4306] gfs2_quota_cleanup+0x414/0x670 [ 82.091923][ T4306] gfs2_make_fs_ro+0x440/0x620 [ 82.096696][ T4306] gfs2_withdraw+0x660/0x14e0 [ 82.101382][ T4306] gfs2_inode_refresh+0xb2d/0x11a0 [ 82.106502][ T4306] inode_go_lock+0x127/0x450 [ 82.111097][ T4306] do_promote+0x75b/0xb20 [ 82.115442][ T4306] finish_xmote+0x4c2/0xaf0 [ 82.119957][ T4306] do_xmote+0x752/0x10a0 [ 82.124210][ T4306] gfs2_glock_nq+0xc6b/0x1510 [ 82.128908][ T4306] do_sync+0x49c/0xba0 [ 82.133027][ T4306] gfs2_quota_sync+0x355/0x780 [ 82.137805][ T4306] gfs2_sync_fs+0x48/0xb0 [ 82.142144][ T4306] sync_filesystem+0xe6/0x220 [ 82.146831][ T4306] generic_shutdown_super+0x6b/0x300 [ 82.152130][ T4306] kill_block_super+0x7c/0xe0 [ 82.156819][ T4306] deactivate_locked_super+0x93/0xf0 [ 82.162119][ T4306] cleanup_mnt+0x426/0x4d0 [ 82.166546][ T4306] task_work_run+0x125/0x1a0 [ 82.171170][ T4306] exit_to_user_mode_loop+0x10f/0x130 [ 82.176554][ T4306] exit_to_user_mode_prepare+0xee/0x180 [ 82.182111][ T4306] syscall_exit_to_user_mode+0x16/0x40 [ 82.187580][ T4306] do_syscall_64+0x58/0xa0 [ 82.192009][ T4306] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 82.197925][ T4306] [ 82.200269][ T4306] The buggy address belongs to the object at ffff888074595000 [ 82.200269][ T4306] which belongs to the cache gfs2_quotad of size 272 [ 82.214329][ T4306] The buggy address is located 144 bytes inside of [ 82.214329][ T4306] 272-byte region [ffff888074595000, ffff888074595110) [ 82.227625][ T4306] The buggy address belongs to the page: [ 82.233275][ T4306] page:ffffea0001d16540 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x74595 [ 82.243433][ T4306] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 82.250991][ T4306] raw: 00fff00000000200 0000000000000000 dead000000000122 ffff88801e7ed8c0 [ 82.259597][ T4306] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 [ 82.268196][ T4306] page dumped because: kasan: bad access detected [ 82.274634][ T4306] page_owner tracks the page as allocated [ 82.280351][ T4306] page last allocated via order 0, migratetype Reclaimable, gfp_mask 0x112c50(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 4319, ts 80952598404, free_ts 80096935443 [ 82.299373][ T4306] get_page_from_freelist+0x24f6/0x2670 [ 82.304937][ T4306] __alloc_pages+0x1ee/0x480 [ 82.309557][ T4306] new_slab+0xc0/0x4b0 [ 82.313632][ T4306] ___slab_alloc+0x807/0xdd0 [ 82.318234][ T4306] kmem_cache_alloc+0xf0/0x280 [ 82.323010][ T4306] qd_alloc+0x50/0x260 [ 82.327121][ T4306] gfs2_quota_init+0x74d/0xe80 [ 82.331902][ T4306] gfs2_make_fs_rw+0x41c/0x590 [ 82.336676][ T4306] gfs2_fill_super+0x17d1/0x1ea0 [ 82.341626][ T4306] get_tree_bdev+0x3e6/0x610 [ 82.346235][ T4306] gfs2_get_tree+0x4d/0x1e0 [ 82.350752][ T4306] vfs_get_tree+0x88/0x270 [ 82.355179][ T4306] do_new_mount+0x247/0xa40 [ 82.359713][ T4306] __se_sys_mount+0x2e3/0x3d0 [ 82.364414][ T4306] do_syscall_64+0x4c/0xa0 [ 82.368843][ T4306] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 82.374749][ T4306] page last free stack trace: [ 82.379448][ T4306] free_unref_page_prepare+0x637/0x6c0 [ 82.384927][ T4306] free_unref_page+0x8f/0x2a0 [ 82.389615][ T4306] __unfreeze_partials+0x188/0x1e0 [ 82.394738][ T4306] put_cpu_partial+0x12d/0x190 [ 82.399512][ T4306] qlist_free_all+0x35/0x90 [ 82.404024][ T4306] kasan_quarantine_reduce+0x150/0x160 [ 82.409507][ T4306] __kasan_slab_alloc+0x2f/0xc0 [ 82.414375][ T4306] slab_post_alloc_hook+0x4c/0x380 [ 82.419495][ T4306] kmem_cache_alloc_node+0x184/0x2c0 [ 82.424789][ T4306] __alloc_skb+0xf4/0x750 [ 82.429132][ T4306] mld_newpack+0x12f/0xba0 [ 82.433565][ T4306] add_grec+0x12de/0x1780 [ 82.437911][ T4306] mld_ifc_work+0x6eb/0xde0 [ 82.442428][ T4306] process_one_work+0x867/0xff0 [ 82.447294][ T4306] worker_thread+0xad7/0x12a0 [ 82.451987][ T4306] kthread+0x42e/0x520 [ 82.456083][ T4306] [ 82.458424][ T4306] Memory state around the buggy address: [ 82.464068][ T4306] ffff888074594f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 82.472147][ T4306] ffff888074595000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 82.480221][ T4306] >ffff888074595080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 82.488294][ T4306] ^ [ 82.492896][ T4306] ffff888074595100: fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 82.500969][ T4306] ffff888074595180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 82.509053][ T4306] ================================================================== [ 82.517135][ T4306] Disabling lock debugging due to kernel taint [ 82.527176][ T4306] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 82.534404][ T4306] CPU: 1 PID: 4306 Comm: syz-executor Tainted: G B syzkaller #0 [ 82.543369][ T4306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 82.553440][ T4306] Call Trace: [ 82.556745][ T4306] [ 82.559696][ T4306] dump_stack_lvl+0x188/0x250 [ 82.564399][ T4306] ? show_regs_print_info+0x20/0x20 [ 82.569621][ T4306] ? load_image+0x410/0x410 [ 82.574153][ T4306] panic+0x2f8/0x850 [ 82.578068][ T4306] ? bpf_jit_dump+0xd0/0xd0 [ 82.582610][ T4306] ? _raw_spin_unlock_irqrestore+0x10d/0x120 [ 82.588613][ T4306] ? _raw_spin_unlock+0x40/0x40 [ 82.593491][ T4306] ? qd_unlock+0x30/0x2d0 [ 82.597855][ T4306] check_panic_on_warn+0x80/0xa0 [ 82.602815][ T4306] ? qd_unlock+0x30/0x2d0 [ 82.607164][ T4306] end_report+0x6d/0xf0 [ 82.611334][ T4306] kasan_report+0x102/0x130 [ 82.615861][ T4306] ? qd_unlock+0x30/0x2d0 [ 82.620224][ T4306] kasan_check_range+0x235/0x290 [ 82.625186][ T4306] qd_unlock+0x30/0x2d0 [ 82.629368][ T4306] gfs2_quota_sync+0x63b/0x780 [ 82.634189][ T4306] gfs2_sync_fs+0x48/0xb0 [ 82.638539][ T4306] sync_filesystem+0xe6/0x220 [ 82.643251][ T4306] generic_shutdown_super+0x6b/0x300 [ 82.648567][ T4306] kill_block_super+0x7c/0xe0 [ 82.653273][ T4306] deactivate_locked_super+0x93/0xf0 [ 82.658584][ T4306] cleanup_mnt+0x426/0x4d0 [ 82.663020][ T4306] task_work_run+0x125/0x1a0 [ 82.667631][ T4306] exit_to_user_mode_loop+0x10f/0x130 [ 82.673047][ T4306] exit_to_user_mode_prepare+0xee/0x180 [ 82.678594][ T4306] syscall_exit_to_user_mode+0x16/0x40 [ 82.684066][ T4306] do_syscall_64+0x58/0xa0 [ 82.688518][ T4306] ? clear_bhb_loop+0x30/0x80 [ 82.693226][ T4306] ? clear_bhb_loop+0x30/0x80 [ 82.697917][ T4306] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 82.703811][ T4306] RIP: 0033:0x7f669051c097 [ 82.708225][ T4306] Code: a2 c7 05 5c 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 82.727849][ T4306] RSP: 002b:00007ffc04a22f28 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 82.736262][ T4306] RAX: 0000000000000000 RBX: 00007f66905b02ca RCX: 00007f669051c097 [ 82.744232][ T4306] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc04a22fe0 [ 82.752200][ T4306] RBP: 00007ffc04a22fe0 R08: 00007ffc04a23fe0 R09: 00000000ffffffff [ 82.760170][ T4306] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc04a24070 [ 82.768139][ T4306] R13: 00007f66905b02ca R14: 0000000000013952 R15: 00007ffc04a240b0 [ 82.776132][ T4306] [ 82.779268][ T4306] Kernel Offset: disabled [ 82.783608][ T4306] Rebooting in 86400 seconds..