Warning: Permanently added '10.128.0.244' (ED25519) to the list of known hosts.
2026/08/31 04:36:23 parsed 1 programs
2026/08/31 04:36:23 serving rpc on tcp://44147
[ 62.935986][ T4197] cgroup: Unknown subsys name 'net'
[ 63.068345][ T4197] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 64.320023][ T4197] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS
[ 67.285190][ T4260] chnl_net:caif_netlink_parms(): no params data found
[ 67.338982][ T4260] bridge0: port 1(bridge_slave_0) entered blocking state
[ 67.350549][ T4260] bridge0: port 1(bridge_slave_0) entered disabled state
[ 67.358845][ T4260] device bridge_slave_0 entered promiscuous mode
[ 67.368608][ T4260] bridge0: port 2(bridge_slave_1) entered blocking state
[ 67.376391][ T4260] bridge0: port 2(bridge_slave_1) entered disabled state
[ 67.384616][ T4260] device bridge_slave_1 entered promiscuous mode
[ 67.410281][ T4260] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 67.421918][ T4260] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 67.442109][ T4260] team0: Port device team_slave_0 added
[ 67.449303][ T4260] team0: Port device team_slave_1 added
[ 67.466023][ T4260] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 67.473898][ T4260] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 67.500204][ T4260] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 67.514184][ T4260] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 67.525192][ T4260] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 67.555188][ T4260] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 67.626198][ T4260] device hsr_slave_0 entered promiscuous mode
[ 67.641916][ T4260] device hsr_slave_1 entered promiscuous mode
[ 67.748011][ T4260] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 67.757739][ T4260] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 67.766745][ T4260] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 67.775780][ T4260] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 67.820080][ T4260] 8021q: adding VLAN 0 to HW filter on device bond0
[ 67.832596][ T568] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 67.842927][ T568] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 67.854584][ T4260] 8021q: adding VLAN 0 to HW filter on device team0
[ 67.864994][ T568] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 67.874051][ T568] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 67.883332][ T568] bridge0: port 1(bridge_slave_0) entered blocking state
[ 67.890499][ T568] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 67.899284][ T568] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 67.912951][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 67.921889][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 67.930201][ T9] bridge0: port 2(bridge_slave_1) entered blocking state
[ 67.937336][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 67.948235][ T568] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 67.962563][ T568] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 67.973275][ T568] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 67.982184][ T568] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 67.991881][ T568] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 68.003044][ T568] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 68.012445][ T568] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 68.023814][ T568] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 68.032315][ T568] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 68.058890][ T568] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 68.068185][ T568] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 68.078690][ T4260] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 68.163674][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 68.171987][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 68.201892][ T4260] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 68.218122][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 68.249256][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 68.258629][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 68.266498][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 68.277020][ T4260] device veth0_vlan entered promiscuous mode
[ 68.288820][ T4260] device veth1_vlan entered promiscuous mode
[ 68.322267][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 68.330331][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 68.338964][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 68.349464][ T4260] device veth0_macvtap entered promiscuous mode
[ 68.360230][ T4260] device veth1_macvtap entered promiscuous mode
[ 68.396244][ T4260] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 68.404010][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 68.413401][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 68.422056][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 68.434029][ T4260] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 68.442261][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 68.451605][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 68.462144][ T4260] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 68.472003][ T4260] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 68.481115][ T4260] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 68.489838][ T4260] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 68.627240][ T4260] syz-executor (4260) used greatest stack depth: 21008 bytes left
[ 68.931281][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 68.939267][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 68.975845][ T568] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 69.015413][ T568] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 69.023675][ T568] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 69.031598][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
2026/08/31 04:36:31 executed programs: 0
[ 69.759055][ T4306] chnl_net:caif_netlink_parms(): no params data found
[ 69.818625][ T4306] bridge0: port 1(bridge_slave_0) entered blocking state
[ 69.829076][ T4306] bridge0: port 1(bridge_slave_0) entered disabled state
[ 69.837472][ T4306] device bridge_slave_0 entered promiscuous mode
[ 69.848047][ T4306] bridge0: port 2(bridge_slave_1) entered blocking state
[ 69.855515][ T4306] bridge0: port 2(bridge_slave_1) entered disabled state
[ 69.864611][ T4306] device bridge_slave_1 entered promiscuous mode
[ 69.890114][ T4306] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 69.904493][ T4306] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 69.933572][ T4306] team0: Port device team_slave_0 added
[ 69.943948][ T4306] team0: Port device team_slave_1 added
[ 69.966572][ T4306] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 69.973677][ T4306] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 70.000540][ T4306] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 70.013001][ T4306] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 70.020090][ T4306] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 70.046410][ T4306] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 70.078153][ T4306] device hsr_slave_0 entered promiscuous mode
[ 70.084870][ T4306] device hsr_slave_1 entered promiscuous mode
[ 70.091470][ T4306] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 70.099239][ T4306] Cannot create hsr debugfs directory
[ 70.182064][ T4306] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 71.232823][ T1422] ieee802154 phy0 wpan0: encryption failed: -22
[ 71.239243][ T1422] ieee802154 phy1 wpan1: encryption failed: -22
[ 71.721266][ T4274] Bluetooth: hci0: command 0x0409 tx timeout
[ 73.506826][ T4306] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 73.792285][ T4274] Bluetooth: hci0: command 0x041b tx timeout
[ 73.816574][ T4306] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 73.878041][ T4306] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 73.966051][ T4306] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 73.975640][ T4306] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 73.984977][ T4306] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 74.002010][ T4306] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 74.045146][ T4306] 8021q: adding VLAN 0 to HW filter on device bond0
[ 74.056456][ T583] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 74.064526][ T583] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 74.076014][ T4306] 8021q: adding VLAN 0 to HW filter on device team0
[ 74.092146][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 74.101031][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 74.109354][ T9] bridge0: port 1(bridge_slave_0) entered blocking state
[ 74.116451][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 74.124330][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 74.142472][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 74.153188][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 74.161601][ T9] bridge0: port 2(bridge_slave_1) entered blocking state
[ 74.168649][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 74.176531][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 74.185165][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 74.194058][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 74.202699][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 74.211296][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 74.219811][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 74.228358][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 74.249200][ T4306] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[ 74.259747][ T4306] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 74.273713][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 74.282473][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 74.291013][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 74.299444][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 74.308176][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 74.393602][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 74.401510][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 74.422210][ T4306] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 74.439010][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 74.448175][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 74.465455][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 74.474915][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 74.484544][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 74.493694][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 74.509421][ T4306] device veth0_vlan entered promiscuous mode
[ 74.520354][ T4306] device veth1_vlan entered promiscuous mode
[ 74.537299][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 74.545862][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 74.555240][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 74.563781][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 74.576281][ T4306] device veth0_macvtap entered promiscuous mode
[ 74.604529][ T4306] device veth1_macvtap entered promiscuous mode
[ 74.618086][ T4306] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[ 74.628990][ T4306] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 74.640835][ T4306] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 74.648607][ T583] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 74.658695][ T583] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 74.666916][ T583] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 74.676347][ T583] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 74.686931][ T4306] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[ 74.697942][ T4306] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 74.708903][ T4306] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 74.722670][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 74.731583][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 74.742755][ T4306] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 74.752664][ T4306] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 74.761889][ T4306] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 74.770673][ T4306] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 74.840109][ T568] device hsr_slave_0 left promiscuous mode
[ 74.846914][ T568] device hsr_slave_1 left promiscuous mode
[ 74.853909][ T568] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 74.861659][ T568] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 74.870228][ T568] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 74.877786][ T568] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 74.885366][ T568] device bridge_slave_1 left promiscuous mode
[ 74.892413][ T568] bridge0: port 2(bridge_slave_1) entered disabled state
[ 74.905277][ T568] device bridge_slave_0 left promiscuous mode
[ 74.912314][ T568] bridge0: port 1(bridge_slave_0) entered disabled state
[ 74.928506][ T568] device veth1_macvtap left promiscuous mode
[ 74.935049][ T568] device veth0_macvtap left promiscuous mode
[ 74.942299][ T568] device veth1_vlan left promiscuous mode
[ 74.948207][ T568] device veth0_vlan left promiscuous mode
[ 75.073200][ T568] team0 (unregistering): Port device team_slave_1 removed
[ 75.088349][ T568] team0 (unregistering): Port device team_slave_0 removed
[ 75.099883][ T568] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 75.113716][ T568] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 75.164147][ T568] bond0 (unregistering): Released all slaves
[ 75.239323][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 75.248738][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 75.258897][ T583] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 75.277711][ T583] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 75.285836][ T583] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 75.294114][ T583] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 75.535513][ T4319] loop0: detected capacity change from 0 to 32768
[ 75.557287][ T4319] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz"
[ 75.573559][ T4319] gfs2: fsid=syz:syz: Now mounting FS (format 1801)...
[ 75.604105][ T4319] gfs2: fsid=syz:syz.0: journal 0 mapped with 5 extents in 0ms
[ 75.615848][ T4287] gfs2: fsid=syz:syz.0: jid=0, already locked for use
[ 75.624287][ T4287] gfs2: fsid=syz:syz.0: jid=0: Looking at journal...
[ 75.654978][ T4287] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 30ms
[ 75.666126][ T4287] gfs2: fsid=syz:syz.0: jid=0: Done
[ 75.672392][ T4319] gfs2: fsid=syz:syz.0: first mount done, others may mount
[ 75.820331][ T4319] gfs2: fsid=syz:syz.0: found 1 quota changes
[ 75.871291][ T4287] Bluetooth: hci0: command 0x040f tx timeout
[ 75.892804][ T4306] gfs2: fsid=syz:syz.0: fatal: filesystem consistency error
[ 75.892804][ T4306] inode = 11 2339
[ 75.892804][ T4306] function = gfs2_dinode_in, file = fs/gfs2/glops.c, line = 414
[ 75.940744][ T4306] gfs2: fsid=syz:syz.0: about to withdraw this file system
[ 75.971091][ T4306] gfs2: fsid=syz:syz.0: warning: assertion "!qd->qd_change" failed at function = gfs2_quota_cleanup, file = fs/gfs2/quota.c, line = 1485
[ 76.000690][ T4306] CPU: 0 PID: 4306 Comm: syz-executor Not tainted syzkaller #0
[ 76.008465][ T4306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 76.018634][ T4306] Call Trace:
[ 76.021920][ T4306]
[ 76.024864][ T4306] dump_stack_lvl+0x188/0x250
[ 76.029577][ T4306] ? show_regs_print_info+0x20/0x20
[ 76.034827][ T4306] ? load_image+0x410/0x410
[ 76.039340][ T4306] ? do_raw_spin_unlock+0x11d/0x230
[ 76.044546][ T4306] gfs2_assert_warn_i+0x187/0x2c0
[ 76.049585][ T4306] gfs2_quota_cleanup+0x48c/0x670
[ 76.054618][ T4306] gfs2_make_fs_ro+0x440/0x620
[ 76.059391][ T4306] ? __might_sleep+0xf0/0xf0
[ 76.063990][ T4306] ? gfs2_dinode_out+0xb00/0xb00
[ 76.068974][ T4306] ? _raw_spin_unlock+0x24/0x40
[ 76.073829][ T4306] ? gfs2_glock_nq+0xcaa/0x1510
[ 76.078702][ T4306] gfs2_withdraw+0x660/0x14e0
[ 76.083390][ T4306] ? gfs2_meta_new+0x160/0x160
[ 76.088157][ T4306] ? gfs2_lm+0x240/0x240
[ 76.092400][ T4306] ? gfs2_freeze_lock+0x52/0xc0
[ 76.097253][ T4306] ? gfs2_consist_inode_i+0xc0/0xe0
[ 76.102456][ T4306] gfs2_inode_refresh+0xb2d/0x11a0
[ 76.107579][ T4306] ? gfs2_inode_metasync+0xf0/0xf0
[ 76.112704][ T4306] inode_go_lock+0x127/0x450
[ 76.117307][ T4306] do_promote+0x75b/0xb20
[ 76.121644][ T4306] finish_xmote+0x4c2/0xaf0
[ 76.126156][ T4306] do_xmote+0x752/0x10a0
[ 76.130418][ T4306] gfs2_glock_nq+0xc6b/0x1510
[ 76.135118][ T4306] do_sync+0x49c/0xba0
[ 76.139200][ T4306] ? slot_put+0x1e0/0x1e0
[ 76.143537][ T4306] ? do_sync+0x494/0xba0
[ 76.147784][ T4306] ? do_raw_spin_unlock+0x11d/0x230
[ 76.152986][ T4306] gfs2_quota_sync+0x355/0x780
[ 76.157765][ T4306] gfs2_sync_fs+0x48/0xb0
[ 76.162101][ T4306] sync_filesystem+0xe6/0x220
[ 76.166785][ T4306] generic_shutdown_super+0x6b/0x300
[ 76.172077][ T4306] kill_block_super+0x7c/0xe0
[ 76.176758][ T4306] deactivate_locked_super+0x93/0xf0
[ 76.182041][ T4306] cleanup_mnt+0x426/0x4d0
[ 76.186461][ T4306] task_work_run+0x125/0x1a0
[ 76.191176][ T4306] exit_to_user_mode_loop+0x10f/0x130
[ 76.196558][ T4306] exit_to_user_mode_prepare+0xee/0x180
[ 76.202105][ T4306] syscall_exit_to_user_mode+0x16/0x40
[ 76.207569][ T4306] do_syscall_64+0x58/0xa0
[ 76.211994][ T4306] ? clear_bhb_loop+0x30/0x80
[ 76.216679][ T4306] ? clear_bhb_loop+0x30/0x80
[ 76.221538][ T4306] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 76.227442][ T4306] RIP: 0033:0x7f7d6d0d7397
[ 76.231877][ T4306] Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
[ 76.251490][ T4306] RSP: 002b:00007ffd3e7730d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[ 76.259913][ T4306] RAX: 0000000000000000 RBX: 00007f7d6d16c474 RCX: 00007f7d6d0d7397
[ 76.267979][ T4306] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd3e773190
[ 76.275963][ T4306] RBP: 00007ffd3e773190 R08: 00007ffd3e774190 R09: 00000000ffffffff
[ 76.283940][ T4306] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd3e774220
[ 76.291912][ T4306] R13: 00007f7d6d16c474 R14: 0000000000012634 R15: 00007ffd3e774260
[ 76.299900][ T4306]
[ 76.312623][ T4306] gfs2: fsid=syz:syz.0: Journal recovery skipped for jid 0 until next mount.
[ 76.321464][ T4306] gfs2: fsid=syz:syz.0: Glock dequeues delayed: 0
[ 76.329380][ T4306] gfs2: fsid=syz:syz.0: File system withdrawn
[ 76.340682][ T4306] CPU: 0 PID: 4306 Comm: syz-executor Not tainted syzkaller #0
[ 76.348258][ T4306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 76.358750][ T4306] Call Trace:
[ 76.362035][ T4306]
[ 76.364966][ T4306] dump_stack_lvl+0x188/0x250
[ 76.369659][ T4306] ? show_regs_print_info+0x20/0x20
[ 76.374860][ T4306] ? load_image+0x410/0x410
[ 76.379397][ T4306] ? lockref_put_or_lock+0x6e/0xb0
[ 76.384518][ T4306] gfs2_withdraw+0xb9a/0x14e0
[ 76.389208][ T4306] ? gfs2_meta_new+0x160/0x160
[ 76.393995][ T4306] ? gfs2_lm+0x240/0x240
[ 76.398261][ T4306] ? gfs2_consist_inode_i+0xc0/0xe0
[ 76.403490][ T4306] gfs2_inode_refresh+0xb2d/0x11a0
[ 76.408626][ T4306] ? gfs2_inode_metasync+0xf0/0xf0
[ 76.413751][ T4306] inode_go_lock+0x127/0x450
[ 76.418345][ T4306] do_promote+0x75b/0xb20
[ 76.422688][ T4306] finish_xmote+0x4c2/0xaf0
[ 76.427201][ T4306] do_xmote+0x752/0x10a0
[ 76.431480][ T4306] gfs2_glock_nq+0xc6b/0x1510
[ 76.436355][ T4306] do_sync+0x49c/0xba0
[ 76.440473][ T4306] ? slot_put+0x1e0/0x1e0
[ 76.444808][ T4306] ? do_sync+0x494/0xba0
[ 76.449056][ T4306] ? do_raw_spin_unlock+0x11d/0x230
[ 76.454271][ T4306] gfs2_quota_sync+0x355/0x780
[ 76.459070][ T4306] gfs2_sync_fs+0x48/0xb0
[ 76.463678][ T4306] sync_filesystem+0xe6/0x220
[ 76.468386][ T4306] generic_shutdown_super+0x6b/0x300
[ 76.473694][ T4306] kill_block_super+0x7c/0xe0
[ 76.478382][ T4306] deactivate_locked_super+0x93/0xf0
[ 76.483685][ T4306] cleanup_mnt+0x426/0x4d0
[ 76.488123][ T4306] task_work_run+0x125/0x1a0
[ 76.492729][ T4306] exit_to_user_mode_loop+0x10f/0x130
[ 76.498114][ T4306] exit_to_user_mode_prepare+0xee/0x180
[ 76.503668][ T4306] syscall_exit_to_user_mode+0x16/0x40
[ 76.509138][ T4306] do_syscall_64+0x58/0xa0
[ 76.513553][ T4306] ? clear_bhb_loop+0x30/0x80
[ 76.518236][ T4306] ? clear_bhb_loop+0x30/0x80
[ 76.522923][ T4306] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 76.528828][ T4306] RIP: 0033:0x7f7d6d0d7397
[ 76.533244][ T4306] Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
[ 76.552862][ T4306] RSP: 002b:00007ffd3e7730d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[ 76.561325][ T4306] RAX: 0000000000000000 RBX: 00007f7d6d16c474 RCX: 00007f7d6d0d7397
[ 76.569308][ T4306] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd3e773190
[ 76.577289][ T4306] RBP: 00007ffd3e773190 R08: 00007ffd3e774190 R09: 00000000ffffffff
[ 76.585266][ T4306] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd3e774220
[ 76.593246][ T4306] R13: 00007f7d6d16c474 R14: 0000000000012634 R15: 00007ffd3e774260
[ 76.601245][ T4306]
[ 76.612346][ T4306] ==================================================================
[ 76.620623][ T4306] BUG: KASAN: use-after-free in qd_unlock+0x30/0x2d0
[ 76.627313][ T4306] Read of size 8 at addr ffff8880713cc090 by task syz-executor/4306
[ 76.635416][ T4306]
[ 76.637754][ T4306] CPU: 0 PID: 4306 Comm: syz-executor Not tainted syzkaller #0
[ 76.645296][ T4306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 76.655377][ T4306] Call Trace:
[ 76.658660][ T4306]
[ 76.661595][ T4306] dump_stack_lvl+0x188/0x250
[ 76.666290][ T4306] ? show_regs_print_info+0x20/0x20
[ 76.671496][ T4306] ? load_image+0x410/0x410
[ 76.676008][ T4306] ? _raw_spin_lock_irqsave+0xbc/0x100
[ 76.681487][ T4306] print_address_description+0x60/0x2d0
[ 76.687039][ T4306] ? qd_unlock+0x30/0x2d0
[ 76.691381][ T4306] kasan_report+0xdf/0x130
[ 76.695800][ T4306] ? qd_unlock+0x30/0x2d0
[ 76.700134][ T4306] kasan_check_range+0x235/0x290
[ 76.705073][ T4306] qd_unlock+0x30/0x2d0
[ 76.709230][ T4306] gfs2_quota_sync+0x63b/0x780
[ 76.714007][ T4306] gfs2_sync_fs+0x48/0xb0
[ 76.718342][ T4306] sync_filesystem+0xe6/0x220
[ 76.723022][ T4306] generic_shutdown_super+0x6b/0x300
[ 76.728315][ T4306] kill_block_super+0x7c/0xe0
[ 76.733000][ T4306] deactivate_locked_super+0x93/0xf0
[ 76.738288][ T4306] cleanup_mnt+0x426/0x4d0
[ 76.742715][ T4306] task_work_run+0x125/0x1a0
[ 76.747319][ T4306] exit_to_user_mode_loop+0x10f/0x130
[ 76.752688][ T4306] exit_to_user_mode_prepare+0xee/0x180
[ 76.758234][ T4306] syscall_exit_to_user_mode+0x16/0x40
[ 76.763694][ T4306] do_syscall_64+0x58/0xa0
[ 76.768113][ T4306] ? clear_bhb_loop+0x30/0x80
[ 76.772791][ T4306] ? clear_bhb_loop+0x30/0x80
[ 76.777469][ T4306] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 76.783357][ T4306] RIP: 0033:0x7f7d6d0d7397
[ 76.787770][ T4306] Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
[ 76.807384][ T4306] RSP: 002b:00007ffd3e7730d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[ 76.815803][ T4306] RAX: 0000000000000000 RBX: 00007f7d6d16c474 RCX: 00007f7d6d0d7397
[ 76.823771][ T4306] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd3e773190
[ 76.831744][ T4306] RBP: 00007ffd3e773190 R08: 00007ffd3e774190 R09: 00000000ffffffff
[ 76.839712][ T4306] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd3e774220
[ 76.847674][ T4306] R13: 00007f7d6d16c474 R14: 0000000000012634 R15: 00007ffd3e774260
[ 76.855645][ T4306]
[ 76.858647][ T4306]
[ 76.860957][ T4306] Allocated by task 4319:
[ 76.865262][ T4306] __kasan_slab_alloc+0x92/0xc0
[ 76.870102][ T4306] slab_post_alloc_hook+0x4c/0x380
[ 76.875227][ T4306] kmem_cache_alloc+0x15d/0x280
[ 76.880091][ T4306] qd_alloc+0x50/0x260
[ 76.884148][ T4306] gfs2_quota_init+0x74d/0xe80
[ 76.888900][ T4306] gfs2_make_fs_rw+0x41c/0x590
[ 76.893658][ T4306] gfs2_fill_super+0x17d1/0x1ea0
[ 76.898583][ T4306] get_tree_bdev+0x3e6/0x610
[ 76.903156][ T4306] gfs2_get_tree+0x4d/0x1e0
[ 76.907642][ T4306] vfs_get_tree+0x88/0x270
[ 76.912041][ T4306] do_new_mount+0x247/0xa40
[ 76.916532][ T4306] __se_sys_mount+0x2e3/0x3d0
[ 76.921190][ T4306] do_syscall_64+0x4c/0xa0
[ 76.925627][ T4306] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 76.931524][ T4306]
[ 76.933833][ T4306] Freed by task 4306:
[ 76.937792][ T4306] kasan_set_track+0x4b/0x70
[ 76.942368][ T4306] kasan_set_free_info+0x1f/0x40
[ 76.947292][ T4306] ____kasan_slab_free+0xd5/0x110
[ 76.952301][ T4306] slab_free_freelist_hook+0xec/0x170
[ 76.957655][ T4306] kmem_cache_free+0x8f/0x210
[ 76.962311][ T4306] rcu_core+0x96e/0x1650
[ 76.966535][ T4306] handle_softirqs+0x336/0x830
[ 76.971281][ T4306] __irq_exit_rcu+0x13b/0x230
[ 76.975942][ T4306] irq_exit_rcu+0x5/0x20
[ 76.980168][ T4306] sysvec_apic_timer_interrupt+0xa0/0xc0
[ 76.985784][ T4306] asm_sysvec_apic_timer_interrupt+0x16/0x20
[ 76.991751][ T4306]
[ 76.994055][ T4306] Last potentially related work creation:
[ 76.999744][ T4306] kasan_save_stack+0x35/0x60
[ 77.004411][ T4306] kasan_record_aux_stack+0xb8/0x100
[ 77.009679][ T4306] call_rcu+0x189/0x900
[ 77.013818][ T4306] gfs2_quota_cleanup+0x414/0x670
[ 77.018825][ T4306] gfs2_make_fs_ro+0x440/0x620
[ 77.023569][ T4306] gfs2_withdraw+0x660/0x14e0
[ 77.028230][ T4306] gfs2_inode_refresh+0xb2d/0x11a0
[ 77.033321][ T4306] inode_go_lock+0x127/0x450
[ 77.037900][ T4306] do_promote+0x75b/0xb20
[ 77.042211][ T4306] finish_xmote+0x4c2/0xaf0
[ 77.046694][ T4306] do_xmote+0x752/0x10a0
[ 77.050917][ T4306] gfs2_glock_nq+0xc6b/0x1510
[ 77.055577][ T4306] do_sync+0x49c/0xba0
[ 77.059639][ T4306] gfs2_quota_sync+0x355/0x780
[ 77.064383][ T4306] gfs2_sync_fs+0x48/0xb0
[ 77.068698][ T4306] sync_filesystem+0xe6/0x220
[ 77.073357][ T4306] generic_shutdown_super+0x6b/0x300
[ 77.078627][ T4306] kill_block_super+0x7c/0xe0
[ 77.083285][ T4306] deactivate_locked_super+0x93/0xf0
[ 77.088551][ T4306] cleanup_mnt+0x426/0x4d0
[ 77.092955][ T4306] task_work_run+0x125/0x1a0
[ 77.097529][ T4306] exit_to_user_mode_loop+0x10f/0x130
[ 77.102884][ T4306] exit_to_user_mode_prepare+0xee/0x180
[ 77.108416][ T4306] syscall_exit_to_user_mode+0x16/0x40
[ 77.113867][ T4306] do_syscall_64+0x58/0xa0
[ 77.118269][ T4306] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 77.124144][ T4306]
[ 77.126451][ T4306] The buggy address belongs to the object at ffff8880713cc000
[ 77.126451][ T4306] which belongs to the cache gfs2_quotad of size 272
[ 77.140483][ T4306] The buggy address is located 144 bytes inside of
[ 77.140483][ T4306] 272-byte region [ffff8880713cc000, ffff8880713cc110)
[ 77.153739][ T4306] The buggy address belongs to the page:
[ 77.159361][ T4306] page:ffffea0001c4f300 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x713cc
[ 77.169520][ T4306] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 77.177111][ T4306] raw: 00fff00000000200 0000000000000000 dead000000000122 ffff88801e61bc80
[ 77.185685][ T4306] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
[ 77.194393][ T4306] page dumped because: kasan: bad access detected
[ 77.200902][ T4306] page_owner tracks the page as allocated
[ 77.206601][ T4306] page last allocated via order 0, migratetype Reclaimable, gfp_mask 0x112c50(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 4319, ts 75806589030, free_ts 20165708927
[ 77.225602][ T4306] get_page_from_freelist+0x24f6/0x2670
[ 77.231137][ T4306] __alloc_pages+0x1ee/0x480
[ 77.235708][ T4306] new_slab+0xc0/0x4b0
[ 77.239758][ T4306] ___slab_alloc+0x807/0xdd0
[ 77.244333][ T4306] kmem_cache_alloc+0xf0/0x280
[ 77.249078][ T4306] qd_alloc+0x50/0x260
[ 77.253130][ T4306] gfs2_quota_init+0x74d/0xe80
[ 77.257878][ T4306] gfs2_make_fs_rw+0x41c/0x590
[ 77.262625][ T4306] gfs2_fill_super+0x17d1/0x1ea0
[ 77.267542][ T4306] get_tree_bdev+0x3e6/0x610
[ 77.272119][ T4306] gfs2_get_tree+0x4d/0x1e0
[ 77.276603][ T4306] vfs_get_tree+0x88/0x270
[ 77.281010][ T4306] do_new_mount+0x247/0xa40
[ 77.285499][ T4306] __se_sys_mount+0x2e3/0x3d0
[ 77.290154][ T4306] do_syscall_64+0x4c/0xa0
[ 77.294558][ T4306] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 77.300437][ T4306] page last free stack trace:
[ 77.305183][ T4306] free_unref_page_prepare+0x637/0x6c0
[ 77.310627][ T4306] free_unref_page+0x8f/0x2a0
[ 77.315291][ T4306] free_contig_range+0x96/0xf0
[ 77.320037][ T4306] destroy_args+0xef/0xa00
[ 77.324439][ T4306] debug_vm_pgtable+0x321/0x380
[ 77.329270][ T4306] do_one_initcall+0x272/0x730
[ 77.334018][ T4306] do_initcall_level+0x13d/0x1f0
[ 77.338937][ T4306] do_initcalls+0x4b/0x90
[ 77.343245][ T4306] kernel_init_freeable+0x3d5/0x560
[ 77.348425][ T4306] kernel_init+0x19/0x1b0
[ 77.352737][ T4306] ret_from_fork+0x1f/0x30
[ 77.357152][ T4306]
[ 77.359458][ T4306] Memory state around the buggy address:
[ 77.365092][ T4306] ffff8880713cbf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 77.373137][ T4306] ffff8880713cc000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.381178][ T4306] >ffff8880713cc080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.389224][ T4306] ^
[ 77.393802][ T4306] ffff8880713cc100: fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 77.401845][ T4306] ffff8880713cc180: fc fc fc fc fc fc fc f