program: syz_read_part_table(0x59d, &(0x7f0000000000)="$eJzs0r1Ls1cYB+CTwEsoVCIiONhBMLg0KsRBh2SwEtMsRsSKFGfBQQfBwUFSorMf/4DiF4iL2NlRjCAKcZKM4lxQXDKltD6FtnZpiyl9ua4lnHPf59w5/J7A/1o8/NRsNmMhhGbi75/+7jQ/XuyZHJ2aDiEW5kII+a++/LUSizp+u/U8WpeidTGRqe3fjL2ctt/23ldTh/GofhEP4YcQwuLjUfLfvo3P31nuKrm+sVzYXM0tPBTWnobm+/PdW/mlneGDbHmmKzsbfVgX8dbMT9VGju+apefdtoFP1Vojcx31pWMfM5//1p/z3+us1CuNib6TlcF0R/2yvB3l/ip/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgg53lrpLrG8uFzdXcwkNh7Wlovj/fvZVf2hk+yJZnurKz8be+i3hr5qdqI8d3zdLzbtvAp2qtkbmO+tKxd0e/+fFj/hIt9HX4Y/57nZV6pTHRd7IymO6oX5a3o9xf3+cPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPCX8uPFnsnRqekQYmEuhPDt/fe9v+w3E2/1WNR3Hv2Wov1iIlPbvxl7OW2/7b2vpg4nEyEkfnfv4uNR8otWPoR/5OcAAAD//2wlhu4=") lgetxattr(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)=@known='system.posix_acl_default\x00', 0x0, 0x0) stat(&(0x7f0000000600)='./file0\x00', &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0}) quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f00000005c0)=@rnullb, r0, &(0x7f00000006c0)='./file0\x00') syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x200801f, &(0x7f0000000040), 0x1, 0x4f2, &(0x7f0000000880)="$eJzs3V9vFGsZAPBnprvQQnGLeoEkAhFMS5RtSwUaL1ATo1ckKnqNtV2aptsuabdAG6IlfgATY9TEG73yxsQPYGL4CMaERO+NGo0xoBfngnPmZHdne0rZbUtOu3tO+/slLzPvzLv7PC/Dvjv/2Ang2LoUEWMRkWVZdjUivpcvT/MSm63SaPfyxZPZRkkiy+7+N4kkX9Z+r5P59HT+ssGI+M43I36QvBl3dX1jcaZarazk9fH6UvIqyzauLSzNzFfmK8tTU5M3p29N35ieOJB+jkTE7a//8+c/+e03bv/xi4/+du/fYz9sdbBlez8OUqvrxebfRVshIlYOI1ifFJo9bLnRvVnW4Z8BAAA9VoqIT0bE5yLiapRioLk3BwAAABwl2VeG41XSuv4HAAAAHE1pRAxHkpbz+32HI03L5dY9vJ+OU2m1tlr/QlbaOl8wEsX0/kK1MpHfOzASxaRRn8zvsW3Xr++oT0XE2Yj4WWmoWS/P1qpzfT3zAQAAAMfH6R3H//8vtY7/AQAAgCNmpN8JAAAAAIfO8T8AAAAcfY7/AQAA4Ej71p07jZK1n38993B9bbH28NpcZXWxvLQ2W56trTwoz9dq883f7Fva6/2qtdqDL8Xy2uPxemW1Pr66vnFvqba2XL+38NojsAEAAIAeOnvx2V+TiNj88lAaEVmybV0xIhvY3rjQ+/yAw5O+TeN/HF4eQO8N9DsBoG/s0sPxVex3AkDf7TUOdL15508HnwsAAHA4Rj+zdf2/WYDjI7/+nyT9TgToOdf/4fg60e8EgL4p7rYH4KAAjrx0Hx/1wejynwX2ff0/y946MQAA4EANN0uSlvPd++FI03I54kzzsQDF5P5CtTIREZ+IiL+Uiicb9cnmKxOnBwAAAAAAAAAAAAAAAAAAAAAAAABgn7IsiayLoa02AAAAwMdZRPqvJH/+12jpyvDO8wMnkndKkT8n9NGv7v7i8Uy9vlLYtj4i6r/Ml1/v3XkLAAAAoLv2cXpzOtnvbAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4al6+eDLbLr2M+5+vRcRIp/iFGGxOB6MYEaf+l0Rh2+uSiBg4gPibTyPiXKf4SSOtGMmz2Bk/jYihPsc/fQDx4Th71hh/vtrp85fGpea08+evkJcPq/v4l26NfwNdxr8znd4wfXPR+ee/H+8a/2nE+ULn8acdP+kS//I++/j9725sdFuX/SZitOP3T/JarPGk8GB8dX3j2sLSzHxlvrI8NTV5c/rW9I3pifH7C9VK/mfHGD/97B/e263/p7rEH9mj/1f22f93nz9+8anWbHHHqmL8OsvGLnfe/ue6xG9/930+39yN+mh7frM1v92F3/35wsVd+j/Xpf97bf+xffb/6rd//Pd9NgUAemB1fWNxplqtrJgxc2gzQ9HDoDOxW5v2TmwP8vlRHuojsQneeqaPgxIAAHAoPtjp73cmAAAAAAAAAAAAAAAAAAAAcHzt9TNgcQA/J7Yz5mZ/ugoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsKv3AwAA///hSstT") (async) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x200801f, &(0x7f0000000040), 0x1, 0x4f2, &(0x7f0000000880)="$eJzs3V9vFGsZAPBnprvQQnGLeoEkAhFMS5RtSwUaL1ATo1ckKnqNtV2aptsuabdAG6IlfgATY9TEG73yxsQPYGL4CMaERO+NGo0xoBfngnPmZHdne0rZbUtOu3tO+/slLzPvzLv7PC/Dvjv/2Ang2LoUEWMRkWVZdjUivpcvT/MSm63SaPfyxZPZRkkiy+7+N4kkX9Z+r5P59HT+ssGI+M43I36QvBl3dX1jcaZarazk9fH6UvIqyzauLSzNzFfmK8tTU5M3p29N35ieOJB+jkTE7a//8+c/+e03bv/xi4/+du/fYz9sdbBlez8OUqvrxebfRVshIlYOI1ifFJo9bLnRvVnW4Z8BAAA9VoqIT0bE5yLiapRioLk3BwAAABwl2VeG41XSuv4HAAAAHE1pRAxHkpbz+32HI03L5dY9vJ+OU2m1tlr/QlbaOl8wEsX0/kK1MpHfOzASxaRRn8zvsW3Xr++oT0XE2Yj4WWmoWS/P1qpzfT3zAQAAAMfH6R3H//8vtY7/AQAAgCNmpN8JAAAAAIfO8T8AAAAcfY7/AQAA4Ej71p07jZK1n38993B9bbH28NpcZXWxvLQ2W56trTwoz9dq883f7Fva6/2qtdqDL8Xy2uPxemW1Pr66vnFvqba2XL+38NojsAEAAIAeOnvx2V+TiNj88lAaEVmybV0xIhvY3rjQ+/yAw5O+TeN/HF4eQO8N9DsBoG/s0sPxVex3AkDf7TUOdL15508HnwsAAHA4Rj+zdf2/WYDjI7/+nyT9TgToOdf/4fg60e8EgL4p7rYH4KAAjrx0Hx/1wejynwX2ff0/y946MQAA4EANN0uSlvPd++FI03I54kzzsQDF5P5CtTIREZ+IiL+Uiicb9cnmKxOnBwAAAAAAAAAAAAAAAAAAAAAAAABgn7IsiayLoa02AAAAwMdZRPqvJH/+12jpyvDO8wMnkndKkT8n9NGv7v7i8Uy9vlLYtj4i6r/Ml1/v3XkLAAAAoLv2cXpzOtnvbAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4al6+eDLbLr2M+5+vRcRIp/iFGGxOB6MYEaf+l0Rh2+uSiBg4gPibTyPiXKf4SSOtGMmz2Bk/jYihPsc/fQDx4Th71hh/vtrp85fGpea08+evkJcPq/v4l26NfwNdxr8znd4wfXPR+ee/H+8a/2nE+ULn8acdP+kS//I++/j9725sdFuX/SZitOP3T/JarPGk8GB8dX3j2sLSzHxlvrI8NTV5c/rW9I3pifH7C9VK/mfHGD/97B/e263/p7rEH9mj/1f22f93nz9+8anWbHHHqmL8OsvGLnfe/ue6xG9/930+39yN+mh7frM1v92F3/35wsVd+j/Xpf97bf+xffb/6rd//Pd9NgUAemB1fWNxplqtrJgxc2gzQ9HDoDOxW5v2TmwP8vlRHuojsQneeqaPgxIAAHAoPtjp73cmAAAAAAAAAAAAAAAAAAAAcHzt9TNgcQA/J7Yz5mZ/ugoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsKv3AwAA///hSstT") [ 102.672315][ T4654] Bluetooth: hci0: command tx timeout [ 102.784602][ T5324] loop0: detected capacity change from 0 to 2048 [ 102.837593][ T5324] Alternate GPT is invalid, using primary GPT. [ 102.841605][ T5324] loop0: p2 p3 p7 [ 102.939203][ T5285] I/O error, dev loop0, sector 408 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 102.947057][ T5324] loop0: detected capacity change from 0 to 512 [ 102.951560][ T5287] I/O error, dev loop0, sector 208 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 102.964277][ T5287] I/O error, dev loop0, sector 208 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 102.969633][ T5285] I/O error, dev loop0, sector 408 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 102.979918][ T5285] Buffer I/O error on dev loop0p7, logical block 8, async page read [ 102.984620][ T5287] Buffer I/O error on dev loop0p3, logical block 8, async page read [ 103.009916][ T5287] udevd[5287]: inotify_add_watch(7, /dev/loop0p3, 10) failed: No such file or directory [ 103.014532][ T176] ================================================================== [ 103.018401][ T176] BUG: KASAN: slab-use-after-free in update_io_ticks+0xa9/0x280 [ 103.022211][ T176] Read of size 8 at addr ffff88803236b9a8 by task kworker/u4:6/176 [ 103.025664][ T176] [ 103.026746][ T176] CPU: 0 UID: 0 PID: 176 Comm: kworker/u4:6 Not tainted syzkaller #0 PREEMPT(full) [ 103.026761][ T176] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.026768][ T176] Workqueue: loop0 loop_rootcg_workfn [ 103.026786][ T176] Call Trace: [ 103.026793][ T176] [ 103.026798][ T176] dump_stack_lvl+0xe8/0x150 [ 103.026816][ T176] print_address_description+0x55/0x1e0 [ 103.026831][ T176] ? update_io_ticks+0xa9/0x280 [ 103.026843][ T176] print_report+0x58/0x70 [ 103.026855][ T176] kasan_report+0x117/0x150 [ 103.026870][ T176] ? update_io_ticks+0xa9/0x280 [ 103.026882][ T176] update_io_ticks+0xa9/0x280 [ 103.026892][ T176] ? __pfx_update_io_ticks+0x10/0x10 [ 103.026901][ T176] ? blk_stat_add+0x74/0x4b0 [ 103.026912][ T176] blk_account_io_done+0x188/0x870 [ 103.026924][ T176] ? blk_stat_add+0x74/0x4b0 [ 103.026935][ T176] __blk_mq_end_request+0x2cf/0x6c0 [ 103.026945][ T176] ? blk_mq_end_request+0x47/0x70 [ 103.026955][ T176] lo_rw_aio+0xcd4/0xf20 [ 103.026969][ T176] ? __pfx_lo_rw_aio+0x10/0x10 [ 103.026978][ T176] ? do_raw_spin_lock+0x12b/0x2f0 [ 103.026990][ T176] ? kthread_associate_blkcg+0x359/0x600 [ 103.027004][ T176] ? _raw_spin_unlock_irq+0x23/0x50 [ 103.027062][ T176] loop_process_work+0x95e/0x11c0 [ 103.027076][ T176] ? __pfx_loop_process_work+0x10/0x10 [ 103.027086][ T176] ? look_up_lock_class+0x57/0x110 [ 103.027099][ T176] ? register_lock_class+0x31/0x2e0 [ 103.027113][ T176] ? __lock_acquire+0x683/0x2cf0 [ 103.027124][ T176] ? rcu_is_watching+0x15/0xb0 [ 103.027138][ T176] ? trace_hrtimer_start+0x82/0x200 [ 103.027151][ T176] ? do_raw_spin_lock+0x12b/0x2f0 [ 103.027160][ T176] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 103.027172][ T176] ? process_scheduled_works+0xa20/0x14e0 [ 103.027184][ T176] ? process_scheduled_works+0xa20/0x14e0 [ 103.027195][ T176] ? rcu_is_watching+0x15/0xb0 [ 103.027208][ T176] ? process_scheduled_works+0xa20/0x14e0 [ 103.027218][ T176] process_scheduled_works+0xa8e/0x14e0 [ 103.027235][ T176] ? __pfx_process_scheduled_works+0x10/0x10 [ 103.027247][ T176] ? assign_work+0x3cf/0x5d0 [ 103.027257][ T176] worker_thread+0xa47/0xfb0 [ 103.027270][ T176] ? __kthread_parkme+0x71/0x1f0 [ 103.027282][ T176] kthread+0x388/0x470 [ 103.027298][ T176] ? __pfx_worker_thread+0x10/0x10 [ 103.027307][ T176] ? __pfx_kthread+0x10/0x10 [ 103.027318][ T176] ret_from_fork+0x514/0xb70 [ 103.027333][ T176] ? __pfx_ret_from_fork+0x10/0x10 [ 103.027343][ T176] ? __switch_to+0xc89/0x1420 [ 103.027354][ T176] ? __pfx_kthread+0x10/0x10 [ 103.027364][ T176] ret_from_fork_asm+0x1a/0x30 [ 103.027375][ T176] [ 103.027378][ T176] [ 103.144995][ T176] Allocated by task 5324: [ 103.147303][ T176] kasan_save_track+0x3e/0x80 [ 103.149205][ T176] __kasan_slab_alloc+0x6c/0x80 [ 103.151282][ T176] kmem_cache_alloc_lru_noprof+0x2aa/0x5f0 [ 103.154168][ T176] bdev_alloc_inode+0x29/0x90 [ 103.156768][ T176] alloc_inode+0x6a/0x1b0 [ 103.159013][ T176] new_inode+0x1f/0x170 [ 103.160779][ T176] bdev_alloc+0x24/0x370 [ 103.162530][ T176] add_partition+0x1c3/0x8e0 [ 103.164391][ T176] bdev_disk_changed+0xc3e/0x17a0 [ 103.166939][ T176] loop_set_status+0x9f7/0xd50 [ 103.169437][ T176] lo_ioctl+0xc14/0x1fc0 [ 103.171366][ T176] blkdev_ioctl+0x5e3/0x740 [ 103.173327][ T176] __se_sys_ioctl+0xfc/0x170 [ 103.175453][ T176] do_syscall_64+0x174/0x580 [ 103.177477][ T176] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.180424][ T176] [ 103.181664][ T176] Freed by task 5287: [ 103.183468][ T176] kasan_save_track+0x3e/0x80 [ 103.185327][ T176] kasan_save_free_info+0x40/0x50 [ 103.187272][ T176] __kasan_slab_free+0x5c/0x80 [ 103.189240][ T176] kmem_cache_free+0x182/0x650 [ 103.191535][ T176] rcu_core+0x78b/0x10a0 [ 103.193658][ T176] handle_softirqs+0x225/0x840 [ 103.195989][ T176] __irq_exit_rcu+0xca/0x220 [ 103.197992][ T176] irq_exit_rcu+0x9/0x30 [ 103.199765][ T176] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 103.202090][ T176] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 103.205351][ T176] [ 103.206821][ T176] Last potentially related work creation: [ 103.209640][ T176] kasan_save_stack+0x3e/0x60 [ 103.211787][ T176] kasan_record_aux_stack+0xbd/0xd0 [ 103.214094][ T176] call_rcu+0xee/0x8b0 [ 103.215872][ T176] evict+0x987/0xb50 [ 103.217591][ T176] device_release+0xc4/0x1f0 [ 103.219440][ T176] kobject_put+0x222/0x550 [ 103.221344][ T176] blkdev_release+0x15/0x20 [ 103.223613][ T176] __fput+0x418/0xa50 [ 103.226158][ T176] fput_close_sync+0x11f/0x240 [ 103.228640][ T176] __x64_sys_close+0x7e/0x110 [ 103.230907][ T176] do_syscall_64+0x174/0x580 [ 103.232886][ T176] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.235493][ T176] [ 103.236525][ T176] The buggy address belongs to the object at ffff88803236b980 [ 103.236525][ T176] which belongs to the cache bdev_cache of size 2792 [ 103.243739][ T176] The buggy address is located 40 bytes inside of [ 103.243739][ T176] freed 2792-byte region [ffff88803236b980, ffff88803236c468) [ 103.250584][ T176] [ 103.251813][ T176] The buggy address belongs to the physical page: [ 103.254833][ T176] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x32368 [ 103.258492][ T176] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 103.261888][ T176] memcg:ffff888040428e81 [ 103.264096][ T176] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 103.267875][ T176] page_type: f5(slab) [ 103.269692][ T176] raw: 04fff00000000040 ffff88801ca81140 dead000000000122 0000000000000000 [ 103.273370][ T176] raw: 0000000000000000 00000008000b000b 00000000f5000000 ffff888040428e81 [ 103.277133][ T176] head: 04fff00000000040 ffff88801ca81140 dead000000000122 0000000000000000 [ 103.281197][ T176] head: 0000000000000000 00000008000b000b 00000000f5000000 ffff888040428e81 [ 103.285332][ T176] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 103.289123][ T176] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 103.293031][ T176] page dumped because: kasan: bad access detected [ 103.296306][ T176] page_owner tracks the page as allocated [ 103.298901][ T176] page last allocated via order 3, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 19037798701, free_ts 0 [ 103.308472][ T176] post_alloc_hook+0x1f9/0x250 [ 103.310519][ T176] get_page_from_freelist+0x21fa/0x2270 [ 103.312912][ T176] __alloc_frozen_pages_noprof+0x18d/0x380 [ 103.315575][ T176] allocate_slab+0x79/0x5e0 [ 103.318020][ T176] refill_objects+0x2d5/0x350 [ 103.320745][ T176] __pcs_replace_empty_main+0x2bf/0x6b0 [ 103.323668][ T176] kmem_cache_alloc_lru_noprof+0x389/0x5f0 [ 103.326105][ T176] bdev_alloc_inode+0x29/0x90 [ 103.327881][ T176] alloc_inode+0x6a/0x1b0 [ 103.329651][ T176] new_inode+0x1f/0x170 [ 103.331281][ T176] bdev_alloc+0x24/0x370 [ 103.332983][ T176] __alloc_disk_node+0x11f/0x600 [ 103.335169][ T176] __blk_alloc_disk+0x105/0x1d0 [ 103.337756][ T176] pmem_attach_disk+0x4d9/0xe10 [ 103.340187][ T176] nvdimm_bus_probe+0x332/0x6c0 [ 103.342349][ T176] really_probe+0x254/0xae0 [ 103.344301][ T176] page_owner free stack trace missing [ 103.346659][ T176] [ 103.347734][ T176] Memory state around the buggy address: [ 103.350418][ T176] ffff88803236b880: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc [ 103.354551][ T176] ffff88803236b900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 103.357976][ T176] >ffff88803236b980: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 103.361208][ T176] ^ [ 103.363448][ T176] ffff88803236ba00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 103.367536][ T176] ffff88803236ba80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 103.371470][ T176] ================================================================== [ 103.375580][ T176] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 103.378490][ T176] CPU: 0 UID: 0 PID: 176 Comm: kworker/u4:6 Not tainted syzkaller #0 PREEMPT(full) [ 103.382508][ T176] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.387574][ T176] Workqueue: loop0 loop_rootcg_workfn [ 103.390132][ T176] Call Trace: [ 103.391624][ T176] [ 103.392948][ T176] vpanic+0x56c/0xa60 [ 103.394754][ T176] ? __pfx_vpanic+0x10/0x10 [ 103.396743][ T176] panic+0xc5/0xd0 [ 103.398534][ T176] ? __pfx_panic+0x10/0x10 [ 103.400787][ T176] ? update_io_ticks+0xa9/0x280 [ 103.403624][ T176] ? update_io_ticks+0xa9/0x280 [ 103.405917][ T176] check_panic_on_warn+0x89/0xb0 [ 103.408020][ T176] ? update_io_ticks+0xa9/0x280 [ 103.410101][ T176] end_report+0x73/0x170 [ 103.412036][ T176] ? update_io_ticks+0xa9/0x280 [ 103.414376][ T176] kasan_report+0x128/0x150 [ 103.416440][ T176] ? update_io_ticks+0xa9/0x280 [ 103.418777][ T176] update_io_ticks+0xa9/0x280 [ 103.421112][ T176] ? __pfx_update_io_ticks+0x10/0x10 [ 103.423698][ T176] ? blk_stat_add+0x74/0x4b0 [ 103.425749][ T176] blk_account_io_done+0x188/0x870 [ 103.427949][ T176] ? blk_stat_add+0x74/0x4b0 [ 103.430061][ T176] __blk_mq_end_request+0x2cf/0x6c0 [ 103.432562][ T176] ? blk_mq_end_request+0x47/0x70 [ 103.434897][ T176] lo_rw_aio+0xcd4/0xf20 [ 103.436606][ T176] ? __pfx_lo_rw_aio+0x10/0x10 [ 103.438649][ T176] ? do_raw_spin_lock+0x12b/0x2f0 [ 103.440873][ T176] ? kthread_associate_blkcg+0x359/0x600 [ 103.443791][ T176] ? _raw_spin_unlock_irq+0x23/0x50 [ 103.446643][ T176] loop_process_work+0x95e/0x11c0 [ 103.449629][ T176] ? __pfx_loop_process_work+0x10/0x10 [ 103.452507][ T176] ? look_up_lock_class+0x57/0x110 [ 103.454849][ T176] ? register_lock_class+0x31/0x2e0 [ 103.457220][ T176] ? __lock_acquire+0x683/0x2cf0 [ 103.459442][ T176] ? rcu_is_watching+0x15/0xb0 [ 103.461551][ T176] ? trace_hrtimer_start+0x82/0x200 [ 103.463969][ T176] ? do_raw_spin_lock+0x12b/0x2f0 [ 103.466414][ T176] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 103.468900][ T176] ? process_scheduled_works+0xa20/0x14e0 [ 103.471303][ T176] ? process_scheduled_works+0xa20/0x14e0 [ 103.473901][ T176] ? rcu_is_watching+0x15/0xb0 [ 103.476279][ T176] ? process_scheduled_works+0xa20/0x14e0 [ 103.479222][ T176] process_scheduled_works+0xa8e/0x14e0 [ 103.481710][ T176] ? __pfx_process_scheduled_works+0x10/0x10 [ 103.484252][ T176] ? assign_work+0x3cf/0x5d0 [ 103.486187][ T176] worker_thread+0xa47/0xfb0 [ 103.488211][ T176] ? __kthread_parkme+0x71/0x1f0 [ 103.490672][ T176] kthread+0x388/0x470 [ 103.492819][ T176] ? __pfx_worker_thread+0x10/0x10 [ 103.495394][ T176] ? __pfx_kthread+0x10/0x10 [ 103.497403][ T176] ret_from_fork+0x514/0xb70 [ 103.499425][ T176] ? __pfx_ret_from_fork+0x10/0x10 [ 103.501571][ T176] ? __switch_to+0xc89/0x1420 [ 103.503461][ T176] ? __pfx_kthread+0x10/0x10 [ 103.505505][ T176] ret_from_fork_asm+0x1a/0x30 [ 103.507781][ T176] [ 103.509964][ T176] Kernel Offset: disabled [ 103.512244][ T176] Rebooting in 86400 seconds..