live-kbench/live-kbench huggingface dataset:
Kernel bug: UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
Subsystem: bcachefs
Status: fixed

Crash report:
bcachefs (loop0): bucket 0:26 gen 0 data type btree sector count overflow: 0 + -256 > U32_MAX
  while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ac62141f8dc7e261 written 24 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0
  
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in fs/bcachefs/sb-downgrade.c:268:4
index 0 is out of range for type '__le16[] __counted_by(nr_errors)' (aka 'unsigned short[]')
CPU: 0 UID: 0 PID: 1037 Comm: kworker/u4:6 Not tainted 6.15.0-rc3-syzkaller-00076-ge72e9e693307 #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: btree_update btree_interior_update_work
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 ubsan_epilogue+0xa/0x40 lib/ubsan.c:231
 __ubsan_handle_out_of_bounds+0xe9/0xf0 lib/ubsan.c:453
 downgrade_table_extra fs/bcachefs/sb-downgrade.c:268 [inline]
 bch2_sb_downgrade_update+0xb10/0xcc0 fs/bcachefs/sb-downgrade.c:388
 bch2_write_super+0xbf4/0x2cc0 fs/bcachefs/super-io.c:1071
 btree_update_new_nodes_mark_sb fs/bcachefs/btree_update_interior.c:608 [inline]
 btree_update_nodes_written fs/bcachefs/btree_update_interior.c:678 [inline]
 btree_interior_update_work+0x441/0x25e0 fs/bcachefs/btree_update_interior.c:843
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
 kthread+0x70e/0x8a0 kernel/kthread.c:464
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
---[ end trace ]---
Kernel panic - not syncing: UBSAN: panic_on_warn set ...
CPU: 0 UID: 0 PID: 1037 Comm: kworker/u4:6 Not tainted 6.15.0-rc3-syzkaller-00076-ge72e9e693307 #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: btree_update btree_interior_update_work
Call Trace:
 <TASK>
 dump_stack_lvl+0x99/0x250 lib/dump_stack.c:120
 panic+0x2db/0x790 kernel/panic.c:354
 check_panic_on_warn+0x89/0xb0 kernel/panic.c:243
 __ubsan_handle_out_of_bounds+0xe9/0xf0 lib/ubsan.c:453
 downgrade_table_extra fs/bcachefs/sb-downgrade.c:268 [inline]
 bch2_sb_downgrade_update+0xb10/0xcc0 fs/bcachefs/sb-downgrade.c:388
 bch2_write_super+0xbf4/0x2cc0 fs/bcachefs/super-io.c:1071
 btree_update_new_nodes_mark_sb fs/bcachefs/btree_update_interior.c:608 [inline]
 btree_update_nodes_written fs/bcachefs/btree_update_interior.c:678 [inline]
 btree_interior_update_work+0x441/0x25e0 fs/bcachefs/btree_update_interior.c:843
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
 kthread+0x70e/0x8a0 kernel/kthread.c:464
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Kernel Offset: disabled
Rebooting in 86400 seconds..
Kernel bug: WARNING in shmem_unlink (2)
Subsystem: overlayfs
Status: fixed

Crash report:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 6236 at fs/inode.c:417 drop_nlink+0xc5/0x110 fs/inode.c:417
Modules linked in:
CPU: 0 UID: 0 PID: 6236 Comm: syz.0.107 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:drop_nlink+0xc5/0x110 fs/inode.c:417
Code: c0 08 00 00 be 08 00 00 00 e8 87 6b ec ff f0 48 ff 83 c0 08 00 00 5b 41 5c 41 5e 41 5f 5d e9 52 5c 90 08 cc e8 2c aa 8a ff 90 <0f> 0b 90 eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 5b ff ff ff
RSP: 0018:ffffc90003b0f288 EFLAGS: 00010293
RAX: ffffffff82340314 RBX: ffff888023b292e0 RCX: ffff8880397ada00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffff52000761e49 R12: 1ffff11004765265
R13: 000000006926eb25 R14: ffff888023b29328 R15: dffffc0000000000
FS:  00007f944571d6c0(0000) GS:ffff888126df6000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f944571cf98 CR3: 0000000028194000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 shmem_unlink+0x1f5/0x2d0 mm/shmem.c:3979
 shmem_rename2+0x22d/0x360 mm/shmem.c:4065
 vfs_rename+0xb34/0xe80 fs/namei.c:5216
 ovl_do_rename+0x13c/0x210 fs/overlayfs/overlayfs.h:373
 ovl_create_over_whiteout fs/overlayfs/dir.c:550 [inline]
 ovl_create_or_link+0xaf7/0x1410 fs/overlayfs/dir.c:656
 ovl_create_object+0x234/0x310 fs/overlayfs/dir.c:695
 lookup_open fs/namei.c:3796 [inline]
 open_last_lookups fs/namei.c:3895 [inline]
 path_openat+0x1500/0x3840 fs/namei.c:4131
 do_filp_open+0x1fa/0x410 fs/namei.c:4161
 do_sys_openat2+0x121/0x1c0 fs/open.c:1437
 do_sys_open fs/open.c:1452 [inline]
 __do_sys_openat fs/open.c:1468 [inline]
 __se_sys_openat fs/open.c:1463 [inline]
 __x64_sys_openat+0x138/0x170 fs/open.c:1463
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f94460cf749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f944571d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f9446326090 RCX: 00007f94460cf749
RDX: 0000000000105042 RSI: 0000200000000080 RDI: ffffffffffffff9c
RBP: 00007f9446153f91 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000000001ff R11: 0000000000000246 R12: 0000000000000000
R13: 00007f9446326128 R14: 00007f9446326090 R15: 00007fff80085c88
 </TASK>
Kernel bug: WARNING in ovl_copy_up_file (2)
Subsystem: squashfs
Status: fixed

Crash report:
loop0: detected capacity change from 0 to 8
------------[ cut here ]------------
WARNING: CPU: 0 PID: 6013 at fs/overlayfs/copy_up.c:276 ovl_copy_up_file+0x640/0x6a0 fs/overlayfs/copy_up.c:276
Modules linked in:
CPU: 0 UID: 0 PID: 6013 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:ovl_copy_up_file+0x640/0x6a0 fs/overlayfs/copy_up.c:276
Code: e9 2d ff ff ff e8 90 17 96 fe 49 bc 00 00 00 00 00 fc ff df e9 14 ff ff ff e8 7c 17 96 fe 90 0f 0b 90 eb 09 e8 71 17 96 fe 90 <0f> 0b 90 41 bd fb ff ff ff 48 8b 5c 24 10 e9 8d fb ff ff e8 c8 b9
RSP: 0018:ffffc90003c9f000 EFLAGS: 00010293
RAX: ffffffff832856cf RBX: ffffc90003c9f080 RCX: ffff888033d59dc0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90003c9f130 R08: 0000000000000000 R09: 0000000000000000
R10: ffffc90003c9f080 R11: fffff52000793e12 R12: dffffc0000000000
R13: fc0000000000000a R14: ffff88801def5200 R15: ffff888057ea06e0
FS:  0000555564874500(0000) GS:ffff8881268bc000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000001000 CR3: 0000000042464000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 ovl_copy_up_tmpfile fs/overlayfs/copy_up.c:885 [inline]
 ovl_do_copy_up fs/overlayfs/copy_up.c:999 [inline]
 ovl_copy_up_one fs/overlayfs/copy_up.c:1202 [inline]
 ovl_copy_up_flags+0x1502/0x2fe0 fs/overlayfs/copy_up.c:1257
 ovl_open+0x13e/0x2f0 fs/overlayfs/file.c:211
 do_dentry_open+0x9ae/0x1350 fs/open.c:965
 vfs_open+0x3b/0x350 fs/open.c:1095
 do_open fs/namei.c:3887 [inline]
 path_openat+0x2ef1/0x3840 fs/namei.c:4046
 do_filp_open+0x1fa/0x410 fs/namei.c:4073
 do_sys_openat2+0x121/0x1c0 fs/open.c:1435
 do_sys_open fs/open.c:1450 [inline]
 __do_sys_openat fs/open.c:1466 [inline]
 __se_sys_openat fs/open.c:1461 [inline]
 __x64_sys_openat+0x138/0x170 fs/open.c:1461
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f570719eec9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffec29d4348 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f57073f5fa0 RCX: 00007f570719eec9
RDX: 0000000000000042 RSI: 0000200000000040 RDI: ffffffffffffff9c
RBP: 00007f5707221f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f57073f5fa0 R14: 00007f57073f5fa0 R15: 0000000000000004
 </TASK>
Kernel bug: WARNING in __io_submit_flush_completions
Subsystem: io-uring
Status: fixed

Crash report:
------------[ cut here ]------------
WARNING: CPU: 1 PID: 5856 at io_uring/io_uring.h:140 io_lockdep_assert_cq_locked+0x1e9/0x320 io_uring/io_uring.h:140
Modules linked in:
CPU: 1 UID: 0 PID: 5856 Comm: syz-executor609 Not tainted 6.13.0-rc3-syzkaller-00136-g8faabc041a00 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024
RIP: 0010:io_lockdep_assert_cq_locked+0x1e9/0x320 io_uring/io_uring.h:140
Code: 44 89 e6 e8 a9 a7 0c fd 45 85 e4 0f 84 13 ff ff ff e8 5b a5 0c fd e8 f6 4f d5 fc 48 85 c0 0f 85 00 ff ff ff e8 48 a5 0c fd 90 <0f> 0b 90 e9 f2 fe ff ff e8 3a a5 0c fd 31 ff 89 ee e8 71 a7 0c fd
RSP: 0018:ffffc90003e87a40 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000002 RCX: ffffffff8161f9fa
RDX: ffff88803063bc00 RSI: ffffffff848ca9a8 RDI: 0000000000000005
RBP: ffff88803063bc00 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
R13: 0000000000000000 R14: ffff888030322138 R15: ffff88807468a078
FS:  0000555592081380(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f82824c70f0 CR3: 000000007c31c000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 io_get_cqe_overflow io_uring/io_uring.h:166 [inline]
 io_get_cqe io_uring/io_uring.h:182 [inline]
 io_fill_cqe_req io_uring/io_uring.h:195 [inline]
 __io_submit_flush_completions+0x131/0x1fd0 io_uring/io_uring.c:1443
 io_submit_flush_completions io_uring/io_uring.h:156 [inline]
 __io_run_local_work+0x13d/0x560 io_uring/io_uring.c:1325
 io_run_local_work io_uring/io_uring.c:1351 [inline]
 io_uring_try_cancel_requests+0x89a/0xd50 io_uring/io_uring.c:3105
 io_uring_cancel_generic+0x651/0x8e0 io_uring/io_uring.c:3166
 io_uring_files_cancel include/linux/io_uring.h:20 [inline]
 do_exit+0x541/0x2d70 kernel/exit.c:894
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1087
 __do_sys_exit_group kernel/exit.c:1098 [inline]
 __se_sys_exit_group kernel/exit.c:1096 [inline]
 __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1096
 x64_sys_call+0x151f/0x1720 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f828244b249
Code: 90 49 c7 c0 b8 ff ff ff be e7 00 00 00 ba 3c 00 00 00 eb 12 0f 1f 44 00 00 89 d0 0f 05 48 3d 00 f0 ff ff 77 1c f4 89 f0 0f 05 <48> 3d 00 f0 ff ff 76 e7 f7 d8 64 41 89 00 eb df 0f 1f 80 00 00 00
RSP: 002b:00007ffcfb7d1bc8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f828244b249
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
RBP: 00007f82824c6290 R08: ffffffffffffffb8 R09: ffffffffffffffff
R10: 0000000000000007 R11: 0000000000000246 R12: 00007f82824c6290
R13: 0000000000000000 R14: 00007f82824c6ce0 R15: 00007f828241c4b0
 </TASK>
Kernel bug: possible deadlock in chaoskey_release
Subsystem: usb
Status: fixed

Crash report:
raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
============================================
WARNING: possible recursive locking detected
6.12.0-rc1-syzkaller-00027-g4a9fe2a8ac53 #0 Not tainted
--------------------------------------------
syz-executor363/2651 is trying to acquire lock:
ffffffff89b120e8 (chaoskey_list_lock){+.+.}-{3:3}, at: chaoskey_release+0x15d/0x2c0 drivers/usb/misc/chaoskey.c:322

but task is already holding lock:
ffffffff89b120e8 (chaoskey_list_lock){+.+.}-{3:3}, at: chaoskey_release+0x7f/0x2c0 drivers/usb/misc/chaoskey.c:299

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(chaoskey_list_lock);
  lock(chaoskey_list_lock);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

1 lock held by syz-executor363/2651:
 #0: ffffffff89b120e8 (chaoskey_list_lock){+.+.}-{3:3}, at: chaoskey_release+0x7f/0x2c0 drivers/usb/misc/chaoskey.c:299

stack backtrace:
CPU: 0 UID: 0 PID: 2651 Comm: syz-executor363 Not tainted 6.12.0-rc1-syzkaller-00027-g4a9fe2a8ac53 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_deadlock_bug+0x2e3/0x410 kernel/locking/lockdep.c:3037
 check_deadlock kernel/locking/lockdep.c:3089 [inline]
 validate_chain kernel/locking/lockdep.c:3891 [inline]
 __lock_acquire+0x2185/0x3ce0 kernel/locking/lockdep.c:5202
 lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825
 __mutex_lock_common kernel/locking/mutex.c:608 [inline]
 __mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
 chaoskey_release+0x15d/0x2c0 drivers/usb/misc/chaoskey.c:322
 __fput+0x3f6/0xb60 fs/file_table.c:431
 task_work_run+0x14e/0x250 kernel/task_work.c:228
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0xadd/0x2ce0 kernel/exit.c:939
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1088
 __do_sys_exit_group kernel/exit.c:1099 [inline]
 __se_sys_exit_group kernel/exit.c:1097 [inline]
 __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1097
 x64_sys_call+0x14a9/0x16a0 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd87e4bb409
Code: Unable to access opcode bytes at 0x7fd87e4bb3df.
RSP: 002b:00007ffcb70ccdd8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fd87e4bb409
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
RBP: 00007fd87e536370 R08: ffffffffffffffb8 R09: 00007ffcb70ccb47
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd87e536370
R13: 0000000000000000 R14: 00007fd87e53a080 R15: 00007fd87e489670
 </TASK>
Kernel bug: KASAN: use-after-free Write in __crypto_shash_import
Subsystem: crypto
Status: fixed

Crash report:
==================================================================
BUG: KASAN: use-after-free in __crypto_shash_import+0x26a/0x2a0 crypto/shash.c:263
Write of size 1 at addr ffff88817c920b47 by task syz-executor264/5855

CPU: 0 UID: 0 PID: 5855 Comm: syz-executor264 Not tainted 6.15.0-rc7-next-20250523-syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xd2/0x2b0 mm/kasan/report.c:521
 kasan_report+0x118/0x150 mm/kasan/report.c:634
 __crypto_shash_import+0x26a/0x2a0 crypto/shash.c:263
 crypto_shash_import+0x84/0x230 crypto/shash.c:286
 hash_accept+0x1fb/0x280 crypto/algif_hash.c:267
 do_accept+0x48f/0x680 net/socket.c:1924
 __sys_accept4_file net/socket.c:1964 [inline]
 __sys_accept4+0x11c/0x1c0 net/socket.c:1993
 __do_sys_accept net/socket.c:2006 [inline]
 __se_sys_accept net/socket.c:2003 [inline]
 __x64_sys_accept+0x7d/0x90 net/socket.c:2003
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f685ecf6d59
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe73b98688 EFLAGS: 00000246 ORIG_RAX: 000000000000002b
RAX: ffffffffffffffda RBX: 00000000000158a5 RCX: 00007f685ecf6d59
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 0000000000000000 R08: 00007ffe73b986bc R09: 00007ffe73b986bc
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe73b986bc
R13: 00007ffe73b986f0 R14: 00007ffe73b986d0 R15: 0000000000000002
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x17c920
flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff)
raw: 057ff00000000000 ffffea0005f24808 ffffea0005f24808 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)

Memory state around the buggy address:
 ffff88817c920a00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88817c920a80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88817c920b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                           ^
 ffff88817c920b80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88817c920c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
Kernel bug: WARNING in __rt_mutex_slowlock_locked (2)
Subsystem: exfat
Status: fixed

Crash report:
loop0: detected capacity change from 0 to 256
exFAT-fs (loop0): start_clu is invalid cluster(0x400)
------------[ cut here ]------------
rtmutex deadlock detected
WARNING: CPU: 0 PID: 6091 at kernel/locking/rtmutex.c:1674 rt_mutex_handle_deadlock kernel/locking/rtmutex.c:1674 [inline]
WARNING: CPU: 0 PID: 6091 at kernel/locking/rtmutex.c:1674 __rt_mutex_slowlock kernel/locking/rtmutex.c:1734 [inline]
WARNING: CPU: 0 PID: 6091 at kernel/locking/rtmutex.c:1674 __rt_mutex_slowlock_locked+0xed2/0x25e0 kernel/locking/rtmutex.c:1760
Modules linked in:
CPU: 0 UID: 0 PID: 6091 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:rt_mutex_handle_deadlock kernel/locking/rtmutex.c:1674 [inline]
RIP: 0010:__rt_mutex_slowlock kernel/locking/rtmutex.c:1734 [inline]
RIP: 0010:__rt_mutex_slowlock_locked+0xed2/0x25e0 kernel/locking/rtmutex.c:1760
Code: 7c 24 20 dd 4c 8b b4 24 98 00 00 00 0f 85 fd 0a 00 00 48 8b 7c 24 10 e8 4c 50 28 09 90 48 c7 c7 60 fd ea 8a e8 ef 62 e7 ff 90 <0f> 0b 90 90 48 8b 9c 24 80 00 00 00 43 80 3c 3e 00 74 08 4c 89 e7
RSP: 0018:ffffc90004167a20 EFLAGS: 00010246
RAX: fb67d2718db70200 RBX: ffff88802c80e4e0 RCX: ffff88802c80da00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90004167c10 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed101710487b R12: ffff88802c80f160
R13: ffff88802c80da18 R14: 1ffff11005901e2c R15: dffffc0000000000
FS:  0000555579130500(0000) GS:ffff888126df9000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f44add04000 CR3: 00000000271c0000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 rt_mutex_slowlock+0xb5/0x160 kernel/locking/rtmutex.c:1800
 __rt_mutex_lock kernel/locking/rtmutex.c:1815 [inline]
 rwbase_write_lock+0x14f/0x750 kernel/locking/rwbase_rt.c:244
 inode_lock include/linux/fs.h:980 [inline]
 vfs_rmdir+0xf7/0x520 fs/namei.c:4537
 do_rmdir+0x25f/0x550 fs/namei.c:4603
 __do_sys_unlinkat fs/namei.c:4777 [inline]
 __se_sys_unlinkat fs/namei.c:4771 [inline]
 __x64_sys_unlinkat+0xc2/0xf0 fs/namei.c:4771
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f98f26cf6c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdb6806d58 EFLAGS: 00000246 ORIG_RAX: 0000000000000107
RAX: ffffffffffffffda RBX: 00007f98f2925fa0 RCX: 00007f98f26cf6c9
RDX: 0000000000000200 RSI: 0000200000000040 RDI: 0000000000000006
RBP: 00007f98f2751f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f98f2925fa0 R14: 00007f98f2925fa0 R15: 0000000000000003
 </TASK>
Kernel bug: WARNING in bch2_fs_journal_stop
Subsystem: bcachefs
Status: fixed

Crash report:
bcachefs (loop0): flushing journal and stopping allocators, journal seq 10
bcachefs (loop0): flushing journal and stopping allocators complete, journal seq 10
------------[ cut here ]------------
journal shutdown error: cur seq 10 but last empty seq 11
WARNING: CPU: 0 PID: 5098 at fs/bcachefs/journal.c:1190 bch2_fs_journal_stop+0x5f3/0x630 fs/bcachefs/journal.c:1186
Modules linked in:
CPU: 0 UID: 0 PID: 5098 Comm: syz-executor239 Not tainted 6.11.0-rc3-syzkaller-00066-g1fb918967b56 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:bch2_fs_journal_stop+0x5f3/0x630 fs/bcachefs/journal.c:1186
Code: 44 24 18 42 80 3c 20 00 48 8b 5c 24 20 74 08 48 89 df e8 b0 78 c5 fd 48 8b 13 48 c7 c7 00 7c 53 8c 4c 89 f6 e8 1e 5c 20 fd 90 <0f> 0b 90 90 e9 e4 fe ff ff 44 89 f1 80 e1 07 38 c1 0f 8c 7f fc ff
RSP: 0018:ffffc9000aff78a0 EFLAGS: 00010246
RAX: 44419301ce265f00 RBX: ffff88803b2ca9e0 RCX: ffff88801a0b2440
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc9000aff79e0 R08: ffffffff8155b4d2 R09: fffffbfff1cfa0e0
R10: dffffc0000000000 R11: fffffbfff1cfa0e0 R12: dffffc0000000000
R13: ffff88803b2ca380 R14: 000000000000000a R15: 1ffff11007659470
FS:  0000555581a9b380(0000) GS:ffff888020800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000564d3e8c4650 CR3: 0000000037c40000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __bch2_fs_read_only+0x311/0x430 fs/bcachefs/super.c:289
 bch2_fs_read_only+0xb57/0x1220 fs/bcachefs/super.c:354
 __bch2_fs_stop+0x105/0x540 fs/bcachefs/super.c:618
 generic_shutdown_super+0x136/0x2d0 fs/super.c:642
 bch2_kill_sb+0x41/0x50 fs/bcachefs/fs.c:2054
 deactivate_locked_super+0xc4/0x130 fs/super.c:473
 cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1373
 task_work_run+0x24f/0x310 kernel/task_work.c:228
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218
 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f157ee7e307
Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffe829319e8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f157ee7e307
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe82931aa0
RBP: 00007ffe82931aa0 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000206 R12: 00007ffe82932b00
R13: 0000555581a9c6c0 R14: 0000000000000001 R15: 431bde82d7b634db
 </TASK>