live-kbench/live-kbench huggingface dataset:
Kernel bug: WARNING in kvm_read_guest_offset_cached
Subsystem: kvm
Status: open

Crash report:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 6107 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:3459 kvm_read_guest_offset_cached+0x3f5/0x4b0 virt/kvm/kvm_main.c:3459
Modules linked in:
CPU: 0 UID: 0 PID: 6107 Comm: syz.0.16 Not tainted 6.16.0-rc6-syzkaller-00002-g155a3c003e55 #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:kvm_read_guest_offset_cached+0x3f5/0x4b0 virt/kvm/kvm_main.c:3459
Code: 0f 01 e8 3e 6c 61 00 e9 9b fc ff ff e8 14 25 85 00 48 8b 3c 24 31 d2 48 89 ee e8 16 bf fa 00 e9 2e fe ff ff e8 fc 24 85 00 90 <0f> 0b 90 bb ea ff ff ff e9 4d fe ff ff e8 e9 24 85 00 48 8b 74 24
RSP: 0018:ffffc9000349f960 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff888050329898 RCX: ffffffff8136ca66
RDX: ffff88803cfa8000 RSI: ffffffff8136cd84 RDI: 0000000000000006
RBP: 0000000000000004 R08: 0000000000000006 R09: 0000000000000008
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000004
R13: ffffc90003921000 R14: 0000000000000000 R15: ffffc900039215a0
FS:  000055558378f500(0000) GS:ffff8880d6713000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000025de6000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 apf_pageready_slot_free arch/x86/kvm/x86.c:13452 [inline]
 kvm_arch_can_dequeue_async_page_present+0x172/0x310 arch/x86/kvm/x86.c:13571
 kvm_check_async_pf_completion+0x61/0x440 virt/kvm/async_pf.c:158
 vcpu_enter_guest arch/x86/kvm/x86.c:10930 [inline]
 vcpu_run+0x48c2/0x5500 arch/x86/kvm/x86.c:11335
 kvm_arch_vcpu_ioctl_run+0x51e/0x18c0 arch/x86/kvm/x86.c:11658
 kvm_vcpu_ioctl+0x5eb/0x1690 virt/kvm/kvm_main.c:4464
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl fs/ioctl.c:893 [inline]
 __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fdb7658e929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd25fe7d98 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fdb767b5fa0 RCX: 00007fdb7658e929
RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
RBP: 00007fdb76610b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fdb767b5fa0 R14: 00007fdb767b5fa0 R15: 0000000000000003
 </TASK>
Kernel bug: WARNING in ext4_iomap_begin (3)
Subsystem: ext4
Status: open

Crash report:
------------[ cut here ]------------
WARNING: fs/ext4/inode.c:3794 at ext4_iomap_begin+0x1ea/0xf80 fs/ext4/inode.c:3794, CPU#1: syz.5.665/9574
Modules linked in:
CPU: 1 UID: 0 PID: 9574 Comm: syz.5.665 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:ext4_iomap_begin+0x1ea/0xf80 fs/ext4/inode.c:3794
Code: c0 01 38 d0 7c 08 84 d2 0f 85 0e 0d 00 00 41 0f b7 9e 6a 05 00 00 31 ff 89 de e8 c1 56 3d ff 66 85 db 74 63 e8 47 5c 3d ff 90 <0f> 0b 90 41 bf de ff ff ff e8 38 5c 3d ff 48 8b 4c 24 60 48 b8 00
RSP: 0018:ffffc900046cf2e0 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 00000000000000a4 RCX: ffffffff8281770f
RDX: ffff88802acb8000 RSI: ffffffff82817719 RDI: 0000000000000003
RBP: ffffffff82817530 R08: 0000000000000003 R09: 0000000000000000
R10: 00000000000000a4 R11: ffff88802acb8b30 R12: 0000000000000000
R13: 0000000000000000 R14: ffff8880650462d8 R15: ffffffff8ba77840
FS:  00007f262a61f6c0(0000) GS:ffff8881249fd000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000300 CR3: 0000000055544000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 iomap_iter+0x5f5/0xfa0 fs/iomap/iter.c:110
 __iomap_dio_rw+0x7da/0x1df0 fs/iomap/direct-io.c:752
 iomap_dio_rw+0x40/0xa0 fs/iomap/direct-io.c:847
 ext4_dio_write_iter fs/ext4/file.c:580 [inline]
 ext4_file_write_iter+0x1682/0x1d00 fs/ext4/file.c:721
 iter_file_splice_write+0xa24/0x12b0 fs/splice.c:738
 do_splice_from fs/splice.c:938 [inline]
 direct_splice_actor+0x192/0x6c0 fs/splice.c:1161
 splice_direct_to_actor+0x345/0xa30 fs/splice.c:1105
 do_splice_direct_actor fs/splice.c:1204 [inline]
 do_splice_direct+0x174/0x240 fs/splice.c:1230
 do_sendfile+0xb06/0xe50 fs/read_write.c:1370
 __do_sys_sendfile64 fs/read_write.c:1431 [inline]
 __se_sys_sendfile64 fs/read_write.c:1417 [inline]
 __x64_sys_sendfile64+0x1d8/0x220 fs/read_write.c:1417
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f262978f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f262a61f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f26299e6090 RCX: 00007f262978f749
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000006
RBP: 00007f2629813f91 R08: 0000000000000000 R09: 0000000000000000
R10: 080000000000001f R11: 0000000000000246 R12: 0000000000000000
R13: 00007f26299e6128 R14: 00007f26299e6090 R15: 00007ffcdc80e1a8
 </TASK>
Kernel bug: possible deadlock in bpf_lru_push_free (2)
Subsystem: bpf
Status: open

Crash report:
============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
syz-executor149/10558 is trying to acquire lock:
ffffe8ffffc41588 (&loc_l->lock){....}-{2:2}, at: bpf_common_lru_push_free kernel/bpf/bpf_lru_list.c:514 [inline]
ffffe8ffffc41588 (&loc_l->lock){....}-{2:2}, at: bpf_lru_push_free+0x33b/0xbb0 kernel/bpf/bpf_lru_list.c:553

but task is already holding lock:
ffffe8ffffc41588 (&loc_l->lock){....}-{2:2}, at: bpf_common_lru_pop_free kernel/bpf/bpf_lru_list.c:440 [inline]
ffffe8ffffc41588 (&loc_l->lock){....}-{2:2}, at: bpf_lru_pop_free+0x1ab/0x19b0 kernel/bpf/bpf_lru_list.c:496

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&loc_l->lock);
  lock(&loc_l->lock);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

3 locks held by syz-executor149/10558:
 #0: ffffffff8df3d620 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #0: ffffffff8df3d620 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
 #0: ffffffff8df3d620 (rcu_read_lock){....}-{1:3}, at: bpf_percpu_hash_update+0x2b/0x200 kernel/bpf/hashtab.c:2409
 #1: ffffe8ffffc41588 (&loc_l->lock){....}-{2:2}, at: bpf_common_lru_pop_free kernel/bpf/bpf_lru_list.c:440 [inline]
 #1: ffffe8ffffc41588 (&loc_l->lock){....}-{2:2}, at: bpf_lru_pop_free+0x1ab/0x19b0 kernel/bpf/bpf_lru_list.c:496
 #2: ffffffff8df3d620 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #2: ffffffff8df3d620 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
 #2: ffffffff8df3d620 (rcu_read_lock){....}-{1:3}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2074 [inline]
 #2: ffffffff8df3d620 (rcu_read_lock){....}-{1:3}, at: bpf_trace_run2+0x186/0x4b0 kernel/trace/bpf_trace.c:2116

stack backtrace:
Kernel bug: kernel BUG in _ocfs2_free_suballoc_bits
Subsystem: ocfs2
Status: open

Crash report:
------------[ cut here ]------------
kernel BUG at fs/ocfs2/suballoc.c:2543!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 0 UID: 0 PID: 954 Comm: kworker/u8:5 Not tainted 6.12.0-rc2-syzkaller-00305-g7234e2ea0edd #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: ocfs2_wq ocfs2_truncate_log_worker
RIP: 0010:_ocfs2_free_suballoc_bits+0x11aa/0x14a0 fs/ocfs2/suballoc.c:2543
Code: e1 80 e1 07 80 c1 03 38 c1 0f 8c 92 fb ff ff 4c 89 e7 e8 19 4a 68 fe e9 85 fb ff ff e8 3f bc 01 fe 90 0f 0b e8 37 bc 01 fe 90 <0f> 0b f3 0f 1e fa 65 8b 1d b5 ac 70 7c bf 07 00 00 00 89 de e8 5d
RSP: 0018:ffffc90003a9f640 EFLAGS: 00010293
RAX: ffffffff83932ac9 RBX: 0000000000000e00 RCX: ffff888025d78000
RDX: 0000000000000000 RSI: 0000000000000e00 RDI: 00000000000083ef
RBP: ffffc90003a9f7e8 R08: ffffffff83931a8c R09: 0000000000007fcf
R10: dffffc0000000000 R11: fffffbfff20378de R12: 00000000000083ef
R13: dffffc0000000000 R14: ffff8880bffb6e00 R15: 0000000000000e00
FS:  0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055555941c788 CR3: 0000000031f8e000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 _ocfs2_free_clusters+0x5ff/0xad0 fs/ocfs2/suballoc.c:2646
 ocfs2_replay_truncate_records fs/ocfs2/alloc.c:5971 [inline]
 __ocfs2_flush_truncate_log+0x760/0x1250 fs/ocfs2/alloc.c:6054
 ocfs2_flush_truncate_log fs/ocfs2/alloc.c:6076 [inline]
 ocfs2_truncate_log_worker+0xa2/0x1b0 fs/ocfs2/alloc.c:6089
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
 worker_thread+0x870/0xd30 kernel/workqueue.c:3391
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:_ocfs2_free_suballoc_bits+0x11aa/0x14a0 fs/ocfs2/suballoc.c:2543
Code: e1 80 e1 07 80 c1 03 38 c1 0f 8c 92 fb ff ff 4c 89 e7 e8 19 4a 68 fe e9 85 fb ff ff e8 3f bc 01 fe 90 0f 0b e8 37 bc 01 fe 90 <0f> 0b f3 0f 1e fa 65 8b 1d b5 ac 70 7c bf 07 00 00 00 89 de e8 5d
RSP: 0018:ffffc90003a9f640 EFLAGS: 00010293
RAX: ffffffff83932ac9 RBX: 0000000000000e00 RCX: ffff888025d78000
RDX: 0000000000000000 RSI: 0000000000000e00 RDI: 00000000000083ef
RBP: ffffc90003a9f7e8 R08: ffffffff83931a8c R09: 0000000000007fcf
R10: dffffc0000000000 R11: fffffbfff20378de R12: 00000000000083ef
R13: dffffc0000000000 R14: ffff8880bffb6e00 R15: 0000000000000e00
FS:  0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055ed82464078 CR3: 0000000031664000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Kernel bug: WARNING in nfc_rfkill_set_block
Subsystem: net, nfc
Status: open

Crash report:
Bluetooth: hci0: Opcode 0x0c1a failed: -110
Bluetooth: hci0: Error when powering off device on rfkill (-110)
------------[ cut here ]------------
rtmutex deadlock detected
WARNING: CPU: 0 PID: 6084 at kernel/locking/rtmutex.c:1674 rt_mutex_handle_deadlock+0x28/0xb0 kernel/locking/rtmutex.c:1674
Modules linked in:
CPU: 0 UID: 0 PID: 6084 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:rt_mutex_handle_deadlock+0x28/0xb0 kernel/locking/rtmutex.c:1674
Code: 90 90 41 57 41 56 41 55 41 54 53 83 ff dd 0f 85 8c 00 00 00 48 89 f7 e8 c6 2c 01 00 90 48 c7 c7 80 08 0b 8b e8 79 78 8a f6 90 <0f> 0b 90 90 4c 8d 3d 00 00 00 00 65 48 8b 1c 25 08 e0 f5 91 4c 8d
RSP: 0018:ffffc90003a8f950 EFLAGS: 00010246
RAX: 4a17b3cdcfcd8c00 RBX: ffffc90003a8f9e0 RCX: ffff888034b23b80
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90003a8fb00 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed1017104863 R12: 1ffff92000751f38
R13: ffffffff8af8b119 R14: ffff88802b77f098 R15: dffffc0000000000
FS:  00007f918c68e6c0(0000) GS:ffff8881268c2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000558db6b05168 CR3: 0000000040f42000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __rt_mutex_slowlock kernel/locking/rtmutex.c:1734 [inline]
 __rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1760 [inline]
 rt_mutex_slowlock+0x692/0x6e0 kernel/locking/rtmutex.c:1800
 __rt_mutex_lock kernel/locking/rtmutex.c:1815 [inline]
 __mutex_lock_common kernel/locking/rtmutex_api.c:536 [inline]
 mutex_lock_nested+0x16a/0x1d0 kernel/locking/rtmutex_api.c:547
 device_lock include/linux/device.h:911 [inline]
 nfc_dev_down net/nfc/core.c:143 [inline]
 nfc_rfkill_set_block+0x50/0x2e0 net/nfc/core.c:179
 rfkill_set_block+0x1e5/0x450 net/rfkill/core.c:346
 rfkill_fop_write+0x44e/0x580 net/rfkill/core.c:1301
 vfs_write+0x284/0xb40 fs/read_write.c:684
 ksys_write+0x14b/0x260 fs/read_write.c:738
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f918d01ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f918c68e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f918d255fa0 RCX: 00007f918d01ebe9
RDX: 0000000000000008 RSI: 0000200000000080 RDI: 0000000000000004
RBP: 00007f918d0a1e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f918d256038 R14: 00007f918d255fa0 R15: 00007ffcb32fa318
 </TASK>
Kernel bug: WARNING in dib0700_ctrl_rd/usb_submit_urb
Subsystem: usb
Status: open

Crash report:
------------[ cut here ]------------
usb 1-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0
WARNING: CPU: 1 PID: 6090 at drivers/usb/core/urb.c:411 usb_submit_urb+0x13a7/0x1770 drivers/usb/core/urb.c:411
Modules linked in:
CPU: 1 UID: 0 PID: 6090 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:usb_submit_urb+0x13a7/0x1770 drivers/usb/core/urb.c:411
Code: e8 ce fe 79 fa 48 8b 7c 24 40 e8 f4 5c d4 fe 48 8b 54 24 30 45 89 e8 44 89 f9 48 89 c6 48 c7 c7 40 10 74 8c e8 da a1 38 fa 90 <0f> 0b 90 90 e9 a0 ef ff ff e8 9b fe 79 fa 0f b6 2d e1 36 52 09 31
RSP: 0018:ffffc900034b7978 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff88802ac12100 RCX: ffffffff817a4388
RDX: ffff888025208000 RSI: ffffffff817a4395 RDI: 0000000000000001
RBP: ffff88805a03a058 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: ffff8880322342a0
R13: 00000000000000c0 R14: 0000000000000001 R15: 0000000080000280
FS:  00005555846e5500(0000) GS:ffff8881247b2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f30439ede9c CR3: 000000005af33000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 usb_start_wait_urb+0x104/0x4b0 drivers/usb/core/message.c:59
 usb_internal_control_msg drivers/usb/core/message.c:103 [inline]
 usb_control_msg+0x326/0x4a0 drivers/usb/core/message.c:154
 dib0700_ctrl_rd+0x1b2/0x350 drivers/media/usb/dvb-usb/dib0700_core.c:95
 dib0700_i2c_xfer_legacy drivers/media/usb/dvb-usb/dib0700_core.c:315 [inline]
 dib0700_i2c_xfer+0xa9a/0xe40 drivers/media/usb/dvb-usb/dib0700_core.c:361
 __i2c_transfer+0x6b6/0x2190 drivers/i2c/i2c-core-base.c:2264
 i2c_transfer drivers/i2c/i2c-core-base.c:2320 [inline]
 i2c_transfer+0x1da/0x380 drivers/i2c/i2c-core-base.c:2296
 i2cdev_ioctl_rdwr+0x373/0x710 drivers/i2c/i2c-dev.c:306
 i2cdev_ioctl+0x5ff/0x820 drivers/i2c/i2c-dev.c:467
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:598 [inline]
 __se_sys_ioctl fs/ioctl.c:584 [inline]
 __x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:584
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4e0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1d2d58eec9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe9661a738 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f1d2d7e5fa0 RCX: 00007f1d2d58eec9
RDX: 0000200000000300 RSI: 0000000000000707 RDI: 0000000000000004
RBP: 00007f1d2d611f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f1d2d7e5fa0 R14: 00007f1d2d7e5fa0 R15: 0000000000000003
 </TASK>
Kernel bug: WARNING in __folio_mark_dirty (3)
Subsystem: ext4
Status: fixed

Crash report:
EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 117
EXT4-fs (loop2): This should not happen!! Data will be lost
------------[ cut here ]------------
WARNING: mm/page-writeback.c:2710 at __folio_mark_dirty+0x1fb/0xe00 mm/page-writeback.c:2710, CPU#0: syz.2.669/7619
Modules linked in:
CPU: 0 UID: 0 PID: 7619 Comm: syz.2.669 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:__folio_mark_dirty+0x1fb/0xe00 mm/page-writeback.c:2710
Code: 3c 38 00 74 08 48 89 df e8 c2 d2 26 00 4c 8b 33 4c 89 f6 48 83 e6 08 31 ff e8 21 67 c4 ff 49 83 e6 08 75 1c e8 b6 61 c4 ff 90 <0f> 0b 90 eb 16 e8 ab 61 c4 ff e9 6e 07 00 00 e8 a1 61 c4 ff eb 05
RSP: 0000:ffffc9000ca3fa10 EFLAGS: 00010293
RAX: ffffffff81fc022a RBX: ffffea000144fdc0 RCX: ffff88802da48000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffff94000289fb9 R12: ffff888040ff8590
R13: ffff888040ff8588 R14: 0000000000000000 R15: dffffc0000000000
FS:  00005555902de500(0000) GS:ffff888126d01000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000100 CR3: 00000000378f6000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 block_dirty_folio+0x17a/0x1d0 fs/buffer.c:754
 fault_dirty_shared_page+0x103/0x550 mm/memory.c:3558
 wp_page_shared mm/memory.c:3945 [inline]
 do_wp_page+0x265e/0x4970 mm/memory.c:4148
 handle_pte_fault mm/memory.c:6289 [inline]
 __handle_mm_fault mm/memory.c:6411 [inline]
 handle_mm_fault+0x9f6/0x1330 mm/memory.c:6580
 do_user_addr_fault+0xa7c/0x1380 arch/x86/mm/fault.c:1336
 handle_page_fault arch/x86/mm/fault.c:1476 [inline]
 exc_page_fault+0x82/0x100 arch/x86/mm/fault.c:1532
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0033:0x7f07eafd7398
Code: fc 89 37 c3 c5 fa 6f 06 c5 fa 6f 4c 16 f0 c5 fa 7f 07 c5 fa 7f 4c 17 f0 c3 66 0f 1f 84 00 00 00 00 00 48 8b 4c 16 f8 48 8b 36 <48> 89 37 48 89 4c 17 f8 c3 c5 fe 6f 54 16 e0 c5 fe 6f 5c 16 c0 c5
RSP: 002b:00007fff6c67b9b8 EFLAGS: 00010202
RAX: 0000200000000100 RBX: 0000000000000004 RCX: 00657375632f7665
RDX: 000000000000000a RSI: 7375632f7665642f RDI: 0000200000000100
RBP: 0000000000000000 R08: 0000001b2eb20000 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000009 R12: 00007f07eb265fac
R13: 00007f07eb265fa0 R14: fffffffffffffffe R15: 0000000000000003
 </TASK>
Kernel bug: INFO: task hung in get_signal (2)
Subsystem: bluetooth
Status: open

Crash report:
INFO: task syz-executor:5969 blocked for more than 143 seconds.
      Not tainted syzkaller #0
task:syz-executor    state:D
Call Trace:
 do_wait_for_common kernel/sched/completion.c:100 [inline]
 __wait_for_common kernel/sched/completion.c:121 [inline]
 wait_for_common kernel/sched/completion.c:132 [inline]
 wait_for_completion+0x2bf/0x5d0 kernel/sched/completion.c:153
 __flush_work+0x9b9/0xbc0 kernel/workqueue.c:4281
 get_signal+0x1285/0x1340 kernel/signal.c:3034
 arch_do_signal_or_restart+0x9a/0x7a0 arch/x86/kernel/signal.c:337
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fac0ed9148a
 #2: ffff88807c668ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d3/0x400 net/bluetooth/hci_sync.c:331
3 locks held by kworker/u9:3/5978:
 #0: ffff888057c3e948 ((wq_completion)hci6){+.+.}-{0:0}, at: process_one_work+0x841/0x15a0 kernel/workqueue.c:3236
 #1: ffffc9000412fb80 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x868/0x15a0 kernel/workqueue.c:3237
 #2: ffff88807ef20ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d3/0x400 net/bluetooth/hci_sync.c:331
3 locks held by kworker/u9:4/5979:
 #0: ffff88801e7c2148 ((wq_completion)hci4){+.+.}-{0:0}, at: process_one_work+0x841/0x15a0 kernel/workqueue.c:3236
 #1: ffffc900040afb80 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x868/0x15a0 kernel/workqueue.c:3237
 #2: ffff888054900ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d3/0x400 net/bluetooth/hci_sync.c:331
3 locks held by kworker/u9:5/6113:
 #0: ffff8880296d3148 ((wq_completion)hci2){+.+.}-{0:0}, at: process_one_work+0x841/0x15a0 kernel/workqueue.c:3236
 #1: ffffc90002f17b80 (
(work_completion)(&hdev->cmd_sync_work)
){+.+.}-{0:0}
3 locks held by kworker/u9:9/11288:
 #1: ffffc9000411fb80 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x868/0x15a0 kernel/workqueue.c:3237
 #2: ffff888030d98ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d3/0x400 net/bluetooth/hci_sync.c:331
3 locks held by kworker/u9:10/11292:
 #0: ffff88801e7c1148 ((wq_completion)hci4#2){+.+.}-{0:0}, at: process_one_work+0x841/0x15a0 kernel/workqueue.c:3236
 #1: ffffc9000c69fb80 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x868/0x15a0 kernel/workqueue.c:3237
 #2: ffff8880549000c0 (&hdev->lock){+.+.}-{4:4}, at: hci_event_packet+0x162/0x1260 net/bluetooth/hci_event.c:7736
7 locks held by kworker/u9:11/12552:
Kernel bug: WARNING in ni_rename (2)
Subsystem: ntfs3
Status: open

Crash report:
loop0: detected capacity change from 0 to 4096
ntfs3(loop0): Different NTFS sector size (1024) and media sector size (512).
ntfs3(loop0): Mark volume as dirty due to NTFS errors
------------[ cut here ]------------
WARNING: CPU: 0 PID: 6065 at fs/ntfs3/frecord.c:3030 ni_rename+0xee/0x100 fs/ntfs3/frecord.c:3029
Modules linked in:
CPU: 0 UID: 0 PID: 6065 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:ni_rename+0xee/0x100 fs/ntfs3/frecord.c:3029
Code: 8b 05 16 c3 a0 0e 48 3b 44 24 10 75 22 44 89 e0 48 83 c4 18 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 13 b0 bc fe 90 <0f> 0b 90 eb c5 e8 b8 b3 be 07 0f 1f 84 00 00 00 00 00 90 90 90 90
RSP: 0018:ffffc90004557a98 EFLAGS: 00010293
RAX: ffffffff8301fd2d RBX: 00000000fffffffe RCX: ffff888035c5bc00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00000000fffffffe R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000020 R12: 0000000000000000
R13: ffff88803cfd3300 R14: ffff88802f8e35d0 R15: ffff88802f8e2e20
FS:  00005555661e4500(0000) GS:ffff888126df4000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b31c63fff CR3: 0000000022ef8000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 ntfs_rename+0x735/0xbf0 fs/ntfs3/namei.c:332
 vfs_rename+0xb34/0xe80 fs/namei.c:5216
 do_renameat2+0x6a2/0xa50 fs/namei.c:5364
 __do_sys_rename fs/namei.c:5411 [inline]
 __se_sys_rename fs/namei.c:5409 [inline]
 __x64_sys_rename+0x82/0x90 fs/namei.c:5409
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f584b01f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd73856c48 EFLAGS: 00000246 ORIG_RAX: 0000000000000052
RAX: ffffffffffffffda RBX: 00007f584b275fa0 RCX: 00007f584b01f749
RDX: 0000000000000000 RSI: 0000200000000440 RDI: 0000200000000340
RBP: 00007f584b0a3f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f584b275fa0 R14: 00007f584b275fa0 R15: 0000000000000002
 </TASK>