live-kbench/live-kbench huggingface dataset:
Kernel bug: KMSAN: uninit-value in can_receive (3)
Subsystem: can
Status: open

Crash report:
=====================================================
BUG: KMSAN: uninit-value in can_receive+0x219/0x5d0 net/can/af_can.c:654
 can_receive+0x219/0x5d0 net/can/af_can.c:654
 can_rcv+0x209/0x3a0 net/can/af_can.c:688
 __netif_receive_skb_one_core net/core/dev.c:5704 [inline]
 __netif_receive_skb+0x42b/0xa00 net/core/dev.c:5817
 process_backlog+0x4ad/0xa50 net/core/dev.c:6149
 __napi_poll+0xe7/0x980 net/core/dev.c:6902
 napi_poll net/core/dev.c:6971 [inline]
 net_rx_action+0xa5a/0x19b0 net/core/dev.c:7093
 handle_softirqs+0x1a0/0x7c0 kernel/softirq.c:561
 __do_softirq+0x14/0x1a kernel/softirq.c:595
 do_softirq+0x9a/0x100 kernel/softirq.c:462
 __local_bh_enable_ip+0x9f/0xb0 kernel/softirq.c:389
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 rcu_read_unlock_bh include/linux/rcupdate.h:919 [inline]
 __dev_queue_xmit+0x2758/0x57d0 net/core/dev.c:4493
 dev_queue_xmit include/linux/netdevice.h:3168 [inline]
 can_send+0xf1c/0x13b0 net/can/af_can.c:277
 isotp_sendmsg+0x1afc/0x2340 net/can/isotp.c:1087
 sock_sendmsg_nosec net/socket.c:711 [inline]
 __sock_sendmsg+0x30f/0x380 net/socket.c:726
 ____sys_sendmsg+0x903/0xb60 net/socket.c:2583
 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2637
 __sys_sendmmsg+0x2ff/0x880 net/socket.c:2726
 __do_sys_sendmmsg net/socket.c:2753 [inline]
 __se_sys_sendmmsg net/socket.c:2750 [inline]
 __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2750
 x64_sys_call+0x33c2/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:308
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:4125 [inline]
 slab_alloc_node mm/slub.c:4168 [inline]
 __do_kmalloc_node mm/slub.c:4297 [inline]
 __kmalloc_node_track_caller_noprof+0x945/0x1240 mm/slub.c:4317
 kmalloc_reserve+0x23e/0x4a0 net/core/skbuff.c:609
 pskb_expand_head+0x226/0x1a60 net/core/skbuff.c:2275
 netif_skb_check_for_xdp net/core/dev.c:5081 [inline]
 netif_receive_generic_xdp net/core/dev.c:5112 [inline]
 do_xdp_generic+0x9e3/0x15a0 net/core/dev.c:5180
 __netif_receive_skb_core+0x25c3/0x6f10 net/core/dev.c:5524
 __netif_receive_skb_one_core net/core/dev.c:5702 [inline]
 __netif_receive_skb+0xca/0xa00 net/core/dev.c:5817
 process_backlog+0x4ad/0xa50 net/core/dev.c:6149
 __napi_poll+0xe7/0x980 net/core/dev.c:6902
 napi_poll net/core/dev.c:6971 [inline]
 net_rx_action+0xa5a/0x19b0 net/core/dev.c:7093
 handle_softirqs+0x1a0/0x7c0 kernel/softirq.c:561
 __do_softirq+0x14/0x1a kernel/softirq.c:595

CPU: 1 UID: 0 PID: 5804 Comm: syz-executor907 Not tainted 6.13.0-rc7-syzkaller-00039-gc3812b15000c #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
=====================================================
Kernel bug: WARNING in ieee80211_tx_skb_tid
Subsystem: wireless
Status: open

Crash report:
------------[ cut here ]------------
WARNING: net/mac80211/tx.c:6303 at ieee80211_tx_skb_tid+0x3b4/0x470 net/mac80211/tx.c:6303, CPU#0: syz.0.18/5530
Modules linked in:
CPU: 0 UID: 0 PID: 5530 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:ieee80211_tx_skb_tid+0x3b4/0x470 net/mac80211/tx.c:6303
Code: f6 ce f6 e9 b1 fe ff ff e8 b9 da f1 f6 90 0f 0b 90 e9 e2 fe ff ff e8 ab da f1 f6 90 0f 0b 90 e9 2a fe ff ff e8 9d da f1 f6 90 <0f> 0b 90 e8 c4 e1 fd ff 31 ff 48 8b 34 24 ba 02 00 00 00 48 83 c4
RSP: 0018:ffffc90002a7f458 EFLAGS: 00010293
RAX: ffffffff8acf8083 RBX: ffffffff8acf7cff RCX: ffff888000f54980
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 00000000ffffffff R08: ffffffff8acf7cff R09: ffffffff8df41cc0
R10: dffffc0000000000 R11: ffffed10092eb486 R12: ffff88801c1b8d80
R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000
FS:  00005555853f1500(0000) GS:ffff88808d683000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000564770e69950 CR3: 0000000032ccf000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 ieee80211_tx_skb net/mac80211/ieee80211_i.h:2418 [inline]
 mesh_plink_frame_tx+0x734/0xc10 net/mac80211/mesh_plink.c:354
 mesh_plink_deactivate+0x18e/0x2f0 net/mac80211/mesh_plink.c:410
 mesh_sta_cleanup+0x42/0x150 net/mac80211/mesh.c:171
 __cleanup_single_sta net/mac80211/sta_info.c:167 [inline]
 cleanup_single_sta+0x40f/0x660 net/mac80211/sta_info.c:192
 __sta_info_flush+0x5e4/0x710 net/mac80211/sta_info.c:1683
 sta_info_flush net/mac80211/sta_info.h:970 [inline]
 ieee80211_do_stop+0x397/0x1f70 net/mac80211/iface.c:526
 ieee80211_stop+0x1b1/0x240 net/mac80211/iface.c:828
 __dev_close_many+0x344/0x6b0 net/core/dev.c:1756
 __dev_close net/core/dev.c:1768 [inline]
 __dev_change_flags+0x2be/0x680 net/core/dev.c:9732
 netif_change_flags+0x88/0x1a0 net/core/dev.c:9797
 dev_change_flags+0x130/0x260 net/core/dev_api.c:68
 dev_ioctl+0x7b4/0x1150 net/core/dev_ioctl.c:842
 sock_do_ioctl+0x22c/0x300 net/socket.c:1259
 sock_ioctl+0x576/0x790 net/socket.c:1366
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fba6778f7c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff8aa47b88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fba679e5fa0 RCX: 00007fba6778f7c9
RDX: 0000200000000000 RSI: 0000000000008914 RDI: 0000000000000004
RBP: 00007fba67813f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fba679e5fa0 R14: 00007fba679e5fa0 R15: 0000000000000003
 </TASK>
Kernel bug: UBSAN: shift-out-of-bounds in sg_build_indirect
Subsystem: scsi
Status: open

Crash report:
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in drivers/scsi/sg.c:1897:13
shift exponent 64 is too large for 32-bit type 'int'
CPU: 1 UID: 0 PID: 5832 Comm: syz-executor361 Not tainted 6.14.0-rc2-syzkaller-00185-g128c8f96eb86 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
 ubsan_epilogue lib/ubsan.c:231 [inline]
 __ubsan_handle_shift_out_of_bounds+0x24f/0x3f0 lib/ubsan.c:468
 sg_build_indirect.cold+0x1b/0x20 drivers/scsi/sg.c:1897
 sg_build_reserve+0xc4/0x180 drivers/scsi/sg.c:2007
 sg_add_sfp drivers/scsi/sg.c:2189 [inline]
 sg_open+0xc37/0x1910 drivers/scsi/sg.c:348
 chrdev_open+0x237/0x6a0 fs/char_dev.c:414
 do_dentry_open+0x735/0x1c40 fs/open.c:956
 vfs_open+0x82/0x3f0 fs/open.c:1086
 do_open fs/namei.c:3830 [inline]
 path_openat+0x1e88/0x2d80 fs/namei.c:3989
 do_filp_open+0x20c/0x470 fs/namei.c:4016
 do_sys_openat2+0x17a/0x1e0 fs/open.c:1428
 do_sys_open fs/open.c:1443 [inline]
 __do_sys_openat fs/open.c:1459 [inline]
 __se_sys_openat fs/open.c:1454 [inline]
 __x64_sys_openat+0x175/0x210 fs/open.c:1454
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1dc41ca3e9
Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffeaa93f3d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007ffeaa93f5a8 RCX: 00007f1dc41ca3e9
RDX: 000000000008a002 RSI: 00004000000000c0 RDI: ffffffffffffff9c
RBP: 00007f1dc423d610 R08: 00007ffeaa93f5a8 R09: 00007ffeaa93f5a8
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffeaa93f598 R14: 0000000000000001 R15: 0000000000000001
 </TASK>
---[ end trace ]---
Kernel bug: INFO: task hung in br_ioctl_stub (2)
Subsystem: bridge
Status: open

Crash report:
INFO: task syz.0.27:5720 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.27        state:D stack:28904 pid:5720  tgid:5719  ppid:5469   task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5325 [inline]
 __schedule+0x1798/0x4cc0 kernel/sched/core.c:6929
 __schedule_loop kernel/sched/core.c:7011 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:7026
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7083
 __mutex_lock_common kernel/locking/mutex.c:676 [inline]
 __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:760
 br_ioctl_stub+0x199/0xc80 net/bridge/br_ioctl.c:418
 br_ioctl_call net/socket.c:1227 [inline]
 sock_ioctl+0x4d8/0x790 net/socket.c:1329
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f91bf78f7c9
RSP: 002b:00007f91c0675038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f91bf9e5fa0 RCX: 00007f91bf78f7c9
RDX: 0000200000000000 RSI: 00000000000089a2 RDI: 0000000000000003
RBP: 00007f91bf813f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f91bf9e6038 R14: 00007f91bf9e5fa0 R15: 00007ffd440d2c68
 </TASK>
INFO: task kworker/u4:11:5722 blocked for more than 150 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:11   state:D stack:28872 pid:5722  tgid:5722  ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: events_unbound linkwatch_event
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5325 [inline]
 __schedule+0x1798/0x4cc0 kernel/sched/core.c:6929
 __schedule_loop kernel/sched/core.c:7011 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:7026
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7083
 __mutex_lock_common kernel/locking/mutex.c:676 [inline]
 __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:760
Kernel bug: WARNING in path_noexec (2)
Subsystem: mm, fs
Status: open

Crash report:
------------[ cut here ]------------
WARNING: fs/exec.c:119 at path_noexec+0x1af/0x200 fs/exec.c:118, CPU#1: syz.0.17/6030
Modules linked in:
CPU: 1 UID: 0 PID: 6030 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:path_noexec+0x1af/0x200 fs/exec.c:118
Code: 02 31 ff 48 89 de e8 c0 ab 86 ff d1 eb eb 07 e8 d7 a6 86 ff b3 01 89 d8 5b 41 5e 41 5f 5d c3 cc cc cc cc cc e8 c2 a6 86 ff 90 <0f> 0b 90 e9 48 ff ff ff 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c a6
RSP: 0018:ffffc900030e7bd8 EFLAGS: 00010293
RAX: ffffffff823a4ebe RBX: ffff8880787cd200 RCX: ffff888030933d00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000080000 R08: ffff888030933d00 R09: 0000000000000003
R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000013
R13: 1ffff9200061cf90 R14: 0000000000000000 R15: dffffc0000000000
FS:  0000555569a9b500(0000) GS:ffff888125f1f000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b30363fff CR3: 0000000078746000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 do_mmap+0xa43/0x10d0 mm/mmap.c:469
 vm_mmap_pgoff+0x2a6/0x4d0 mm/util.c:581
 ksys_mmap_pgoff+0x51f/0x760 mm/mmap.c:604
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0db138f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe9e2cf278 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007f0db15e5fa0 RCX: 00007f0db138f749
RDX: 0000000002000001 RSI: 0000000000003000 RDI: 0000200000000000
RBP: 00007f0db1413f91 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f0db15e5fa0 R14: 00007f0db15e5fa0 R15: 0000000000000006
 </TASK>
Kernel bug: WARNING in usb_stor_msg_common
Subsystem: usb-storage
Status: open

Crash report:
------------[ cut here ]------------
URB ffff888106a99b00 submitted while active
WARNING: drivers/usb/core/urb.c:380 at 0x0, CPU#1: usb-storage/6095
Modules linked in:
CPU: 1 UID: 0 PID: 6095 Comm: usb-storage Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:usb_submit_urb+0x15a3/0x1970 drivers/usb/core/urb.c:380
Code: 4b 03 00 00 48 8b 04 24 48 8b 90 b0 00 00 00 eb 91 bb ed ff ff ff e9 07 f3 ff ff e8 b7 19 a9 fa 48 8d 3d a0 73 7e 09 48 89 de <67> 48 0f b9 3a bb f0 ff ff ff e9 e9 f2 ff ff e8 99 19 a9 fa 0f 1f
RSP: 0018:ffffc90003aff670 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff888106a99b00 RCX: dffffc0000000000
RDX: ffff888029d74980 RSI: ffff888106a99b00 RDI: ffffffff90943db0
RBP: 1ffff9200075fee1 R08: 0000000000000002 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000002ba1 R12: ffff888039800ee8
R13: ffff888039800e60 R14: ffffc90003aff728 R15: ffff888106a99b00
FS:  0000000000000000(0000) GS:ffff8880d69fa000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000564726f21168 CR3: 0000000039502000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 usb_stor_msg_common+0x23f/0x560 drivers/usb/storage/transport.c:143
 usb_stor_bulk_transfer_buf+0x17c/0x410 drivers/usb/storage/transport.c:395
 ene_send_scsi_cmd+0x130/0x610 drivers/usb/storage/ene_ub6250.c:502
 ene_init drivers/usb/storage/ene_ub6250.c:2197 [inline]
 ene_transport+0x13fd/0x37f0 drivers/usb/storage/ene_ub6250.c:2310
 usb_stor_invoke_transport+0xee/0x1570 drivers/usb/storage/transport.c:611
 usb_stor_control_thread+0x5eb/0xb00 drivers/usb/storage/usb.c:462
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>
----------------
Code disassembly (best guess):
   0:	4b 03 00             	rex.WXB add (%r8),%rax
   3:	00 48 8b             	add    %cl,-0x75(%rax)
   6:	04 24                	add    $0x24,%al
   8:	48 8b 90 b0 00 00 00 	mov    0xb0(%rax),%rdx
   f:	eb 91                	jmp    0xffffffa2
  11:	bb ed ff ff ff       	mov    $0xffffffed,%ebx
  16:	e9 07 f3 ff ff       	jmp    0xfffff322
  1b:	e8 b7 19 a9 fa       	call   0xfaa919d7
  20:	48 8d 3d a0 73 7e 09 	lea    0x97e73a0(%rip),%rdi        # 0x97e73c7
  27:	48 89 de             	mov    %rbx,%rsi
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	bb f0 ff ff ff       	mov    $0xfffffff0,%ebx
  34:	e9 e9 f2 ff ff       	jmp    0xfffff322
  39:	e8 99 19 a9 fa       	call   0xfaa919d7
  3e:	0f                   	.byte 0xf
  3f:	1f                   	(bad)
Kernel bug: WARNING in v9fs_begin_writeback
Subsystem: v9fs
Status: open

Crash report:
------------[ cut here ]------------
folio expected an open fid inode->i_ino=23005ff
WARNING: CPU: 2 PID: 1155 at fs/9p/vfs_addr.c:39 v9fs_begin_writeback fs/9p/vfs_addr.c:39 [inline]
WARNING: CPU: 2 PID: 1155 at fs/9p/vfs_addr.c:39 v9fs_begin_writeback+0x210/0x280 fs/9p/vfs_addr.c:33
Modules linked in:
CPU: 2 UID: 0 PID: 1155 Comm: kworker/u32:9 Not tainted 6.11.0-rc1-syzkaller-00154-gc0ecd6388360 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: writeback wb_workfn (flush-9p-55)
RIP: 0010:v9fs_begin_writeback fs/9p/vfs_addr.c:39 [inline]
RIP: 0010:v9fs_begin_writeback+0x210/0x280 fs/9p/vfs_addr.c:33
Code: 00 fc ff df 48 8b 5b 48 48 8d 7b 40 48 89 fa 48 c1 ea 03 80 3c 02 00 75 66 48 8b 73 40 48 c7 c7 20 9a 8e 8b e8 51 4a 0d fe 90 <0f> 0b 90 90 e9 62 ff ff ff e8 32 2b a8 fe e9 51 ff ff ff e8 98 2a
RSP: 0018:ffffc9000610f480 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff8880327a0670 RCX: ffffffff814cc379
RDX: ffff88802329a440 RSI: ffffffff814cc386 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888012c4a408
R13: dffffc0000000000 R14: ffffc9000610f840 R15: ffff888012c4a658
FS:  0000000000000000(0000) GS:ffff88806b200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020001000 CR3: 0000000011d46000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 netfs_writepages+0x656/0xde0 fs/netfs/write_issue.c:534
 do_writepages+0x1a3/0x7f0 mm/page-writeback.c:2683
 __writeback_single_inode+0x163/0xf90 fs/fs-writeback.c:1651
 writeback_sb_inodes+0x611/0x1150 fs/fs-writeback.c:1947
 wb_writeback+0x199/0xb50 fs/fs-writeback.c:2127
 wb_do_writeback fs/fs-writeback.c:2274 [inline]
 wb_workfn+0x28d/0xf40 fs/fs-writeback.c:2314
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Kernel bug: WARNING in __alloc_frozen_pages_noprof
Subsystem: dri
Status: open

Crash report:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5936 at mm/page_alloc.c:4715 __alloc_frozen_pages_noprof+0x1f66/0x2470 mm/page_alloc.c:4715
Modules linked in:
CPU: 0 UID: 0 PID: 5936 Comm: syz-executor305 Not tainted 6.14.0-rc4-syzkaller-00248-g03d38806a902 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:__alloc_frozen_pages_noprof+0x1f66/0x2470 mm/page_alloc.c:4715
Code: 24 38 41 89 c6 0f b6 c0 44 8b ac 24 84 00 00 00 89 44 24 18 e9 a8 f7 ff ff 90 0f 0b 90 e9 b6 f7 ff ff c6 05 2d 52 3a 0e 01 90 <0f> 0b 90 e9 d9 e4 ff ff 90 0f 0b 90 e9 4e fb ff ff 83 bc 24 80 00
RSP: 0018:ffffc900039677c0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 000000000000000b RDI: 0000000000040dc0
RBP: 00000000007a1200 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 000000000000000b
R13: 1ffff9200072cf0c R14: 00000000007a1200 R15: ffffffff855c28fd
FS:  00005555724b6380(0000) GS:ffff88806a600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00004000003d0000 CR3: 0000000025918000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __alloc_pages_noprof+0xb/0x1b0 mm/page_alloc.c:4773
 __alloc_pages_node_noprof include/linux/gfp.h:265 [inline]
 alloc_pages_node_noprof include/linux/gfp.h:292 [inline]
 ___kmalloc_large_node+0x84/0x1b0 mm/slub.c:4239
 __kmalloc_large_node_noprof+0x1c/0x70 mm/slub.c:4266
 __do_kmalloc_node mm/slub.c:4282 [inline]
 __kmalloc_noprof.cold+0xc/0x61 mm/slub.c:4306
 kmalloc_noprof include/linux/slab.h:905 [inline]
 kmalloc_array_noprof include/linux/slab.h:946 [inline]
 fill_object_idr drivers/gpu/drm/drm_lease.c:389 [inline]
 drm_mode_create_lease_ioctl+0x4bd/0x1f60 drivers/gpu/drm/drm_lease.c:522
 drm_ioctl_kernel+0x1e6/0x3d0 drivers/gpu/drm/drm_ioctl.c:796
 drm_ioctl+0x5d6/0xc00 drivers/gpu/drm/drm_ioctl.c:893
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:906 [inline]
 __se_sys_ioctl fs/ioctl.c:892 [inline]
 __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fee89044129
Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe5200dad8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000400000000000 RCX: 00007fee89044129
RDX: 00004000000003c0 RSI: 00000000c01864c6 RDI: 0000000000000003
RBP: 00007fee890b7610 R08: 0023647261632f69 R09: 00007ffe5200dca8
R10: 000000000000000f R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffe5200dc98 R14: 0000000000000001 R15: 0000000000000001
 </TASK>
Kernel bug: INFO: task hung in diNewExt
Subsystem: jfs
Status: open

Crash report:
INFO: task syz.2.19:6098 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.19        state:D stack:24120 pid:6098  tgid:6097  ppid:5976   task_flags:0x400140 flags:0x00080003
Call Trace:
 context_switch kernel/sched/core.c:5254 [inline]
 __schedule+0x17c4/0x4d60 kernel/sched/core.c:6862
 __schedule_loop kernel/sched/core.c:6944 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:6959
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7016
 rwsem_down_read_slowpath+0x5fd/0x8f0 kernel/locking/rwsem.c:1086
 __down_read_common kernel/locking/rwsem.c:1261 [inline]
 __down_read kernel/locking/rwsem.c:1274 [inline]
 down_read_nested+0x9a/0x2f0 kernel/locking/rwsem.c:1663
 diNewExt+0x9af/0x3150 fs/jfs/jfs_imap.c:2261
 diAllocExt fs/jfs/jfs_imap.c:1952 [inline]
 diAllocAG+0xe86/0x1df0 fs/jfs/jfs_imap.c:1669
 diAlloc+0x1d5/0x1680 fs/jfs/jfs_imap.c:1590
 ialloc+0x8c/0x8f0 fs/jfs/jfs_inode.c:56
 jfs_mkdir+0x193/0xa70 fs/jfs/namei.c:225
 vfs_mkdir+0x306/0x510 fs/namei.c:4453
 do_mkdirat+0x247/0x590 fs/namei.c:4486
 __do_sys_mkdirat fs/namei.c:4503 [inline]
 __se_sys_mkdirat fs/namei.c:4501 [inline]
 __x64_sys_mkdirat+0x87/0xa0 fs/namei.c:4501
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa19698efc9
RSP: 002b:00007fa197895038 EFLAGS: 00000246
RBP: 00007fa196a11f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
INFO: task syz.0.17:6103 blocked for more than 148 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17        state:D
 stack:25592 pid:6103  tgid:6102  ppid:5971   task_flags:0x400140 flags:0x00080003
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5254 [inline]
 __schedule+0x17c4/0x4d60 kernel/sched/core.c:6862
 __schedule_loop kernel/sched/core.c:6944 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:6959
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7016
 rwsem_down_read_slowpath+0x5fd/0x8f0 kernel/locking/rwsem.c:1086
 __down_read_common kernel/locking/rwsem.c:1261 [inline]
 __down_read kernel/locking/rwsem.c:1274 [inline]
 down_read_nested+0x9a/0x2f0 kernel/locking/rwsem.c:1663
 dbAlloc+0x3a7/0xba0 fs/jfs/jfs_dmap.c:790
 diNewExt+0x9af/0x3150 fs/jfs/jfs_imap.c:2261
 diAllocExt fs/jfs/jfs_imap.c:1952 [inline]
 diAllocAG+0xe86/0x1df0 fs/jfs/jfs_imap.c:1669
 diAlloc+0x1d5/0x1680 fs/jfs/jfs_imap.c:1590
 ialloc+0x8c/0x8f0 fs/jfs/jfs_inode.c:56
 jfs_mkdir+0x193/0xa70 fs/jfs/namei.c:225