live-kbench/live-kbench huggingface dataset:
Kernel bug: KASAN: null-ptr-deref Write in gfs2_trans_add_revoke
Subsystem: gfs2
Status: open

Crash report:
gfs2: fsid=syz:syz.0: first mount done, others may mount
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_write include/linux/instrumented.h:82 [inline]
BUG: KASAN: null-ptr-deref in set_bit include/asm-generic/bitops/instrumented-atomic.h:28 [inline]
BUG: KASAN: null-ptr-deref in gfs2_trans_add_revoke+0x8c/0xe0 fs/gfs2/trans.c:321
Write of size 8 at addr 0000000000000018 by task syz.0.17/5566

CPU: 0 UID: 0 PID: 5566 Comm: syz.0.17 Not tainted 6.16.0-syzkaller-08685-g260f6f4fda93 #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 kasan_report+0x118/0x150 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x2b0/0x2c0 mm/kasan/generic.c:189
 instrument_atomic_write include/linux/instrumented.h:82 [inline]
 set_bit include/asm-generic/bitops/instrumented-atomic.h:28 [inline]
 gfs2_trans_add_revoke+0x8c/0xe0 fs/gfs2/trans.c:321
 gfs2_remove_from_journal+0x43e/0x6d0 fs/gfs2/meta_io.c:366
 gfs2_discard fs/gfs2/aops.c:597 [inline]
 gfs2_invalidate_folio+0x579/0x750 fs/gfs2/aops.c:631
 folio_invalidate mm/truncate.c:140 [inline]
 truncate_cleanup_folio+0x2d5/0x430 mm/truncate.c:160
 truncate_inode_pages_range+0x233/0xda0 mm/truncate.c:379
 do_gfs2_set_flags fs/gfs2/file.c:254 [inline]
 gfs2_fileattr_set+0x80a/0x9b0 fs/gfs2/file.c:311
 vfs_fileattr_set+0x92f/0xb90 fs/file_attr.c:298
 ioctl_setflags+0x17b/0x200 fs/file_attr.c:336
 do_vfs_ioctl+0x8ed/0x1430 fs/ioctl.c:561
 __do_sys_ioctl fs/ioctl.c:596 [inline]
 __se_sys_ioctl+0x82/0x170 fs/ioctl.c:584
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f55c3b8eb69
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffea6c68328 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f55c3db5fa0 RCX: 00007f55c3b8eb69
RDX: 0000200000000000 RSI: 0000000040086602 RDI: 0000000000000005
RBP: 00007f55c3c11df1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f55c3db5fa0 R14: 00007f55c3db5fa0 R15: 0000000000000003
 </TASK>
==================================================================
Kernel bug: UBSAN: shift-out-of-bounds in dbSplit (3)
Subsystem: jfs
Status: open

Crash report:
loop0: detected capacity change from 0 to 32768
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:2629:11
shift exponent 110 is too large for 32-bit type 'int'
CPU: 0 UID: 0 PID: 5303 Comm: syz-executor956 Not tainted 6.15.0-rc3-syzkaller-00283-gf1a3944c860b #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 ubsan_epilogue+0xa/0x40 lib/ubsan.c:231
 __ubsan_handle_shift_out_of_bounds+0x386/0x410 lib/ubsan.c:492
 dbSplit+0x1f8/0x200 fs/jfs/jfs_dmap.c:2629
 dbAdjCtl+0x34c/0xa20 fs/jfs/jfs_dmap.c:2521
 dbAllocDmap fs/jfs/jfs_dmap.c:2032 [inline]
 dbAllocNear+0x2ee/0x3d0 fs/jfs/jfs_dmap.c:1243
 dbAlloc+0x933/0xba0 fs/jfs/jfs_dmap.c:828
 ea_write+0x374/0xdd0 fs/jfs/xattr.c:232
 ea_put fs/jfs/xattr.c:619 [inline]
 __jfs_setxattr+0xa01/0x1120 fs/jfs/xattr.c:792
 __jfs_xattr_set+0xda/0x170 fs/jfs/xattr.c:941
 __vfs_setxattr+0x439/0x480 fs/xattr.c:200
 __vfs_setxattr_noperm+0x12d/0x660 fs/xattr.c:234
 vfs_setxattr+0x16b/0x2f0 fs/xattr.c:321
 do_setxattr fs/xattr.c:636 [inline]
 filename_setxattr+0x274/0x600 fs/xattr.c:665
 path_setxattrat+0x364/0x3a0 fs/xattr.c:713
 __do_sys_lsetxattr fs/xattr.c:754 [inline]
 __se_sys_lsetxattr fs/xattr.c:750 [inline]
 __x64_sys_lsetxattr+0xbf/0xe0 fs/xattr.c:750
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fdaa19996b9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffe3d43d28 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd
RAX: ffffffffffffffda RBX: 0000200000000200 RCX: 00007fdaa19996b9
RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000200000000040
RBP: 00002000000000c0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000040
R13: 0031656c69662f2e R14: 0000000000000001 R15: 0000000000000001
 </TASK>
---[ end trace ]---
Kernel bug: WARNING in nilfs_rename (2)
Subsystem: nilfs
Status: open

Crash report:
------------[ cut here ]------------
WARNING: fs/inode.c:417 at drop_nlink+0xc5/0x110 fs/inode.c:417, CPU#0: syz.0.217/6748
Modules linked in:
CPU: 0 UID: 0 PID: 6748 Comm: syz.0.217 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:drop_nlink+0xc5/0x110 fs/inode.c:417
Code: 70 07 00 00 be 08 00 00 00 e8 07 da e7 ff f0 48 ff 83 70 07 00 00 5b 41 5c 41 5e 41 5f 5d c3 cc cc cc cc cc e8 dc 26 82 ff 90 <0f> 0b 90 eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 5b ff ff ff
RSP: 0018:ffffc9000c52f9d0 EFLAGS: 00010293
RAX: ffffffff823e1d34 RBX: ffff88805699e008 RCX: ffff888027213c80
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff8f9e1877 R09: 1ffffffff1f3c30e
R10: dffffc0000000000 R11: fffffbfff1f3c30f R12: 1ffff1100ad33c0a
R13: ffff88805699d368 R14: ffff88805699e050 R15: dffffc0000000000
FS:  00007f06f15f66c0(0000) GS:ffff888125d0b000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa97ff3f000 CR3: 0000000072f60000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 nilfs_rename+0x46a/0x820 fs/nilfs2/namei.c:418
 vfs_rename+0xb34/0xe80 fs/namei.c:5216
 do_renameat2+0x6a2/0xa50 fs/namei.c:5364
 __do_sys_rename fs/namei.c:5411 [inline]
 __se_sys_rename fs/namei.c:5409 [inline]
 __x64_sys_rename+0x82/0x90 fs/namei.c:5409
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f06f078eec9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f06f15f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000052
RAX: ffffffffffffffda RBX: 00007f06f09e5fa0 RCX: 00007f06f078eec9
RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000200000000040
RBP: 00007f06f0811f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f06f09e6038 R14: 00007f06f09e5fa0 R15: 00007fffd3cbc518
 </TASK>
Kernel bug: WARNING in reg_bounds_sanity_check (2)
Subsystem: bpf
Status: fixed

Crash report:
verifier bug: REG INVARIANTS VIOLATION (false_reg1): range bounds violation u64=[0xfffffffefffff630, 0xffffffff00000000] s64=[0xfffffffefffff630, 0xffffffff00000000] u32=[0x30, 0x8000050] s32=[0x30, 0x0] var_off=(0xfffffffe00000030, 0x10fffffc0)(1)
WARNING: CPU: 1 PID: 6031 at kernel/bpf/verifier.c:2722 reg_bounds_sanity_check+0x62b/0x1200 kernel/bpf/verifier.c:2722
Modules linked in:
CPU: 1 UID: 0 PID: 6031 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:reg_bounds_sanity_check+0x62b/0x1200 kernel/bpf/verifier.c:2722
Code: 45 ac 50 8b 45 b0 50 8b 45 b4 50 ff 75 b8 4c 8b 4d c0 4c 8b 45 c8 48 8b 95 58 ff ff ff 48 8b b5 60 ff ff ff e8 96 76 aa ff 90 <0f> 0b 90 90 48 8b 95 40 ff ff ff 48 83 c4 38 48 b8 00 00 00 00 00
RSP: 0018:ffffc900043af2f8 EFLAGS: 00010286
RAX: 0000000000000000 RBX: fffffffefffff630 RCX: ffffffff817a3388
RDX: ffff88802ab90000 RSI: ffffffff817a3395 RDI: 0000000000000001
RBP: ffffc900043af3f0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff8880756a0000
R13: ffff888023fb01bc R14: ffff888023fb01b4 R15: ffff888023fb0168
FS:  00005555645e7500(0000) GS:ffff8881247b6000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8dcc7c7dac CR3: 00000000753db000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 reg_set_min_max kernel/bpf/verifier.c:16336 [inline]
 reg_set_min_max+0x1dc/0x2c0 kernel/bpf/verifier.c:16308
 check_cond_jmp_op+0x19b0/0x72d0 kernel/bpf/verifier.c:16768
 do_check_insn kernel/bpf/verifier.c:19956 [inline]
 do_check kernel/bpf/verifier.c:20093 [inline]
 do_check_common+0xa13e/0xb410 kernel/bpf/verifier.c:23260
 do_check_main kernel/bpf/verifier.c:23343 [inline]
 bpf_check+0x869f/0xc670 kernel/bpf/verifier.c:24703
 bpf_prog_load+0xe41/0x2490 kernel/bpf/syscall.c:2979
 __sys_bpf+0x4a3f/0x4de0 kernel/bpf/syscall.c:6029
 __do_sys_bpf kernel/bpf/syscall.c:6139 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6137 [inline]
 __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:6137
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8dcc58ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc501e4a78 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f8dcc7c5fa0 RCX: 00007f8dcc58ebe9
RDX: 0000000000000048 RSI: 00002000000017c0 RDI: 0000000000000005
RBP: 00007f8dcc611e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f8dcc7c5fa0 R14: 00007f8dcc7c5fa0 R15: 0000000000000003
 </TASK>
Kernel bug: WARNING in dev_deactivate_many
Subsystem: net
Status: open

Crash report:
 linkwatch_event+0x8f/0xc0 net/core/link_watch.c:304
 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3263
 process_scheduled_works kernel/workqueue.c:3346 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3427
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x56d/0x700 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
------------[ cut here ]------------
WARNING: CPU: 1 PID: 4085 at lib/ref_tracker.c:323 ref_tracker_free+0x61a/0x830 lib/ref_tracker.c:323
Modules linked in:
CPU: 1 UID: 0 PID: 4085 Comm: kworker/u8:6 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: events_unbound linkwatch_event
RIP: 0010:ref_tracker_free+0x61a/0x830 lib/ref_tracker.c:323
Code: 00 44 8b 73 18 31 ff 44 89 f6 e8 01 29 e1 fe 45 85 f6 0f 85 a6 00 00 00 e8 b3 2d e1 fe 48 8b 34 24 48 89 ef e8 e7 95 a9 04 90 <0f> 0b 90 bb ea ff ff ff e9 50 fd ff ff e8 94 2d e1 fe 4c 8d 6d 44
RSP: 0018:ffffc9000174f8a8 EFLAGS: 00010202
RAX: 0000000000000201 RBX: ffff888134bfe7c0 RCX: 0000000000000000
RDX: 0000000000000202 RSI: ffffffff88c86d07 RDI: 0000000000000001
RBP: ffff88810abbc5d0 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff8aa0cfd7 R11: 0000000000000001 R12: 1ffff920002e9f17
R13: ffffc9000174f8d8 R14: 0000000005ae0155 R15: ffff888134bfe7d8
FS:  0000000000000000(0000) GS:ffff888268fa3000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fabecdc9000 CR3: 00000000090a4000 CR4: 00000000003506f0
Call Trace:
 <TASK>
 netdev_tracker_free include/linux/netdevice.h:4395 [inline]
 netdev_put include/linux/netdevice.h:4412 [inline]
 netdev_put include/linux/netdevice.h:4408 [inline]
 netdev_watchdog_down net/sched/sch_generic.c:572 [inline]
 dev_deactivate_many+0x286/0xd30 net/sched/sch_generic.c:1370
 dev_deactivate+0xf8/0x1c0 net/sched/sch_generic.c:1401
 linkwatch_do_dev+0x11e/0x160 net/core/link_watch.c:184
 __linkwatch_run_queue+0x2a3/0x7a0 net/core/link_watch.c:244
 linkwatch_event+0x8f/0xc0 net/core/link_watch.c:304
 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3263
 process_scheduled_works kernel/workqueue.c:3346 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3427
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x56d/0x700 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Kernel bug: WARNING in do_mknodat (3)
Subsystem: gfs2
Status: open

Crash report:
------------[ cut here ]------------
DEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) != current) && !rwsem_test_oflags(sem, RWSEM_NONSPINNABLE)): count = 0x0, magic = 0xffff8880450e5058, owner = 0x0, curr 0xffff888000214900, list empty
WARNING: CPU: 0 PID: 5469 at kernel/locking/rwsem.c:1381 __up_write kernel/locking/rwsem.c:1380 [inline]
WARNING: CPU: 0 PID: 5469 at kernel/locking/rwsem.c:1381 up_write+0x3a2/0x420 kernel/locking/rwsem.c:1643
Modules linked in:
CPU: 0 UID: 0 PID: 5469 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:__up_write kernel/locking/rwsem.c:1380 [inline]
RIP: 0010:up_write+0x3a2/0x420 kernel/locking/rwsem.c:1643
Code: d0 48 c7 c7 20 ff 6a 8b 48 c7 c6 40 01 6b 8b 48 8b 14 24 4c 89 f1 4d 89 e0 4c 8b 4c 24 08 41 52 e8 c3 35 e6 ff 48 83 c4 08 90 <0f> 0b 90 90 e9 6d fd ff ff 48 c7 c1 94 3f 7d 8f 80 e1 07 80 c1 03
RSP: 0018:ffffc90002b0fd90 EFLAGS: 00010296
RAX: 2647f64315e69700 RBX: ffff8880450e5058 RCX: ffff888000214900
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff1bba684 R12: 0000000000000000
R13: ffff8880450e50b0 R14: ffff8880450e5058 R15: 1ffff11008a1ca0c
FS:  00007fbf073dd6c0(0000) GS:ffff88808d72f000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000001480 CR3: 000000001c151000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 inode_unlock include/linux/fs.h:990 [inline]
 end_creating_path fs/namei.c:4263 [inline]
 do_mknodat+0x428/0x4d0 fs/namei.c:4387
 __do_sys_mknod fs/namei.c:4405 [inline]
 __se_sys_mknod fs/namei.c:4403 [inline]
 __x64_sys_mknod+0x8c/0xa0 fs/namei.c:4403
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fbf07d8f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fbf073dd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000085
RAX: ffffffffffffffda RBX: 00007fbf07fe6090 RCX: 00007fbf07d8f749
RDX: 0000000000000400 RSI: 0000000000001000 RDI: 0000200000000280
RBP: 00007fbf07e13f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fbf07fe6128 R14: 00007fbf07fe6090 R15: 00007ffd36594318
 </TASK>
Kernel bug: INFO: task hung in tun_chr_close (5)
Subsystem: net
Status: open

Crash report:
INFO: task syz-executor:5517 blocked for more than 143 seconds.
      Not tainted syzkaller #0
      Blocked by coredump.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:21448 pid:5517  tgid:5517  ppid:1      task_flags:0x40054c flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5357 [inline]
 __schedule+0x1798/0x4cc0 kernel/sched/core.c:6961
 __schedule_loop kernel/sched/core.c:7043 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:7058
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7115
 __mutex_lock_common kernel/locking/mutex.c:676 [inline]
 __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:760
 tun_detach drivers/net/tun.c:634 [inline]
 tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3433
 __fput+0x449/0xa70 fs/file_table.c:468
 task_work_run+0x1d1/0x260 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0x6b5/0x2300 kernel/exit.c:961
 do_group_exit+0x21c/0x2d0 kernel/exit.c:1102
 get_signal+0x1286/0x1340 kernel/signal.c:3034
 arch_do_signal_or_restart+0x9a/0x750 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop+0x75/0x110 kernel/entry/common.c:40
 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
 do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7774190a7c
RSP: 002b:00007fff58c32c60 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
RAX: 000000000000002c RBX: 00007f7774ef4620 RCX: 00007f7774190a7c
RDX: 000000000000002c RSI: 00007f7774ef4670 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007fff58c32cb4 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f7774ef4670 R15: 0000000000000000
 </TASK>
INFO: task syz-executor:5786 blocked for more than 150 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:25096 pid:5786  tgid:5786  ppid:1      task_flags:0x400140 flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5357 [inline]
 __schedule+0x1798/0x4cc0 kernel/sched/core.c:6961
 __schedule_loop kernel/sched/core.c:7043 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:7058
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7115
 __mutex_lock_common kernel/locking/mutex.c:676 [inline]
 __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:760
Kernel bug: WARNING in vcpu_run
Subsystem: kvm-x86
Status: open

Crash report:
kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.
kvm: pic: non byte write
------------[ cut here ]------------
WARNING: arch/x86/kvm/x86.c:11592 at vcpu_block arch/x86/kvm/x86.c:11592 [inline], CPU#0: syz.0.17/5992
WARNING: arch/x86/kvm/x86.c:11592 at vcpu_run+0x748a/0x76b0 arch/x86/kvm/x86.c:11634, CPU#0: syz.0.17/5992
Modules linked in:
CPU: 0 UID: 0 PID: 5992 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:vcpu_block arch/x86/kvm/x86.c:11592 [inline]
RIP: 0010:vcpu_run+0x748a/0x76b0 arch/x86/kvm/x86.c:11634
Code: 48 83 c3 20 48 89 d8 48 c1 e8 03 42 0f b6 04 38 84 c0 0f 85 16 02 00 00 44 88 33 eb 10 e8 be a0 7a 00 eb 09 e8 b7 a0 7a 00 90 <0f> 0b 90 45 31 e4 48 c7 84 24 00 03 00 00 0e 36 e0 45 48 8b 84 24
RSP: 0018:ffffc90003477560 EFLAGS: 00010293
RAX: ffffffff81470ff9 RBX: 00000000fffffff0 RCX: ffff88801c3b3d00
RDX: 0000000000000000 RSI: 00000000fffffff0 RDI: 00000000fffffff0
RBP: ffffc90003477990 R08: ffff88807793f8e7 R09: 1ffff1100ef27f1c
R10: dffffc0000000000 R11: ffffed100ef27f1d R12: 1ffff11005272066
R13: ffff888029390000 R14: ffff888029390038 R15: dffffc0000000000
FS:  000055558ba86500(0000) GS:ffff888125e3a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000007453a000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 kvm_arch_vcpu_ioctl_run+0x1148/0x1c90 arch/x86/kvm/x86.c:11977
 kvm_vcpu_ioctl+0x99a/0xed0 virt/kvm/kvm_main.c:4477
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4aebf8f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffb0481ed8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f4aec1e5fa0 RCX: 00007f4aebf8f749
RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
RBP: 00007f4aec013f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4aec1e5fa0 R14: 00007f4aec1e5fa0 R15: 0000000000000003
 </TASK>
Kernel bug: WARNING in kvm_apic_accept_events (2)
Subsystem: kvm-x86
Status: fixed

Crash report:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5496 at arch/x86/kvm/lapic.c:3483 kvm_apic_accept_events+0x341/0x490 arch/x86/kvm/lapic.c:3483
Modules linked in:
CPU: 0 UID: 0 PID: 5496 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:kvm_apic_accept_events+0x341/0x490 arch/x86/kvm/lapic.c:3483
Code: eb 0c e8 32 da 71 00 eb 05 e8 2b da 71 00 45 31 ff 44 89 f8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 10 da 71 00 90 <0f> 0b 90 e9 ec fd ff ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 4f
RSP: 0018:ffffc90002acfbf0 EFLAGS: 00010293
RAX: ffffffff814e3940 RBX: 0000000000000002 RCX: ffff8880005c4900
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000002
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff814689b6
R10: dffffc0000000000 R11: ffffed100827c008 R12: 0000000000000002
R13: dffffc0000000000 R14: ffff888032de9200 R15: ffff8880413e02d8
FS:  0000555570b9c500(0000) GS:ffff88808d72f000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000002000 CR3: 00000000115bf000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 kvm_arch_vcpu_ioctl_get_mpstate+0x128/0x480 arch/x86/kvm/x86.c:12147
 kvm_vcpu_ioctl+0x625/0xe90 virt/kvm/kvm_main.c:4539
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3bdab8f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff9c843d78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f3bdade5fa0 RCX: 00007f3bdab8f749
RDX: 0000000000000000 RSI: 000000008004ae98 RDI: 0000000000000005
RBP: 00007f3bdac13f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3bdade5fa0 R14: 00007f3bdade5fa0 R15: 0000000000000003
 </TASK>