live-kbench/live-kbench huggingface dataset:
Kernel bug: WARNING in gl861_ctrl_msg/usb_submit_urb
Subsystem: usb
Status: open

Crash report:
------------[ cut here ]------------
usb 2-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0
WARNING: CPU: 0 PID: 5845 at drivers/usb/core/urb.c:413 usb_submit_urb+0x11dd/0x18c0 drivers/usb/core/urb.c:411
Modules linked in:
CPU: 0 UID: 0 PID: 5845 Comm: syz-executor566 Not tainted 6.15.0-rc2-syzkaller-00488-g6fea5fabd332 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:usb_submit_urb+0x11dd/0x18c0 drivers/usb/core/urb.c:411
Code: 48 8b 4c 24 08 0f b6 04 01 84 c0 0f 85 52 05 00 00 45 0f b6 07 48 c7 c7 a0 59 f2 8c 4c 89 f6 48 89 da 89 e9 e8 64 c2 f1 f9 90 <0f> 0b 90 90 e9 c7 f3 ff ff 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 53
RSP: 0018:ffffc900040df748 EFLAGS: 00010246
RAX: a1ba001046e4b900 RBX: ffff88801e2f6cc0 RCX: ffff888027a31e00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000080000280 R08: ffffffff818218d2 R09: 1ffff9200081be84
R10: dffffc0000000000 R11: fffff5200081be85 R12: ffff8881453e30b0
R13: ffff88801e6c1b00 R14: ffffffff8cf2c440 R15: ffff8880206cf7c0
FS:  000055558e0e4380(0000) GS:ffff888124f9a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000558df9b18050 CR3: 00000000326be000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 usb_start_wait_urb+0x11a/0x530 drivers/usb/core/message.c:59
 usb_internal_control_msg drivers/usb/core/message.c:103 [inline]
 usb_control_msg+0x2b3/0x4c0 drivers/usb/core/message.c:154
 gl861_ctrl_msg+0x332/0x6f0 drivers/media/usb/dvb-usb-v2/gl861.c:58
 gl861_i2c_master_xfer+0x3b4/0x650 drivers/media/usb/dvb-usb-v2/gl861.c:144
 __i2c_transfer+0x859/0x2250 drivers/i2c/i2c-core-base.c:-1
 i2c_transfer+0x2c2/0x430 drivers/i2c/i2c-core-base.c:2315
 i2cdev_ioctl_rdwr+0x488/0x780 drivers/i2c/i2c-dev.c:306
 i2cdev_ioctl+0x78a/0xa20 drivers/i2c/i2c-dev.c:467
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:906 [inline]
 __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:892
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf3/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f83d3039529
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffa9feff58 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007f83d3039529
RDX: 0000200000002580 RSI: 0000000000000707 RDI: 0000000000000004
RBP: 00000000000f4240 R08: 00232d6332692f76 R09: 00000000000000a0
R10: 000000000000000f R11: 0000000000000246 R12: 0000000000000001
R13: 00007fffa9ff0178 R14: 00007fffa9feff80 R15: 00007fffa9feff70
 </TASK>
Kernel bug: WARNING in cfg80211_scan_done
Subsystem: wireless
Status: open

Crash report:
------------[ cut here ]------------
WARNING: CPU: 1 PID: 12 at net/wireless/scan.c:1194 cfg80211_scan_done+0x2f3/0x480 net/wireless/scan.c:1193
Modules linked in:
CPU: 1 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:cfg80211_scan_done+0x2f3/0x480 net/wireless/scan.c:1193
Code: 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d e9 c2 55 b1 00 cc e8 5c 14 ac f7 90 0f 0b 90 e9 07 fe ff ff e8 4e 14 ac f7 90 <0f> 0b 90 e9 d7 fe ff ff e8 40 14 ac f7 c6 05 cf c6 ad 04 01 90 48
RSP: 0018:ffffc900001178c0 EFLAGS: 00010293
RAX: ffffffff8a12a9b2 RBX: ffff8880410afc18 RCX: ffff88801b2cda00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000117988 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1dac52f R12: ffff8880410afc00
R13: ffff8880410afc78 R14: dffffc0000000000 R15: ffff88805bb00860
FS:  0000000000000000(0000) GS:ffff888126efc000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f01fb510890 CR3: 0000000023fd4000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __ieee80211_scan_completed+0x550/0xb40 net/mac80211/scan.c:501
 cfg80211_wiphy_work+0x2bb/0x470 net/wireless/core.c:435
 process_one_work kernel/workqueue.c:3263 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Kernel bug: BUG: unable to handle kernel NULL pointer dereference in filemap_read_folio (4)
Subsystem: fs
Status: open

Crash report:
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 8000000056a42067 P4D 8000000056a42067 PUD 0 
Oops: Oops: 0010 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 6106 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 0018:ffffc900034c7938 EFLAGS: 00010293
RAX: ffffffff81fb26d4 RBX: 1ffffd40003188b0 RCX: ffff88802e7c9e80
RDX: 0000000000000000 RSI: ffffea00018c4580 RDI: ffff88807c7f28c0
RBP: ffffc900034c79f8 R08: ffffea00018c4587 R09: 1ffffd40003188b0
R10: dffffc0000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffffea00018c4588 R14: ffffea00018c4580 R15: 1ffffd40003188b1
FS:  00007fc5a7b436c0(0000) GS:ffff888125e35000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 0000000074ee0000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 filemap_read_folio+0x117/0x380 mm/filemap.c:2496
 do_read_cache_folio+0x358/0x590 mm/filemap.c:4096
 freader_get_folio+0x3c7/0x830 lib/buildid.c:58
 freader_fetch+0xa3/0x750 lib/buildid.c:101
 __build_id_parse+0x133/0x7d0 lib/buildid.c:289
 do_procmap_query fs/proc/task_mmu.c:733 [inline]
 procfs_procmap_ioctl+0x76f/0xce0 fs/proc/task_mmu.c:813
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc5a6d8f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc5a7b43038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fc5a6fe6090 RCX: 00007fc5a6d8f749
RDX: 0000200000000180 RSI: 00000000c0686611 RDI: 0000000000000003
RBP: 00007fc5a6e13f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fc5a6fe6128 R14: 00007fc5a6fe6090 R15: 00007ffc8ea85678
 </TASK>
Modules linked in:
CR2: 0000000000000000
---[ end trace 0000000000000000 ]---
RIP: 0010:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 0018:ffffc900034c7938 EFLAGS: 00010293
RAX: ffffffff81fb26d4 RBX: 1ffffd40003188b0 RCX: ffff88802e7c9e80
RDX: 0000000000000000 RSI: ffffea00018c4580 RDI: ffff88807c7f28c0
RBP: ffffc900034c79f8 R08: ffffea00018c4587 R09: 1ffffd40003188b0
R10: dffffc0000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffffea00018c4588 R14: ffffea00018c4580 R15: 1ffffd40003188b1
FS:  00007fc5a7b436c0(0000) GS:ffff888125e35000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 0000000074ee0000 CR4: 00000000003526f0
Kernel bug: UBSAN: array-index-out-of-bounds in __ocfs2_find_path
Subsystem: ocfs2
Status: fixed

Crash report:
loop0: detected capacity change from 0 to 32768
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in fs/ocfs2/alloc.c:1838:11
index 0 is out of range for type 'struct ocfs2_extent_rec[] __counted_by(l_count)' (aka 'struct ocfs2_extent_rec[]')
CPU: 0 UID: 0 PID: 6062 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 ubsan_epilogue+0xa/0x40 lib/ubsan.c:233
 __ubsan_handle_out_of_bounds+0xe9/0xf0 lib/ubsan.c:455
 __ocfs2_find_path+0x606/0xa40 fs/ocfs2/alloc.c:1838
 ocfs2_find_leaf+0xab/0x1c0 fs/ocfs2/alloc.c:1946
 ocfs2_get_clusters_nocache+0x172/0xc60 fs/ocfs2/extent_map.c:418
 ocfs2_get_clusters+0x505/0xa70 fs/ocfs2/extent_map.c:631
 ocfs2_extent_map_get_blocks+0x202/0x6a0 fs/ocfs2/extent_map.c:678
 ocfs2_read_virt_blocks+0x286/0x930 fs/ocfs2/extent_map.c:1001
 ocfs2_read_dir_block fs/ocfs2/dir.c:521 [inline]
 ocfs2_find_entry_el fs/ocfs2/dir.c:728 [inline]
 ocfs2_find_entry+0x3e4/0x2090 fs/ocfs2/dir.c:1120
 ocfs2_find_files_on_disk+0xdf/0x310 fs/ocfs2/dir.c:2023
 ocfs2_lookup_ino_from_name+0x52/0x100 fs/ocfs2/dir.c:2045
 _ocfs2_get_system_file_inode fs/ocfs2/sysfile.c:136 [inline]
 ocfs2_get_system_file_inode+0x326/0x770 fs/ocfs2/sysfile.c:112
 ocfs2_init_global_system_inodes+0x319/0x660 fs/ocfs2/super.c:461
 ocfs2_initialize_super fs/ocfs2/super.c:2196 [inline]
 ocfs2_fill_super+0x4432/0x65b0 fs/ocfs2/super.c:993
 get_tree_bdev_flags+0x40e/0x4d0 fs/super.c:1691
 vfs_get_tree+0x92/0x2a0 fs/super.c:1751
 fc_mount fs/namespace.c:1199 [inline]
 do_new_mount_fc fs/namespace.c:3636 [inline]
 do_new_mount+0x302/0xa10 fs/namespace.c:3712
 do_mount fs/namespace.c:4035 [inline]
 __do_sys_mount fs/namespace.c:4224 [inline]
 __se_sys_mount+0x313/0x410 fs/namespace.c:4201
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6175f30eea
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffefc9145f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffefc914680 RCX: 00007f6175f30eea
RDX: 0000200000004440 RSI: 0000200000000340 RDI: 00007ffefc914640
RBP: 0000200000004440 R08: 00007ffefc914680 R09: 0000000000004000
R10: 0000000000004000 R11: 0000000000000246 R12: 0000200000000340
R13: 00007ffefc914640 R14: 0000000000004463 R15: 0000200000000300
 </TASK>
---[ end trace ]---
Kernel bug: WARNING in mark_buffer_dirty (7)
Subsystem: hfs, bfs
Status: open

Crash report:
loop0: detected capacity change from 0 to 64
------------[ cut here ]------------
WARNING: CPU: 1 PID: 6091 at fs/buffer.c:1183 mark_buffer_dirty+0x2a9/0x410 fs/buffer.c:1183
Modules linked in:
CPU: 1 UID: 0 PID: 6091 Comm: syz.0.27 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:mark_buffer_dirty+0x2a9/0x410 fs/buffer.c:1183
Code: 4c 89 f7 e8 a9 9b e1 ff 49 8b 3e be 40 00 00 00 5b 41 5c 41 5e 41 5f 5d e9 14 e9 fb ff e8 bf dc 7f ff eb 8c e8 b8 dc 7f ff 90 <0f> 0b 90 e9 95 fd ff ff e8 aa dc 7f ff 90 0f 0b 90 e9 bf fd ff ff
RSP: 0018:ffffc90003d7f608 EFLAGS: 00010293
RAX: ffffffff823ed098 RBX: ffff888041d62de0 RCX: ffff88802038bc00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff888036e34001 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed10083ac5bd R12: ffff888047042c00
R13: ffff888041d62a68 R14: ffff888041d62de0 R15: 000000000000000a
FS:  0000555569a76500(0000) GS:ffff888126ef6000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff9bcf3f68c CR3: 0000000038082000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 bfs_move_block fs/bfs/file.c:44 [inline]
 bfs_move_blocks fs/bfs/file.c:57 [inline]
 bfs_get_block+0x5da/0xae0 fs/bfs/file.c:126
 __block_write_begin_int+0x6b5/0x1900 fs/buffer.c:2145
 block_write_begin+0x8a/0x120 fs/buffer.c:2256
 bfs_write_begin+0x35/0xd0 fs/bfs/file.c:180
 generic_perform_write+0x29d/0x8c0 mm/filemap.c:4254
 generic_file_write_iter+0x118/0x550 mm/filemap.c:4397
 new_sync_write fs/read_write.c:593 [inline]
 vfs_write+0x5d5/0xb40 fs/read_write.c:686
 ksys_pwrite64 fs/read_write.c:793 [inline]
 __do_sys_pwrite64 fs/read_write.c:801 [inline]
 __se_sys_pwrite64 fs/read_write.c:798 [inline]
 __x64_sys_pwrite64+0x196/0x220 fs/read_write.c:798
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7faa82b9f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffde23b5f78 EFLAGS: 00000246 ORIG_RAX: 0000000000000012
RAX: ffffffffffffffda RBX: 00007faa82df5fa0 RCX: 00007faa82b9f749
RDX: 000000000000fdef RSI: 0000200000000140 RDI: 0000000000000006
RBP: 00007faa82c23f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000e7c R11: 0000000000000246 R12: 0000000000000000
R13: 00007faa82df5fa0 R14: 00007faa82df5fa0 R15: 0000000000000004
 </TASK>
Kernel bug: memory leak in gfs2_trans_begin (2)
Subsystem: gfs2
Status: open

Crash report:
BUG: memory leak
unreferenced object 0xffff888110e52000 (size 144):
  comm "syz.0.17", pid 6071, jiffies 4294944857
  hex dump (first 32 bytes):
    c0 ff 59 82 ff ff ff ff 05 00 00 00 db 1a 00 00  ..Y.............
    0b 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00  ................
  backtrace (crc 853012f0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4983 [inline]
    slab_alloc_node mm/slub.c:5288 [inline]
    kmem_cache_alloc_noprof+0x397/0x5a0 mm/slub.c:5295
    gfs2_trans_begin+0x29/0xa0 fs/gfs2/trans.c:115
    alloc_dinode fs/gfs2/inode.c:418 [inline]
    gfs2_create_inode+0xca0/0x1890 fs/gfs2/inode.c:807
    gfs2_atomic_open+0x98/0x190 fs/gfs2/inode.c:1387
    atomic_open fs/namei.c:3656 [inline]
    lookup_open fs/namei.c:3767 [inline]
    open_last_lookups fs/namei.c:3895 [inline]
    path_openat+0x13ef/0x1eb0 fs/namei.c:4131
    do_filp_open+0x102/0x1f0 fs/namei.c:4161
    do_sys_openat2+0xc1/0x140 fs/open.c:1437
    do_sys_open fs/open.c:1452 [inline]
    __do_sys_openat fs/open.c:1468 [inline]
    __se_sys_openat fs/open.c:1463 [inline]
    __x64_sys_openat+0xb2/0x100 fs/open.c:1463
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF
Kernel bug: KMSAN: kernel-infoleak in i2cdev_ioctl_smbus
Subsystem: usb, i2c
Status: open

Crash report:
=====================================================
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak in _inline_copy_to_user include/linux/uaccess.h:196 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120 lib/usercopy.c:26
 instrument_copy_to_user include/linux/instrumented.h:114 [inline]
 _inline_copy_to_user include/linux/uaccess.h:196 [inline]
 _copy_to_user+0xcc/0x120 lib/usercopy.c:26
 copy_to_user include/linux/uaccess.h:225 [inline]
 i2cdev_ioctl_smbus+0x586/0x660 drivers/i2c/i2c-dev.c:394
 i2cdev_ioctl+0xa14/0xf40 drivers/i2c/i2c-dev.c:478
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0x23c/0x400 fs/ioctl.c:583
 __x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:583
 x64_sys_call+0x1cbc/0x3e30 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 i2c_smbus_xfer_emulated drivers/i2c/i2c-core-smbus.c:-1 [inline]
 __i2c_smbus_xfer+0x2561/0x2f60 drivers/i2c/i2c-core-smbus.c:608
 i2c_smbus_xfer+0x31d/0x4d0 drivers/i2c/i2c-core-smbus.c:546
 i2cdev_ioctl_smbus+0x4a1/0x660 drivers/i2c/i2c-dev.c:389
 i2cdev_ioctl+0xa14/0xf40 drivers/i2c/i2c-dev.c:478
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0x23c/0x400 fs/ioctl.c:583
 __x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:583
 x64_sys_call+0x1cbc/0x3e30 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Local variable msgbuf1.i created at:
 i2c_smbus_xfer_emulated drivers/i2c/i2c-core-smbus.c:335 [inline]
 __i2c_smbus_xfer+0x86a/0x2f60 drivers/i2c/i2c-core-smbus.c:608
 i2c_smbus_xfer+0x31d/0x4d0 drivers/i2c/i2c-core-smbus.c:546

Byte 0 of 1 is uninitialized
Memory access of size 1 starts at ffff888049c8bcf6
Data copied to user address 0000200000000040

CPU: 0 UID: 0 PID: 6049 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(none) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
=====================================================
Kernel bug: WARNING: bad unlock balance in namespace_unlock
Subsystem: fs
Status: open

Crash report:
=====================================
WARNING: bad unlock balance detected!
syzkaller #0 Not tainted
-------------------------------------
syz.0.45/6245 is trying to release lock (namespace_sem) at:
[<ffffffff82401096>] namespace_unlock+0x486/0x760 fs/namespace.c:1705
but there are no more locks to release!

other info that might help us debug this:
no locks held by syz.0.45/6245.

stack backtrace:
CPU: 0 UID: 0 PID: 6245 Comm: syz.0.45 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 print_unlock_imbalance_bug+0xdc/0xf0 kernel/locking/lockdep.c:5298
 __lock_release kernel/locking/lockdep.c:5527 [inline]
 lock_release+0x212/0x3e0 kernel/locking/lockdep.c:5889
 up_write+0x2d/0x420 kernel/locking/rwsem.c:1642
 namespace_unlock+0x486/0x760 fs/namespace.c:1705
 class_namespace_excl_destructor fs/namespace.c:96 [inline]
 copy_mnt_ns+0x6e5/0x880 fs/namespace.c:4176
 create_new_namespaces+0xd1/0x720 kernel/nsproxy.c:78
 unshare_nsproxy_namespaces+0x11c/0x170 kernel/nsproxy.c:218
 ksys_unshare+0x4c8/0x8c0 kernel/fork.c:3198
 __do_sys_unshare kernel/fork.c:3269 [inline]
 __se_sys_unshare kernel/fork.c:3267 [inline]
 __x64_sys_unshare+0x38/0x50 kernel/fork.c:3267
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5a3d18eec9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5a3df98038 EFLAGS: 00000246 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007f5a3d3e6180 RCX: 00007f5a3d18eec9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040020000
RBP: 00007f5a3d211f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5a3d3e6218 R14: 00007f5a3d3e6180 R15: 00007fffccee9248
 </TASK>
Kernel bug: WARNING in cfg80211_rehash_bss
Subsystem: wireless
Status: open

Crash report:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 43 at net/wireless/scan.c:1666 rb_insert_bss net/wireless/scan.c:1666 [inline]
WARNING: CPU: 0 PID: 43 at net/wireless/scan.c:1666 cfg80211_rehash_bss+0x1e6/0x540 net/wireless/scan.c:1723
Modules linked in:
CPU: 0 UID: 0 PID: 43 Comm: kworker/u4:3 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:rb_insert_bss net/wireless/scan.c:1666 [inline]
RIP: 0010:cfg80211_rehash_bss+0x1e6/0x540 net/wireless/scan.c:1723
Code: e8 48 c1 e8 03 42 0f b6 04 30 84 c0 0f 85 33 03 00 00 ff 45 00 48 83 c4 18 5b 41 5c 41 5d 41 5e 41 5f 5d e9 0c 3d af 00 cc 90 <0f> 0b 90 4c 8b 2c 24 4c 89 ef e8 7b 4c 02 fa 84 c0 74 78 e8 e2 dd
RSP: 0018:ffffc900005e6f20 EFLAGS: 00010246
RAX: ffffffff8acfee15 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88801f0c8000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff8880113f6c68 R08: 0000000000000000 R09: 0000000000000002
R10: 0000000000000002 R11: 0000000000000000 R12: ffff888043c281a0
R13: ffff88801a485430 R14: dffffc0000000000 R15: ffff88801a484c20
FS:  0000000000000000(0000) GS:ffff88808d00a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c009610000 CR3: 0000000011e4c000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 cfg80211_update_assoc_bss_entry+0x3f6/0x6a0 net/wireless/scan.c:3471
 cfg80211_ch_switch_notify+0x3c1/0x780 net/wireless/nl80211.c:20399
 ieee80211_sta_process_chanswitch+0xad4/0x2870 net/mac80211/mlme.c:-1
 ieee80211_rx_mgmt_beacon+0x19c7/0x2cd0 net/mac80211/mlme.c:7523
 ieee80211_sta_rx_queued_mgmt+0x4ed/0x4470 net/mac80211/mlme.c:8093
 ieee80211_iface_process_skb net/mac80211/iface.c:1696 [inline]
 ieee80211_iface_work+0x652/0x12d0 net/mac80211/iface.c:1753
 cfg80211_wiphy_work+0x2b8/0x470 net/wireless/core.c:435
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3319
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
 kthread+0x70e/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x436/0x7d0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Kernel bug: INFO: task hung in nl80211_pre_doit (3)
Subsystem: wireless
Status: open

Crash report:
INFO: task syz-executor:5470 blocked for more than 143 seconds.
      Not tainted 6.15.0-syzkaller-13473-gc0c9379f235d #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:21016 pid:5470  tgid:5470  ppid:1      task_flags:0x400140 flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5396 [inline]
 __schedule+0x16f5/0x4d00 kernel/sched/core.c:6785
 __schedule_loop kernel/sched/core.c:6863 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:6878
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6935
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x724/0xe80 kernel/locking/mutex.c:747
 nl80211_pre_doit+0x5f/0x930 net/wireless/nl80211.c:16733
 genl_family_rcv_msg_doit+0x1bb/0x300 net/netlink/genetlink.c:1110
 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
 genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210
 netlink_rcv_skb+0x205/0x470 net/netlink/af_netlink.c:2534
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
 netlink_unicast+0x758/0x8d0 net/netlink/af_netlink.c:1339
 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1883
 sock_sendmsg_nosec net/socket.c:712 [inline]
 __sock_sendmsg+0x219/0x270 net/socket.c:727
 __sys_sendto+0x3bd/0x520 net/socket.c:2180