live-kbench/live-kbench huggingface dataset:
Kernel bug: UBSAN: shift-out-of-bounds in dbFindBits
Subsystem: jfs
Status: fixed

Crash report:
ERROR: (device loop0): remounting filesystem as read-only
jfs_rename: dtInsert returned -EIO
ERROR: (device loop0): dbAllocBits: leaf page corrupt
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:3025:47
shift exponent 32 is too large for 32-bit type 'u32' (aka 'unsigned int')
CPU: 0 UID: 0 PID: 5213 Comm: syz-executor267 Not tainted 6.11.0-rc2-syzkaller-00239-g34ac1e82e5a7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:93 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119
 ubsan_epilogue lib/ubsan.c:231 [inline]
 __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468
 dbFindBits+0x11a/0x1d0 fs/jfs/jfs_dmap.c:3025
 dbAllocDmapLev+0x1e9/0x4a0 fs/jfs/jfs_dmap.c:1985
 dbAllocCtl+0x113/0x920 fs/jfs/jfs_dmap.c:1825
 dbAllocAG+0x28f/0x10b0 fs/jfs/jfs_dmap.c:1364
 dbDiscardAG+0x352/0xa20 fs/jfs/jfs_dmap.c:1613
 jfs_ioc_trim+0x433/0x670 fs/jfs/jfs_discard.c:100
 jfs_ioctl+0x2d0/0x3e0 fs/jfs/ioctl.c:131
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fbb2632d059
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe933950b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fbb26376095 RCX: 00007fbb2632d059
RDX: 0000000020000080 RSI: 00000000c0185879 RDI: 0000000000000006
RBP: 00007fbb263a85f0 R08: 000055555ee264c0 R09: 000055555ee264c0
R10: 000055555ee264c0 R11: 0000000000000246 R12: 00007ffe933950e0
R13: 00007ffe93395308 R14: 431bde82d7b634db R15: 00007fbb2637603b
 </TASK>
---[ end trace ]---
Kernel bug: KMSAN: uninit-value in diFree
Subsystem: jfs
Status: fixed

Crash report:
ERROR: (device loop0): diUpdatePMap: the iag is outside the map
ERROR: (device loop0): remounting filesystem as read-only
=====================================================
BUG: KMSAN: uninit-value in hex_dump_to_buffer+0x888/0x1100 lib/hexdump.c:171
 hex_dump_to_buffer+0x888/0x1100 lib/hexdump.c:171
 print_hex_dump+0x13d/0x3e0 lib/hexdump.c:276
 diFree+0x5ba/0x4350 fs/jfs/jfs_imap.c:876
 jfs_evict_inode+0x510/0x550 fs/jfs/inode.c:156
 evict+0x723/0xd10 fs/inode.c:796
 iput_final fs/inode.c:1946 [inline]
 iput+0x97b/0xdb0 fs/inode.c:1972
 txUpdateMap+0xf3e/0x1150 fs/jfs/jfs_txnmgr.c:2367
 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline]
 jfs_lazycommit+0x627/0x11d0 fs/jfs/jfs_txnmgr.c:2733
 kthread+0x6b9/0xef0 kernel/kthread.c:464
 ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:4121 [inline]
 slab_alloc_node mm/slub.c:4164 [inline]
 __kmalloc_cache_noprof+0x8e3/0xdf0 mm/slub.c:4320
 kmalloc_noprof include/linux/slab.h:901 [inline]
 diMount+0x61/0x7f0 fs/jfs/jfs_imap.c:105
 jfs_mount+0xa8e/0x11d0 fs/jfs/jfs_mount.c:176
 jfs_fill_super+0xa47/0x17c0 fs/jfs/super.c:523
 get_tree_bdev_flags+0x6ec/0x910 fs/super.c:1636
 get_tree_bdev+0x37/0x50 fs/super.c:1659
 jfs_get_tree+0x34/0x40 fs/jfs/super.c:635
 vfs_get_tree+0xb1/0x5a0 fs/super.c:1814
 do_new_mount+0x71f/0x15e0 fs/namespace.c:3560
 path_mount+0x742/0x1f10 fs/namespace.c:3887
 do_mount fs/namespace.c:3900 [inline]
 __do_sys_mount fs/namespace.c:4111 [inline]
 __se_sys_mount+0x71f/0x800 fs/namespace.c:4088
 __x64_sys_mount+0xe4/0x150 fs/namespace.c:4088
 x64_sys_call+0x39bf/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 1 UID: 0 PID: 113 Comm: jfsCommit Not tainted 6.14.0-rc3-syzkaller-00060-g6537cfb395f3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
=====================================================
Kernel bug: KMSAN: uninit-value in __sctp_v6_cmp_addr (2)
Subsystem: sctp
Status: fixed

Crash report:
=====================================================
BUG: KMSAN: uninit-value in __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649
 __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649
 sctp_inet6_cmp_addr+0x4f2/0x510 net/sctp/ipv6.c:983
 sctp_bind_addr_conflict+0x22a/0x3b0 net/sctp/bind_addr.c:390
 sctp_get_port_local+0x21eb/0x2440 net/sctp/socket.c:8452
 sctp_get_port net/sctp/socket.c:8523 [inline]
 sctp_listen_start net/sctp/socket.c:8567 [inline]
 sctp_inet_listen+0x710/0xfd0 net/sctp/socket.c:8636
 __sys_listen_socket net/socket.c:1912 [inline]
 __sys_listen net/socket.c:1927 [inline]
 __do_sys_listen net/socket.c:1932 [inline]
 __se_sys_listen net/socket.c:1930 [inline]
 __x64_sys_listen+0x343/0x4c0 net/socket.c:1930
 x64_sys_call+0x271d/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:51
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Local variable t.i created at:
 __do_sys_futex kernel/futex/syscalls.c:165 [inline]
 __se_sys_futex+0x4d/0x740 kernel/futex/syscalls.c:160
 __x64_sys_futex+0x114/0x1a0 kernel/futex/syscalls.c:160

CPU: 1 UID: 0 PID: 6089 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(none) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
=====================================================
Kernel bug: WARNING in dev_xdp_install
Subsystem: bpf
Status: fixed

Crash report:
------------[ cut here ]------------
WARNING: CPU: 3 PID: 5936 at ./include/net/netdev_lock.h:54 netdev_ops_assert_locked include/net/netdev_lock.h:54 [inline]
WARNING: CPU: 3 PID: 5936 at ./include/net/netdev_lock.h:54 dev_xdp_install+0x610/0x9b0 net/core/dev.c:9911
Modules linked in:
CPU: 3 UID: 0 PID: 5936 Comm: syz-executor652 Not tainted 6.14.0-syzkaller-12456-gacc4d5ff0b61 #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:netdev_ops_assert_locked include/net/netdev_lock.h:54 [inline]
RIP: 0010:dev_xdp_install+0x610/0x9b0 net/core/dev.c:9911
Code: 8d bc 24 30 0d 00 00 be ff ff ff ff e8 b9 0d 28 02 31 ff 89 c5 89 c6 e8 4e f4 71 f8 85 ed 0f 85 59 fb ff ff e8 01 f9 71 f8 90 <0f> 0b 90 e9 4b fb ff ff e8 f3 f8 71 f8 49 8d bc 24 30 0d 00 00 be
RSP: 0018:ffffc900031d7950 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88802ab20cc5 RCX: ffffffff89494752
RDX: ffff88802a4b2440 RSI: ffffffff8949475f RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88802ab20000
R13: ffffffff87119240 R14: ffffc90000a26000 R15: 0000000000000002
FS:  0000555586ae1380(0000) GS:ffff8880d6cbb000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000140 CR3: 0000000030ae2000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 dev_xdp_attach+0x6d1/0x16a0 net/core/dev.c:10094
 dev_xdp_attach_link net/core/dev.c:10113 [inline]
 bpf_xdp_link_attach+0x2c5/0x680 net/core/dev.c:10287
 link_create kernel/bpf/syscall.c:5418 [inline]
 __sys_bpf+0x19ef/0x4d80 kernel/bpf/syscall.c:5904
 __do_sys_bpf kernel/bpf/syscall.c:5941 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5939 [inline]
 __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5939
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa71b995919
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc061aef48 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa71b995919
RDX: 0000000000000040 RSI: 0000200000000200 RDI: 000000000000001c
RBP: 0000000000000000 R08: 0000555500000000 R09: 0000555500000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000003
 </TASK>
Kernel bug: WARNING in virtio_transport_send_pkt_info
Subsystem: kvm, net, virt
Status: fixed

Crash report:
------------[ cut here ]------------
'send_pkt()' returns 0, but 65536 expected
WARNING: CPU: 0 PID: 5503 at net/vmw_vsock/virtio_transport_common.c:428 virtio_transport_send_pkt_info+0xd11/0xf00 net/vmw_vsock/virtio_transport_common.c:426
Modules linked in:
CPU: 0 UID: 0 PID: 5503 Comm: syz.0.17 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:virtio_transport_send_pkt_info+0xd11/0xf00 net/vmw_vsock/virtio_transport_common.c:426
Code: 0f 0b 90 bd f2 ff ff ff eb bc e8 8a 20 65 f6 c6 05 94 cf 32 04 01 90 48 c7 c7 00 c3 b8 8c 44 89 f6 4c 89 ea e8 40 af 28 f6 90 <0f> 0b 90 90 e9 e1 fe ff ff e8 61 20 65 f6 90 0f 0b 90 e9 c5 f7 ff
RSP: 0018:ffffc900027ff530 EFLAGS: 00010246
RAX: d7fcdfc663889c00 RBX: 0000000000010000 RCX: ffff888000e1a440
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: ffffffff8f8764d0 R08: ffff88801fc24253 R09: 1ffff11003f8484a
R10: dffffc0000000000 R11: ffffed1003f8484b R12: dffffc0000000000
R13: 0000000000010000 R14: 0000000000000000 R15: ffff888058b48024
FS:  000055556bda1500(0000) GS:ffff88808d218000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000020000003f000 CR3: 000000003f6db000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 virtio_transport_stream_enqueue net/vmw_vsock/virtio_transport_common.c:1111 [inline]
 virtio_transport_seqpacket_enqueue+0x143/0x1c0 net/vmw_vsock/virtio_transport_common.c:839
 vsock_connectible_sendmsg+0xac7/0x1050 net/vmw_vsock/af_vsock.c:2140
 sock_sendmsg_nosec net/socket.c:714 [inline]
 __sock_sendmsg+0x21c/0x270 net/socket.c:729
 ____sys_sendmsg+0x52d/0x830 net/socket.c:2614
 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668
 __sys_sendmmsg+0x227/0x430 net/socket.c:2757
 __do_sys_sendmmsg net/socket.c:2784 [inline]
 __se_sys_sendmmsg net/socket.c:2781 [inline]
 __x64_sys_sendmmsg+0xa0/0xc0 net/socket.c:2781
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fddc238ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd48081028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00007fddc25b5fa0 RCX: 00007fddc238ebe9
RDX: 0000000000000001 RSI: 0000200000000100 RDI: 0000000000000004
RBP: 00007fddc2411e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000024008094 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fddc25b5fa0 R14: 00007fddc25b5fa0 R15: 0000000000000004
 </TASK>
Kernel bug: WARNING in tracing_buffers_mmap_close (2)
Subsystem: trace
Status: fixed

Crash report:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5989 at kernel/trace/trace.c:8780 tracing_buffers_mmap_close kernel/trace/trace.c:8780 [inline]
WARNING: CPU: 0 PID: 5989 at kernel/trace/trace.c:8780 tracing_buffers_mmap_close+0xdd/0x130 kernel/trace/trace.c:8775
Modules linked in:
CPU: 0 UID: 0 PID: 5989 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:tracing_buffers_mmap_close kernel/trace/trace.c:8780 [inline]
RIP: 0010:tracing_buffers_mmap_close+0xdd/0x130 kernel/trace/trace.c:8775
Code: 75 46 48 8b 7b 08 e8 b2 94 ff ff 31 ff 89 c3 89 c6 e8 07 4b fb ff 85 db 75 0a 48 83 c4 08 5b e9 b9 4f fb ff e8 b4 4f fb ff 90 <0f> 0b 90 48 83 c4 08 5b e9 a6 4f fb ff e8 b1 e6 62 00 eb 87 e8 da
RSP: 0018:ffffc90003047ba8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 00000000ffffffed RCX: ffffffff81c11d89
RDX: ffff888020713c80 RSI: ffffffff81c11d9c RDI: 0000000000000005
RBP: ffffffff81c11cc0 R08: 0000000000000005 R09: 0000000000000000
R10: 00000000ffffffed R11: 0000000000000000 R12: ffff8880217512c8
R13: dffffc0000000000 R14: ffffc90003047c30 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff888124a0d000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555606ff808 CR3: 000000000e182000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 vma_close mm/internal.h:190 [inline]
 remove_vma+0x88/0x160 mm/vma.c:464
 exit_mmap+0x50a/0xb90 mm/mmap.c:1305
 __mmput+0x12a/0x410 kernel/fork.c:1133
 mmput+0x62/0x70 kernel/fork.c:1156
 exit_mm kernel/exit.c:582 [inline]
 do_exit+0x7c7/0x2bf0 kernel/exit.c:954
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1107
 __do_sys_exit_group kernel/exit.c:1118 [inline]
 __se_sys_exit_group kernel/exit.c:1116 [inline]
 __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1116
 x64_sys_call+0x150b/0x1730 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f168a18f6c9
Code: Unable to access opcode bytes at 0x7f168a18f69f.
RSP: 002b:00007ffff8c604f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f168a18f6c9
RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000003 R08: 00000004f8c605ef R09: 00007f168a3b1280
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f168a3b1280 R14: 0000000000000003 R15: 00007ffff8c605b0
 </TASK>
Kernel bug: KMSAN: uninit-value in em_canid_match
Subsystem: can, net
Status: fixed

Crash report:
syzkaller0: entered promiscuous mode
syzkaller0: entered allmulticast mode
=====================================================
BUG: KMSAN: uninit-value in em_canid_match+0x2f0/0x360 net/sched/em_canid.c:104
 em_canid_match+0x2f0/0x360 net/sched/em_canid.c:104
 tcf_em_match net/sched/ematch.c:494 [inline]
 __tcf_em_tree_match+0x215/0xc70 net/sched/ematch.c:520
 tcf_em_tree_match include/net/pkt_cls.h:512 [inline]
 basic_classify+0x154/0x480 net/sched/cls_basic.c:50
 tc_classify include/net/tc_wrapper.h:197 [inline]
 __tcf_classify net/sched/cls_api.c:1764 [inline]
 tcf_classify+0x855/0x1cb0 net/sched/cls_api.c:1860
 multiq_classify net/sched/sch_multiq.c:39 [inline]
 multiq_enqueue+0x82/0x590 net/sched/sch_multiq.c:66
 dev_qdisc_enqueue net/core/dev.c:4118 [inline]
 __dev_xmit_skb net/core/dev.c:4214 [inline]
 __dev_queue_xmit+0x1d91/0x5e60 net/core/dev.c:4729
 dev_queue_xmit include/linux/netdevice.h:3365 [inline]
 packet_xmit+0x8f/0x710 net/packet/af_packet.c:275
 packet_snd net/packet/af_packet.c:3076 [inline]
 packet_sendmsg+0x9173/0xa2a0 net/packet/af_packet.c:3108
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg+0x333/0x3d0 net/socket.c:742
 ____sys_sendmsg+0x7e0/0xd80 net/socket.c:2630
 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2684
 __sys_sendmsg net/socket.c:2716 [inline]
 __do_sys_sendmsg net/socket.c:2721 [inline]
 __se_sys_sendmsg net/socket.c:2719 [inline]
 __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2719
 x64_sys_call+0x1dfd/0x3e30 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:4985 [inline]
 slab_alloc_node mm/slub.c:5288 [inline]
 kmem_cache_alloc_node_noprof+0x989/0x16b0 mm/slub.c:5340
 kmalloc_reserve+0x13c/0x4b0 net/core/skbuff.c:579
 __alloc_skb+0x347/0x7d0 net/core/skbuff.c:670
 alloc_skb include/linux/skbuff.h:1383 [inline]
 alloc_skb_with_frags+0xc5/0xa60 net/core/skbuff.c:6671
 sock_alloc_send_pskb+0xacc/0xc60 net/core/sock.c:2965
 packet_alloc_skb net/packet/af_packet.c:2926 [inline]
 packet_snd net/packet/af_packet.c:3019 [inline]
 packet_sendmsg+0x743d/0xa2a0 net/packet/af_packet.c:3108
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg+0x333/0x3d0 net/socket.c:742
 ____sys_sendmsg+0x7e0/0xd80 net/socket.c:2630
 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2684
 __sys_sendmsg net/socket.c:2716 [inline]
 __do_sys_sendmsg net/socket.c:2721 [inline]
 __se_sys_sendmsg net/socket.c:2719 [inline]
 __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2719
 x64_sys_call+0x1dfd/0x3e30 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 6067 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(none) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
=====================================================
Kernel bug: WARNING in kvm_recalculate_apic_map
Subsystem: kvm-x86
Status: fixed

Crash report:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5014 at arch/x86/kvm/lapic.c:341 kvm_recalculate_apic_map+0xc97/0x15b0 arch/x86/kvm/lapic.c:424
Modules linked in:
CPU: 0 PID: 5014 Comm: syz-executor181 Not tainted 6.5.0-rc6-syzkaller-00036-g4853c74bd7ab #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
RIP: 0010:kvm_recalculate_logical_map arch/x86/kvm/lapic.c:341 [inline]
RIP: 0010:kvm_recalculate_apic_map+0xc97/0x15b0 arch/x86/kvm/lapic.c:424
Code: 54 74 00 83 fb 01 7e 29 83 fb 02 74 5d 83 fb 03 74 6e 83 fb 04 0f 85 be 00 00 00 e8 d3 4f 74 00 e9 bb 00 00 00 e8 c9 4f 74 00 <0f> 0b e9 fd fe ff ff 85 db 0f 84 96 00 00 00 83 fb 01 0f 85 97 00
RSP: 0018:ffffc90003aaf400 EFLAGS: 00010293
RAX: ffffffff81176867 RBX: 0000000000000001 RCX: ffff8880277e8000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000082000
RBP: ffffc90003aaf548 R08: ffffffff8117675d R09: 1ffffffff1d30ead
R10: dffffc0000000000 R11: fffffbfff1d30eae R12: ffffc900015c6e58
R13: ffff88801fb2e090 R14: 0000000000082000 R15: ffff888076ea8024
FS:  0000555556776380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002004d008 CR3: 00000000283c0000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 kvm_apic_set_state+0x519/0x1700 arch/x86/kvm/lapic.c:2971
 kvm_vcpu_ioctl_set_lapic+0x20/0x180 arch/x86/kvm/x86.c:4944
 kvm_arch_vcpu_ioctl+0x1389/0x2a30 arch/x86/kvm/x86.c:5682
 kvm_vcpu_ioctl+0x6df/0xd00 arch/x86/kvm/../../../virt/kvm/kvm_main.c:4280
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:870 [inline]
 __se_sys_ioctl+0xf8/0x170 fs/ioctl.c:856
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f3b14249439
Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe1b9bfab8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ffe1b9bfc88 RCX: 00007f3b14249439
RDX: 0000000020000880 RSI: 000000004400ae8f RDI: 0000000000000005
RBP: 00007f3b142bc610 R08: 00007ffe1b9bfc88 R09: 00007ffe1b9bfc88
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffe1b9bfc78 R14: 0000000000000001 R15: 0000000000000001
 </TASK>
Kernel bug: KASAN: null-ptr-deref Read in bch2_sb_set_upgrade_extra
Subsystem: bcachefs
Status: fixed

Crash report:
bcachefs (loop0): flagging btree freespace lost data
error reading btree root freespace l=0: btree_node_read_error, fixing
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: null-ptr-deref in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
BUG: KASAN: null-ptr-deref in btree_node_fake fs/bcachefs/btree_types.h:622 [inline]
BUG: KASAN: null-ptr-deref in have_stripes fs/bcachefs/sb-downgrade.c:146 [inline]
BUG: KASAN: null-ptr-deref in bch2_sb_set_upgrade_extra+0x152/0x270 fs/bcachefs/sb-downgrade.c:161
Read of size 8 at addr 00000000000000b0 by task syz-executor407/5095

CPU: 0 UID: 0 PID: 5095 Comm: syz-executor407 Not tainted 6.12.0-rc3-syzkaller-00319-gb04ae0f45168 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_report+0xe8/0x550 mm/kasan/report.c:491
 kasan_report+0x143/0x180 mm/kasan/report.c:601
 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189
 instrument_atomic_read include/linux/instrumented.h:68 [inline]
 _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
 btree_node_fake fs/bcachefs/btree_types.h:622 [inline]
 have_stripes fs/bcachefs/sb-downgrade.c:146 [inline]
 bch2_sb_set_upgrade_extra+0x152/0x270 fs/bcachefs/sb-downgrade.c:161
 bch2_fs_recovery+0x25c4/0x39c0 fs/bcachefs/recovery.c:860
 bch2_fs_start+0x356/0x5b0 fs/bcachefs/super.c:1036
 bch2_fs_get_tree+0xd68/0x1710 fs/bcachefs/fs.c:2174
 vfs_get_tree+0x90/0x2b0 fs/super.c:1800
 do_new_mount+0x2be/0xb40 fs/namespace.c:3507
 do_mount fs/namespace.c:3847 [inline]
 __do_sys_mount fs/namespace.c:4055 [inline]
 __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4032
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff4b3b479ba
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe3df5ae28 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffe3df5ae40 RCX: 00007ff4b3b479ba
RDX: 00000000200058c0 RSI: 0000000020000000 RDI: 00007ffe3df5ae40
RBP: 0000000000000004 R08: 00007ffe3df5ae80 R09: 0000000000005909
R10: 0000000000010000 R11: 0000000000000282 R12: 0000000000010000
R13: 00007ffe3df5ae80 R14: 0000000000000003 R15: 0000000001000000
 </TASK>
==================================================================