live-kbench/live-kbench huggingface dataset:
Kernel bug: WARNING in io_pin_pages
Subsystem: io-uring
Status: fixed

Crash report:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5834 at io_uring/memmap.c:144 io_pin_pages+0x149/0x180 io_uring/memmap.c:144
Modules linked in:
CPU: 0 UID: 0 PID: 5834 Comm: syz-executor825 Not tainted 6.12.0-next-20241118-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
RIP: 0010:io_pin_pages+0x149/0x180 io_uring/memmap.c:144
Code: 63 fd 4c 89 f8 5b 41 5c 41 5e 41 5f 5d c3 cc cc cc cc e8 da c1 e3 fc 90 0f 0b 90 49 c7 c7 ea ff ff ff eb de e8 c8 c1 e3 fc 90 <0f> 0b 90 49 c7 c7 b5 ff ff ff eb cc 44 89 f1 80 e1 07 80 c1 03 38
RSP: 0018:ffffc90003d17c10 EFLAGS: 00010293
RAX: ffffffff84bbb6e8 RBX: fff0000000000091 RCX: ffff88802c6d5a00
RDX: 0000000000000000 RSI: fff0000000000091 RDI: 000000007fffffff
RBP: 000ffffffffffff0 R08: ffffffff84bbb5ee R09: 1ffff110041538c0
R10: dffffc0000000000 R11: ffffed10041538c1 R12: ffffffffffff0000
R13: ffffffffffff0000 R14: ffffc90003d17c80 R15: 1ffff110068d2920
FS:  0000555568d4e380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055ee7661e0d8 CR3: 0000000075cb2000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __io_uaddr_map+0xfb/0x2d0 io_uring/memmap.c:183
 io_rings_map io_uring/io_uring.c:2611 [inline]
 io_allocate_scq_urings+0x1c0/0x650 io_uring/io_uring.c:3470
 io_uring_create+0x5b5/0xc00 io_uring/io_uring.c:3692
 io_uring_setup io_uring/io_uring.c:3781 [inline]
 __do_sys_io_uring_setup io_uring/io_uring.c:3808 [inline]
 __se_sys_io_uring_setup+0x2ba/0x330 io_uring/io_uring.c:3802
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7feda57a15a9
Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff8a663b18 EFLAGS: 00000246 ORIG_RAX: 00000000000001a9
RAX: ffffffffffffffda RBX: 0000000000002c0c RCX: 00007feda57a15a9
RDX: ffffffffffffffb8 RSI: 0000000020000400 RDI: 0000000000002c0c
RBP: 00007feda5814610 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000000000e8 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fff8a663cf8 R14: 0000000000000001 R15: 0000000000000001
 </TASK>
Kernel bug: WARNING in io_sq_offload_create
Subsystem: io-uring
Status: fixed

Crash report:
------------[ cut here ]------------
WARNING: CPU: 1 PID: 5230 at include/linux/cpumask.h:135 cpu_max_bits_warn include/linux/cpumask.h:135 [inline]
WARNING: CPU: 1 PID: 5230 at include/linux/cpumask.h:135 cpumask_check include/linux/cpumask.h:142 [inline]
WARNING: CPU: 1 PID: 5230 at include/linux/cpumask.h:135 cpumask_test_cpu include/linux/cpumask.h:562 [inline]
WARNING: CPU: 1 PID: 5230 at include/linux/cpumask.h:135 io_sq_offload_create+0xe3d/0x1090 io_uring/sqpoll.c:469
Modules linked in:
CPU: 1 UID: 0 PID: 5230 Comm: syz-executor334 Not tainted 6.11.0-syzkaller-02520-gadfc3ded5c33 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
RIP: 0010:cpu_max_bits_warn include/linux/cpumask.h:135 [inline]
RIP: 0010:cpumask_check include/linux/cpumask.h:142 [inline]
RIP: 0010:cpumask_test_cpu include/linux/cpumask.h:562 [inline]
RIP: 0010:io_sq_offload_create+0xe3d/0x1090 io_uring/sqpoll.c:469
Code: 44 24 08 e9 2f f7 ff ff e8 a0 8d 0f fd 44 89 e3 e9 06 ff ff ff e8 93 8d 0f fd 4c 89 ff e8 6b 5f 7f fd eb ad e8 84 8d 0f fd 90 <0f> 0b 90 e9 f3 fd ff ff e8 76 8d 0f fd 31 ff 89 de e8 ad 8f 0f fd
RSP: 0018:ffffc9000369fcd8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88803234bc00 RCX: ffffffff847b951e
RDX: ffff88801f7eda00 RSI: ffffffff847b972c RDI: 0000000000000005
RBP: ffff88802b2aa000 R08: 0000000000000005 R09: 0000000000000007
R10: 0000000000000008 R11: 0000000000000000 R12: 0000000000000008
R13: 1ffff920006d3fa0 R14: ffffc9000369fd20 R15: 0000000000000000
FS:  000055557be9d380(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f88aadf0df8 CR3: 0000000078b14000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 io_uring_create io_uring/io_uring.c:3617 [inline]
 io_uring_setup+0x180f/0x3730 io_uring/io_uring.c:3726
 __do_sys_io_uring_setup io_uring/io_uring.c:3753 [inline]
 __se_sys_io_uring_setup io_uring/io_uring.c:3747 [inline]
 __x64_sys_io_uring_setup+0x98/0x140 io_uring/io_uring.c:3747
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f88aad91919
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe74f4e298 EFLAGS: 00000246 ORIG_RAX: 00000000000001a9
RAX: ffffffffffffffda RBX: 00007f88aaddb105 RCX: 00007f88aad91919
RDX: ffffffffffffffb8 RSI: 0000000000000003 RDI: 00000000000003ff
RBP: 00007f88aaddb0e3 R08: 0000000000008000 R09: 0000000000008000
R10: 0000000000008000 R11: 0000000000000246 R12: 00007f88aade009c
R13: 00007f88aaddb0a3 R14: 0000000000000001 R15: 0000000000000001
 </TASK>
Kernel bug: UBSAN: shift-out-of-bounds in bch2_blacklist_entries_gc
Subsystem: bcachefs
Status: fixed

Crash report:
bcachefs (loop0): stripes_read... done
bcachefs (loop0): snapshots_read... done
bcachefs (loop0): journal_replay... done
bcachefs (loop0): resume_logged_ops... done
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in ./include/linux/log2.h:67:13
shift exponent 4294967295 is too large for 64-bit type 'long unsigned int'
CPU: 0 PID: 5189 Comm: syz-executor355 Not tainted 6.10.0-rc4-syzkaller-00283-g563a50672d8a #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:114
 ubsan_epilogue lib/ubsan.c:231 [inline]
 __ubsan_handle_shift_out_of_bounds+0x2a5/0x480 lib/ubsan.c:468
 __rounddown_pow_of_two include/linux/log2.h:67 [inline]
 eytzinger1_first fs/bcachefs/eytzinger.h:51 [inline]
 eytzinger0_first fs/bcachefs/eytzinger.h:194 [inline]
 bch2_blacklist_entries_gc.cold+0x35/0x56 fs/bcachefs/journal_seq_blacklist.c:235
 bch2_fs_recovery+0x3240/0x3e40 fs/bcachefs/recovery.c:897
 bch2_fs_start+0x2e9/0x600 fs/bcachefs/super.c:1036
 bch2_fs_open+0xfa0/0x1110 fs/bcachefs/super.c:2128
 bch2_mount+0xe2c/0x1230 fs/bcachefs/fs.c:1926
 legacy_get_tree+0x109/0x220 fs/fs_context.c:662
 vfs_get_tree+0x8f/0x380 fs/super.c:1780
 do_new_mount fs/namespace.c:3352 [inline]
 path_mount+0x14e6/0x1f20 fs/namespace.c:3679
 do_mount fs/namespace.c:3692 [inline]
 __do_sys_mount fs/namespace.c:3898 [inline]
 __se_sys_mount fs/namespace.c:3875 [inline]
 __x64_sys_mount+0x297/0x320 fs/namespace.c:3875
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd8395e2bba
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe022b6078 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffe022b6090 RCX: 00007fd8395e2bba
RDX: 0000000020011a00 RSI: 0000000020000040 RDI: 00007ffe022b6090
RBP: 0000000000000004 R08: 00007ffe022b60d0 R09: 00000000000119f4
R10: 0000000001200014 R11: 0000000000000282 R12: 0000000001200014
R13: 00007ffe022b60d0 R14: 0000000000000003 R15: 0000000001000000
 </TASK>
---[ end trace ]---
Kernel bug: UBSAN: array-index-out-of-bounds in read_inline_xattr
Subsystem: f2fs
Status: fixed

Crash report:
F2FS-fs (loop0): Failed to enable quota tracking (type=1, err=-22). Please run fsck to fix.
F2FS-fs (loop0): Cannot turn on quotas: error -22
F2FS-fs (loop0): Mounted with checkpoint version = 1b41e954
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in fs/f2fs/f2fs.h:3292:19
index 18446744073709500059 is out of range for type '__le32[923]' (aka 'unsigned int[923]')
CPU: 1 UID: 0 PID: 5819 Comm: syz-executor309 Not tainted 6.13.0-rc3-syzkaller-00301-gbcde95ce32b6 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 ubsan_epilogue lib/ubsan.c:231 [inline]
 __ubsan_handle_out_of_bounds+0x121/0x150 lib/ubsan.c:429
 read_inline_xattr+0x273/0x280
 lookup_all_xattrs fs/f2fs/xattr.c:341 [inline]
 f2fs_getxattr+0x57b/0x13b0 fs/f2fs/xattr.c:533
 __vfs_getxattr+0x433/0x470 fs/xattr.c:423
 smk_fetch+0xb1/0x140 security/smack/smack_lsm.c:306
 smack_d_instantiate+0x749/0xa50 security/smack/smack_lsm.c:3615
 security_d_instantiate+0x107/0x1f0 security/security.c:4070
 d_splice_alias+0x6f/0x330 fs/dcache.c:3001
 f2fs_lookup+0x4ff/0x820 fs/f2fs/namei.c:523
 lookup_one_qstr_excl+0x11f/0x260 fs/namei.c:1692
 filename_create+0x297/0x540 fs/namei.c:4081
 do_mkdirat+0xbd/0x3a0 fs/namei.c:4326
 __do_sys_mkdir fs/namei.c:4354 [inline]
 __se_sys_mkdir fs/namei.c:4352 [inline]
 __x64_sys_mkdir+0x6c/0x80 fs/namei.c:4352
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fdaa8e2f717
Code: ff ff 77 07 31 c0 c3 0f 1f 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe117c86e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000053
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fdaa8e2f717
RDX: 0000000000000000 RSI: 00000000000001ff RDI: 0000000020000180
RBP: 0000000020000180 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffe117c8780 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
---[ end trace ]---
Kernel bug: UBSAN: array-index-out-of-bounds in dtReadFirst (2)
Subsystem: jfs
Status: fixed

Crash report:
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:3096:10
index 237 is out of range for type 'struct dtslot[128]'
CPU: 0 UID: 0 PID: 5822 Comm: syz-executor740 Not tainted 6.13.0-rc4-syzkaller-00110-g4099a71718b0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 ubsan_epilogue lib/ubsan.c:231 [inline]
 __ubsan_handle_out_of_bounds+0x121/0x150 lib/ubsan.c:429
 dtReadFirst+0x622/0xc50 fs/jfs/jfs_dtree.c:3096
 dtReadNext fs/jfs/jfs_dtree.c:3147 [inline]
 jfs_readdir+0x9aa/0x3c50 fs/jfs/jfs_dtree.c:2862
 wrap_directory_iterator+0x91/0xd0 fs/readdir.c:65
 iterate_dir+0x571/0x800 fs/readdir.c:108
 __do_sys_getdents64 fs/readdir.c:403 [inline]
 __se_sys_getdents64+0x1e2/0x4b0 fs/readdir.c:389
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1a02212fa3
Code: c1 66 0f 1f 44 00 00 48 83 c4 08 48 89 ef 5b 5d e9 a2 48 fb ff 66 90 b8 ff ff ff 7f 48 39 c2 48 0f 47 d0 b8 d9 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 c7 c2 b8 ff ff ff f7 d8
RSP: 002b:00007fffd5e0be18 EFLAGS: 00000293 ORIG_RAX: 00000000000000d9
RAX: ffffffffffffffda RBX: 000055557b4c7730 RCX: 00007f1a02212fa3
RDX: 0000000000008000 RSI: 000055557b4c7730 RDI: 0000000000000004
RBP: 000055557b4c7704 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000001000 R11: 0000000000000293 R12: ffffffffffffffb8
R13: 0000000000000010 R14: 000055557b4c7700 R15: 00007fffd5e0e090
 </TASK>
---[ end trace ]---
Kernel bug: WARNING in current_check_refer_path
Subsystem: lsm
Status: fixed

Crash report:
NILFS (loop0): broken superblock, retrying with spare superblock (blocksize = 1024)
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5090 at security/landlock/fs.c:971 get_mode_access security/landlock/fs.c:971 [inline]
WARNING: CPU: 0 PID: 5090 at security/landlock/fs.c:971 current_check_refer_path+0x71b/0xdd0 security/landlock/fs.c:1132
Modules linked in:
CPU: 0 UID: 0 PID: 5090 Comm: syz-executor393 Not tainted 6.12.0-rc4-syzkaller-00047-gc2ee9f594da8 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:get_mode_access security/landlock/fs.c:971 [inline]
RIP: 0010:current_check_refer_path+0x71b/0xdd0 security/landlock/fs.c:1132
Code: b8 00 08 89 04 24 eb 2c e8 42 02 18 fd 66 b8 40 00 89 04 24 eb 1e e8 34 02 18 fd 66 b8 00 10 89 04 24 eb 10 e8 26 02 18 fd 90 <0f> 0b 90 c7 04 24 00 00 00 00 8b 44 24 04 84 c0 0f 84 d6 00 00 00
RSP: 0018:ffffc9000af0fa60 EFLAGS: 00010293
RAX: ffffffff847cd5ba RBX: 000000000000000f RCX: ffff8880003f4880
RDX: 0000000000000000 RSI: ffffffff8f032660 RDI: 000000000000000f
RBP: ffffc9000af0fbb8 R08: 0000000000000005 R09: ffffffff847cd481
R10: 0000000000000008 R11: ffff8880003f4880 R12: ffff88803ff47a70
R13: ffff888041445d60 R14: 1ffff11008288bac R15: 0000000000580000
FS:  000055558b188380(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055c88e356030 CR3: 0000000041120000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 security_path_rename+0x22a/0x4e0 security/security.c:2022
 do_renameat2+0x94a/0x13f0 fs/namei.c:5157
 __do_sys_renameat2 fs/namei.c:5204 [inline]
 __se_sys_renameat2 fs/namei.c:5201 [inline]
 __x64_sys_renameat2+0xce/0xe0 fs/namei.c:5201
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f91721ec6b9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc5601e958 EFLAGS: 00000246 ORIG_RAX: 000000000000013c
RAX: ffffffffffffffda RBX: 00007ffc5601eb28 RCX: 00007f91721ec6b9
RDX: 00000000ffffff9c RSI: 0000000020000a00 RDI: 00000000ffffff9c
RBP: 00007f9172260610 R08: 0000000000000002 R09: 00007ffc5601eb28
R10: 0000000020000600 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffc5601eb18 R14: 0000000000000001 R15: 0000000000000001
 </TASK>
Kernel bug: UBSAN: array-index-out-of-bounds in ieee80211_request_ibss_scan
Subsystem: wireless
Status: fixed

Crash report:
wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
wlan1: Trigger new scan to find an IBSS to join
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:1208:5
index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]')
CPU: 0 UID: 0 PID: 131 Comm: kworker/u4:5 Not tainted 6.15.0-rc3-syzkaller-00342-g5bc1018675ec #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 ubsan_epilogue+0xa/0x40 lib/ubsan.c:231
 __ubsan_handle_out_of_bounds+0xe9/0xf0 lib/ubsan.c:453
 ieee80211_request_ibss_scan+0x600/0x8b0 net/mac80211/scan.c:1208
 ieee80211_sta_find_ibss net/mac80211/ibss.c:-1 [inline]
 ieee80211_ibss_work+0xde7/0x1060 net/mac80211/ibss.c:1670
 cfg80211_wiphy_work+0x2dc/0x460 net/wireless/core.c:435
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
 kthread+0x70e/0x8a0 kernel/kthread.c:464
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
---[ end trace ]---
Kernel panic - not syncing: UBSAN: panic_on_warn set ...
CPU: 0 UID: 0 PID: 131 Comm: kworker/u4:5 Not tainted 6.15.0-rc3-syzkaller-00342-g5bc1018675ec #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
 <TASK>
 dump_stack_lvl+0x99/0x250 lib/dump_stack.c:120
 panic+0x2db/0x790 kernel/panic.c:354
 check_panic_on_warn+0x89/0xb0 kernel/panic.c:243
 __ubsan_handle_out_of_bounds+0xe9/0xf0 lib/ubsan.c:453
 ieee80211_request_ibss_scan+0x600/0x8b0 net/mac80211/scan.c:1208
 ieee80211_sta_find_ibss net/mac80211/ibss.c:-1 [inline]
 ieee80211_ibss_work+0xde7/0x1060 net/mac80211/ibss.c:1670
 cfg80211_wiphy_work+0x2dc/0x460 net/wireless/core.c:435
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
 kthread+0x70e/0x8a0 kernel/kthread.c:464
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Kernel Offset: disabled
Rebooting in 86400 seconds..
Kernel bug: BUG: unable to handle kernel NULL pointer dereference in mempool_alloc_noprof (2)
Subsystem: bcachefs
Status: fixed

Crash report:
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 0 P4D 0 
Oops: Oops: 0010 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 5834 Comm: syz-executor375 Not tainted 6.16.0-rc1-syzkaller-00157-g02adc1490e6d #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 0018:ffffc900041b6d98 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff888072e03ef0
RDX: 1ffff1100e5c07de RSI: 0000000000000000 RDI: 0000000000092800
RBP: ffffc900041b6ef0 R08: ffffc900041b6e67 R09: 0000000000000000
R10: ffffc900041b6e40 R11: 0000000000000000 R12: 1ffff92000836dc4
R13: ffff888072e03ef0 R14: 0000000000092c40 R15: 0000000000092800
FS:  0000000000000000(0000) GS:ffff888125c84000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 00000000339f4000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 mempool_alloc_noprof+0x1a4/0x510 mm/mempool.c:402
 bch2_btree_update_start+0x572/0x1dc0 fs/bcachefs/btree_update_interior.c:1219
 bch2_btree_node_rewrite+0x17e/0x1120 fs/bcachefs/btree_update_interior.c:2245
 bch2_move_btree+0x6f0/0xc60 fs/bcachefs/move.c:1145
 bch2_scan_old_btree_nodes+0x95/0x240 fs/bcachefs/move.c:1266
 bch2_data_job+0x646/0x910 fs/bcachefs/move.c:1404
 bch2_data_thread+0x8f/0x1d0 fs/bcachefs/chardev.c:315
 kthread+0x70e/0x8a0 kernel/kthread.c:464
 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
CR2: 0000000000000000
---[ end trace 0000000000000000 ]---
RIP: 0010:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 0018:ffffc900041b6d98 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff888072e03ef0
RDX: 1ffff1100e5c07de RSI: 0000000000000000 RDI: 0000000000092800
RBP: ffffc900041b6ef0 R08: ffffc900041b6e67 R09: 0000000000000000
R10: ffffc900041b6e40 R11: 0000000000000000 R12: 1ffff92000836dc4
R13: ffff888072e03ef0 R14: 0000000000092c40 R15: 0000000000092800
FS:  0000000000000000(0000) GS:ffff888125c84000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 00000000339f4000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Kernel bug: KMSAN: uninit-value in pptp_xmit (3)
Subsystem: net
Status: fixed

Crash report:
=====================================================
BUG: KMSAN: uninit-value in pptp_xmit+0xc34/0x2720 drivers/net/ppp/pptp.c:193
 pptp_xmit+0xc34/0x2720 drivers/net/ppp/pptp.c:193
 ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2290 [inline]
 ppp_input+0x1d6/0xe60 drivers/net/ppp/ppp_generic.c:2314
 pppoe_rcv_core+0x1e8/0x760 drivers/net/ppp/pppoe.c:379
 sk_backlog_rcv+0x142/0x420 include/net/sock.h:1148
 __release_sock+0x1d3/0x330 net/core/sock.c:3213
 release_sock+0x6b/0x270 net/core/sock.c:3767
 pppoe_sendmsg+0x15d/0xcb0 drivers/net/ppp/pppoe.c:904
 sock_sendmsg_nosec net/socket.c:712 [inline]
 __sock_sendmsg+0x330/0x3d0 net/socket.c:727
 ____sys_sendmsg+0x893/0xd80 net/socket.c:2566
 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2620
 __sys_sendmmsg+0x2d9/0x7c0 net/socket.c:2709
 __do_sys_sendmmsg net/socket.c:2736 [inline]
 __se_sys_sendmmsg net/socket.c:2733 [inline]
 __x64_sys_sendmmsg+0xc6/0x150 net/socket.c:2733
 x64_sys_call+0x3ce7/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:308
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:4154 [inline]
 slab_alloc_node mm/slub.c:4197 [inline]
 __do_kmalloc_node mm/slub.c:4327 [inline]
 __kmalloc_node_track_caller_noprof+0x96d/0x12f0 mm/slub.c:4347
 kmalloc_reserve+0x22f/0x4b0 net/core/skbuff.c:601
 pskb_expand_head+0x1fc/0x1610 net/core/skbuff.c:2241
 skb_realloc_headroom+0x152/0x2d0 net/core/skbuff.c:2321
 pptp_xmit+0x9d4/0x2720 drivers/net/ppp/pptp.c:181
 ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2290 [inline]
 ppp_input+0x1d6/0xe60 drivers/net/ppp/ppp_generic.c:2314
 pppoe_rcv_core+0x1e8/0x760 drivers/net/ppp/pppoe.c:379
 sk_backlog_rcv+0x142/0x420 include/net/sock.h:1148
 __release_sock+0x1d3/0x330 net/core/sock.c:3213
 release_sock+0x6b/0x270 net/core/sock.c:3767
 pppoe_sendmsg+0x15d/0xcb0 drivers/net/ppp/pppoe.c:904
 sock_sendmsg_nosec net/socket.c:712 [inline]
 __sock_sendmsg+0x330/0x3d0 net/socket.c:727
 ____sys_sendmsg+0x893/0xd80 net/socket.c:2566
 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2620
 __sys_sendmmsg+0x2d9/0x7c0 net/socket.c:2709
 __do_sys_sendmmsg net/socket.c:2736 [inline]
 __se_sys_sendmmsg net/socket.c:2733 [inline]
 __x64_sys_sendmmsg+0xc6/0x150 net/socket.c:2733
 x64_sys_call+0x3ce7/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:308
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 5830 Comm: syz-executor110 Not tainted 6.16.0-syzkaller #0 PREEMPT(none) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
=====================================================