live-kbench/live-kbench huggingface dataset:
Kernel bug: WARNING in move_page_tables
Subsystem: mm
Status: fixed

Crash report:
R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000002
R13: 00007f00d0db5fa0 R14: 00007f00d0db5fa0 R15: 0000000000000005
 </TASK>
------------[ cut here ]------------
WARNING: CPU: 2 PID: 6133 at mm/mremap.c:357 move_normal_pmd mm/mremap.c:357 [inline]
WARNING: CPU: 2 PID: 6133 at mm/mremap.c:357 move_pgt_entry mm/mremap.c:595 [inline]
WARNING: CPU: 2 PID: 6133 at mm/mremap.c:357 move_page_tables+0x3832/0x44a0 mm/mremap.c:852
Modules linked in:
CPU: 2 UID: 0 PID: 6133 Comm: syz.0.19 Not tainted 6.17.0-rc1-syzkaller-00004-g53e760d89498 #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:move_normal_pmd mm/mremap.c:357 [inline]
RIP: 0010:move_pgt_entry mm/mremap.c:595 [inline]
RIP: 0010:move_page_tables+0x3832/0x44a0 mm/mremap.c:852
Code: 02 00 0f 85 b6 03 00 00 48 8b 2b 4c 89 f6 48 89 ef e8 e2 1b af ff 49 39 ee 0f 82 d5 cb ff ff e9 0c cc ff ff e8 1f 21 af ff 90 <0f> 0b 90 48 8b 44 24 40 48 8d 78 40 48 b8 00 00 00 00 00 fc ff df
RSP: 0018:ffffc900037a76d8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000032930007 RCX: ffffffff820c6645
RDX: ffff88802e56a440 RSI: ffffffff820c7201 RDI: 0000000000000007
RBP: ffff888037728fc0 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000032930007 R11: 0000000000000000 R12: 0000000000000000
R13: ffffc900037a79a8 R14: 0000000000000001 R15: dffffc0000000000
FS:  000055556316a500(0000) GS:ffff8880d68bc000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b30863fff CR3: 0000000050171000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 copy_vma_and_data+0x468/0x790 mm/mremap.c:1215
 move_vma+0x548/0x1780 mm/mremap.c:1282
 mremap_to+0x1b7/0x450 mm/mremap.c:1406
 do_mremap+0xfad/0x1f80 mm/mremap.c:1921
 __do_sys_mremap+0x119/0x170 mm/mremap.c:1977
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f00d0b8ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe5ea5ee98 EFLAGS: 00000246 ORIG_RAX: 0000000000000019
RAX: ffffffffffffffda RBX: 00007f00d0db5fa0 RCX: 00007f00d0b8ebe9
RDX: 0000000000400000 RSI: 0000000000c00000 RDI: 0000200000000000
RBP: 00007ffe5ea5eef0 R08: 0000200000c00000 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000002
R13: 00007f00d0db5fa0 R14: 00007f00d0db5fa0 R15: 0000000000000005
 </TASK>
Kernel bug: WARNING: ODEBUG bug in gfs2_fill_super
Subsystem: gfs2
Status: fixed

Crash report:
gfs2: fsid=syz:syz.s: about to withdraw this file system
gfs2: fsid=syz:syz.s: Error checking journal for spectator mount.
------------[ cut here ]------------
ODEBUG: free active (active state 0) object: ffff8880314d05a0 object type: work_struct hint: gfs2_withdraw_func+0x0/0x430 fs/gfs2/util.c:-1
WARNING: lib/debugobjects.c:615 at debug_print_object+0x16b/0x1e0 lib/debugobjects.c:612, CPU#1: syz.0.17/6061
Modules linked in:
CPU: 1 UID: 0 PID: 6061 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:debug_print_object+0x16b/0x1e0 lib/debugobjects.c:612
Code: 4c 89 ff e8 27 85 8a fd 4d 8b 0f 48 c7 c7 00 89 c0 8b 48 8b 34 24 4c 89 ea 89 e9 4d 89 f0 41 54 e8 0a ed e7 fc 48 83 c4 08 90 <0f> 0b 90 90 ff 05 47 c8 02 0b 48 83 c4 08 5b 41 5c 41 5d 41 5e 41
RSP: 0018:ffffc900030578a0 EFLAGS: 00010296
RAX: 9d408a94b4129f00 RBX: dffffc0000000000 RCX: ffff8880268c3c80
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff1bfa6c0 R12: ffffffff8404d450
R13: ffffffff8bc08a80 R14: ffff8880314d05a0 R15: ffffffff8b69e000
FS:  0000555593002500(0000) GS:ffff888125dfe000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff89d199000 CR3: 0000000069a02000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __debug_check_no_obj_freed lib/debugobjects.c:1099 [inline]
 debug_check_no_obj_freed+0x3a2/0x470 lib/debugobjects.c:1129
 slab_free_hook mm/slub.c:2461 [inline]
 slab_free mm/slub.c:6619 [inline]
 kfree+0x115/0x6d0 mm/slub.c:6826
 free_sbd fs/gfs2/ops_fstype.c:72 [inline]
 gfs2_fill_super+0x1552/0x2230 fs/gfs2/ops_fstype.c:1317
 get_tree_bdev_flags+0x40e/0x4d0 fs/super.c:1691
 gfs2_get_tree+0x51/0x1e0 fs/gfs2/ops_fstype.c:1333
 vfs_get_tree+0x92/0x2b0 fs/super.c:1751
 fc_mount fs/namespace.c:1208 [inline]
 do_new_mount_fc fs/namespace.c:3651 [inline]
 do_new_mount+0x302/0xa10 fs/namespace.c:3727
 do_mount fs/namespace.c:4050 [inline]
 __do_sys_mount fs/namespace.c:4238 [inline]
 __se_sys_mount+0x313/0x410 fs/namespace.c:4215
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff158d9076a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd513a6298 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffd513a6320 RCX: 00007ff158d9076a
RDX: 0000200000000400 RSI: 0000200000012500 RDI: 00007ffd513a62e0
RBP: 0000200000000400 R08: 00007ffd513a6320 R09: 0000000000200001
R10: 0000000000200001 R11: 0000000000000246 R12: 0000200000012500
R13: 00007ffd513a62e0 R14: 00000000000125d5 R15: 0000200000000240
 </TASK>
Kernel bug: WARNING: bad unlock balance in ocfs2_read_blocks
Subsystem: ocfs2
Status: fixed

Crash report:
loop0: detected capacity change from 0 to 9061
(syz-executor268,5095,0):ocfs2_read_blocks:240 ERROR: status = -12
=====================================
WARNING: bad unlock balance detected!
6.11.0-rc3-syzkaller-00338-gc3f2d783a459 #0 Not tainted
-------------------------------------
syz-executor268/5095 is trying to release lock (&oi->ip_io_mutex) at:
[<ffffffff837f37f6>] ocfs2_read_blocks+0x11c6/0x1620 fs/ocfs2/buffer_head_io.c:394
but there are no more locks to release!

other info that might help us debug this:
1 lock held by syz-executor268/5095:
 #0: ffff8880207680e0 (&type->s_umount_key#43/1){+.+.}-{3:3}, at: alloc_super+0x221/0x9d0 fs/super.c:344

stack backtrace:
CPU: 0 UID: 0 PID: 5095 Comm: syz-executor268 Not tainted 6.11.0-rc3-syzkaller-00338-gc3f2d783a459 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:93 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119
 print_unlock_imbalance_bug+0x256/0x2c0 kernel/locking/lockdep.c:5199
 __lock_release kernel/locking/lockdep.c:5436 [inline]
 lock_release+0x5cb/0xa30 kernel/locking/lockdep.c:5780
 __mutex_unlock_slowpath+0xe2/0x750 kernel/locking/mutex.c:912
 ocfs2_read_blocks+0x11c6/0x1620 fs/ocfs2/buffer_head_io.c:394
 ocfs2_map_slot_buffers fs/ocfs2/slot_map.c:385 [inline]
 ocfs2_init_slot_info+0xb35/0x13d0 fs/ocfs2/slot_map.c:424
 ocfs2_initialize_super fs/ocfs2/super.c:2274 [inline]
 ocfs2_fill_super+0x31b7/0x5880 fs/ocfs2/super.c:994
 mount_bdev+0x20a/0x2d0 fs/super.c:1679
 legacy_get_tree+0xee/0x190 fs/fs_context.c:662
 vfs_get_tree+0x90/0x2a0 fs/super.c:1800
 do_new_mount+0x2be/0xb40 fs/namespace.c:3472
 do_mount fs/namespace.c:3812 [inline]
 __do_sys_mount fs/namespace.c:4020 [inline]
 __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:3997
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0669b38cea
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f0669aed048 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000020000100 RCX: 00007f0669b38cea
RDX: 0000000020000100 RSI: 00000000200044c0 RDI: 00007f0669aed0a0
RBP: 00000000200044c0 R08: 00007f0669aed0e0 R09: 00000000ffffffe8
R10: 0000000000000000 R11: 0000000000000282 R12: 00007f0669aed0e0
R13: 000000000000447d R14: 0000000000000000 R15: 0000000020002340
 </TASK>
(syz-executor268,5095,0):ocfs2_map_slot_buffers:388 ERROR: status = -12
(syz-executor268,5095,0):ocfs2_init_slot_info:426 ERROR: status = -12
(syz-executor268,5095,0):ocfs2_initialize_super:2276 ERROR: status = -12
(syz-executor268,5095,0):ocfs2_fill_super:1178 ERROR: status = -12
Kernel bug: UBSAN: shift-out-of-bounds in ax88772_bind
Subsystem: usb
Status: fixed

Crash report:
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in drivers/net/usb/asix_devices.c:679:27
shift exponent 208 is too large for 64-bit type 'unsigned long'
CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.17.0-rc1-syzkaller-00214-g99bade344cfa #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Workqueue: usb_hub_wq hub_event
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 ubsan_epilogue+0xa/0x40 lib/ubsan.c:233
 __ubsan_handle_shift_out_of_bounds+0x386/0x410 lib/ubsan.c:494
 ax88772_init_mdio drivers/net/usb/asix_devices.c:679 [inline]
 ax88772_bind+0xdcf/0xfa0 drivers/net/usb/asix_devices.c:910
 usbnet_probe+0xa96/0x2870 drivers/net/usb/usbnet.c:1781
 usb_probe_interface+0x668/0xc30 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x26a/0x9e0 drivers/base/dd.c:659
 __driver_probe_device+0x18c/0x2f0 drivers/base/dd.c:801
 driver_probe_device+0x4f/0x430 drivers/base/dd.c:831
 __device_attach_driver+0x2ce/0x530 drivers/base/dd.c:959
 bus_for_each_drv+0x251/0x2e0 drivers/base/bus.c:462
 __device_attach+0x2b8/0x400 drivers/base/dd.c:1031
 bus_probe_device+0x185/0x260 drivers/base/bus.c:537
 device_add+0x7b6/0xb50 drivers/base/core.c:3689
 usb_set_configuration+0x1a87/0x20e0 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c1/0x390 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x26a/0x9e0 drivers/base/dd.c:659
 __driver_probe_device+0x18c/0x2f0 drivers/base/dd.c:801
 driver_probe_device+0x4f/0x430 drivers/base/dd.c:831
 __device_attach_driver+0x2ce/0x530 drivers/base/dd.c:959
 bus_for_each_drv+0x251/0x2e0 drivers/base/bus.c:462
 __device_attach+0x2b8/0x400 drivers/base/dd.c:1031
 bus_probe_device+0x185/0x260 drivers/base/bus.c:537
 device_add+0x7b6/0xb50 drivers/base/core.c:3689
 usb_new_device+0xa39/0x16f0 drivers/usb/core/hub.c:2694
 hub_port_connect drivers/usb/core/hub.c:5566 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5706 [inline]
 port_event drivers/usb/core/hub.c:5870 [inline]
 hub_event+0x2958/0x4a20 drivers/usb/core/hub.c:5952
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
 kthread+0x70e/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
---[ end trace ]---
Kernel bug: WARNING in cleanup_net (4)
Subsystem: net
Status: fixed

Crash report:
     proc_sctp_do_udp_port+0x380/0x450 net/sctp/sysctl.c:555
     proc_sys_call_handler+0x3c6/0x5a0 fs/proc/proc_sysctl.c:601
     iter_file_splice_write+0x90f/0x10b0 fs/splice.c:743
     do_splice_from fs/splice.c:941 [inline]
     direct_splice_actor+0x18f/0x6c0 fs/splice.c:1164
     splice_direct_to_actor+0x346/0xa40 fs/splice.c:1108
     do_splice_direct_actor fs/splice.c:1207 [inline]
     do_splice_direct+0x178/0x250 fs/splice.c:1233
     do_sendfile+0xafb/0xe40 fs/read_write.c:1363
     __do_sys_sendfile64 fs/read_write.c:1424 [inline]
     __se_sys_sendfile64 fs/read_write.c:1410 [inline]
     __x64_sys_sendfile64+0x1da/0x220 fs/read_write.c:1410
     do_syscall_x64 arch/x86/entry/common.c:52 [inline]
     do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
------------[ cut here ]------------
WARNING: CPU: 0 PID: 12 at lib/ref_tracker.c:179 ref_tracker_dir_exit+0x3e3/0x680 lib/ref_tracker.c:179
Modules linked in:
CPU: 0 UID: 0 PID: 12 Comm: kworker/u8:1 Not tainted 6.14.0-rc3-syzkaller-00060-g6537cfb395f3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Workqueue: netns cleanup_net
RIP: 0010:ref_tracker_dir_exit+0x3e3/0x680 lib/ref_tracker.c:179
Code: 11 02 00 00 4d 39 f5 49 8b 06 4d 89 f7 0f 85 0e ff ff ff 48 8b 2c 24 e8 5b 16 c8 fc 48 8b 74 24 18 48 89 ef e8 6e bd 65 06 90 <0f> 0b 90 e8 45 16 c8 fc 48 8d 5d 44 be 04 00 00 00 48 89 df e8 c4
RSP: 0018:ffffc90000117ac8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffffffff8b6ceca0 RDI: 0000000000000001
RBP: ffff88802f7b01e0 R08: 0000000000000001 R09: fffffbfff2dd79b7
R10: ffffffff96ebcdbf R11: 0000000000002ba2 R12: ffff88802f7b0230
R13: ffff88802f7b0230 R14: ffff88802f7b0230 R15: ffff88802f7b0230
FS:  0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000557010814f20 CR3: 000000000df80000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 net_free net/core/net_namespace.c:473 [inline]
 net_free net/core/net_namespace.c:467 [inline]
 cleanup_net+0x99f/0xbf0 net/core/net_namespace.c:675
 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3236
 process_scheduled_works kernel/workqueue.c:3317 [inline]
 worker_thread+0x6c8/0xf00 kernel/workqueue.c:3398
 kthread+0x3af/0x750 kernel/kthread.c:464
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Kernel bug: WARNING in ip6mr_free_table
Subsystem: net
Status: fixed

Crash report:
------------[ cut here ]------------
WARNING: CPU: 1 PID: 5843 at net/ipv6/ip6mr.c:419 ip6mr_free_table+0xbd/0x120 net/ipv6/ip6mr.c:419
Modules linked in:
CPU: 1 UID: 0 PID: 5843 Comm: syz-executor151 Not tainted 6.13.0-rc1-syzkaller-00036-g5076001689e4 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:ip6mr_free_table+0xbd/0x120 net/ipv6/ip6mr.c:419
Code: 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 58 49 83 bc 24 c0 0e 00 00 00 74 09 e8 e4 3f bb f7 90 <0f> 0b 90 e8 db 3f bb f7 48 8d 7b 38 e8 b2 17 a8 f7 48 89 df be 0f
RSP: 0018:ffffc90003857bd8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88807b248000 RCX: ffffffff89de0064
RDX: ffff88807b210000 RSI: ffffffff89de009c RDI: ffff888035094b40
RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000002 R12: ffff888035093c80
R13: ffff88807b248000 R14: ffff88807b248008 R15: dead000000000100
FS:  00007f0ccedb86c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555566c1cce8 CR3: 0000000033caa000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 ip6mr_rules_exit+0x176/0x2d0 net/ipv6/ip6mr.c:283
 ip6mr_net_exit_batch+0x53/0xa0 net/ipv6/ip6mr.c:1388
 ops_exit_list+0x128/0x180 net/core/net_namespace.c:177
 setup_net+0x4fe/0x860 net/core/net_namespace.c:394
 copy_net_ns+0x2b4/0x6b0 net/core/net_namespace.c:500
 create_new_namespaces+0x3ea/0xad0 kernel/nsproxy.c:110
 unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:228
 ksys_unshare+0x45d/0xa40 kernel/fork.c:3334
 __do_sys_unshare kernel/fork.c:3405 [inline]
 __se_sys_unshare kernel/fork.c:3403 [inline]
 __x64_sys_unshare+0x31/0x40 kernel/fork.c:3403
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0ccedfd2d9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f0ccedb8238 EFLAGS: 00000246 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007f0ccee87308 RCX: 00007f0ccedfd2d9
RDX: 00007f0ccedd98c6 RSI: 0000000000000000 RDI: 0000000040000080
RBP: 00007f0ccee87300 R08: 00007fff50c78907 R09: 00007f0ccedb86c0
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0ccee8730c
R13: 0000000000000000 R14: 00007fff50c78820 R15: 00007fff50c78908
 </TASK>
Kernel bug: WARNING in handle_policy_update
Subsystem: lsm
Status: fixed

Crash report:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5827 at mm/page_alloc.c:4727 __alloc_pages_noprof+0xeff/0x25b0 mm/page_alloc.c:4727
Modules linked in:
CPU: 0 UID: 0 PID: 5827 Comm: syz-executor752 Not tainted 6.13.0-rc2-syzkaller-00159-gf932fb9b4074 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024
RIP: 0010:__alloc_pages_noprof+0xeff/0x25b0 mm/page_alloc.c:4727
Code: 24 2c 00 00 00 00 89 cd 0f 84 8b f9 ff ff 8b 34 24 48 89 da 8b 7c 24 08 e8 0e b3 fe ff e9 69 f9 ff ff c6 05 e1 44 16 0e 01 90 <0f> 0b 90 31 db e9 9f f3 ff ff 89 14 24 e8 9f a2 0c 00 8b 14 24 e9
RSP: 0018:ffffc900015978e8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000013 RDI: 0000000000040cc0
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000100
R10: 0000000000000100 R11: ffffffff81fb9344 R12: 0000000000000013
R13: 0000000000040cc0 R14: 1ffff920002b2f31 R15: 00000000ffffffff
FS:  000055556162e380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000130 CR3: 0000000028cc2000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
 alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
 ___kmalloc_large_node+0x84/0x1b0 mm/slub.c:4228
 __kmalloc_large_node_noprof+0x1c/0x70 mm/slub.c:4255
 __do_kmalloc_node mm/slub.c:4271 [inline]
 __kmalloc_node_track_caller_noprof.cold+0x5/0x5f mm/slub.c:4302
 memdup_user_nul+0x2b/0x110 mm/util.c:305
 handle_policy_update+0x188/0x11e0 security/safesetid/securityfs.c:153
 safesetid_gid_file_write+0x87/0xc0 security/safesetid/securityfs.c:260
 vfs_write+0x24c/0x1150 fs/read_write.c:677
 ksys_write+0x12b/0x250 fs/read_write.c:731
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8b2d0d02e9
Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd58b75818 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007ffd58b759f8 RCX: 00007f8b2d0d02e9
RDX: 00000000fffffdef RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007f8b2d143610 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffd58b759e8 R14: 0000000000000001 R15: 0000000000000001
 </TASK>
Kernel bug: WARNING in ieee80211_set_active_links
Subsystem: wireless
Status: fixed

Crash report:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 1167 at net/mac80211/link.c:504 ieee80211_set_active_links+0x7ba/0x9c0 net/mac80211/link.c:504
Modules linked in:
CPU: 0 UID: 0 PID: 1167 Comm: kworker/u8:7 Not tainted 6.13.0-rc5-syzkaller-00012-g0bc21e701a6f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:ieee80211_set_active_links+0x7ba/0x9c0 net/mac80211/link.c:504
Code: 94 c4 31 ff 44 89 e6 e8 a4 ae 04 f7 45 84 e4 0f 84 81 fc ff ff e8 b6 ac 04 f7 e8 61 3e 77 f6 e9 72 fc ff ff e8 a7 ac 04 f7 90 <0f> 0b 90 b8 ea ff ff ff e9 74 fa ff ff e8 94 ac 04 f7 e8 6f 78 ea
RSP: 0018:ffffc9000435fb78 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff8880276829d0 RCX: ffffffff8a949c04
RDX: ffff88802758bc00 RSI: ffffffff8a94a319 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000003 R12: ffffffff901d1854
R13: 0000000000000001 R14: ffff888027668e40 R15: ffff888027681720
FS:  0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055cb729caa28 CR3: 00000000775f0000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 ieee80211_if_parse_active_links+0xa4/0x110 net/mac80211/debugfs_netdev.c:733
 wiphy_locked_debugfs_write_work+0xe3/0x1c0 net/wireless/debugfs.c:215
 cfg80211_wiphy_work+0x3de/0x560 net/wireless/core.c:440
 process_one_work+0x958/0x1b30 kernel/workqueue.c:3229
 process_scheduled_works kernel/workqueue.c:3310 [inline]
 worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Kernel bug: WARNING in convert_ctx_accesses
Subsystem: bpf
Status: fixed

Crash report:
------------[ cut here ]------------
verifier bug: error during ctx access conversion(1)
WARNING: CPU: 0 PID: 5822 at kernel/bpf/verifier.c:21448 convert_ctx_accesses+0x2045/0x2920 kernel/bpf/verifier.c:21448
Modules linked in:
CPU: 0 UID: 0 PID: 5822 Comm: syz-executor130 Not tainted 6.16.0-syzkaller-06699-ge8d780dcd957 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:convert_ctx_accesses+0x2045/0x2920 kernel/bpf/verifier.c:21448
Code: c7 c6 a0 95 b5 8b e8 ea a5 07 00 e9 a4 f9 ff ff e8 50 6c e8 ff c6 05 16 03 bd 0e 01 90 48 c7 c7 00 96 b5 8b e8 6c 02 a7 ff 90 <0f> 0b 90 90 e9 f1 fe ff ff e8 2d 6c e8 ff 0f b6 1d f6 02 bd 0e 31
RSP: 0018:ffffc90003dcf6e8 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817a3658
RDX: ffff8880775dc880 RSI: ffffffff817a3665 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: dffffc0000000000
R13: ffffc90000ace048 R14: 0000000000000004 R15: ffff888023798000
FS:  0000555582c6c380(0000) GS:ffff88812471e000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000561e04e07000 CR3: 0000000071c4c000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 bpf_check+0x5960/0xc600 kernel/bpf/verifier.c:24736
 bpf_prog_load+0xe41/0x2490 kernel/bpf/syscall.c:2972
 __sys_bpf+0x4a3f/0x4de0 kernel/bpf/syscall.c:6022
 __do_sys_bpf kernel/bpf/syscall.c:6132 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6130 [inline]
 __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:6130
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f75a63f53a9
Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffeb40793f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007ffeb40795d8 RCX: 00007f75a63f53a9
RDX: 0000000000000048 RSI: 00002000000054c0 RDI: 0000000000000005
RBP: 00007f75a6468610 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffeb40795c8 R14: 0000000000000001 R15: 0000000000000001
 </TASK>