live-kbench/live-kbench huggingface dataset:
Kernel bug: WARNING in try_to_migrate_one (3)
Subsystem: mm
Status: fixed

Crash report:
 do_initcall_level+0x104/0x190 init/main.c:1331
 do_initcalls+0x59/0xa0 init/main.c:1347
 kernel_init_freeable+0x334/0x4b0 init/main.c:1579
 kernel_init+0x1d/0x1d0 init/main.c:1469
 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5866 at mm/rmap.c:2452 try_to_migrate_one+0xf27/0x34d0 mm/rmap.c:2451
Modules linked in:
CPU: 0 UID: 0 PID: 5866 Comm: syz-executor265 Not tainted 6.16.0-syzkaller-12187-g0227b49b5027 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:try_to_migrate_one+0xf27/0x34d0 mm/rmap.c:2451
Code: fb 00 00 00 f4 0f 84 35 0e 00 00 e8 f3 41 ae ff e9 73 f8 ff ff e8 e9 41 ae ff 4c 89 e7 48 c7 c6 00 79 96 8b e8 0a 92 16 ff 90 <0f> 0b 90 e9 60 ff ff ff e8 cc 41 ae ff 49 ff cf e9 3e fb ff ff e8
RSP: 0000:ffffc9000401f120 EFLAGS: 00010246
RAX: c3d51769d0dbd500 RBX: 0400000000000000 RCX: c3d51769d0dbd500
RDX: 0000000000000003 RSI: ffffffff8dba5e25 RDI: ffff8880115dda00
RBP: ffffc9000401f370 R08: ffff8880b8624253 R09: 1ffff110170c484a
R10: dffffc0000000000 R11: ffffed10170c484b R12: ffffea0001cd8000
R13: 0000000073603867 R14: dffffc0000000000 R15: ffffea0001cd8018
FS:  0000555590a54380(0000) GS:ffff888125c1c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000045ad50 CR3: 00000000743ea000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 rmap_walk_anon+0x550/0x730 mm/rmap.c:2842
 rmap_walk_locked mm/rmap.c:2958 [inline]
 try_to_migrate+0x3f5/0x670 mm/rmap.c:2619
 unmap_folio+0x191/0x1f0 mm/huge_memory.c:3137
 __folio_split+0x90d/0x1c60 mm/huge_memory.c:3711
 try_split_folio+0x13f/0x310 mm/migrate.c:1550
 migrate_pages_batch+0x653/0x3620 mm/migrate.c:1819
 migrate_pages_sync mm/migrate.c:1974 [inline]
 migrate_pages+0x1bcc/0x2930 mm/migrate.c:2083
 do_mbind mm/mempolicy.c:1539 [inline]
 kernel_mbind mm/mempolicy.c:1682 [inline]
 __do_sys_mbind mm/mempolicy.c:1756 [inline]
 __se_sys_mbind+0xa3e/0xc30 mm/mempolicy.c:1752
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb95004e539
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffa7b144d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ed
RAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007fb95004e539
RDX: 0000000000000001 RSI: 0000000000600000 RDI: 0000200000000000
RBP: 00007fb9500c15f0 R08: 0000000000000000 R09: 0000000000000002
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001
 </TASK>
Kernel bug: BUG: sleeping function called from invalid context in ovl_cache_entry_new
Subsystem: ntfs3, afs
Status: fixed

Crash report:
BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:321
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 5821, name: syz-executor365
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
4 locks held by syz-executor365/5821:
 #0: ffff888032b155f8 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x247/0x310 fs/file.c:1213
 #1: ffff888077c90cf8 (&ovl_i_mutex_dir_key[depth]){++++}-{4:4}, at: wrap_directory_iterator+0x5a/0xd0 fs/readdir.c:54
 #2: ffff88807d2c0148 (&type->i_mutex_dir_key#6){++++}-{4:4}, at: iterate_dir+0x4a6/0x760 fs/readdir.c:101
 #3: ffffffff8eb3a760 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #3: ffffffff8eb3a760 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
 #3: ffffffff8eb3a760 (rcu_read_lock){....}-{1:3}, at: afs_dynroot_readdir+0x466/0xbe0 fs/afs/dynroot.c:351
CPU: 0 UID: 0 PID: 5821 Comm: syz-executor365 Not tainted 6.14.0-syzkaller-01103-g2df0c02dab82 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 __might_resched+0x558/0x6c0 kernel/sched/core.c:8798
 might_alloc include/linux/sched/mm.h:321 [inline]
 slab_pre_alloc_hook mm/slub.c:4089 [inline]
 slab_alloc_node mm/slub.c:4167 [inline]
 __do_kmalloc_node mm/slub.c:4317 [inline]
 __kmalloc_noprof+0xd0/0x4d0 mm/slub.c:4330
 kmalloc_noprof include/linux/slab.h:906 [inline]
 ovl_cache_entry_new+0x39/0x7b0 fs/overlayfs/readdir.c:152
 ovl_cache_entry_add_rb fs/overlayfs/readdir.c:188 [inline]
 ovl_fill_merge+0x416/0x830 fs/overlayfs/readdir.c:266
 dir_emit include/linux/fs.h:3853 [inline]
 afs_dynroot_readdir_cells fs/afs/dynroot.c:310 [inline]
 afs_dynroot_readdir+0x814/0xbe0 fs/afs/dynroot.c:352
 iterate_dir+0x5a9/0x760 fs/readdir.c:108
 ovl_dir_read+0xfe/0x570 fs/overlayfs/readdir.c:313
 ovl_dir_read_merged+0x315/0x5e0 fs/overlayfs/readdir.c:369
 ovl_cache_get fs/overlayfs/readdir.c:422 [inline]
 ovl_iterate+0x1196/0x21c0 fs/overlayfs/readdir.c:783
 wrap_directory_iterator+0x91/0xd0 fs/readdir.c:65
 iterate_dir+0x5a9/0x760 fs/readdir.c:108
 __do_sys_getdents fs/readdir.c:322 [inline]
 __se_sys_getdents+0x1ff/0x4e0 fs/readdir.c:308
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7c82f020f9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff5a9e9b58 EFLAGS: 00000246 ORIG_RAX: 000000000000004e
RAX: ffffffffffffffda RBX: 00007fff5a9e9c20 RCX: 00007f7c82f020f9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000000000
Kernel bug: UBSAN: shift-out-of-bounds in flow_classify
Subsystem: net
Status: fixed

Crash report:
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in net/sched/cls_flow.c:329:23
shift exponent 9445 is too large for 32-bit type 'u32' (aka 'unsigned int')
CPU: 0 UID: 0 PID: 11 Comm: kworker/u8:0 Not tainted 6.13.0-rc3-syzkaller-00180-g4f619d518db9 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: ipv6_addrconf addrconf_dad_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 ubsan_epilogue lib/ubsan.c:231 [inline]
 __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468
 flow_classify+0x24d5/0x25b0 net/sched/cls_flow.c:329
 tc_classify include/net/tc_wrapper.h:197 [inline]
 __tcf_classify net/sched/cls_api.c:1771 [inline]
 tcf_classify+0x420/0x1160 net/sched/cls_api.c:1867
 sfb_classify net/sched/sch_sfb.c:260 [inline]
 sfb_enqueue+0x3ad/0x18b0 net/sched/sch_sfb.c:318
 dev_qdisc_enqueue+0x4b/0x290 net/core/dev.c:3793
 __dev_xmit_skb net/core/dev.c:3889 [inline]
 __dev_queue_xmit+0xf0e/0x3f50 net/core/dev.c:4400
 dev_queue_xmit include/linux/netdevice.h:3168 [inline]
 neigh_hh_output include/net/neighbour.h:523 [inline]
 neigh_output include/net/neighbour.h:537 [inline]
 ip_finish_output2+0xd41/0x1390 net/ipv4/ip_output.c:236
 iptunnel_xmit+0x55d/0x9b0 net/ipv4/ip_tunnel_core.c:82
 udp_tunnel_xmit_skb+0x262/0x3b0 net/ipv4/udp_tunnel_core.c:173
 geneve_xmit_skb drivers/net/geneve.c:916 [inline]
 geneve_xmit+0x21dc/0x2d00 drivers/net/geneve.c:1039
 __netdev_start_xmit include/linux/netdevice.h:5002 [inline]
 netdev_start_xmit include/linux/netdevice.h:5011 [inline]
 xmit_one net/core/dev.c:3590 [inline]
 dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3606
 __dev_queue_xmit+0x1b73/0x3f50 net/core/dev.c:4434
 neigh_output include/net/neighbour.h:539 [inline]
 ip6_finish_output2+0x12c7/0x17b0 net/ipv6/ip6_output.c:141
 ip6_finish_output+0x41e/0x840 net/ipv6/ip6_output.c:226
 NF_HOOK include/linux/netfilter.h:314 [inline]
 ndisc_send_skb+0xb30/0x1450 net/ipv6/ndisc.c:511
 ndisc_send_ns+0xcc/0x160 net/ipv6/ndisc.c:669
 addrconf_dad_work+0xb45/0x16f0 net/ipv6/addrconf.c:4303
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
 worker_thread+0x870/0xd30 kernel/workqueue.c:3391
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
---[ end trace ]---
Kernel bug: UBSAN: shift-out-of-bounds in parse_audio_unit
Subsystem: sound
Status: fixed

Crash report:
usb 1-1: 0:2 : does not exist
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in sound/usb/mixer.c:2057:20
shift exponent 42 is too large for 32-bit type 'int'
CPU: 1 PID: 45 Comm: kworker/1:1 Not tainted 6.10.0-rc7-syzkaller-00025-ga19ea421490d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: usb_hub_wq hub_event
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
 ubsan_epilogue lib/ubsan.c:231 [inline]
 __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468
 parse_audio_feature_unit sound/usb/mixer.c:2057 [inline]
 parse_audio_unit+0x277d/0x3f10 sound/usb/mixer.c:2907
 snd_usb_mixer_controls sound/usb/mixer.c:3252 [inline]
 snd_usb_create_mixer+0x1365/0x2fa0 sound/usb/mixer.c:3599
 usb_audio_probe+0x1688/0x2100 sound/usb/card.c:888
 usb_probe_interface+0x645/0xbb0 drivers/usb/core/driver.c:399
 really_probe+0x2b8/0xad0 drivers/base/dd.c:656
 __driver_probe_device+0x1a2/0x390 drivers/base/dd.c:798
 driver_probe_device+0x50/0x430 drivers/base/dd.c:828
 __device_attach_driver+0x2d6/0x530 drivers/base/dd.c:956
 bus_for_each_drv+0x24e/0x2e0 drivers/base/bus.c:457
 __device_attach+0x333/0x520 drivers/base/dd.c:1028
 bus_probe_device+0x189/0x260 drivers/base/bus.c:532
 device_add+0x856/0xbf0 drivers/base/core.c:3679
 usb_set_configuration+0x1976/0x1fb0 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0x88/0x140 drivers/usb/core/generic.c:254
 usb_probe_device+0x1b8/0x380 drivers/usb/core/driver.c:294
 really_probe+0x2b8/0xad0 drivers/base/dd.c:656
 __driver_probe_device+0x1a2/0x390 drivers/base/dd.c:798
 driver_probe_device+0x50/0x430 drivers/base/dd.c:828
 __device_attach_driver+0x2d6/0x530 drivers/base/dd.c:956
 bus_for_each_drv+0x24e/0x2e0 drivers/base/bus.c:457
 __device_attach+0x333/0x520 drivers/base/dd.c:1028
 bus_probe_device+0x189/0x260 drivers/base/bus.c:532
 device_add+0x856/0xbf0 drivers/base/core.c:3679
 usb_new_device+0x104a/0x19a0 drivers/usb/core/hub.c:2651
 hub_port_connect drivers/usb/core/hub.c:5521 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5661 [inline]
 port_event drivers/usb/core/hub.c:5821 [inline]
 hub_event+0x2d6a/0x5150 drivers/usb/core/hub.c:5903
 process_one_work kernel/workqueue.c:3248 [inline]
 process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3329
 worker_thread+0x86d/0xd50 kernel/workqueue.c:3409
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
---[ end trace ]---
Kernel bug: WARNING in ntfs_extend_initialized_size
Subsystem: ntfs3
Status: fixed

Crash report:
------------[ cut here ]------------
WARNING: CPU: 1 PID: 5234 at fs/ntfs3/file.c:181 ntfs_extend_initialized_size+0x907/0x950 fs/ntfs3/file.c:181
Modules linked in:
CPU: 1 UID: 0 PID: 5234 Comm: syz-executor337 Not tainted 6.12.0-rc1-syzkaller-00031-ge32cde8d2bd7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:ntfs_extend_initialized_size+0x907/0x950 fs/ntfs3/file.c:181
Code: 66 89 d8 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc e8 58 72 a7 fe 90 0f 0b 90 e9 ba f8 ff ff e8 4a 72 a7 fe 90 <0f> 0b 90 e9 cf f8 ff ff 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 5a
RSP: 0018:ffffc90002eaf580 EFLAGS: 00010293
RAX: ffffffff82ed6916 RBX: 000000000000b5b3 RCX: ffff888029a61e00
RDX: 0000000000000000 RSI: 000000000000b5b3 RDI: 0000000000050000
RBP: ffffc90002eaf6b0 R08: ffffffff82ed61e0 R09: 1ffffffff2037745
R10: dffffc0000000000 R11: fffffbfff2037746 R12: ffff88802db18000
R13: dffffc0000000000 R14: 0000000000050000 R15: 0000000000000000
FS:  00007f62c31fa6c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffee48b8dd8 CR3: 0000000076342000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 ntfs_file_mmap+0x5f2/0x850 fs/ntfs3/file.c:368
 call_mmap include/linux/fs.h:2172 [inline]
 mmap_region+0x1add/0x2990 mm/mmap.c:1440
 do_mmap+0x8f0/0x1000 mm/mmap.c:496
 vm_mmap_pgoff+0x1dd/0x3d0 mm/util.c:588
 ksys_mmap_pgoff+0x4eb/0x720 mm/mmap.c:542
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f62c32646b9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f62c31fa208 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007f62c330a658 RCX: 00007f62c32646b9
RDX: 00000000017ffff7 RSI: 0000000000600000 RDI: 0000000020000000
RBP: 00007f62c330a650 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000004002011 R11: 0000000000000246 R12: 00007f62c32d78c4
R13: 00007f62c32b80c0 R14: 007570637265705f R15: 0700000000000000
 </TASK>
Kernel bug: WARNING: suspicious RCU usage in kvm_vcpu_gfn_to_memslot
Subsystem: kvm
Status: fixed

Crash report:
=============================
WARNING: suspicious RCU usage
6.13.0-syzkaller-00918-g95ec54a420b8 #0 Not tainted
-----------------------------
./include/linux/kvm_host.h:1038 suspicious rcu_dereference_check() usage!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
no locks held by syz-executor167/5303.

stack backtrace:
CPU: 0 UID: 0 PID: 5303 Comm: syz-executor167 Not tainted 6.13.0-syzkaller-00918-g95ec54a420b8 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 lockdep_rcu_suspicious+0x226/0x340 kernel/locking/lockdep.c:6845
 __kvm_memslots include/linux/kvm_host.h:1036 [inline]
 kvm_vcpu_memslots include/linux/kvm_host.h:1050 [inline]
 kvm_vcpu_gfn_to_memslot+0x429/0x4c0 virt/kvm/kvm_main.c:2554
 kvm_vcpu_write_guest_page virt/kvm/kvm_main.c:3238 [inline]
 kvm_vcpu_write_guest+0x7c/0x130 virt/kvm/kvm_main.c:3274
 kvm_xen_write_hypercall_page+0x2ff/0x5f0 arch/x86/kvm/xen.c:1299
 kvm_set_msr_common+0x150/0x3da0 arch/x86/kvm/x86.c:3751
 vmx_set_msr+0x15da/0x2790 arch/x86/kvm/vmx/vmx.c:2487
 __kvm_set_msr arch/x86/kvm/x86.c:1877 [inline]
 kvm_vcpu_reset+0xbea/0x1740 arch/x86/kvm/x86.c:12456
 kvm_arch_vcpu_create+0x8dc/0xa80 arch/x86/kvm/x86.c:12305
 kvm_vm_ioctl_create_vcpu+0x3d6/0xa00 virt/kvm/kvm_main.c:4106
 kvm_vm_ioctl+0x7e2/0xd30 virt/kvm/kvm_main.c:5019
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:906 [inline]
 __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9a62a26369
Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff83b20f38 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fff83b21108 RCX: 00007f9a62a26369
RDX: 0000000000000000 RSI: 000000000000ae41 RDI: 0000000000000004
RBP: 00007f9a62a99610 R08: 00007fff83b21108 R09: 00007fff83b21108
R10: 00007fff83b21108 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fff83b210f8 R14: 0000000000000001 R15: 0000000000000001
 </TASK>
Kernel bug: WARNING in shmem_unlink
Subsystem: overlayfs
Status: fixed

Crash report:
------------[ cut here ]------------
WARNING: CPU: 1 PID: 9026 at fs/inode.c:417 drop_nlink+0xc5/0x110 fs/inode.c:417
Modules linked in:
CPU: 1 UID: 0 PID: 9026 Comm: syz.4.1430 Tainted: G        W           6.17.0-rc1-syzkaller-00038-g0cc53520e68b #0 PREEMPT_{RT,(full)} 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:drop_nlink+0xc5/0x110 fs/inode.c:417
Code: c8 08 00 00 be 08 00 00 00 e8 b7 90 ec ff f0 48 ff 83 c8 08 00 00 5b 41 5c 41 5e 41 5f 5d e9 82 9f c8 08 cc e8 dc 5a 8d ff 90 <0f> 0b 90 eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 5b ff ff ff
RSP: 0018:ffffc9000f5ef600 EFLAGS: 00010293
RAX: ffffffff82310064 RBX: ffff88803352c420 RCX: ffff88802cfcbb80
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffff52001ebdeb5 R12: 1ffff110066a588d
R13: 00000000689e7afa R14: ffff88803352c468 R15: dffffc0000000000
FS:  00007fec6bd366c0(0000) GS:ffff8881269c5000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555591d73608 CR3: 00000000274f4000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 shmem_unlink+0x1f5/0x2d0 mm/shmem.c:4041
 vfs_unlink+0x39a/0x660 fs/namei.c:4586
 ovl_do_unlink fs/overlayfs/overlayfs.h:218 [inline]
 ovl_cleanup_locked fs/overlayfs/dir.c:36 [inline]
 ovl_cleanup+0x151/0x230 fs/overlayfs/dir.c:56
 ovl_check_rename_whiteout fs/overlayfs/super.c:607 [inline]
 ovl_make_workdir fs/overlayfs/super.c:704 [inline]
 ovl_get_workdir+0xabd/0x17c0 fs/overlayfs/super.c:827
 ovl_fill_super+0x1365/0x35b0 fs/overlayfs/super.c:1406
 vfs_get_super fs/super.c:1325 [inline]
 get_tree_nodev+0xbb/0x150 fs/super.c:1344
 vfs_get_tree+0x8f/0x2b0 fs/super.c:1815
 do_new_mount+0x2a2/0x9e0 fs/namespace.c:3805
 do_mount fs/namespace.c:4133 [inline]
 __do_sys_mount fs/namespace.c:4344 [inline]
 __se_sys_mount+0x317/0x410 fs/namespace.c:4321
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fec6c6cebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fec6bd36038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fec6c8f5fa0 RCX: 00007fec6c6cebe9
RDX: 0000200000000200 RSI: 0000200000000000 RDI: 0000000000000000
RBP: 00007fec6c751e19 R08: 0000200000000140 R09: 0000000000000000
R10: 00000000000000d4 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fec6c8f6038 R14: 00007fec6c8f5fa0 R15: 00007ffc15eea8d8
 </TASK>
Kernel bug: BUG: using smp_processor_id() in preemptible code in bpf_mem_alloc
Subsystem: bpf
Status: fixed

Crash report:
BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor373/5838
caller is bpf_mem_alloc+0x117/0x220 kernel/bpf/memalloc.c:903
CPU: 1 UID: 0 PID: 5838 Comm: syz-executor373 Not tainted 6.12.0-rc7-syzkaller-g379d5ee624ed #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 check_preemption_disabled+0x10e/0x120 lib/smp_processor_id.c:49
 bpf_mem_alloc+0x117/0x220 kernel/bpf/memalloc.c:903
 range_tree_set+0x971/0x1830 kernel/bpf/range_tree.c:238
 arena_map_alloc+0x36f/0x440 kernel/bpf/arena.c:137
 map_create+0x946/0x11c0 kernel/bpf/syscall.c:1441
 __sys_bpf+0x6d1/0x810 kernel/bpf/syscall.c:5741
 __do_sys_bpf kernel/bpf/syscall.c:5866 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5864 [inline]
 __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5864
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5cb29a1329
Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffee3bcaa18 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007ffee3bcabf8 RCX: 00007f5cb29a1329
RDX: 0000000000000048 RSI: 0000000020003940 RDI: 0000000000000000
RBP: 00007f5cb2a14610 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffee3bcabe8 R14: 0000000000000001 R15: 0000000000000001
 </TA
Kernel bug: WARNING in nla_get_range_unsigned (3)
Subsystem: net
Status: fixed

Crash report:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5836 at lib/nlattr.c:123 nla_get_range_unsigned+0xc8/0x4b0 lib/nlattr.c:122
Modules linked in:
CPU: 0 UID: 0 PID: 5836 Comm: syz-executor416 Not tainted 6.15.0-rc4-syzkaller-00808-ga7371be8c8f5 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025
RIP: 0010:nla_get_range_unsigned+0xc8/0x4b0 lib/nlattr.c:122
Code: 0f 85 71 03 00 00 41 0f b7 2c 24 31 ff 89 ee e8 4e a8 d3 fc 66 85 ed 0f 88 df 02 00 00 e8 a0 a4 d3 fc eb 09 e8 99 a4 d3 fc 90 <0f> 0b 90 4c 89 ed 48 c1 ed 03 42 80 7c 35 00 00 74 08 4c 89 ef e8
RSP: 0018:ffffc900043073d0 EFLAGS: 00010293
RAX: ffffffff84ec1e8f RBX: ffffffff8c808eb0 RCX: ffff88802da1bc00
RDX: 0000000000000000 RSI: 0000000000008a3e RDI: 0000000000000000
RBP: 0000000000008a3e R08: ffff88802da1bc00 R09: 0000000000000004
R10: 0000000000000004 R11: 0000000000000000 R12: ffffffff8c808eba
R13: ffffc900043075b0 R14: dffffc0000000000 R15: 1ffffffff19011d6
FS:  0000555581b32380(0000) GS:ffff8881260c1000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000005b1e008 CR3: 000000007888a000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __netlink_policy_dump_write_attr+0x565/0xdc0 net/netlink/policy.c:316
 netlink_policy_dump_write+0x1e1/0x6e0 net/netlink/policy.c:447
 ctrl_dumppolicy+0x6f4/0xb90 net/netlink/genetlink.c:1743
 genl_dumpit+0x108/0x1b0 net/netlink/genetlink.c:1027
 netlink_dump+0x64e/0xe70 net/netlink/af_netlink.c:2309
 netlink_recvmsg+0x67b/0xe00 net/netlink/af_netlink.c:1965
 sock_recvmsg_nosec net/socket.c:1017 [inline]
 sock_recvmsg+0x229/0x270 net/socket.c:1039
 __sys_recvfrom+0x1f6/0x340 net/socket.c:2230
 __do_sys_recvfrom net/socket.c:2245 [inline]
 __se_sys_recvfrom net/socket.c:2241 [inline]
 __x64_sys_recvfrom+0xde/0x100 net/socket.c:2241
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f082f5e79b9
Code: ff e8 cb 01 00 00 66 2e 0f 1f 84 00 00 00 00 00 90 80 3d d1 56 07 00 00 41 89 ca 74 1c 45 31 c9 45 31 c0 b8 2d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 67 c3 66 0f 1f 44 00 00 55 48 83 ec 20 48 89
RSP: 002b:00007ffd83e65928 EFLAGS: 00000246 ORIG_RAX: 000000000000002d
RAX: ffffffffffffffda RBX: 00007ffd83e659b4 RCX: 00007f082f5e79b9
RDX: 0000000000001000 RSI: 00007ffd83e659a0 RDI: 0000000000000003
RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd83e659a0
R13: 0000000000000010 R14: 0000200000000048 R15: 0000000000000001
 </TASK>