live-kbench/live-kbench huggingface dataset:
Kernel bug: WARNING in raw_ioctl
Subsystem: usb, mm
Status: fixed

Crash report:
------------[ cut here ]------------
WARNING: mm/page_alloc.c:5186 at __alloc_frozen_pages_noprof+0x2c8/0x370 mm/page_alloc.c:5186, CPU#0: syz.0.17/5983
Modules linked in:
CPU: 0 UID: 0 PID: 5983 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:__alloc_frozen_pages_noprof+0x2c8/0x370 mm/page_alloc.c:5186
Code: 74 10 4c 89 e7 89 54 24 0c e8 24 d9 0d 00 8b 54 24 0c 49 83 3c 24 00 0f 85 a5 fe ff ff e9 a6 fe ff ff c6 05 7c 17 8f 0d 01 90 <0f> 0b 90 e9 18 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24
RSP: 0018:ffffc90003467920 EFLAGS: 00010246
RAX: ffffc90003467900 RBX: 0000000000000013 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90003467988
RBP: ffffc90003467a18 R08: ffffc90003467987 R09: 0000000000000000
R10: ffffc90003467960 R11: fffff5200068cf31 R12: 0000000000000000
R13: 1ffff9200068cf28 R14: 0000000000040cc0 R15: dffffc0000000000
FS:  0000555576900500(0000) GS:ffff888125a78000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000020000000100a CR3: 0000000078b10000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2486
 ___kmalloc_large_node+0x5f/0x1b0 mm/slub.c:5595
 __kmalloc_large_node_noprof+0x18/0x90 mm/slub.c:5626
 __do_kmalloc_node mm/slub.c:5642 [inline]
 __kmalloc_noprof+0x4c9/0x800 mm/slub.c:5666
 kmalloc_noprof include/linux/slab.h:961 [inline]
 raw_alloc_io_data drivers/usb/gadget/legacy/raw_gadget.c:673 [inline]
 raw_ioctl_ep_read drivers/usb/gadget/legacy/raw_gadget.c:1162 [inline]
 raw_ioctl+0x18cb/0x4050 drivers/usb/gadget/legacy/raw_gadget.c:1325
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7efcc398f6c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc2b19fcb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007efcc3be5fa0 RCX: 00007efcc398f6c9
RDX: 0000200000000500 RSI: 00000000c0085508 RDI: 0000000000000003
RBP: 00007efcc3a11f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007efcc3be5fa0 R14: 00007efcc3be5fa0 R15: 0000000000000003
 </TASK>
Kernel bug: WARNING in nilfs_btree_mark
Subsystem: nilfs
Status: fixed

Crash report:
loop0: detected capacity change from 0 to 4096
------------[ cut here ]------------
ret == -ENOENT
WARNING: fs/nilfs2/btree.c:2356 at nilfs_btree_mark+0x1c9/0x210 fs/nilfs2/btree.c:2356, CPU#1: syz.0.17/5978
Modules linked in:
CPU: 1 UID: 0 PID: 5978 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:nilfs_btree_mark+0x1c9/0x210 fs/nilfs2/btree.c:2356
Code: 48 8b 05 fa 0d 70 0f 48 3b 44 24 10 75 26 89 e8 48 83 c4 18 5b 41 5c 41 5d 41 5e 41 5f 5d e9 c9 1e 64 fd cc e8 b8 7e 19 fe 90 <0f> 0b 90 bd fe ff ff ff eb c3 e8 08 7f 02 08 44 89 f1 80 e1 07 80
RSP: 0018:ffffc900038075b0 EFLAGS: 00010293
RAX: ffffffff83ac2248 RBX: ffff888035117080 RCX: ffff888028170000
RDX: 0000000000000000 RSI: 00000000fffffffe RDI: 00000000fffffffe
RBP: 00000000fffffffe R08: 0000000000000341 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed1006a22ee3 R12: ffff88805726c5c0
R13: dffffc0000000000 R14: ffff88805726c588 R15: fffffffffffffff8
FS:  000055558815d500(0000) GS:ffff88812555d000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2f663fff CR3: 00000000270a5000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 nilfs_bmap_mark+0xba/0x180 fs/nilfs2/bmap.c:402
 nilfs_ioctl_mark_blocks_dirty fs/nilfs2/ioctl.c:764 [inline]
 nilfs_ioctl_prepare_clean_segments+0x49a/0x800 fs/nilfs2/ioctl.c:799
 nilfs_clean_segments+0x18c/0xa50 fs/nilfs2/segment.c:2525
 nilfs_ioctl_clean_segments fs/nilfs2/ioctl.c:916 [inline]
 nilfs_ioctl+0x261f/0x2780 fs/nilfs2/ioctl.c:1346
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f97fcd9c799
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffdfc45fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f97fd015fa0 RCX: 00007f97fcd9c799
RDX: 0000200000000640 RSI: 0000000040786e88 RDI: 0000000000000004
RBP: 00007f97fce32c99 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f97fd015fac R14: 00007f97fd015fa0 R15: 00007f97fd015fa0
 </TASK>
Kernel bug: KMSAN: uninit-value in netif_skb_features (4)
Subsystem: net
Status: fixed

Crash report:
=====================================================
BUG: KMSAN: uninit-value in gso_features_check net/core/dev.c:3804 [inline]
BUG: KMSAN: uninit-value in netif_skb_features+0x6fb/0x1870 net/core/dev.c:3828
 gso_features_check net/core/dev.c:3804 [inline]
 netif_skb_features+0x6fb/0x1870 net/core/dev.c:3828
 validate_xmit_skb+0xb6/0x2400 net/core/dev.c:4003
 validate_xmit_skb_list+0xd4/0x320 net/core/dev.c:4065
 sch_direct_xmit+0xd4/0xcf0 net/sched/sch_generic.c:332
 __dev_xmit_skb net/core/dev.c:4179 [inline]
 __dev_queue_xmit+0x3016/0x5a50 net/core/dev.c:4795
 dev_queue_xmit include/linux/netdevice.h:3384 [inline]
 packet_xmit+0x8f/0x710 net/packet/af_packet.c:275
 packet_snd net/packet/af_packet.c:3077 [inline]
 packet_sendmsg+0x91d9/0xa320 net/packet/af_packet.c:3109
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg net/socket.c:742 [inline]
 ____sys_sendmsg+0xfe7/0x1080 net/socket.c:2592
 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2646
 __sys_sendmsg net/socket.c:2678 [inline]
 __do_sys_sendmsg net/socket.c:2683 [inline]
 __se_sys_sendmsg net/socket.c:2681 [inline]
 __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2681
 x64_sys_call+0x1e20/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:4466 [inline]
 slab_alloc_node mm/slub.c:4788 [inline]
 kmem_cache_alloc_node_noprof+0x3cd/0x12d0 mm/slub.c:4840
 kmalloc_reserve net/core/skbuff.c:613 [inline]
 __alloc_skb+0x855/0x1190 net/core/skbuff.c:713
 alloc_skb include/linux/skbuff.h:1383 [inline]
 alloc_skb_with_frags+0xc5/0xa60 net/core/skbuff.c:6750
 sock_alloc_send_pskb+0xacb/0xc60 net/core/sock.c:2995
 packet_alloc_skb net/packet/af_packet.c:2927 [inline]
 packet_snd net/packet/af_packet.c:3020 [inline]
 packet_sendmsg+0x7477/0xa320 net/packet/af_packet.c:3109
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg net/socket.c:742 [inline]
 ____sys_sendmsg+0xfe7/0x1080 net/socket.c:2592
 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2646
 __sys_sendmsg net/socket.c:2678 [inline]
 __do_sys_sendmsg net/socket.c:2683 [inline]
 __se_sys_sendmsg net/socket.c:2681 [inline]
 __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2681
 x64_sys_call+0x1e20/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 6045 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
=====================================================
Kernel bug: WARNING in nilfs_ioctl_prepare_clean_segments
Subsystem: nilfs
Status: fixed

Crash report:
loop0: detected capacity change from 0 to 4096
------------[ cut here ]------------
ret == -ENOENT
WARNING: fs/nilfs2/ioctl.c:757 at nilfs_ioctl_mark_blocks_dirty fs/nilfs2/ioctl.c:757 [inline], CPU#1: syz.0.17/6067
WARNING: fs/nilfs2/ioctl.c:757 at nilfs_ioctl_prepare_clean_segments+0x7e7/0x800 fs/nilfs2/ioctl.c:799, CPU#1: syz.0.17/6067
Modules linked in:
CPU: 1 UID: 0 PID: 6067 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:nilfs_ioctl_mark_blocks_dirty fs/nilfs2/ioctl.c:757 [inline]
RIP: 0010:nilfs_ioctl_prepare_clean_segments+0x7e7/0x800 fs/nilfs2/ioctl.c:799
Code: fe e9 3e fa ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c d4 fa ff ff 4c 89 ef e8 34 a7 7e fe e9 c7 fa ff ff e8 fa 40 15 fe 90 <0f> 0b 90 41 bf fe ff ff ff e9 e3 fe ff ff 66 66 2e 0f 1f 84 00 00
RSP: 0018:ffffc90002f17640 EFLAGS: 00010293
RAX: ffffffff83b11086 RBX: 00000000fffffffe RCX: ffff888029a05b80
RDX: 0000000000000000 RSI: ffffffff8ecbc490 RDI: 00000000fffffffe
RBP: ffffc90002f17730 R08: ffff888029a05b80 R09: 0000000000000002
R10: 00000000fffffffe R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000020 R14: ffff88805c254560 R15: ffff88807ade9180
FS:  0000555588d41500(0000) GS:ffff888125548000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b31063fff CR3: 0000000078882000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 nilfs_clean_segments+0x18c/0xa50 fs/nilfs2/segment.c:2525
 nilfs_ioctl_clean_segments fs/nilfs2/ioctl.c:916 [inline]
 nilfs_ioctl+0x261f/0x2780 fs/nilfs2/ioctl.c:1346
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2426b9c799
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcedafafd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f2426e15fa0 RCX: 00007f2426b9c799
RDX: 0000200000000000 RSI: 0000000040786e88 RDI: 0000000000000004
RBP: 00007f2426c32c99 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f2426e15fac R14: 00007f2426e15fa0 R15: 00007f2426e15fa0
 </TASK>
Kernel bug: KMSAN: uninit-value in pfn_reader_next
Subsystem: iommu
Status: fixed

Crash report:
iommufd_mock iommufd_mock0: Adding to iommu group 0
=====================================================
BUG: KMSAN: uninit-value in batch_add_pfn_num drivers/iommu/iommufd/pages.c:365 [inline]
BUG: KMSAN: uninit-value in batch_add_pfn drivers/iommu/iommufd/pages.c:398 [inline]
BUG: KMSAN: uninit-value in batch_from_pages drivers/iommu/iommufd/pages.c:658 [inline]
BUG: KMSAN: uninit-value in pfn_reader_fill_span drivers/iommu/iommufd/pages.c:1220 [inline]
BUG: KMSAN: uninit-value in pfn_reader_next+0x1d5a/0x3e50 drivers/iommu/iommufd/pages.c:1247
 batch_add_pfn_num drivers/iommu/iommufd/pages.c:365 [inline]
 batch_add_pfn drivers/iommu/iommufd/pages.c:398 [inline]
 batch_from_pages drivers/iommu/iommufd/pages.c:658 [inline]
 pfn_reader_fill_span drivers/iommu/iommufd/pages.c:1220 [inline]
 pfn_reader_next+0x1d5a/0x3e50 drivers/iommu/iommufd/pages.c:1247
 pfn_reader_first+0xbcf/0xee0 drivers/iommu/iommufd/pages.c:1354
 iopt_area_fill_domains+0x202/0x1590 drivers/iommu/iommufd/pages.c:1917
 iopt_fill_domains_pages drivers/iommu/iommufd/io_pagetable.c:359 [inline]
 iopt_map_pages+0x1ba5/0x2130 drivers/iommu/iommufd/io_pagetable.c:387
 iopt_map_common+0x224/0x610 drivers/iommu/iommufd/io_pagetable.c:425
 iopt_map_user_pages+0x148/0x1c0 drivers/iommu/iommufd/io_pagetable.c:466
 iommufd_ioas_map+0x6a2/0x9b0 drivers/iommu/iommufd/ioas.c:270
 iommufd_fops_ioctl+0x82a/0x9e0 drivers/iommu/iommufd/main.c:533
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0x23c/0x400 fs/ioctl.c:583
 __x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:583
 x64_sys_call+0x18a7/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Local variable pfns created at:
 iopt_area_fill_domains+0x5c/0x1590 drivers/iommu/iommufd/pages.c:1900
 iopt_fill_domains_pages drivers/iommu/iommufd/io_pagetable.c:359 [inline]
 iopt_map_pages+0x1ba5/0x2130 drivers/iommu/iommufd/io_pagetable.c:387

CPU: 0 UID: 0 PID: 6065 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026
=====================================================
Kernel bug: KMSAN: uninit-value in fuse_fileattr_get
Subsystem: fuse
Status: fixed

Crash report:
=====================================================
BUG: KMSAN: uninit-value in fuse_fileattr_get+0xeb4/0x1450 fs/fuse/ioctl.c:517
 fuse_fileattr_get+0xeb4/0x1450 fs/fuse/ioctl.c:517
 vfs_fileattr_get fs/file_attr.c:94 [inline]
 __do_sys_file_getattr fs/file_attr.c:416 [inline]
 __se_sys_file_getattr+0x6cb/0xbd0 fs/file_attr.c:372
 __x64_sys_file_getattr+0xe4/0x150 fs/file_attr.c:372
 x64_sys_call+0x17cd/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:469
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Local variable fa.i created at:
 __do_sys_file_getattr fs/file_attr.c:380 [inline]
 __se_sys_file_getattr+0x8c/0xbd0 fs/file_attr.c:372
 __x64_sys_file_getattr+0xe4/0x150 fs/file_attr.c:372

CPU: 1 UID: 0 PID: 6065 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
=====================================================
Kernel bug: memory leak in nr_sendmsg
Subsystem: hams
Status: fixed

Crash report:
BUG: memory leak
unreferenced object 0xffff888129f35500 (size 240):
  comm "syz.0.17", pid 6119, jiffies 4294944652
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 10 52 28 81 88 ff ff  ..........R(....
  backtrace (crc 1456a3e4):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4983 [inline]
    slab_alloc_node mm/slub.c:5288 [inline]
    kmem_cache_alloc_node_noprof+0x36f/0x5e0 mm/slub.c:5340
    __alloc_skb+0x203/0x240 net/core/skbuff.c:660
    alloc_skb include/linux/skbuff.h:1383 [inline]
    alloc_skb_with_frags+0x69/0x3f0 net/core/skbuff.c:6671
    sock_alloc_send_pskb+0x379/0x3e0 net/core/sock.c:2965
    sock_alloc_send_skb include/net/sock.h:1859 [inline]
    nr_sendmsg+0x287/0x450 net/netrom/af_netrom.c:1105
    sock_sendmsg_nosec net/socket.c:727 [inline]
    __sock_sendmsg net/socket.c:742 [inline]
    sock_write_iter+0x293/0x2a0 net/socket.c:1195
    new_sync_write fs/read_write.c:593 [inline]
    vfs_write+0x45d/0x710 fs/read_write.c:686
    ksys_write+0x143/0x170 fs/read_write.c:738
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff8881112c0000 (size 65536):
  comm "syz.0.17", pid 6119, jiffies 4294944652
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01  ................
    01 00 00 05 02 98 92 9c aa b0 40 02 00 00 00 00  ..........@.....
  backtrace (crc 75262837):
    ___kmalloc_large_node+0xc1/0x100 mm/slub.c:5604
    __kmalloc_large_node_noprof+0x18/0xa0 mm/slub.c:5622
    __do_kmalloc_node mm/slub.c:5638 [inline]
    __kmalloc_node_track_caller_noprof+0x412/0x6b0 mm/slub.c:5759
    kmalloc_reserve+0x96/0x180 net/core/skbuff.c:601
    __alloc_skb+0xd4/0x240 net/core/skbuff.c:670
    alloc_skb include/linux/skbuff.h:1383 [inline]
    alloc_skb_with_frags+0x69/0x3f0 net/core/skbuff.c:6671
    sock_alloc_send_pskb+0x379/0x3e0 net/core/sock.c:2965
    sock_alloc_send_skb include/net/sock.h:1859 [inline]
    nr_sendmsg+0x287/0x450 net/netrom/af_netrom.c:1105
    sock_sendmsg_nosec net/socket.c:727 [inline]
    __sock_sendmsg net/socket.c:742 [inline]
    sock_write_iter+0x293/0x2a0 net/socket.c:1195
    new_sync_write fs/read_write.c:593 [inline]
    vfs_write+0x45d/0x710 fs/read_write.c:686
    ksys_write+0x143/0x170 fs/read_write.c:738
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF
Kernel bug: WARNING in skb_attempt_defer_free
Subsystem: net
Status: fixed

Crash report:
------------[ cut here ]------------
WARNING: net/core/skbuff.c:7243 at skb_attempt_defer_free+0x641/0x710 net/core/skbuff.c:7243, CPU#3: syz.0.20/6099
Modules linked in:
CPU: 3 UID: 0 PID: 6099 Comm: syz.0.20 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:skb_attempt_defer_free+0x641/0x710 net/core/skbuff.c:7243
Code: 66 e6 f8 e9 5d ff ff ff e8 fc 8b 7c f8 90 0f 0b 90 e9 f0 fc ff ff e8 ee 8b 7c f8 90 0f 0b 90 e9 74 fc ff ff e8 e0 8b 7c f8 90 <0f> 0b 90 e9 95 fc ff ff e8 d2 8b 7c f8 90 0f 0b 90 48 b8 00 00 00
RSP: 0018:ffffc9000463f5a8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff888053a2d180 RCX: ffffffff894256f5
RDX: ffff88802644a4c0 RSI: ffffffff89425a90 RDI: ffff888053a2d1e0
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000001
R10: 0000000000000000 R11: ffff88802644aff0 R12: 0000000000000000
R13: 1ffff920008c7eb9 R14: 0000000000000000 R15: ffff888053a2d1d8
FS:  00007fad2f19c6c0(0000) GS:ffff8880d6bf5000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fad2f19bf98 CR3: 000000002ccfd000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 skb_consume_udp+0x19f/0x250 net/ipv4/udp.c:1854
 udp_recvmsg+0x6c7/0x1350 net/ipv4/udp.c:2145
 sk_udp_recvmsg+0x9b/0x120 net/ipv4/udp_bpf.c:20
 udp_bpf_recvmsg net/ipv4/udp_bpf.c:94 [inline]
 udp_bpf_recvmsg+0x5c0/0xe40 net/ipv4/udp_bpf.c:62
 inet_recvmsg+0x625/0x6a0 net/ipv4/af_inet.c:891
 sock_recvmsg_nosec net/socket.c:1078 [inline]
 sock_recvmsg+0x1b2/0x250 net/socket.c:1100
 ____sys_recvmsg+0x218/0x6b0 net/socket.c:2812
 ___sys_recvmsg+0x114/0x1a0 net/socket.c:2854
 do_recvmmsg+0x2fe/0x750 net/socket.c:2949
 __sys_recvmmsg net/socket.c:3023 [inline]
 __do_sys_recvmmsg net/socket.c:3046 [inline]
 __se_sys_recvmmsg net/socket.c:3039 [inline]
 __x64_sys_recvmmsg+0x22a/0x280 net/socket.c:3039
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fad2e38f7c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fad2f19c038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 00007fad2e5e6090 RCX: 00007fad2e38f7c9
RDX: 0000000000000001 RSI: 00002000000047c0 RDI: 0000000000000003
RBP: 00007fad2e413f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fad2e5e6128 R14: 00007fad2e5e6090 R15: 00007ffd88783058
 </TASK>
Kernel bug: UBSAN: array-index-out-of-bounds in ocfs2_xa_remove_entry
Subsystem: ocfs2
Status: fixed

Crash report:
=======================================================
JBD2: Ignoring recovery information on journal
ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode.
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in fs/ocfs2/xattr.c:1955:3
index 2 is out of range for type 'struct ocfs2_xattr_entry[] __counted_by(xh_count)' (aka 'struct ocfs2_xattr_entry[]')
CPU: 0 UID: 0 PID: 5512 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 ubsan_epilogue+0xa/0x40 lib/ubsan.c:233
 __ubsan_handle_out_of_bounds+0xe9/0xf0 lib/ubsan.c:455
 ocfs2_xa_remove_entry+0x36d/0x3e0 fs/ocfs2/xattr.c:1955
 ocfs2_xa_remove fs/ocfs2/xattr.c:2043 [inline]
 ocfs2_xa_set+0xaf4/0x2a70 fs/ocfs2/xattr.c:2247
 ocfs2_xattr_block_set+0x3ca/0x31b0 fs/ocfs2/xattr.c:2985
 __ocfs2_xattr_set_handle+0x27e/0xf20 fs/ocfs2/xattr.c:-1
 ocfs2_xattr_set+0xde8/0x11f0 fs/ocfs2/xattr.c:3650
 __vfs_removexattr+0x431/0x470 fs/xattr.c:518
 __vfs_removexattr_locked+0x1e8/0x230 fs/xattr.c:553
 vfs_removexattr+0x80/0x1b0 fs/xattr.c:575
 removexattr fs/xattr.c:1023 [inline]
 filename_removexattr fs/xattr.c:1052 [inline]
 path_removexattrat+0x35d/0x690 fs/xattr.c:1088
 __do_sys_lremovexattr fs/xattr.c:1106 [inline]
 __se_sys_lremovexattr fs/xattr.c:1103 [inline]
 __x64_sys_lremovexattr+0x65/0x80 fs/xattr.c:1103
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7facfd38f7c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffde0f1a2f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000c6
RAX: ffffffffffffffda RBX: 00007facfd5e5fa0 RCX: 00007facfd38f7c9
RDX: 0000000000000000 RSI: 0000200000000180 RDI: 00002000000000c0
RBP: 00007facfd413f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007facfd5e5fa0 R14: 00007facfd5e5fa0 R15: 0000000000000002
 </TASK>
---[ end trace ]---