./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1287933138
<...>
DUID 00:04:d6:b0:09:ff:72:32:c6:5d:c0:56:b1:2d:70:06:fa:56
forked to background, child pid 3210
[ 30.398704][ T3211] 8021q: adding VLAN 0 to HW filter on device bond0
[ 30.412662][ T3211] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.1.28' (ECDSA) to the list of known hosts.
execve("./syz-executor1287933138", ["./syz-executor1287933138"], 0x7ffecf59f5d0 /* 10 vars */) = 0
brk(NULL) = 0x555555df1000
brk(0x555555df1c40) = 0x555555df1c40
arch_prctl(ARCH_SET_FS, 0x555555df1300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor1287933138", 4096) = 28
brk(0x555555e12c40) = 0x555555e12c40
brk(0x555555e13000) = 0x555555e13000
mprotect(0x7fbd70bf3000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
memfd_create("syzkaller", 0) = 3
mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbd6871a000
write(3, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x04\x04\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x80\x00\xff\x07\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\xff\x00\x00\x00\x00\x00\x00\x00\xf6\x00\x00\x00\x01\x00\x00\x00\xbf\xd6\xaf\x3d\x29\x4e\xa1\x54\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00"..., 2097152) = 2097152
munmap(0x7fbd6871a000, 2097152) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
ioctl(4, LOOP_SET_FD, 3) = 0
close(3) = 0
mkdir("./file0", 0777) = 0
mount("/dev/loop0", "./file0", "ntfs3", 0, "") = 0
openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
chdir("./file0") = 0
ioctl(4, LOOP_CLR_FD) = 0
close(4) = 0
syzkaller login: [ 55.465374][ T3632] loop0: detected capacity change from 0 to 4096
[ 55.477825][ T3632] ntfs3: loop0: Different NTFS' sector size (1024) and media sector size (512)
[ 55.509272][ T3632] ==================================================================
[ 55.517392][ T3632] BUG: KASAN: slab-out-of-bounds in ntfs_listxattr+0x401/0x570
[ 55.524979][ T3632] Read of size 1 at addr ffff888021acaf3d by task syz-executor128/3632
[ 55.533279][ T3632]
[ 55.535602][ T3632] CPU: 1 PID: 3632 Comm: syz-executor128 Not tainted 6.1.0-rc8-syzkaller-00014-g8ed710da2873 #0
[ 55.546000][ T3632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 55.556035][ T3632] Call Trace:
[ 55.559302][ T3632]
[ 55.562237][ T3632] dump_stack_lvl+0x1e3/0x2cb
[ 55.566934][ T3632] ? nf_tcp_handle_invalid+0x62e/0x62e
[ 55.572379][ T3632] ? __wake_up_klogd+0xcd/0x100
[ 55.577215][ T3632] ? panic+0x766/0x766
[ 55.581353][ T3632] ? _printk+0xcf/0x10f
[ 55.585495][ T3632] print_address_description+0x74/0x340
[ 55.591024][ T3632] print_report+0x107/0x220
[ 55.595510][ T3632] ? __virt_addr_valid+0x21b/0x2d0
[ 55.600605][ T3632] ? __phys_addr+0xb5/0x160
[ 55.605095][ T3632] ? ntfs_listxattr+0x401/0x570
[ 55.610017][ T3632] kasan_report+0x139/0x170
[ 55.614503][ T3632] ? ntfs_listxattr+0x401/0x570
[ 55.619343][ T3632] ntfs_listxattr+0x401/0x570
[ 55.624004][ T3632] ? kasan_quarantine_put+0xd4/0x230
[ 55.629277][ T3632] ? ntfs_permission+0xf0/0xf0
[ 55.634024][ T3632] ? slab_free_freelist_hook+0x12e/0x1a0
[ 55.639643][ T3632] ? user_path_at_empty+0x149/0x1a0
[ 55.644825][ T3632] ? kmem_cache_free+0x94/0x1d0
[ 55.649662][ T3632] ? bpf_lsm_inode_listxattr+0x5/0x10
[ 55.655016][ T3632] listxattr+0x293/0x2d0
[ 55.659246][ T3632] ? ntfs_permission+0xf0/0xf0
[ 55.664000][ T3632] __x64_sys_llistxattr+0x174/0x230
[ 55.669185][ T3632] ? print_irqtrace_events+0x220/0x220
[ 55.674639][ T3632] ? __ia32_sys_listxattr+0x230/0x230
[ 55.680083][ T3632] ? syscall_enter_from_user_mode+0x2e/0x1d0
[ 55.686052][ T3632] ? syscall_enter_from_user_mode+0x86/0x1d0
[ 55.692021][ T3632] do_syscall_64+0x2b/0x70
[ 55.696420][ T3632] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 55.702380][ T3632] RIP: 0033:0x7fbd70b66749
[ 55.706780][ T3632] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 55.726409][ T3632] RSP: 002b:00007fff05b9d818 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3
[ 55.734805][ T3632] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007fbd70b66749
[ 55.742761][ T3632] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200000c0
[ 55.750714][ T3632] RBP: 00007fbd70b25fe0 R08: 000000000001f6fe R09: 0000000000000000
[ 55.758671][ T3632] R10: 00007fff05b9d6e0 R11: 0000000000000246 R12: 00007fbd70b26070
[ 55.766627][ T3632] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 55.774586][ T3632]
[ 55.777590][ T3632]
[ 55.779896][ T3632] Allocated by task 3632:
[ 55.784201][ T3632] kasan_set_track+0x4c/0x70
[ 55.788780][ T3632] __kasan_kmalloc+0x97/0xb0
[ 55.793350][ T3632] __kmalloc+0xaf/0x1a0
[ 55.797489][ T3632] ntfs_read_ea+0x437/0x820
[ 55.801977][ T3632] ntfs_listxattr+0x184/0x570
[ 55.806636][ T3632] listxattr+0x293/0x2d0
[ 55.810862][ T3632] __x64_sys_llistxattr+0x174/0x230
[ 55.816047][ T3632] do_syscall_64+0x2b/0x70
[ 55.820452][ T3632] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 55.826327][ T3632]
[ 55.828634][ T3632] The buggy address belongs to the object at ffff888021acaf00
[ 55.828634][ T3632] which belongs to the cache kmalloc-64 of size 64
[ 55.842492][ T3632] The buggy address is located 61 bytes inside of
[ 55.842492][ T3632] 64-byte region [ffff888021acaf00, ffff888021acaf40)
[ 55.855572][ T3632]
[ 55.857878][ T3632] The buggy address belongs to the physical page:
[ 55.864271][ T3632] page:ffffea000086b280 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888021aca080 pfn:0x21aca
[ 55.875700][ T3632] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 55.883233][ T3632] raw: 00fff00000000200 ffffea0000796a40 dead000000000005 ffff888012841640
[ 55.891798][ T3632] raw: ffff888021aca080 000000008020001d 00000001ffffffff 0000000000000000
[ 55.900357][ T3632] page dumped because: kasan: bad access detected
[ 55.906746][ T3632] page_owner tracks the page as allocated
[ 55.912444][ T3632] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 46, tgid 46 (kworker/u4:3), ts 7050450825, free_ts 6956530319
[ 55.930250][ T3632] get_page_from_freelist+0x72b/0x7a0
[ 55.935610][ T3632] __alloc_pages+0x259/0x560
[ 55.940188][ T3632] alloc_slab_page+0xbd/0x190
[ 55.944848][ T3632] allocate_slab+0x5e/0x4b0
[ 55.949335][ T3632] ___slab_alloc+0x7f4/0xeb0
[ 55.953913][ T3632] __kmem_cache_alloc_node+0x252/0x310
[ 55.959354][ T3632] kmalloc_node_trace+0x23/0x60
[ 55.964200][ T3632] __get_vm_area_node+0x13f/0x380
[ 55.969208][ T3632] __vmalloc_node_range+0x3a6/0x1400
[ 55.974474][ T3632] alloc_thread_stack_node+0x307/0x500
[ 55.979919][ T3632] dup_task_struct+0x8b/0x490
[ 55.984579][ T3632] copy_process+0x637/0x3fc0
[ 55.989151][ T3632] kernel_clone+0x227/0x640
[ 55.993634][ T3632] user_mode_thread+0x12d/0x190
[ 55.998473][ T3632] call_usermodehelper_exec_work+0x57/0x220
[ 56.004347][ T3632] process_one_work+0x81c/0xd10
[ 56.009182][ T3632] page last free stack trace:
[ 56.013835][ T3632] free_pcp_prepare+0x80c/0x8f0
[ 56.018674][ T3632] free_unref_page+0x7d/0x630
[ 56.023342][ T3632] __vunmap+0x867/0x9d0
[ 56.027519][ T3632] free_work+0x66/0x90
[ 56.031577][ T3632] process_one_work+0x81c/0xd10
[ 56.036410][ T3632] worker_thread+0xb14/0x1330
[ 56.041081][ T3632] kthread+0x266/0x300
[ 56.045132][ T3632] ret_from_fork+0x1f/0x30
[ 56.049532][ T3632]
[ 56.051840][ T3632] Memory state around the buggy address:
[ 56.057459][ T3632] ffff888021acae00: 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc fc
[ 56.065510][ T3632] ffff888021acae80: 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc fc
[ 56.073550][ T3632] >ffff888021acaf00: 00 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc
[ 56.081587][ T3632] ^
[ 56.087459][ T3632] ffff888021acaf80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 56.095498][ T3632] ffff888021acb000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 56.103535][ T3632] ==================================================================
[ 56.111791][ T3632] Kernel panic - not syncing: panic_on_warn set ...
[ 56.118386][ T3632] CPU: 1 PID: 3632 Comm: syz-executor128 Not tainted 6.1.0-rc8-syzkaller-00014-g8ed710da2873 #0
[ 56.128796][ T3632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 56.138856][ T3632] Call Trace:
[ 56.142149][ T3632]
[ 56.145080][ T3632] dump_stack_lvl+0x1e3/0x2cb
[ 56.149758][ T3632] ? nf_tcp_handle_invalid+0x62e/0x62e
[ 56.155217][ T3632] ? panic+0x766/0x766
[ 56.159299][ T3632] ? preempt_schedule_common+0xb7/0xe0
[ 56.164768][ T3632] ? preempt_schedule+0xd9/0xe0
[ 56.169621][ T3632] ? vscnprintf+0x59/0x80
[ 56.173955][ T3632] panic+0x316/0x766
[ 56.177858][ T3632] ? memcpy_page_flushcache+0xfc/0xfc
[ 56.183239][ T3632] ? _raw_spin_unlock_irqrestore+0x128/0x130
[ 56.189221][ T3632] ? print_report+0x1e0/0x220
[ 56.193900][ T3632] ? ntfs_listxattr+0x401/0x570
[ 56.198748][ T3632] end_report+0x91/0xa0
[ 56.202899][ T3632] kasan_report+0x146/0x170
[ 56.207397][ T3632] ? ntfs_listxattr+0x401/0x570
[ 56.212246][ T3632] ntfs_listxattr+0x401/0x570
[ 56.216917][ T3632] ? kasan_quarantine_put+0xd4/0x230
[ 56.222200][ T3632] ? ntfs_permission+0xf0/0xf0
[ 56.226959][ T3632] ? slab_free_freelist_hook+0x12e/0x1a0
[ 56.232588][ T3632] ? user_path_at_empty+0x149/0x1a0
[ 56.237783][ T3632] ? kmem_cache_free+0x94/0x1d0
[ 56.242627][ T3632] ? bpf_lsm_inode_listxattr+0x5/0x10
[ 56.247992][ T3632] listxattr+0x293/0x2d0
[ 56.252229][ T3632] ? ntfs_permission+0xf0/0xf0
[ 56.257163][ T3632] __x64_sys_llistxattr+0x174/0x230
[ 56.262356][ T3632] ? print_irqtrace_events+0x220/0x220
[ 56.267810][ T3632] ? __ia32_sys_listxattr+0x230/0x230
[ 56.273186][ T3632] ? syscall_enter_from_user_mode+0x2e/0x1d0
[ 56.279162][ T3632] ? syscall_enter_from_user_mode+0x86/0x1d0
[ 56.285137][ T3632] do_syscall_64+0x2b/0x70
[ 56.289549][ T3632] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 56.295437][ T3632] RIP: 0033:0x7fbd70b66749
[ 56.299843][ T3632] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 56.319439][ T3632] RSP: 002b:00007fff05b9d818 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3
[ 56.327855][ T3632] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007fbd70b66749
[ 56.335822][ T3632] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200000c0
[ 56.343785][ T3632] RBP: 00007fbd70b25fe0 R08: 000000000001f6fe R09: 0000000000000000
[ 56.351750][ T3632] R10: 00007fff05b9d6e0 R11: 0000000000000246 R12: 00007fbd70b26070
[ 56.359712][ T3632] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 56.367679][ T3632]
[ 56.370839][ T3632] Kernel Offset: disabled
[ 56.375162][ T3632] Rebooting in 86400 seconds..