Warning: Permanently added '10.128.1.159' (ED25519) to the list of known hosts. executing program [ 37.811600][ T3499] loop0: detected capacity change from 0 to 4096 [ 37.821113][ T3499] ntfs3: loop0: Different NTFS' sector size (4096) and media sector size (512) [ 37.837388][ T3499] ntfs3: loop0: Mark volume as dirty due to NTFS errors [ 37.845238][ T3499] ntfs3: loop0: Failed to load $Extend. [ 37.862110][ T3499] ================================================================== [ 37.870257][ T3499] BUG: KASAN: slab-out-of-bounds in ntfs_listxattr+0x3b2/0x5b0 [ 37.877824][ T3499] Read of size 48 at addr ffff888012df9830 by task syz-executor194/3499 [ 37.886143][ T3499] [ 37.888447][ T3499] CPU: 0 PID: 3499 Comm: syz-executor194 Not tainted 5.15.138-syzkaller #0 [ 37.897003][ T3499] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 37.907032][ T3499] Call Trace: [ 37.910287][ T3499] [ 37.913196][ T3499] dump_stack_lvl+0x1e3/0x2cb [ 37.917850][ T3499] ? io_uring_drop_tctx_refs+0x19d/0x19d [ 37.923455][ T3499] ? _printk+0xd1/0x111 [ 37.927585][ T3499] ? __wake_up_klogd+0xcc/0x100 [ 37.932409][ T3499] ? panic+0x84d/0x84d [ 37.936449][ T3499] ? _raw_spin_lock_irqsave+0xdd/0x120 [ 37.941883][ T3499] ? ntfs_read_ea+0x83c/0xa00 [ 37.946558][ T3499] print_address_description+0x63/0x3b0 [ 37.952092][ T3499] ? ntfs_listxattr+0x3b2/0x5b0 [ 37.956921][ T3499] kasan_report+0x16b/0x1c0 [ 37.961400][ T3499] ? ntfs_listxattr+0x3b2/0x5b0 [ 37.966226][ T3499] kasan_check_range+0x27e/0x290 [ 37.971136][ T3499] ? ntfs_listxattr+0x3b2/0x5b0 [ 37.975965][ T3499] memcpy+0x25/0x60 [ 37.979748][ T3499] ntfs_listxattr+0x3b2/0x5b0 [ 37.984401][ T3499] ? ntfs_permission+0xf0/0xf0 [ 37.989136][ T3499] ? __kmalloc_node+0x199/0x390 [ 37.993959][ T3499] ? kvmalloc_node+0x80/0x140 [ 37.998609][ T3499] ? bpf_lsm_inode_listxattr+0x5/0x10 [ 38.003955][ T3499] listxattr+0x282/0x2e0 [ 38.008173][ T3499] ? ntfs_permission+0xf0/0xf0 [ 38.012913][ T3499] __x64_sys_listxattr+0x172/0x230 [ 38.017999][ T3499] ? print_irqtrace_events+0x210/0x210 [ 38.023433][ T3499] ? __ia32_sys_fgetxattr+0x200/0x200 [ 38.028780][ T3499] ? syscall_enter_from_user_mode+0x2e/0x230 [ 38.034734][ T3499] ? lockdep_hardirqs_on+0x94/0x130 [ 38.039912][ T3499] ? syscall_enter_from_user_mode+0x2e/0x230 [ 38.045874][ T3499] do_syscall_64+0x3d/0xb0 [ 38.050279][ T3499] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 38.056150][ T3499] RIP: 0033:0x7f1a6e4085f9 [ 38.060543][ T3499] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 38.080124][ T3499] RSP: 002b:00007ffd76258d88 EFLAGS: 00000246 ORIG_RAX: 00000000000000c2 [ 38.088521][ T3499] RAX: ffffffffffffffda RBX: 0032656c69662f2e RCX: 00007f1a6e4085f9 [ 38.096476][ T3499] RDX: 00000000000000d3 RSI: 0000000020000040 RDI: 0000000020000000 [ 38.104425][ T3499] RBP: 00007f1a6e49a610 R08: 000000000001f1e5 R09: 0000000000000000 [ 38.112376][ T3499] R10: 00007ffd76258c50 R11: 0000000000000246 R12: 0000000000000001 [ 38.120325][ T3499] R13: 00007ffd76258f58 R14: 0000000000000001 R15: 0000000000000001 [ 38.128279][ T3499] [ 38.131281][ T3499] [ 38.133585][ T3499] Allocated by task 3499: [ 38.137881][ T3499] ____kasan_kmalloc+0xba/0xf0 [ 38.142629][ T3499] __kmalloc+0x168/0x300 [ 38.146865][ T3499] ntfs_read_ea+0x48a/0xa00 [ 38.151346][ T3499] ntfs_listxattr+0x179/0x5b0 [ 38.156008][ T3499] listxattr+0x282/0x2e0 [ 38.160230][ T3499] __x64_sys_listxattr+0x172/0x230 [ 38.165314][ T3499] do_syscall_64+0x3d/0xb0 [ 38.169706][ T3499] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 38.175571][ T3499] [ 38.177866][ T3499] The buggy address belongs to the object at ffff888012df9800 [ 38.177866][ T3499] which belongs to the cache kmalloc-64 of size 64 [ 38.191722][ T3499] The buggy address is located 48 bytes inside of [ 38.191722][ T3499] 64-byte region [ffff888012df9800, ffff888012df9840) [ 38.204794][ T3499] The buggy address belongs to the page: [ 38.210406][ T3499] page:ffffea00004b7e40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12df9 [ 38.220532][ T3499] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 38.228059][ T3499] raw: 00fff00000000200 ffffea00008c3340 0000000900000004 ffff888011c41640 [ 38.236613][ T3499] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 38.245166][ T3499] page dumped because: kasan: bad access detected [ 38.251549][ T3499] page_owner tracks the page as allocated [ 38.257232][ T3499] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY), pid 2966, ts 12536376615, free_ts 10689103632 [ 38.273087][ T3499] get_page_from_freelist+0x322a/0x33c0 [ 38.278613][ T3499] __alloc_pages+0x272/0x700 [ 38.283179][ T3499] new_slab+0xbb/0x4b0 [ 38.287219][ T3499] ___slab_alloc+0x6f6/0xe10 [ 38.291784][ T3499] __kmalloc+0x1c9/0x300 [ 38.296001][ T3499] tomoyo_encode+0x26b/0x530 [ 38.300564][ T3499] tomoyo_realpath_from_path+0x5a2/0x5e0 [ 38.306167][ T3499] tomoyo_check_open_permission+0x22c/0x490 [ 38.312030][ T3499] security_file_open+0x5f/0xa0 [ 38.316853][ T3499] do_dentry_open+0x315/0xfb0 [ 38.321501][ T3499] path_openat+0x2702/0x2f20 [ 38.326064][ T3499] do_filp_open+0x21c/0x460 [ 38.330539][ T3499] do_sys_openat2+0x13b/0x500 [ 38.335188][ T3499] __x64_sys_openat+0x243/0x290 [ 38.340009][ T3499] do_syscall_64+0x3d/0xb0 [ 38.344402][ T3499] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 38.350267][ T3499] page last free stack trace: [ 38.354908][ T3499] free_unref_page_prepare+0xc34/0xcf0 [ 38.360338][ T3499] free_unref_page+0x95/0x2d0 [ 38.364989][ T3499] kasan_depopulate_vmalloc_pte+0x66/0x80 [ 38.370679][ T3499] __apply_to_page_range+0x9bf/0xcc0 [ 38.375936][ T3499] kasan_release_vmalloc+0x96/0xb0 [ 38.381015][ T3499] __purge_vmap_area_lazy+0x15ae/0x1740 [ 38.386531][ T3499] _vm_unmap_aliases+0x453/0x4e0 [ 38.391441][ T3499] change_page_attr_set_clr+0x308/0x1050 [ 38.397046][ T3499] set_memory_nx+0xee/0x130 [ 38.401521][ T3499] free_initmem+0x71/0xc0 [ 38.405822][ T3499] kernel_init+0x23/0x290 [ 38.410123][ T3499] ret_from_fork+0x1f/0x30 [ 38.414520][ T3499] [ 38.416815][ T3499] Memory state around the buggy address: [ 38.422414][ T3499] ffff888012df9700: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 38.430444][ T3499] ffff888012df9780: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 38.438474][ T3499] >ffff888012df9800: 00 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc [ 38.446503][ T3499] ^ [ 38.452363][ T3499] ffff888012df9880: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 38.460396][ T3499] ffff888012df9900: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 38.468424][ T3499] ================================================================== [ 38.476453][ T3499] Disabling lock debugging due to kernel taint [ 38.486393][ T3499] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 38.493575][ T3499] CPU: 1 PID: 3499 Comm: syz-executor194 Tainted: G B 5.15.138-syzkaller #0 [ 38.503521][ T3499] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 38.513546][ T3499] Call Trace: [ 38.516799][ T3499] [ 38.519703][ T3499] dump_stack_lvl+0x1e3/0x2cb [ 38.524354][ T3499] ? io_uring_drop_tctx_refs+0x19d/0x19d [ 38.529959][ T3499] ? panic+0x84d/0x84d [ 38.533999][ T3499] ? preempt_schedule_common+0xa6/0xd0 [ 38.539428][ T3499] ? preempt_schedule+0xd9/0xe0 [ 38.544253][ T3499] panic+0x318/0x84d [ 38.548121][ T3499] ? check_panic_on_warn+0x1d/0xa0 [ 38.553203][ T3499] ? fb_is_primary_device+0xcc/0xcc [ 38.558372][ T3499] ? _raw_spin_unlock_irqrestore+0x128/0x130 [ 38.564322][ T3499] ? _raw_spin_unlock+0x40/0x40 [ 38.569142][ T3499] ? print_memory_metadata+0xe2/0x140 [ 38.574487][ T3499] check_panic_on_warn+0x7e/0xa0 [ 38.579393][ T3499] ? ntfs_listxattr+0x3b2/0x5b0 [ 38.584216][ T3499] end_report+0x6d/0xf0 [ 38.588341][ T3499] kasan_report+0x18e/0x1c0 [ 38.592817][ T3499] ? ntfs_listxattr+0x3b2/0x5b0 [ 38.597639][ T3499] kasan_check_range+0x27e/0x290 [ 38.602548][ T3499] ? ntfs_listxattr+0x3b2/0x5b0 [ 38.607368][ T3499] memcpy+0x25/0x60 [ 38.611145][ T3499] ntfs_listxattr+0x3b2/0x5b0 [ 38.615792][ T3499] ? ntfs_permission+0xf0/0xf0 [ 38.620524][ T3499] ? __kmalloc_node+0x199/0x390 [ 38.625345][ T3499] ? kvmalloc_node+0x80/0x140 [ 38.629994][ T3499] ? bpf_lsm_inode_listxattr+0x5/0x10 [ 38.635338][ T3499] listxattr+0x282/0x2e0 [ 38.639552][ T3499] ? ntfs_permission+0xf0/0xf0 [ 38.644289][ T3499] __x64_sys_listxattr+0x172/0x230 [ 38.649372][ T3499] ? print_irqtrace_events+0x210/0x210 [ 38.654803][ T3499] ? __ia32_sys_fgetxattr+0x200/0x200 [ 38.660145][ T3499] ? syscall_enter_from_user_mode+0x2e/0x230 [ 38.666096][ T3499] ? lockdep_hardirqs_on+0x94/0x130 [ 38.671264][ T3499] ? syscall_enter_from_user_mode+0x2e/0x230 [ 38.677216][ T3499] do_syscall_64+0x3d/0xb0 [ 38.681603][ T3499] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 38.687470][ T3499] RIP: 0033:0x7f1a6e4085f9 [ 38.691856][ T3499] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 38.711434][ T3499] RSP: 002b:00007ffd76258d88 EFLAGS: 00000246 ORIG_RAX: 00000000000000c2 [ 38.719818][ T3499] RAX: ffffffffffffffda RBX: 0032656c69662f2e RCX: 00007f1a6e4085f9 [ 38.727760][ T3499] RDX: 00000000000000d3 RSI: 0000000020000040 RDI: 0000000020000000 [ 38.735705][ T3499] RBP: 00007f1a6e49a610 R08: 000000000001f1e5 R09: 0000000000000000 [ 38.743648][ T3499] R10: 00007ffd76258c50 R11: 0000000000000246 R12: 0000000000000001 [ 38.751602][ T3499] R13: 00007ffd76258f58 R14: 0000000000000001 R15: 0000000000000001 [ 38.759548][ T3499] [ 38.762689][ T3499] Kernel Offset: disabled [ 38.766988][ T3499] Rebooting in 86400 seconds..