Warning: Permanently added '10.128.0.62' (ED25519) to the list of known hosts. executing program [ 67.497879][ T5025] syz-executor536[5025]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 67.554293][ T5025] loop0: detected capacity change from 0 to 4096 [ 67.588831][ T5025] ntfs: volume version 3.1. [ 67.597968][ T5025] ================================================================== [ 67.606225][ T5025] BUG: KASAN: use-after-free in ntfs_lookup_inode_by_name+0xe86/0x2ca0 [ 67.614480][ T5025] Read of size 8 at addr ffff888073cec55a by task syz-executor536/5025 [ 67.622728][ T5025] [ 67.625047][ T5025] CPU: 0 PID: 5025 Comm: syz-executor536 Not tainted 6.6.0-rc3-syzkaller-00146-g9f3ebbef746f #0 [ 67.635457][ T5025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 [ 67.645509][ T5025] Call Trace: [ 67.648788][ T5025] [ 67.651726][ T5025] dump_stack_lvl+0x1e7/0x2d0 [ 67.656410][ T5025] ? nf_tcp_handle_invalid+0x650/0x650 [ 67.661898][ T5025] ? panic+0x770/0x770 [ 67.666066][ T5025] ? _printk+0xd5/0x120 [ 67.670235][ T5025] print_report+0x163/0x540 [ 67.674755][ T5025] ? __kasan_slab_alloc+0x66/0x70 [ 67.679788][ T5025] ? __virt_addr_valid+0x22f/0x2e0 [ 67.684904][ T5025] ? __phys_addr+0xba/0x170 [ 67.689438][ T5025] ? ntfs_lookup_inode_by_name+0xe86/0x2ca0 [ 67.695345][ T5025] kasan_report+0x175/0x1b0 [ 67.699859][ T5025] ? ntfs_lookup_inode_by_name+0xe86/0x2ca0 [ 67.706282][ T5025] ntfs_lookup_inode_by_name+0xe86/0x2ca0 [ 67.712010][ T5025] ? clear_nonspinnable+0x60/0x60 [ 67.717044][ T5025] check_windows_hibernation_status+0xf0/0x4c0 [ 67.723210][ T5025] ? load_and_check_logfile+0xd0/0xd0 [ 67.728587][ T5025] ? load_system_files+0x3519/0x4840 [ 67.733878][ T5025] ? rcu_is_watching+0x15/0xb0 [ 67.738646][ T5025] load_system_files+0x35db/0x4840 [ 67.743782][ T5025] ? ntfs_setup_allocators+0x2d0/0x2d0 [ 67.749249][ T5025] ? __asan_memset+0x23/0x40 [ 67.753853][ T5025] ? generate_default_upcase+0x8ed/0x940 [ 67.759491][ T5025] ntfs_fill_super+0x19b3/0x2bd0 [ 67.764445][ T5025] mount_bdev+0x237/0x300 [ 67.768781][ T5025] ? ntfs_mount+0x40/0x40 [ 67.773135][ T5025] ? get_tree_bdev+0x5b0/0x5b0 [ 67.777903][ T5025] ? vfs_parse_fs_string+0x190/0x230 [ 67.783206][ T5025] ? vfs_parse_fs_param+0x410/0x410 [ 67.788503][ T5025] ? cap_capable+0x1b4/0x240 [ 67.793097][ T5025] legacy_get_tree+0xef/0x190 [ 67.797789][ T5025] ? ntfs_rl_punch_nolock+0x15b0/0x15b0 [ 67.803864][ T5025] vfs_get_tree+0x8c/0x280 [ 67.808293][ T5025] do_new_mount+0x28f/0xae0 [ 67.812812][ T5025] ? do_move_mount_old+0x170/0x170 [ 67.817946][ T5025] ? user_path_at_empty+0x12f/0x180 [ 67.823150][ T5025] __se_sys_mount+0x2d9/0x3c0 [ 67.827929][ T5025] ? __x64_sys_mount+0xc0/0xc0 [ 67.832705][ T5025] ? syscall_enter_from_user_mode+0x32/0x230 [ 67.838696][ T5025] ? lockdep_hardirqs_on+0x98/0x140 [ 67.843903][ T5025] ? __x64_sys_mount+0x20/0xc0 [ 67.848676][ T5025] do_syscall_64+0x41/0xc0 [ 67.853095][ T5025] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 67.858998][ T5025] RIP: 0033:0x7f7da98491ba [ 67.863414][ T5025] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 0e 06 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 67.883024][ T5025] RSP: 002b:00007fff406f6f98 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 67.891528][ T5025] RAX: ffffffffffffffda RBX: 00007fff406f6fb0 RCX: 00007f7da98491ba [ 67.899500][ T5025] RDX: 000000002001ec80 RSI: 000000002001ecc0 RDI: 00007fff406f6fb0 [ 67.907474][ T5025] RBP: 0000000000000004 R08: 00007fff406f6ff0 R09: 000000000001ec63 [ 67.915456][ T5025] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000000 [ 67.923428][ T5025] R13: 00007fff406f6ff0 R14: 0000000000000003 R15: 0000000000200000 [ 67.931412][ T5025] [ 67.934445][ T5025] [ 67.936765][ T5025] The buggy address belongs to the physical page: [ 67.943176][ T5025] page:ffffea0001cf3b00 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x73cec [ 67.953326][ T5025] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 67.960429][ T5025] page_type: 0xffffffff() [ 67.964779][ T5025] raw: 00fff00000000000 ffffea0001cf3b48 ffffea0001cf3ac8 0000000000000000 [ 67.973369][ T5025] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 67.981941][ T5025] page dumped because: kasan: bad access detected [ 67.988347][ T5025] page_owner tracks the page as freed [ 67.993702][ T5025] page last allocated via order 0, migratetype Movable, gfp_mask 0x8(__GFP_MOVABLE), pid 1, tgid 1 (swapper/0), ts 22302775480, free_ts 24837568900 [ 68.008641][ T5025] post_alloc_hook+0x1e6/0x210 [ 68.013419][ T5025] split_map_pages+0x24a/0x510 [ 68.018233][ T5025] isolate_freepages_range+0x472/0x4d0 [ 68.023716][ T5025] alloc_contig_range+0x62e/0x9a0 [ 68.028785][ T5025] alloc_contig_pages+0x3f4/0x4f0 [ 68.033831][ T5025] debug_vm_pgtable_alloc_huge_page+0xb9/0x110 [ 68.040001][ T5025] init_args+0x837/0xb10 [ 68.044247][ T5025] debug_vm_pgtable+0xe0/0x540 [ 68.049013][ T5025] do_one_initcall+0x23d/0x7d0 [ 68.053779][ T5025] do_initcall_level+0x157/0x210 [ 68.058721][ T5025] do_initcalls+0x3f/0x80 [ 68.063052][ T5025] kernel_init_freeable+0x429/0x5c0 [ 68.068270][ T5025] kernel_init+0x1d/0x2a0 [ 68.072638][ T5025] ret_from_fork+0x48/0x80 [ 68.077075][ T5025] ret_from_fork_asm+0x11/0x20 [ 68.081852][ T5025] page last free stack trace: [ 68.086638][ T5025] free_unref_page_prepare+0x8c3/0x9f0 [ 68.092111][ T5025] free_unref_page+0x37/0x3f0 [ 68.096793][ T5025] free_contig_range+0x9e/0x150 [ 68.101665][ T5025] destroy_args+0x95/0x7c0 [ 68.106092][ T5025] debug_vm_pgtable+0x4ba/0x540 [ 68.110963][ T5025] do_one_initcall+0x23d/0x7d0 [ 68.115925][ T5025] do_initcall_level+0x157/0x210 [ 68.120892][ T5025] do_initcalls+0x3f/0x80 [ 68.125248][ T5025] kernel_init_freeable+0x429/0x5c0 [ 68.130461][ T5025] kernel_init+0x1d/0x2a0 [ 68.134827][ T5025] ret_from_fork+0x48/0x80 [ 68.139262][ T5025] ret_from_fork_asm+0x11/0x20 [ 68.144052][ T5025] [ 68.146388][ T5025] Memory state around the buggy address: [ 68.152039][ T5025] ffff888073cec400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 68.160189][ T5025] ffff888073cec480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 68.168253][ T5025] >ffff888073cec500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 68.176313][ T5025] ^ [ 68.183242][ T5025] ffff888073cec580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 68.191299][ T5025] ffff888073cec600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 68.199352][ T5025] ================================================================== [ 68.207790][ T5025] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 68.215006][ T5025] CPU: 0 PID: 5025 Comm: syz-executor536 Not tainted 6.6.0-rc3-syzkaller-00146-g9f3ebbef746f #0 [ 68.225525][ T5025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 [ 68.235591][ T5025] Call Trace: [ 68.238875][ T5025] [ 68.241807][ T5025] dump_stack_lvl+0x1e7/0x2d0 [ 68.246498][ T5025] ? nf_tcp_handle_invalid+0x650/0x650 [ 68.252021][ T5025] ? panic+0x770/0x770 [ 68.256096][ T5025] ? preempt_schedule_common+0x83/0xc0 [ 68.261565][ T5025] ? vscnprintf+0x5d/0x80 [ 68.266009][ T5025] panic+0x30f/0x770 [ 68.269912][ T5025] ? check_panic_on_warn+0x21/0xa0 [ 68.275027][ T5025] ? __memcpy_flushcache+0x2b0/0x2b0 [ 68.280325][ T5025] ? _raw_spin_unlock_irqrestore+0x12c/0x140 [ 68.286315][ T5025] ? _raw_spin_unlock+0x40/0x40 [ 68.291176][ T5025] ? print_report+0x4fb/0x540 [ 68.295862][ T5025] check_panic_on_warn+0x82/0xa0 [ 68.300822][ T5025] ? ntfs_lookup_inode_by_name+0xe86/0x2ca0 [ 68.306715][ T5025] end_report+0x6e/0x130 [ 68.310974][ T5025] kasan_report+0x186/0x1b0 [ 68.315491][ T5025] ? ntfs_lookup_inode_by_name+0xe86/0x2ca0 [ 68.321389][ T5025] ntfs_lookup_inode_by_name+0xe86/0x2ca0 [ 68.327116][ T5025] ? clear_nonspinnable+0x60/0x60 [ 68.332152][ T5025] check_windows_hibernation_status+0xf0/0x4c0 [ 68.338315][ T5025] ? load_and_check_logfile+0xd0/0xd0 [ 68.343709][ T5025] ? load_system_files+0x3519/0x4840 [ 68.349001][ T5025] ? rcu_is_watching+0x15/0xb0 [ 68.353770][ T5025] load_system_files+0x35db/0x4840 [ 68.358895][ T5025] ? ntfs_setup_allocators+0x2d0/0x2d0 [ 68.364364][ T5025] ? __asan_memset+0x23/0x40 [ 68.368963][ T5025] ? generate_default_upcase+0x8ed/0x940 [ 68.374605][ T5025] ntfs_fill_super+0x19b3/0x2bd0 [ 68.379552][ T5025] mount_bdev+0x237/0x300 [ 68.383900][ T5025] ? ntfs_mount+0x40/0x40 [ 68.388233][ T5025] ? get_tree_bdev+0x5b0/0x5b0 [ 68.393022][ T5025] ? vfs_parse_fs_string+0x190/0x230 [ 68.398322][ T5025] ? vfs_parse_fs_param+0x410/0x410 [ 68.403805][ T5025] ? cap_capable+0x1b4/0x240 [ 68.408400][ T5025] legacy_get_tree+0xef/0x190 [ 68.413091][ T5025] ? ntfs_rl_punch_nolock+0x15b0/0x15b0 [ 68.418646][ T5025] vfs_get_tree+0x8c/0x280 [ 68.423113][ T5025] do_new_mount+0x28f/0xae0 [ 68.427630][ T5025] ? do_move_mount_old+0x170/0x170 [ 68.432764][ T5025] ? user_path_at_empty+0x12f/0x180 [ 68.437971][ T5025] __se_sys_mount+0x2d9/0x3c0 [ 68.442655][ T5025] ? __x64_sys_mount+0xc0/0xc0 [ 68.447432][ T5025] ? syscall_enter_from_user_mode+0x32/0x230 [ 68.453420][ T5025] ? lockdep_hardirqs_on+0x98/0x140 [ 68.458639][ T5025] ? __x64_sys_mount+0x20/0xc0 [ 68.463411][ T5025] do_syscall_64+0x41/0xc0 [ 68.467837][ T5025] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 68.473734][ T5025] RIP: 0033:0x7f7da98491ba [ 68.478162][ T5025] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 0e 06 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 68.497866][ T5025] RSP: 002b:00007fff406f6f98 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 68.506283][ T5025] RAX: ffffffffffffffda RBX: 00007fff406f6fb0 RCX: 00007f7da98491ba [ 68.514290][ T5025] RDX: 000000002001ec80 RSI: 000000002001ecc0 RDI: 00007fff406f6fb0 [ 68.522257][ T5025] RBP: 0000000000000004 R08: 00007fff406f6ff0 R09: 000000000001ec63 [ 68.530222][ T5025] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000000 [ 68.538189][ T5025] R13: 00007fff406f6ff0 R14: 0000000000000003 R15: 0000000000200000 [ 68.546261][ T5025] [ 68.549616][ T5025] Kernel Offset: disabled [ 68.553955][ T5025] Rebooting in 86400 seconds..