./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2143073502 <...> Warning: Permanently added '10.128.0.253' (ECDSA) to the list of known hosts. execve("./syz-executor2143073502", ["./syz-executor2143073502"], 0x7fff7f575f20 /* 10 vars */) = 0 brk(NULL) = 0x555556bed000 brk(0x555556bedc40) = 0x555556bedc40 arch_prctl(ARCH_SET_FS, 0x555556bed300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor2143073502", 4096) = 28 brk(0x555556c0ec40) = 0x555556c0ec40 brk(0x555556c0f000) = 0x555556c0f000 mprotect(0x7f5c24abb000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f5c1c5e3000 write(3, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x08\x02\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x80\x00\xff\x03\x00\x00\x00\x00\x00\x00\xff\x00\x00\x00\x00\x00\x00\x00\xff\x00\x00\x00\x00\x00\x00\x00\xf5\x00\x00\x00\x01\x00\x00\x00\xf7\x9a\x81\x47\x2b\x73\xcf\x43\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00"..., 2097152) = 2097152 munmap(0x7f5c1c5e3000, 2097152) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./file0", 0777) = 0 syzkaller login: [ 54.032434][ T4991] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=4991 'syz-executor214' [ 54.067655][ T4991] loop0: detected capacity change from 0 to 4096 [ 54.077613][ T4991] ntfs: (device loop0): parse_options(): Option utf8 is no longer supported, using option nls=utf8. Please use option nls=utf8 in the future and make sure utf8 is compiled either as a module or into the kernel. [ 54.099692][ T4991] ================================================================================ [ 54.109020][ T4991] UBSAN: shift-out-of-bounds in fs/ntfs/inode.c:1080:43 [ 54.115947][ T4991] shift exponent 267 is too large for 32-bit type 'unsigned int' [ 54.123765][ T4991] CPU: 1 PID: 4991 Comm: syz-executor214 Not tainted 6.4.0-rc5-syzkaller-00305-g022ce8862dff #0 [ 54.134186][ T4991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 [ 54.144335][ T4991] Call Trace: [ 54.147607][ T4991] [ 54.150540][ T4991] dump_stack_lvl+0x1e7/0x2d0 [ 54.155247][ T4991] ? nf_tcp_handle_invalid+0x650/0x650 [ 54.160757][ T4991] ? panic+0x770/0x770 [ 54.164832][ T4991] ? __kasan_slab_alloc+0x66/0x70 [ 54.169858][ T4991] __ubsan_handle_shift_out_of_bounds+0x3c3/0x420 [ 54.176281][ T4991] ntfs_read_locked_inode+0x4665/0x49c0 [ 54.181831][ T4991] ntfs_read_inode_mount+0xda6/0x2660 [ 54.187340][ T4991] ntfs_fill_super+0x1883/0x2bd0 [ 54.192426][ T4991] mount_bdev+0x2d0/0x3f0 [ 54.197554][ T4991] ? ntfs_mount+0x40/0x40 [ 54.201978][ T4991] legacy_get_tree+0xef/0x190 [ 54.206732][ T4991] ? ntfs_rl_punch_nolock+0x15b0/0x15b0 [ 54.212454][ T4991] vfs_get_tree+0x8c/0x270 [ 54.216862][ T4991] do_new_mount+0x28f/0xae0 [ 54.221355][ T4991] ? path_mount+0x5f2/0xf80 [ 54.225844][ T4991] ? do_move_mount_old+0x170/0x170 [ 54.230950][ T4991] ? user_path_at_empty+0x12f/0x180 [ 54.236318][ T4991] __se_sys_mount+0x2d9/0x3c0 [ 54.240985][ T4991] ? __x64_sys_mount+0xc0/0xc0 [ 54.245920][ T4991] ? syscall_enter_from_user_mode+0x32/0x230 [ 54.251889][ T4991] ? __x64_sys_mount+0x20/0xc0 [ 54.256816][ T4991] do_syscall_64+0x41/0xc0 [ 54.261218][ T4991] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 54.267103][ T4991] RIP: 0033:0x7f5c24a30f9a [ 54.271504][ T4991] Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 54.291186][ T4991] RSP: 002b:00007fffedb28378 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 54.299593][ T4991] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f5c24a30f9a [ 54.307549][ T4991] RDX: 0000000020000000 RSI: 000000002001ee80 RDI: 00007fffedb28390 [ 54.315506][ T4991] RBP: 00007fffedb28390 R08: 00007fffedb283d0 R09: 00007fffedb283e0 [ 54.323580][ T4991] R10: 0000000000800804 R11: 0000000000000286 R12: 0000000000000004 [ 54.331537][ T4991] R13: 0000555556bed2c0 R14: 0000000000800804 R15: 00007fffedb283d0 [ 54.339504][ T4991] [ 54.342681][ T4991] ================================================================================ [ 54.352184][ T4991] Kernel panic - not syncing: UBSAN: panic_on_warn set ... [ 54.359977][ T4991] CPU: 1 PID: 4991 Comm: syz-executor214 Not tainted 6.4.0-rc5-syzkaller-00305-g022ce8862dff #0 [ 54.370364][ T4991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 [ 54.385010][ T4991] Call Trace: [ 54.388269][ T4991] [ 54.391209][ T4991] dump_stack_lvl+0x1e7/0x2d0 [ 54.396055][ T4991] ? nf_tcp_handle_invalid+0x650/0x650 [ 54.401500][ T4991] ? panic+0x770/0x770 [ 54.405821][ T4991] ? vscnprintf+0x5d/0x80 [ 54.410312][ T4991] panic+0x30f/0x770 [ 54.414188][ T4991] ? check_panic_on_warn+0x21/0xa0 [ 54.419380][ T4991] ? __memcpy_flushcache+0x2b0/0x2b0 [ 54.424648][ T4991] ? check_panic_on_warn+0x21/0xa0 [ 54.429835][ T4991] ? check_panic_on_warn+0x6e/0xa0 [ 54.435197][ T4991] check_panic_on_warn+0x82/0xa0 [ 54.440206][ T4991] __ubsan_handle_shift_out_of_bounds+0x3e2/0x420 [ 54.446603][ T4991] ntfs_read_locked_inode+0x4665/0x49c0 [ 54.452223][ T4991] ntfs_read_inode_mount+0xda6/0x2660 [ 54.457580][ T4991] ntfs_fill_super+0x1883/0x2bd0 [ 54.462517][ T4991] mount_bdev+0x2d0/0x3f0 [ 54.466839][ T4991] ? ntfs_mount+0x40/0x40 [ 54.471163][ T4991] legacy_get_tree+0xef/0x190 [ 54.475916][ T4991] ? ntfs_rl_punch_nolock+0x15b0/0x15b0 [ 54.481636][ T4991] vfs_get_tree+0x8c/0x270 [ 54.486130][ T4991] do_new_mount+0x28f/0xae0 [ 54.490622][ T4991] ? path_mount+0x5f2/0xf80 [ 54.495123][ T4991] ? do_move_mount_old+0x170/0x170 [ 54.500310][ T4991] ? user_path_at_empty+0x12f/0x180 [ 54.505585][ T4991] __se_sys_mount+0x2d9/0x3c0 [ 54.510266][ T4991] ? __x64_sys_mount+0xc0/0xc0 [ 54.515183][ T4991] ? syscall_enter_from_user_mode+0x32/0x230 [ 54.522668][ T4991] ? __x64_sys_mount+0x20/0xc0 [ 54.527429][ T4991] do_syscall_64+0x41/0xc0 [ 54.531838][ T4991] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 54.537812][ T4991] RIP: 0033:0x7f5c24a30f9a [ 54.542219][ T4991] Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 54.562074][ T4991] RSP: 002b:00007fffedb28378 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 54.570477][ T4991] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f5c24a30f9a [ 54.578525][ T4991] RDX: 0000000020000000 RSI: 000000002001ee80 RDI: 00007fffedb28390 [ 54.586837][ T4991] RBP: 00007fffedb28390 R08: 00007fffedb283d0 R09: 00007fffedb283e0 [ 54.594889][ T4991] R10: 0000000000800804 R11: 0000000000000286 R12: 0000000000000004 [ 54.603126][ T4991] R13: 0000555556bed2c0 R14: 0000000000800804 R15: 00007fffedb283d0 [ 54.611104][ T4991] [ 54.614279][ T4991] Kernel Offset: disabled [ 54.618594][ T4991] Rebooting in 86400 seconds..