Warning: Permanently added '10.128.1.76' (ED25519) to the list of known hosts. executing program [ 38.104402][ T4290] loop0: detected capacity change from 0 to 4096 [ 38.112404][ T4290] ntfs: (device loop0): check_mft_mirror(): Incomplete multi sector transfer detected in mft mirror record 0. [ 38.114930][ T4290] ntfs: (device loop0): load_system_files(): $MFTMirr does not match $MFT. Mounting read-only. Run ntfsfix and/or chkdsk. [ 38.119909][ T4290] ntfs: (device loop0): ntfs_read_locked_inode(): First extent of $DATA attribute has non zero lowest_vcn. [ 38.122766][ T4290] ntfs: (device loop0): ntfs_read_locked_inode(): Failed with error code -5. Marking corrupt inode 0xa as bad. Run chkdsk. [ 38.125448][ T4290] ntfs: (device loop0): load_and_init_upcase(): Failed to load $UpCase from the volume. Using default. [ 38.130172][ T4290] ntfs: volume version 3.1. [ 38.132909][ T4290] ntfs: (device loop0): ntfs_check_logfile(): Did not find any restart pages in $LogFile and it was not empty. [ 38.135651][ T4290] ntfs: (device loop0): load_system_files(): Failed to load $LogFile. Will not be able to remount read-write. Mount in Windows. [ 38.139053][ T4290] ntfs: (device loop0): ntfs_lookup_inode_by_name(): Index entry out of bounds in directory inode 0x5. [ 38.141858][ T4290] ntfs: (device loop0): check_windows_hibernation_status(): Failed to find inode number for hiberfil.sys. [ 38.144428][ T4290] ntfs: (device loop0): load_system_files(): Failed to determine if Windows is hibernated. Will not be able to remount read-write. Run chkdsk. [ 38.149475][ T4290] ================================================================== [ 38.151390][ T4290] BUG: KASAN: slab-out-of-bounds in ntfs_readdir+0xb00/0x2be8 [ 38.153109][ T4290] Read of size 1 at addr ffff0000c37ed271 by task syz-executor793/4290 [ 38.155025][ T4290] [ 38.155556][ T4290] CPU: 1 PID: 4290 Comm: syz-executor793 Tainted: G W 6.1.122-syzkaller #0 [ 38.157702][ T4290] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 38.159938][ T4290] Call trace: [ 38.160617][ T4290] dump_backtrace+0x1c8/0x1f4 [ 38.161653][ T4290] show_stack+0x2c/0x3c [ 38.162507][ T4290] dump_stack_lvl+0x108/0x170 [ 38.163566][ T4290] print_report+0x174/0x4c0 [ 38.164564][ T4290] kasan_report+0xd4/0x130 [ 38.165507][ T4290] __asan_report_load1_noabort+0x2c/0x38 [ 38.166674][ T4290] ntfs_readdir+0xb00/0x2be8 [ 38.167675][ T4290] iterate_dir+0x1f4/0x4ec [ 38.168566][ T4290] __arm64_sys_getdents64+0x1c4/0x4a0 [ 38.169739][ T4290] invoke_syscall+0x98/0x2bc [ 38.170784][ T4290] el0_svc_common+0x138/0x258 [ 38.171847][ T4290] do_el0_svc+0x58/0x13c [ 38.172813][ T4290] el0_svc+0x58/0x168 [ 38.173728][ T4290] el0t_64_sync_handler+0x84/0xf0 [ 38.174787][ T4290] el0t_64_sync+0x18c/0x190 [ 38.175788][ T4290] [ 38.176243][ T4290] Allocated by task 4290: [ 38.177232][ T4290] kasan_set_track+0x4c/0x80 [ 38.178164][ T4290] kasan_save_alloc_info+0x24/0x30 [ 38.179359][ T4290] __kasan_kmalloc+0xac/0xc4 [ 38.180364][ T4290] __kmalloc+0xd8/0x1c4 [ 38.181207][ T4290] ntfs_readdir+0x65c/0x2be8 [ 38.182203][ T4290] iterate_dir+0x1f4/0x4ec [ 38.183238][ T4290] __arm64_sys_getdents64+0x1c4/0x4a0 [ 38.184353][ T4290] invoke_syscall+0x98/0x2bc [ 38.185373][ T4290] el0_svc_common+0x138/0x258 [ 38.186368][ T4290] do_el0_svc+0x58/0x13c [ 38.187297][ T4290] el0_svc+0x58/0x168 [ 38.188170][ T4290] el0t_64_sync_handler+0x84/0xf0 [ 38.189228][ T4290] el0t_64_sync+0x18c/0x190 [ 38.190216][ T4290] [ 38.190728][ T4290] The buggy address belongs to the object at ffff0000c37ed200 [ 38.190728][ T4290] which belongs to the cache kmalloc-128 of size 128 [ 38.193817][ T4290] The buggy address is located 113 bytes inside of [ 38.193817][ T4290] 128-byte region [ffff0000c37ed200, ffff0000c37ed280) [ 38.196784][ T4290] [ 38.197314][ T4290] The buggy address belongs to the physical page: [ 38.198759][ T4290] page:00000000673d93c1 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1037ed [ 38.200876][ T4290] flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff) [ 38.202508][ T4290] raw: 05ffc00000000200 dead000000000100 dead000000000122 ffff0000c0002300 [ 38.204426][ T4290] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 38.206299][ T4290] page dumped because: kasan: bad access detected [ 38.207689][ T4290] [ 38.208191][ T4290] Memory state around the buggy address: [ 38.209500][ T4290] ffff0000c37ed100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 38.211290][ T4290] ffff0000c37ed180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 38.213140][ T4290] >ffff0000c37ed200: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc [ 38.214917][ T4290] ^ [ 38.216560][ T4290] ffff0000c37ed280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 38.218343][ T4290] ffff0000c37ed300: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 38.220062][ T4290] ================================================================== [ 38.221991][ T4290] Disabling lock debugging due to kernel taint