./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3039232050 <...> DUID 00:04:76:8b:f6:84:a4:3b:36:39:6c:68:e7:10:38:dd:b7:2c forked to background, child pid 4659 [ 37.839505][ T4660] 8021q: adding VLAN 0 to HW filter on device bond0 [ 37.851111][ T4660] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.1.138' (ECDSA) to the list of known hosts. execve("./syz-executor3039232050", ["./syz-executor3039232050"], 0x7ffef2012310 /* 10 vars */) = 0 brk(NULL) = 0x5555556f7000 brk(0x5555556f7c40) = 0x5555556f7c40 arch_prctl(ARCH_SET_FS, 0x5555556f7300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor3039232050", 4096) = 28 brk(0x555555718c40) = 0x555555718c40 brk(0x555555719000) = 0x555555719000 mprotect(0x7fac411f4000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fac38d1b000 write(3, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x02\x02\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x80\x00\xff\x0f\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\xff\x03\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\xc8\x0f\x00\x00\x8f\x24\x2d\x5f\x49\x6d\x50\x0b\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00"..., 2097152) = 2097152 munmap(0x7fac38d1b000, 2097152) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 syzkaller login: [ 66.046702][ T4995] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=4995 'syz-executor303' ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./bus", 0777) = 0 [ 66.088582][ T4995] loop0: detected capacity change from 0 to 4096 [ 66.100920][ T4995] ================================================================================ [ 66.110368][ T4995] UBSAN: shift-out-of-bounds in fs/ntfs3/super.c:799:9 [ 66.117671][ T4995] shift exponent 56 is too large for 32-bit type 'unsigned int' [ 66.125331][ T4995] CPU: 0 PID: 4995 Comm: syz-executor303 Not tainted 6.3.0-syzkaller-13164-g78b421b6a7c6 #0 [ 66.135409][ T4995] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 [ 66.145553][ T4995] Call Trace: [ 66.148833][ T4995] [ 66.151766][ T4995] dump_stack_lvl+0x1e7/0x2d0 [ 66.156531][ T4995] ? nf_tcp_handle_invalid+0x650/0x650 [ 66.162003][ T4995] ? panic+0x770/0x770 [ 66.166085][ T4995] ? __bio_add_page+0x310/0x310 [ 66.170954][ T4995] __ubsan_handle_shift_out_of_bounds+0x3c3/0x420 [ 66.177393][ T4995] ntfs_fill_super+0x2baf/0x4530 [ 66.182359][ T4995] ? put_ntfs+0x2b0/0x2b0 [ 66.186778][ T4995] ? set_blocksize+0x1e2/0x390 [ 66.191548][ T4995] ? sb_set_blocksize+0x99/0x100 [ 66.196489][ T4995] get_tree_bdev+0x405/0x620 [ 66.201082][ T4995] ? put_ntfs+0x2b0/0x2b0 [ 66.205418][ T4995] vfs_get_tree+0x8c/0x270 [ 66.209839][ T4995] do_new_mount+0x28f/0xae0 [ 66.214354][ T4995] ? path_mount+0x5f2/0xf80 [ 66.218947][ T4995] ? do_move_mount_old+0x170/0x170 [ 66.224095][ T4995] ? user_path_at_empty+0x12f/0x180 [ 66.229313][ T4995] __se_sys_mount+0x2d9/0x3c0 [ 66.234016][ T4995] ? __x64_sys_mount+0xc0/0xc0 [ 66.238781][ T4995] ? syscall_enter_from_user_mode+0x32/0x230 [ 66.244770][ T4995] ? __x64_sys_mount+0x20/0xc0 [ 66.249539][ T4995] do_syscall_64+0x41/0xc0 [ 66.253969][ T4995] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 66.259877][ T4995] RIP: 0033:0x7fac41168afa [ 66.264293][ T4995] Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 66.283990][ T4995] RSP: 002b:00007ffdbb22a0f8 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 66.292410][ T4995] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fac41168afa [ 66.300488][ T4995] RDX: 000000002001f740 RSI: 0000000020000180 RDI: 00007ffdbb22a110 [ 66.308464][ T4995] RBP: 00007ffdbb22a110 R08: 00007ffdbb22a150 R09: 000000000001f76a [ 66.316435][ T4995] R10: 0000000000004010 R11: 0000000000000286 R12: 0000000000000004 [ 66.324838][ T4995] R13: 00005555556f72c0 R14: 0000000000004010 R15: 00007ffdbb22a150 [ 66.332829][ T4995] [ 66.336298][ T4995] ================================================================================ [ 66.345914][ T4995] Kernel panic - not syncing: UBSAN: panic_on_warn set ... [ 66.353839][ T4995] CPU: 0 PID: 4995 Comm: syz-executor303 Not tainted 6.3.0-syzkaller-13164-g78b421b6a7c6 #0 [ 66.363917][ T4995] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 [ 66.373984][ T4995] Call Trace: [ 66.377261][ T4995] [ 66.380203][ T4995] dump_stack_lvl+0x1e7/0x2d0 [ 66.384910][ T4995] ? nf_tcp_handle_invalid+0x650/0x650 [ 66.390381][ T4995] ? panic+0x770/0x770 [ 66.394459][ T4995] ? vscnprintf+0x5d/0x80 [ 66.398797][ T4995] panic+0x30f/0x770 [ 66.402693][ T4995] ? check_panic_on_warn+0x21/0xa0 [ 66.407807][ T4995] ? __memcpy_flushcache+0x2b0/0x2b0 [ 66.413092][ T4995] ? dump_stack_lvl+0x253/0x2d0 [ 66.417956][ T4995] check_panic_on_warn+0x82/0xa0 [ 66.422896][ T4995] __ubsan_handle_shift_out_of_bounds+0x3e2/0x420 [ 66.429333][ T4995] ntfs_fill_super+0x2baf/0x4530 [ 66.434295][ T4995] ? put_ntfs+0x2b0/0x2b0 [ 66.438637][ T4995] ? set_blocksize+0x1e2/0x390 [ 66.443402][ T4995] ? sb_set_blocksize+0x99/0x100 [ 66.448338][ T4995] get_tree_bdev+0x405/0x620 [ 66.452931][ T4995] ? put_ntfs+0x2b0/0x2b0 [ 66.457267][ T4995] vfs_get_tree+0x8c/0x270 [ 66.461684][ T4995] do_new_mount+0x28f/0xae0 [ 66.466202][ T4995] ? path_mount+0x5f2/0xf80 [ 66.470711][ T4995] ? do_move_mount_old+0x170/0x170 [ 66.475864][ T4995] ? user_path_at_empty+0x12f/0x180 [ 66.481074][ T4995] __se_sys_mount+0x2d9/0x3c0 [ 66.485758][ T4995] ? __x64_sys_mount+0xc0/0xc0 [ 66.490525][ T4995] ? syscall_enter_from_user_mode+0x32/0x230 [ 66.496516][ T4995] ? __x64_sys_mount+0x20/0xc0 [ 66.501281][ T4995] do_syscall_64+0x41/0xc0 [ 66.505708][ T4995] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 66.511698][ T4995] RIP: 0033:0x7fac41168afa [ 66.516112][ T4995] Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 66.535814][ T4995] RSP: 002b:00007ffdbb22a0f8 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 66.544233][ T4995] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fac41168afa [ 66.552206][ T4995] RDX: 000000002001f740 RSI: 0000000020000180 RDI: 00007ffdbb22a110 [ 66.560179][ T4995] RBP: 00007ffdbb22a110 R08: 00007ffdbb22a150 R09: 000000000001f76a [ 66.568148][ T4995] R10: 0000000000004010 R11: 0000000000000286 R12: 0000000000000004 [ 66.576206][ T4995] R13: 00005555556f72c0 R14: 0000000000004010 R15: 00007ffdbb22a150 [ 66.584197][ T4995] [ 66.587501][ T4995] Kernel Offset: disabled [ 66.591909][ T4995] Rebooting in 86400 seconds..