DUID 00:04:e3:38:52:80:67:3f:e9:c9:a2:47:22:a3:59:23:7d:1e
forked to background, child pid 3185
[ 24.248245][ T3186] 8021q: adding VLAN 0 to HW filter on device bond0
[ 24.262203][ T3186] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.1.78' (ECDSA) to the list of known hosts.
executing program
syzkaller login: [ 41.466438][ T3600] loop0: detected capacity change from 0 to 4095
[ 41.476571][ T3600] ntfs3: loop0: Different NTFS' sector size (1024) and media sector size (512)
[ 41.486758][ T3600] ==================================================================
[ 41.494816][ T3600] BUG: KASAN: use-after-free in run_unpack+0x84f/0xd00
[ 41.501683][ T3600] Read of size 1 at addr ffff88801dc43148 by task syz-executor331/3600
[ 41.509902][ T3600]
[ 41.512218][ T3600] CPU: 0 PID: 3600 Comm: syz-executor331 Not tainted 6.0.0-rc7-syzkaller-00029-g3800a713b607 #0
[ 41.522611][ T3600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
[ 41.532648][ T3600] Call Trace:
[ 41.535915][ T3600]
[ 41.538854][ T3600] dump_stack_lvl+0x1b1/0x28e
[ 41.543533][ T3600] ? fortify_panic+0x13/0x13
[ 41.548109][ T3600] ? __wake_up_klogd+0xcd/0x100
[ 41.552945][ T3600] ? panic+0x715/0x715
[ 41.557000][ T3600] ? _printk+0xc0/0x100
[ 41.561160][ T3600] print_address_description+0x65/0x4b0
[ 41.566695][ T3600] print_report+0x108/0x1f0
[ 41.571210][ T3600] ? _raw_spin_lock+0x40/0x40
[ 41.575871][ T3600] ? run_add_entry+0xbb5/0xe80
[ 41.580621][ T3600] ? run_unpack+0x84f/0xd00
[ 41.585106][ T3600] kasan_report+0xc3/0xf0
[ 41.589421][ T3600] ? run_unpack+0x84f/0xd00
[ 41.593906][ T3600] run_unpack+0x84f/0xd00
[ 41.598238][ T3600] run_unpack_ex+0xcc/0x870
[ 41.602728][ T3600] ? kvmalloc_node+0x6e/0x160
[ 41.607391][ T3600] ? ni_enum_attr_ex+0x2f6/0x6d0
[ 41.612310][ T3600] ? run_unpack+0xd00/0xd00
[ 41.616796][ T3600] ? ni_find_attr+0x8c0/0x8c0
[ 41.621457][ T3600] ? mi_read+0x260/0x510
[ 41.625686][ T3600] ntfs_iget5+0x1cf2/0x36a0
[ 41.630184][ T3600] ? check_index_root+0x680/0x680
[ 41.635194][ T3600] ntfs_loadlog_and_replay+0x1ac/0x5c0
[ 41.640645][ T3600] ? ntfs_extend_init+0x5a0/0x5a0
[ 41.645670][ T3600] ? evict+0x5d5/0x620
[ 41.649736][ T3600] ntfs_fill_super+0x2333/0x42a0
[ 41.654688][ T3600] ? put_ntfs+0x2a0/0x2a0
[ 41.659005][ T3600] ? vscnprintf+0x80/0x80
[ 41.663322][ T3600] ? set_blocksize+0x1d5/0x360
[ 41.668074][ T3600] get_tree_bdev+0x400/0x620
[ 41.672647][ T3600] ? put_ntfs+0x2a0/0x2a0
[ 41.676958][ T3600] vfs_get_tree+0x88/0x270
[ 41.681360][ T3600] do_new_mount+0x289/0xad0
[ 41.685847][ T3600] ? do_move_mount_old+0x150/0x150
[ 41.690944][ T3600] ? user_path_at_empty+0x149/0x1a0
[ 41.696128][ T3600] __se_sys_mount+0x2d3/0x3c0
[ 41.700812][ T3600] ? __x64_sys_mount+0xc0/0xc0
[ 41.705557][ T3600] ? syscall_enter_from_user_mode+0x2e/0x1d0
[ 41.711521][ T3600] ? lockdep_hardirqs_on+0x8d/0x130
[ 41.716704][ T3600] ? __x64_sys_mount+0x1c/0xc0
[ 41.721465][ T3600] do_syscall_64+0x3d/0xb0
[ 41.725863][ T3600] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 41.731740][ T3600] RIP: 0033:0x7f3b8fe4126a
[ 41.736140][ T3600] Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 41.755731][ T3600] RSP: 002b:00007ffd41c81b08 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
[ 41.764129][ T3600] RAX: ffffffffffffffda RBX: 00007ffd41c81b60 RCX: 00007f3b8fe4126a
[ 41.772085][ T3600] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffd41c81b20
[ 41.780043][ T3600] RBP: 00007ffd41c81b20 R08: 00007ffd41c81b60 R09: 0000000000000000
[ 41.787997][ T3600] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000020000338
[ 41.795953][ T3600] R13: 0000000000000003 R14: 0000000000000004 R15: 000000000000000d
[ 41.803915][ T3600]
[ 41.806920][ T3600]
[ 41.809231][ T3600] Allocated by task 3600:
[ 41.813538][ T3600] ____kasan_kmalloc+0xcd/0x100
[ 41.818373][ T3600] __kmalloc+0x226/0x370
[ 41.822600][ T3600] mi_init+0x72/0xe0
[ 41.826478][ T3600] ntfs_iget5+0x309/0x36a0
[ 41.830878][ T3600] ntfs_fill_super+0x2127/0x42a0
[ 41.835797][ T3600] get_tree_bdev+0x400/0x620
[ 41.840379][ T3600] vfs_get_tree+0x88/0x270
[ 41.844778][ T3600] do_new_mount+0x289/0xad0
[ 41.849261][ T3600] __se_sys_mount+0x2d3/0x3c0
[ 41.853919][ T3600] do_syscall_64+0x3d/0xb0
[ 41.858320][ T3600] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 41.864195][ T3600]
[ 41.866506][ T3600] Freed by task 3600:
[ 41.870465][ T3600] kasan_set_track+0x3d/0x60
[ 41.875036][ T3600] kasan_set_free_info+0x1f/0x40
[ 41.879957][ T3600] ____kasan_slab_free+0xd8/0x120
[ 41.884966][ T3600] slab_free_freelist_hook+0x12e/0x1a0
[ 41.890405][ T3600] kfree+0xda/0x210
[ 41.894195][ T3600] ni_clear+0x32e/0x3e0
[ 41.898335][ T3600] evict+0x2a4/0x620
[ 41.902213][ T3600] ntfs_fill_super+0x229a/0x42a0
[ 41.907133][ T3600] get_tree_bdev+0x400/0x620
[ 41.911711][ T3600] vfs_get_tree+0x88/0x270
[ 41.916111][ T3600] do_new_mount+0x289/0xad0
[ 41.920599][ T3600] __se_sys_mount+0x2d3/0x3c0
[ 41.925256][ T3600] do_syscall_64+0x3d/0xb0
[ 41.929668][ T3600] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 41.935548][ T3600]
[ 41.937857][ T3600] The buggy address belongs to the object at ffff88801dc43000
[ 41.937857][ T3600] which belongs to the cache kmalloc-1k of size 1024
[ 41.951891][ T3600] The buggy address is located 328 bytes inside of
[ 41.951891][ T3600] 1024-byte region [ffff88801dc43000, ffff88801dc43400)
[ 41.965232][ T3600]
[ 41.967538][ T3600] The buggy address belongs to the physical page:
[ 41.973927][ T3600] page:ffffea0000771000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1dc40
[ 41.984058][ T3600] head:ffffea0000771000 order:3 compound_mapcount:0 compound_pincount:0
[ 41.992376][ T3600] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 42.000353][ T3600] raw: 00fff00000010200 ffffea0001e08c00 dead000000000002 ffff888012041dc0
[ 42.008932][ T3600] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[ 42.017513][ T3600] page dumped because: kasan: bad access detected
[ 42.023907][ T3600] page_owner tracks the page as allocated
[ 42.029602][ T3600] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 42, tgid 42 (kworker/u4:2), ts 5903211796, free_ts 0
[ 42.049653][ T3600] get_page_from_freelist+0x742/0x7c0
[ 42.055029][ T3600] __alloc_pages+0x259/0x560
[ 42.059603][ T3600] alloc_slab_page+0x2e/0xf0
[ 42.064185][ T3600] allocate_slab+0x5e/0x520
[ 42.068679][ T3600] ___slab_alloc+0x3ee/0xc40
[ 42.073255][ T3600] kmem_cache_alloc_node_trace+0x29c/0x360
[ 42.079065][ T3600] sbitmap_queue_init_node+0x174/0x860
[ 42.084527][ T3600] blk_mq_init_tags+0x149/0x270
[ 42.089372][ T3600] blk_mq_alloc_map_and_rqs+0xb6/0x990
[ 42.094818][ T3600] blk_mq_alloc_set_map_and_rqs+0x1b6/0x890
[ 42.100699][ T3600] blk_mq_alloc_tag_set+0x714/0xcc0
[ 42.105881][ T3600] do_floppy_init+0x194/0xc54
[ 42.110552][ T3600] async_run_entry_fn+0xa6/0x400
[ 42.115472][ T3600] process_one_work+0x877/0xdb0
[ 42.120303][ T3600] worker_thread+0xb14/0x1330
[ 42.124962][ T3600] kthread+0x266/0x300
[ 42.129017][ T3600] page_owner free stack trace missing
[ 42.134363][ T3600]
[ 42.136672][ T3600] Memory state around the buggy address:
[ 42.142279][ T3600] ffff88801dc43000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 42.150320][ T3600] ffff88801dc43080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 42.158363][ T3600] >ffff88801dc43100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 42.166403][ T3600] ^
[ 42.172808][ T3600] ffff88801dc43180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 42.180882][ T3600] ffff88801dc43200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 42.188925][ T3600] ==================================================================
[ 42.198528][ T3600] Kernel panic - not syncing: panic_on_warn set ...
[ 42.205129][ T3600] CPU: 1 PID: 3600 Comm: syz-executor331 Not tainted 6.0.0-rc7-syzkaller-00029-g3800a713b607 #0
[ 42.215534][ T3600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
[ 42.225567][ T3600] Call Trace:
[ 42.228828][ T3600]
[ 42.231742][ T3600] dump_stack_lvl+0x1b1/0x28e
[ 42.236406][ T3600] ? fortify_panic+0x13/0x13
[ 42.240981][ T3600] ? panic+0x715/0x715
[ 42.245034][ T3600] ? preempt_schedule_common+0xb7/0xe0
[ 42.250487][ T3600] ? vscnprintf+0x59/0x80
[ 42.254813][ T3600] panic+0x2d6/0x715
[ 42.258709][ T3600] ? fb_is_primary_device+0xcc/0xcc
[ 42.263893][ T3600] ? _raw_spin_unlock_irqrestore+0x110/0x120
[ 42.269855][ T3600] ? print_report+0x1b4/0x1f0
[ 42.274516][ T3600] ? run_unpack+0x84f/0xd00
[ 42.279007][ T3600] end_report+0x91/0xa0
[ 42.283155][ T3600] kasan_report+0xd0/0xf0
[ 42.287478][ T3600] ? run_unpack+0x84f/0xd00
[ 42.291959][ T3600] run_unpack+0x84f/0xd00
[ 42.296270][ T3600] run_unpack_ex+0xcc/0x870
[ 42.300750][ T3600] ? kvmalloc_node+0x6e/0x160
[ 42.305417][ T3600] ? ni_enum_attr_ex+0x2f6/0x6d0
[ 42.310371][ T3600] ? run_unpack+0xd00/0xd00
[ 42.314861][ T3600] ? ni_find_attr+0x8c0/0x8c0
[ 42.319525][ T3600] ? mi_read+0x260/0x510
[ 42.323752][ T3600] ntfs_iget5+0x1cf2/0x36a0
[ 42.328247][ T3600] ? check_index_root+0x680/0x680
[ 42.333259][ T3600] ntfs_loadlog_and_replay+0x1ac/0x5c0
[ 42.338704][ T3600] ? ntfs_extend_init+0x5a0/0x5a0
[ 42.343714][ T3600] ? evict+0x5d5/0x620
[ 42.347765][ T3600] ntfs_fill_super+0x2333/0x42a0
[ 42.352692][ T3600] ? put_ntfs+0x2a0/0x2a0
[ 42.357000][ T3600] ? vscnprintf+0x80/0x80
[ 42.361312][ T3600] ? set_blocksize+0x1d5/0x360
[ 42.366056][ T3600] get_tree_bdev+0x400/0x620
[ 42.370628][ T3600] ? put_ntfs+0x2a0/0x2a0
[ 42.374950][ T3600] vfs_get_tree+0x88/0x270
[ 42.379364][ T3600] do_new_mount+0x289/0xad0
[ 42.383859][ T3600] ? do_move_mount_old+0x150/0x150
[ 42.388960][ T3600] ? user_path_at_empty+0x149/0x1a0
[ 42.394150][ T3600] __se_sys_mount+0x2d3/0x3c0
[ 42.398816][ T3600] ? __x64_sys_mount+0xc0/0xc0
[ 42.403589][ T3600] ? syscall_enter_from_user_mode+0x2e/0x1d0
[ 42.409560][ T3600] ? lockdep_hardirqs_on+0x8d/0x130
[ 42.414746][ T3600] ? __x64_sys_mount+0x1c/0xc0
[ 42.419500][ T3600] do_syscall_64+0x3d/0xb0
[ 42.423909][ T3600] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 42.429787][ T3600] RIP: 0033:0x7f3b8fe4126a
[ 42.434186][ T3600] Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 42.453773][ T3600] RSP: 002b:00007ffd41c81b08 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
[ 42.462166][ T3600] RAX: ffffffffffffffda RBX: 00007ffd41c81b60 RCX: 00007f3b8fe4126a
[ 42.470120][ T3600] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffd41c81b20
[ 42.478073][ T3600] RBP: 00007ffd41c81b20 R08: 00007ffd41c81b60 R09: 0000000000000000
[ 42.486023][ T3600] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000020000338
[ 42.493970][ T3600] R13: 0000000000000003 R14: 0000000000000004 R15: 000000000000000d
[ 42.501934][ T3600]
[ 42.505012][ T3600] Kernel Offset: disabled
[ 42.509326][ T3600] Rebooting in 86400 seconds..