forked to background, child pid 3183 no interfaces have a carrier [ 21.605838][ T3184] 8021q: adding VLAN 0 to HW filter on device bond0 [ 21.621546][ T3184] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.152' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 46.980293][ T3598] loop0: detected capacity change from 0 to 2304 [ 46.988991][ T3598] ntfs3: loop0: Different NTFS' sector size (1024) and media sector size (512) [ 46.998018][ T3598] ntfs3: loop0: RAW NTFS volume: Filesystem size 0.00 Gb > volume size 0.00 Gb. Mount in read-only [ 47.009331][ T3598] ================================================================== [ 47.017465][ T3598] BUG: KASAN: use-after-free in run_unpack+0x8b7/0x970 [ 47.024320][ T3598] Read of size 1 at addr ffff8881473acef3 by task syz-executor238/3598 [ 47.032539][ T3598] [ 47.034842][ T3598] CPU: 0 PID: 3598 Comm: syz-executor238 Not tainted 6.0.0-rc7-syzkaller-00250-ga962b54e162c #0 [ 47.045318][ T3598] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 [ 47.055356][ T3598] Call Trace: [ 47.058619][ T3598] [ 47.061532][ T3598] dump_stack_lvl+0xcd/0x134 [ 47.066132][ T3598] print_report.cold+0x2ba/0x719 [ 47.071076][ T3598] ? run_unpack+0x8b7/0x970 [ 47.075565][ T3598] kasan_report+0xb1/0x1e0 [ 47.079991][ T3598] ? run_unpack+0x8b7/0x970 [ 47.084496][ T3598] run_unpack+0x8b7/0x970 [ 47.088814][ T3598] ? run_pack+0x1100/0x1100 [ 47.093304][ T3598] ? ntfs_bread_run+0x310/0x310 [ 47.098138][ T3598] ? kfree+0x1fb/0x580 [ 47.102191][ T3598] run_unpack_ex+0xb0/0x7c0 [ 47.106677][ T3598] ? mi_enum_attr+0x34f/0x630 [ 47.111341][ T3598] ? ni_enum_attr_ex+0x281/0x400 [ 47.116263][ T3598] ? run_unpack+0x970/0x970 [ 47.120750][ T3598] ? ni_fname_type.part.0+0x1e0/0x1e0 [ 47.126108][ T3598] ? mi_read+0x27f/0x5b0 [ 47.130335][ T3598] ntfs_iget5+0xc20/0x3280 [ 47.134741][ T3598] ? ntfs_write_end+0x800/0x800 [ 47.139579][ T3598] ntfs_loadlog_and_replay+0x124/0x5d0 [ 47.145111][ T3598] ? ntfs_write_end+0x800/0x800 [ 47.149947][ T3598] ? ntfs_bio_fill_1+0xa10/0xa10 [ 47.154871][ T3598] ? destroy_inode+0xc4/0x1b0 [ 47.159537][ T3598] ? iput.part.0+0x55d/0x810 [ 47.164113][ T3598] ntfs_fill_super+0x1eff/0x37f0 [ 47.169044][ T3598] ? put_ntfs+0x330/0x330 [ 47.173361][ T3598] ? set_blocksize+0x2e5/0x370 [ 47.178117][ T3598] get_tree_bdev+0x440/0x760 [ 47.182691][ T3598] ? put_ntfs+0x330/0x330 [ 47.187007][ T3598] vfs_get_tree+0x89/0x2f0 [ 47.191410][ T3598] path_mount+0x1326/0x1e20 [ 47.195901][ T3598] ? kmem_cache_free+0xeb/0x5b0 [ 47.200737][ T3598] ? finish_automount+0x960/0x960 [ 47.205752][ T3598] ? putname+0xfe/0x140 [ 47.209896][ T3598] __x64_sys_mount+0x27f/0x300 [ 47.214670][ T3598] ? copy_mnt_ns+0xae0/0xae0 [ 47.219248][ T3598] ? syscall_enter_from_user_mode+0x22/0xb0 [ 47.225138][ T3598] do_syscall_64+0x35/0xb0 [ 47.229544][ T3598] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 47.235431][ T3598] RIP: 0033:0x7fc170bc63fa [ 47.239836][ T3598] Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 47.259525][ T3598] RSP: 002b:00007fff821c2d68 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 47.267929][ T3598] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc170bc63fa [ 47.276078][ T3598] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007fff821c2d80 [ 47.284124][ T3598] RBP: 00007fff821c2d80 R08: 00007fff821c2dc0 R09: 0000555556d3b2c0 [ 47.292098][ T3598] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000004 [ 47.300056][ T3598] R13: 00007fff821c2dc0 R14: 000000000000000d R15: 0000000020000338 [ 47.308017][ T3598] [ 47.311022][ T3598] [ 47.313331][ T3598] Allocated by task 3232: [ 47.317637][ T3598] kasan_save_stack+0x1e/0x40 [ 47.322302][ T3598] __kasan_kmalloc+0xa9/0xd0 [ 47.326890][ T3598] tomoyo_realpath_from_path+0xc3/0x620 [ 47.332420][ T3598] tomoyo_path_perm+0x21b/0x400 [ 47.337256][ T3598] security_inode_getattr+0xcf/0x140 [ 47.342528][ T3598] vfs_statx+0x16a/0x390 [ 47.346755][ T3598] vfs_fstatat+0x8c/0xb0 [ 47.350983][ T3598] __do_sys_newfstatat+0x91/0x110 [ 47.355988][ T3598] do_syscall_64+0x35/0xb0 [ 47.360476][ T3598] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 47.366366][ T3598] [ 47.368670][ T3598] Freed by task 3232: [ 47.372627][ T3598] kasan_save_stack+0x1e/0x40 [ 47.377291][ T3598] kasan_set_track+0x21/0x30 [ 47.381863][ T3598] kasan_set_free_info+0x20/0x30 [ 47.386801][ T3598] ____kasan_slab_free+0x166/0x1c0 [ 47.391895][ T3598] slab_free_freelist_hook+0x8b/0x1c0 [ 47.397247][ T3598] kfree+0xe2/0x580 [ 47.401042][ T3598] tomoyo_realpath_from_path+0x191/0x620 [ 47.406656][ T3598] tomoyo_path_perm+0x21b/0x400 [ 47.411495][ T3598] security_inode_getattr+0xcf/0x140 [ 47.416760][ T3598] vfs_statx+0x16a/0x390 [ 47.420984][ T3598] vfs_fstatat+0x8c/0xb0 [ 47.425208][ T3598] __do_sys_newfstatat+0x91/0x110 [ 47.430212][ T3598] do_syscall_64+0x35/0xb0 [ 47.434614][ T3598] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 47.440490][ T3598] [ 47.442796][ T3598] The buggy address belongs to the object at ffff8881473ac000 [ 47.442796][ T3598] which belongs to the cache kmalloc-4k of size 4096 [ 47.456832][ T3598] The buggy address is located 3827 bytes inside of [ 47.456832][ T3598] 4096-byte region [ffff8881473ac000, ffff8881473ad000) [ 47.470263][ T3598] [ 47.472569][ T3598] The buggy address belongs to the physical page: [ 47.479145][ T3598] page:ffffea00051cea00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1473a8 [ 47.489363][ T3598] head:ffffea00051cea00 order:3 compound_mapcount:0 compound_pincount:0 [ 47.497670][ T3598] flags: 0x57ff00000010200(slab|head|node=1|zone=2|lastcpupid=0x7ff) [ 47.505725][ T3598] raw: 057ff00000010200 dead000000000100 dead000000000122 ffff888011842140 [ 47.514291][ T3598] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 47.522854][ T3598] page dumped because: kasan: bad access detected [ 47.529243][ T3598] page_owner tracks the page as allocated [ 47.534934][ T3598] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 5866950423, free_ts 0 [ 47.554627][ T3598] get_page_from_freelist+0x109b/0x2ce0 [ 47.560165][ T3598] __alloc_pages+0x1c7/0x510 [ 47.564739][ T3598] alloc_page_interleave+0x1e/0x200 [ 47.569920][ T3598] alloc_pages+0x22f/0x270 [ 47.574323][ T3598] allocate_slab+0x27e/0x3d0 [ 47.578983][ T3598] ___slab_alloc+0x7f1/0xe10 [ 47.583556][ T3598] __slab_alloc.constprop.0+0x4d/0xa0 [ 47.588909][ T3598] kmem_cache_alloc_node_trace+0x185/0x410 [ 47.594788][ T3598] bdi_alloc+0x43/0x180 [ 47.598928][ T3598] __alloc_disk_node+0x9e/0x650 [ 47.603768][ T3598] __blk_mq_alloc_disk+0x13b/0x1f0 [ 47.608863][ T3598] loop_add+0x3e2/0xaf0 [ 47.613002][ T3598] loop_init+0x1f4/0x216 [ 47.617233][ T3598] do_one_initcall+0xfe/0x650 [ 47.621908][ T3598] kernel_init_freeable+0x6b1/0x73a [ 47.627524][ T3598] kernel_init+0x1a/0x1d0 [ 47.631839][ T3598] page_owner free stack trace missing [ 47.637198][ T3598] [ 47.639504][ T3598] Memory state around the buggy address: [ 47.645110][ T3598] ffff8881473acd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 47.653158][ T3598] ffff8881473ace00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 47.661292][ T3598] >ffff8881473ace80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 47.669347][ T3598] ^ [ 47.677048][ T3598] ffff8881473acf00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 47.685092][ T3598] ffff8881473acf80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 47.693134][ T3598] ================================================================== [ 47.701572][ T3598] Kernel panic - not syncing: panic_on_warn set ... [ 47.708189][ T3598] CPU: 1 PID: 3598 Comm: syz-executor238 Not tainted 6.0.0-rc7-syzkaller-00250-ga962b54e162c #0 [ 47.718603][ T3598] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 [ 47.728723][ T3598] Call Trace: [ 47.731979][ T3598] [ 47.734888][ T3598] dump_stack_lvl+0xcd/0x134 [ 47.739480][ T3598] panic+0x2c8/0x627 [ 47.743355][ T3598] ? panic_print_sys_info.part.0+0x10b/0x10b [ 47.749318][ T3598] ? preempt_schedule_common+0x59/0xc0 [ 47.754939][ T3598] ? preempt_schedule_thunk+0x16/0x18 [ 47.760299][ T3598] ? run_unpack+0x8b7/0x970 [ 47.764781][ T3598] end_report.part.0+0x3f/0x7c [ 47.769524][ T3598] kasan_report.cold+0xa/0xf [ 47.774109][ T3598] ? run_unpack+0x8b7/0x970 [ 47.778599][ T3598] run_unpack+0x8b7/0x970 [ 47.783013][ T3598] ? run_pack+0x1100/0x1100 [ 47.787497][ T3598] ? ntfs_bread_run+0x310/0x310 [ 47.792323][ T3598] ? kfree+0x1fb/0x580 [ 47.796366][ T3598] run_unpack_ex+0xb0/0x7c0 [ 47.800846][ T3598] ? mi_enum_attr+0x34f/0x630 [ 47.805592][ T3598] ? ni_enum_attr_ex+0x281/0x400 [ 47.810505][ T3598] ? run_unpack+0x970/0x970 [ 47.814979][ T3598] ? ni_fname_type.part.0+0x1e0/0x1e0 [ 47.820328][ T3598] ? mi_read+0x27f/0x5b0 [ 47.824551][ T3598] ntfs_iget5+0xc20/0x3280 [ 47.828943][ T3598] ? ntfs_write_end+0x800/0x800 [ 47.833774][ T3598] ntfs_loadlog_and_replay+0x124/0x5d0 [ 47.839214][ T3598] ? ntfs_write_end+0x800/0x800 [ 47.844045][ T3598] ? ntfs_bio_fill_1+0xa10/0xa10 [ 47.849132][ T3598] ? destroy_inode+0xc4/0x1b0 [ 47.853789][ T3598] ? iput.part.0+0x55d/0x810 [ 47.858444][ T3598] ntfs_fill_super+0x1eff/0x37f0 [ 47.863370][ T3598] ? put_ntfs+0x330/0x330 [ 47.867673][ T3598] ? set_blocksize+0x2e5/0x370 [ 47.872416][ T3598] get_tree_bdev+0x440/0x760 [ 47.876982][ T3598] ? put_ntfs+0x330/0x330 [ 47.881292][ T3598] vfs_get_tree+0x89/0x2f0 [ 47.885682][ T3598] path_mount+0x1326/0x1e20 [ 47.890160][ T3598] ? kmem_cache_free+0xeb/0x5b0 [ 47.894983][ T3598] ? finish_automount+0x960/0x960 [ 47.900089][ T3598] ? putname+0xfe/0x140 [ 47.904228][ T3598] __x64_sys_mount+0x27f/0x300 [ 47.909070][ T3598] ? copy_mnt_ns+0xae0/0xae0 [ 47.913899][ T3598] ? syscall_enter_from_user_mode+0x22/0xb0 [ 47.919771][ T3598] do_syscall_64+0x35/0xb0 [ 47.924169][ T3598] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 47.930132][ T3598] RIP: 0033:0x7fc170bc63fa [ 47.934522][ T3598] Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 47.954108][ T3598] RSP: 002b:00007fff821c2d68 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 47.962493][ T3598] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc170bc63fa [ 47.970457][ T3598] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007fff821c2d80 [ 47.978674][ T3598] RBP: 00007fff821c2d80 R08: 00007fff821c2dc0 R09: 0000555556d3b2c0 [ 47.986622][ T3598] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000004 [ 47.994566][ T3598] R13: 00007fff821c2dc0 R14: 000000000000000d R15: 0000000020000338 [ 48.002517][ T3598] [ 48.006246][ T3598] Kernel Offset: disabled [ 48.010555][ T3598] Rebooting in 86400 seconds..