Warning: Permanently added '10.128.0.207' (ED25519) to the list of known hosts. executing program [ 36.495135][ T6166] loop0: detected capacity change from 0 to 4096 [ 36.501225][ T6166] ntfs: (device loop0): check_mft_mirror(): Incomplete multi sector transfer detected in mft mirror record 0. [ 36.504509][ T6166] ntfs: (device loop0): load_system_files(): $MFTMirr does not match $MFT. Mounting read-only. Run ntfsfix and/or chkdsk. [ 36.508226][ T6166] ntfs: (device loop0): ntfs_read_locked_inode(): First extent of $DATA attribute has non zero lowest_vcn. [ 36.512228][ T6166] ntfs: (device loop0): ntfs_read_locked_inode(): Failed with error code -5. Marking corrupt inode 0xa as bad. Run chkdsk. [ 36.515953][ T6166] ntfs: (device loop0): load_and_init_upcase(): Failed to load $UpCase from the volume. Using default. [ 36.521396][ T6166] ntfs: volume version 3.1. [ 36.524352][ T6166] ntfs: (device loop0): ntfs_check_logfile(): Did not find any restart pages in $LogFile and it was not empty. [ 36.527659][ T6166] ntfs: (device loop0): load_system_files(): Failed to load $LogFile. Will not be able to remount read-write. Mount in Windows. [ 36.531684][ T6166] ntfs: (device loop0): ntfs_lookup_inode_by_name(): Index entry out of bounds in directory inode 0x5. [ 36.534966][ T6166] ntfs: (device loop0): check_windows_hibernation_status(): Failed to find inode number for hiberfil.sys. [ 36.538076][ T6166] ntfs: (device loop0): load_system_files(): Failed to determine if Windows is hibernated. Will not be able to remount read-write. Run chkdsk. [ 36.543696][ T6166] ================================================================== [ 36.545937][ T6166] BUG: KASAN: slab-out-of-bounds in ntfs_readdir+0xb00/0x2bf0 [ 36.547956][ T6166] Read of size 1 at addr ffff0000cfb97471 by task syz-executor687/6166 [ 36.550267][ T6166] [ 36.550900][ T6166] CPU: 1 PID: 6166 Comm: syz-executor687 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 36.553562][ T6166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 [ 36.556488][ T6166] Call trace: [ 36.557357][ T6166] dump_backtrace+0x1b8/0x1e4 [ 36.558624][ T6166] show_stack+0x2c/0x3c [ 36.559777][ T6166] dump_stack_lvl+0xd0/0x124 [ 36.561055][ T6166] print_report+0x178/0x518 [ 36.562331][ T6166] kasan_report+0xd8/0x138 [ 36.563593][ T6166] __asan_report_load1_noabort+0x20/0x2c [ 36.565193][ T6166] ntfs_readdir+0xb00/0x2bf0 [ 36.566492][ T6166] wrap_directory_iterator+0xa8/0xf4 [ 36.567999][ T6166] shared_ntfs_readdir+0x30/0x40 [ 36.569334][ T6166] iterate_dir+0x3f8/0x580 [ 36.570496][ T6166] __arm64_sys_getdents64+0x1c4/0x4a0 [ 36.572003][ T6166] invoke_syscall+0x98/0x2b8 [ 36.573332][ T6166] el0_svc_common+0x130/0x23c [ 36.574634][ T6166] do_el0_svc+0x48/0x58 [ 36.575752][ T6166] el0_svc+0x54/0x168 [ 36.576875][ T6166] el0t_64_sync_handler+0x84/0xfc [ 36.578278][ T6166] el0t_64_sync+0x190/0x194 [ 36.579402][ T6166] [ 36.580017][ T6166] Allocated by task 6166: [ 36.581202][ T6166] kasan_save_track+0x40/0x78 [ 36.582467][ T6166] kasan_save_alloc_info+0x40/0x50 [ 36.583873][ T6166] __kasan_kmalloc+0xac/0xc4 [ 36.585042][ T6166] __kmalloc+0x2bc/0x5d4 [ 36.586173][ T6166] ntfs_readdir+0x65c/0x2bf0 [ 36.587316][ T6166] wrap_directory_iterator+0xa8/0xf4 [ 36.588640][ T6166] shared_ntfs_readdir+0x30/0x40 [ 36.589970][ T6166] iterate_dir+0x3f8/0x580 [ 36.591150][ T6166] __arm64_sys_getdents64+0x1c4/0x4a0 [ 36.592633][ T6166] invoke_syscall+0x98/0x2b8 [ 36.593883][ T6166] el0_svc_common+0x130/0x23c [ 36.595164][ T6166] do_el0_svc+0x48/0x58 [ 36.596242][ T6166] el0_svc+0x54/0x168 [ 36.597270][ T6166] el0t_64_sync_handler+0x84/0xfc [ 36.598675][ T6166] el0t_64_sync+0x190/0x194 [ 36.599971][ T6166] [ 36.600632][ T6166] The buggy address belongs to the object at ffff0000cfb97400 [ 36.600632][ T6166] which belongs to the cache kmalloc-64 of size 64 [ 36.604398][ T6166] The buggy address is located 57 bytes to the right of [ 36.604398][ T6166] allocated 56-byte region [ffff0000cfb97400, ffff0000cfb97438) [ 36.608280][ T6166] [ 36.608911][ T6166] The buggy address belongs to the physical page: [ 36.610653][ T6166] page:00000000e46d47d9 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff0000cfb97d00 pfn:0x10fb97 [ 36.613878][ T6166] ksm flags: 0x5ffc00000000800(slab|node=0|zone=2|lastcpupid=0x7ff) [ 36.616066][ T6166] page_type: 0xffffffff() [ 36.617297][ T6166] raw: 05ffc00000000800 ffff0000c0001640 fffffdffc3673440 dead000000000007 [ 36.619681][ T6166] raw: ffff0000cfb97d00 000000008020001f 00000001ffffffff 0000000000000000 [ 36.622047][ T6166] page dumped because: kasan: bad access detected [ 36.623692][ T6166] [ 36.624272][ T6166] Memory state around the buggy address: [ 36.625861][ T6166] ffff0000cfb97300: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 36.628130][ T6166] ffff0000cfb97380: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 36.630269][ T6166] >ffff0000cfb97400: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc [ 36.632363][ T6166] ^ [ 36.634457][ T6166] ffff0000cfb97480: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 36.636706][ T6166] ffff0000cfb97500: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 36.638843][ T6166] ================================================================== [ 36.641089][ T6166] Disabling lock debugging due to kernel taint