./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor894805093 <...> Warning: Permanently added '10.128.0.118' (ED25519) to the list of known hosts. execve("./syz-executor894805093", ["./syz-executor894805093"], 0x7fffde123f90 /* 10 vars */) = 0 brk(NULL) = 0x555556a10000 brk(0x555556a10d00) = 0x555556a10d00 arch_prctl(ARCH_SET_FS, 0x555556a10380) = 0 set_tid_address(0x555556a10650) = 5067 set_robust_list(0x555556a10660, 24) = 0 rseq(0x555556a10ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor894805093", 4096) = 27 getrandom("\x2e\x0b\x63\x5a\xcc\x8a\x87\xb8", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555556a10d00 brk(0x555556a31d00) = 0x555556a31d00 brk(0x555556a32000) = 0x555556a32000 mprotect(0x7fa86d2c1000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 [ 106.032511][ T27] audit: type=1400 audit(1699416681.423:83): avc: denied { execmem } for pid=5067 comm="syz-executor894" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 106.055013][ T27] audit: type=1400 audit(1699416681.443:84): avc: denied { read write } for pid=5067 comm="syz-executor894" name="loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5068 attached [pid 5068] set_robust_list(0x555556a10660, 24 [pid 5067] <... clone resumed>, child_tidptr=0x555556a10650) = 5068 [pid 5068] <... set_robust_list resumed>) = 0 [ 106.080565][ T27] audit: type=1400 audit(1699416681.443:85): avc: denied { open } for pid=5067 comm="syz-executor894" path="/dev/loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [pid 5068] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5068] setpgid(0, 0) = 0 [pid 5068] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5068] write(3, "1000", 4) = 4 [pid 5068] close(3) = 0 [pid 5068] memfd_create("syzkaller", 0) = 3 [pid 5068] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa864df0000 [ 106.110122][ T27] audit: type=1400 audit(1699416681.453:86): avc: denied { ioctl } for pid=5067 comm="syz-executor894" path="/dev/loop0" dev="devtmpfs" ino=648 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [pid 5068] write(3, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x04\x40\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x80\x00\xff\x07\x00\x00\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\x00\x00\xf6\x00\x00\x00\xf4\x00\x00\x00\xf7\x9a\x81\x47\x2b\x73\xcf\x43\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00"..., 2097152) = 2097152 [pid 5068] munmap(0x7fa864df0000, 138412032) = 0 [pid 5068] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5068] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5068] close(3) = 0 [pid 5068] mkdir("./file0", 0777) = 0 [ 106.220050][ T5068] loop0: detected capacity change from 0 to 4096 [ 106.249184][ T27] audit: type=1400 audit(1699416681.643:87): avc: denied { mounton } for pid=5068 comm="syz-executor894" path="/root/file0" dev="sda1" ino=1927 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 106.275970][ T5068] syz-executor894: attempt to access beyond end of device [ 106.275970][ T5068] loop0: rw=0, sector=32768, nr_sectors = 2 limit=4096 [ 106.290082][ T5068] ntfs: (device loop0): ntfs_end_buffer_async_read(): Buffer I/O error, logical block 0x4000. [ 106.300454][ T5068] syz-executor894: attempt to access beyond end of device [ 106.300454][ T5068] loop0: rw=0, sector=32770, nr_sectors = 2 limit=4096 [ 106.314532][ T5068] ntfs: (device loop0): ntfs_end_buffer_async_read(): Buffer I/O error, logical block 0x4001. [ 106.324872][ T5068] syz-executor894: attempt to access beyond end of device [ 106.324872][ T5068] loop0: rw=0, sector=32772, nr_sectors = 2 limit=4096 [ 106.338734][ T5068] ntfs: (device loop0): ntfs_end_buffer_async_read(): Buffer I/O error, logical block 0x4002. [ 106.349085][ T5068] syz-executor894: attempt to access beyond end of device [ 106.349085][ T5068] loop0: rw=0, sector=32774, nr_sectors = 2 limit=4096 [ 106.362969][ T5068] ntfs: (device loop0): ntfs_end_buffer_async_read(): Buffer I/O error, logical block 0x4003. [ 106.373269][ T5068] ntfs: (device loop0): check_mft_mirror(): Failed to read $MFTMirr. [ 106.381490][ T5068] ================================================================== [ 106.389555][ T5068] BUG: KASAN: use-after-free in ntfs_attr_find+0xaa4/0xbe0 [ 106.396789][ T5068] Read of size 2 at addr ffff888070bf6152 by task syz-executor894/5068 [ 106.405032][ T5068] [ 106.407380][ T5068] CPU: 1 PID: 5068 Comm: syz-executor894 Not tainted 6.6.0-syzkaller-15156-g13d88ac54ddd #0 [ 106.417480][ T5068] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 106.427549][ T5068] Call Trace: [ 106.430869][ T5068] [ 106.433834][ T5068] dump_stack_lvl+0xd9/0x1b0 [ 106.438628][ T5068] print_report+0xc4/0x620 [ 106.443076][ T5068] ? __virt_addr_valid+0x5e/0x2d0 [ 106.448146][ T5068] ? __phys_addr+0xc6/0x140 [ 106.452676][ T5068] kasan_report+0xda/0x110 [ 106.457125][ T5068] ? ntfs_attr_find+0xaa4/0xbe0 [ 106.462090][ T5068] ? ntfs_attr_find+0xaa4/0xbe0 [ 106.466981][ T5068] ntfs_attr_find+0xaa4/0xbe0 [ 106.471684][ T5068] ntfs_attr_lookup+0x10e0/0x2100 [ 106.476753][ T5068] ? kasan_set_track+0x25/0x30 [ 106.481542][ T5068] ? ntfs_attr_reinit_search_ctx+0x3c0/0x3c0 [ 106.487547][ T5068] ? kmem_cache_alloc+0x33c/0x3f0 [ 106.492593][ T5068] ? map_mft_record+0x300/0x730 [ 106.497473][ T5068] ntfs_attr_iget+0x6d1/0x2660 [ 106.502271][ T5068] ? __ntfs_init_inode+0x5d0/0x5d0 [ 106.507413][ T5068] ? ntfs_end_buffer_async_read+0x18d0/0x18d0 [ 106.513528][ T5068] ntfs_fill_super+0x2611/0x9100 [ 106.518506][ T5068] ? parse_options+0x1db0/0x1db0 [ 106.523567][ T5068] ? preempt_count_sub+0x150/0x150 [ 106.528715][ T5068] ? do_raw_spin_lock+0x12e/0x2b0 [ 106.533773][ T5068] ? rwsem_down_write_slowpath+0x12a0/0x12a0 [ 106.539776][ T5068] ? sb_set_blocksize+0xf6/0x120 [ 106.544729][ T5068] ? setup_bdev_super+0x3b5/0x780 [ 106.549775][ T5068] ? parse_options+0x1db0/0x1db0 [ 106.554744][ T5068] mount_bdev+0x1f3/0x2e0 [ 106.559099][ T5068] ? sget+0x640/0x640 [ 106.563121][ T5068] ? selinux_sb_eat_lsm_opts+0x594/0x700 [ 106.568781][ T5068] ? cap_capable+0x1d8/0x240 [ 106.573408][ T5068] ? ntfs_rl_punch_nolock+0x15d0/0x15d0 [ 106.578987][ T5068] legacy_get_tree+0x109/0x220 [ 106.583781][ T5068] vfs_get_tree+0x8c/0x370 [ 106.588219][ T5068] path_mount+0x1492/0x1ed0 [ 106.592771][ T5068] ? lockdep_hardirqs_on+0x7d/0x100 [ 106.598010][ T5068] ? finish_automount+0xa40/0xa40 [ 106.603064][ T5068] ? putname+0x12e/0x170 [ 106.607336][ T5068] __x64_sys_mount+0x293/0x310 [ 106.612138][ T5068] ? copy_mnt_ns+0xb60/0xb60 [ 106.616754][ T5068] ? lockdep_hardirqs_on+0x7d/0x100 [ 106.621985][ T5068] ? _raw_spin_unlock_irq+0x2e/0x50 [ 106.629398][ T5068] ? ptrace_notify+0xf4/0x130 [ 106.634102][ T5068] do_syscall_64+0x3f/0x110 [ 106.640632][ T5068] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 106.646549][ T5068] RIP: 0033:0x7fa86d22fdaa [ 106.650982][ T5068] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 106.670614][ T5068] RSP: 002b:00007ffe495fd7f8 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 106.679052][ T5068] RAX: ffffffffffffffda RBX: 00007ffe495fd800 RCX: 00007fa86d22fdaa [ 106.687488][ T5068] RDX: 000000002001f6c0 RSI: 000000002001f640 RDI: 00007ffe495fd800 [ 106.695477][ T5068] RBP: 0000000000000004 R08: 00007ffe495fd840 R09: 000000000001f61d [ 106.703462][ T5068] R10: 0000000000008703 R11: 0000000000000286 R12: 00007ffe495fd840 [ 106.711449][ T5068] R13: 0000000000000003 R14: 0000000000200000 R15: 00007fa86d27703b [ 106.719466][ T5068] [ 106.722493][ T5068] [ 106.724822][ T5068] The buggy address belongs to the physical page: [ 106.731269][ T5068] page:ffffea0001c2fd80 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x70bf6 [ 106.741712][ T5068] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 106.748829][ T5068] page_type: 0xffffffff() [ 106.753190][ T5068] raw: 00fff00000000000 ffffea0001c2fdc8 ffffea0001cfb548 0000000000000000 [ 106.761817][ T5068] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 106.770420][ T5068] page dumped because: kasan: bad access detected [ 106.776847][ T5068] page_owner tracks the page as freed [ 106.782223][ T5068] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 5053, tgid 5053 (sshd), ts 97374357371, free_ts 97463131105 [ 106.800236][ T5068] post_alloc_hook+0x2cf/0x340 [ 106.805047][ T5068] get_page_from_freelist+0xa25/0x36c0 [ 106.810554][ T5068] __alloc_pages+0x1d0/0x4a0 [ 106.815445][ T5068] alloc_pages_mpol+0x258/0x5f0 [ 106.820323][ T5068] vma_alloc_folio+0xad/0x220 [ 106.825028][ T5068] __handle_mm_fault+0xe06/0x3d60 [ 106.830116][ T5068] handle_mm_fault+0x478/0xa00 [ 106.834907][ T5068] do_user_addr_fault+0x30b/0x1000 [ 106.840044][ T5068] exc_page_fault+0x5c/0xd0 [ 106.844564][ T5068] asm_exc_page_fault+0x26/0x30 [ 106.849439][ T5068] page last free stack trace: [ 106.854128][ T5068] free_unref_page_prepare+0x4f8/0xa90 [ 106.859630][ T5068] free_unref_page_list+0xe6/0xb30 [ 106.864788][ T5068] release_pages+0x32a/0x14e0 [ 106.869491][ T5068] tlb_batch_pages_flush+0x9a/0x190 [ 106.874728][ T5068] tlb_finish_mmu+0x14b/0x6f0 [ 106.879443][ T5068] unmap_region.constprop.0+0x2e6/0x3b0 [ 106.885016][ T5068] do_vmi_align_munmap+0xddc/0x15f0 [ 106.890253][ T5068] do_vmi_munmap+0x20e/0x450 [ 106.894896][ T5068] __vm_munmap+0x144/0x390 [ 106.899355][ T5068] __x64_sys_munmap+0x62/0x80 [ 106.904078][ T5068] do_syscall_64+0x3f/0x110 [ 106.909139][ T5068] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 106.915089][ T5068] [ 106.917453][ T5068] Memory state around the buggy address: [ 106.923154][ T5068] ffff888070bf6000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 106.931329][ T5068] ffff888070bf6080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 106.939524][ T5068] >ffff888070bf6100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 106.947598][ T5068] ^ [ 106.954285][ T5068] ffff888070bf6180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 106.962373][ T5068] ffff888070bf6200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 106.970450][ T5068] ================================================================== [ 106.978932][ T5068] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 106.986159][ T5068] CPU: 1 PID: 5068 Comm: syz-executor894 Not tainted 6.6.0-syzkaller-15156-g13d88ac54ddd #0 [ 106.996265][ T5068] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 107.006354][ T5068] Call Trace: [ 107.009646][ T5068] [ 107.012589][ T5068] dump_stack_lvl+0xd9/0x1b0 [ 107.017214][ T5068] panic+0x6dc/0x790 [ 107.021136][ T5068] ? panic_smp_self_stop+0xa0/0xa0 [ 107.026275][ T5068] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 107.032457][ T5068] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 107.038647][ T5068] ? check_panic_on_warn+0x1f/0xb0 [ 107.044149][ T5068] check_panic_on_warn+0xab/0xb0 [ 107.049116][ T5068] end_report+0x108/0x150 [ 107.053490][ T5068] kasan_report+0xea/0x110 [ 107.057956][ T5068] ? ntfs_attr_find+0xaa4/0xbe0 [ 107.062880][ T5068] ? ntfs_attr_find+0xaa4/0xbe0 [ 107.067776][ T5068] ntfs_attr_find+0xaa4/0xbe0 [ 107.072486][ T5068] ntfs_attr_lookup+0x10e0/0x2100 [ 107.077550][ T5068] ? kasan_set_track+0x25/0x30 [ 107.082386][ T5068] ? ntfs_attr_reinit_search_ctx+0x3c0/0x3c0 [ 107.088410][ T5068] ? kmem_cache_alloc+0x33c/0x3f0 [ 107.093463][ T5068] ? map_mft_record+0x300/0x730 [ 107.098352][ T5068] ntfs_attr_iget+0x6d1/0x2660 [ 107.103164][ T5068] ? __ntfs_init_inode+0x5d0/0x5d0 [ 107.108305][ T5068] ? ntfs_end_buffer_async_read+0x18d0/0x18d0 [ 107.114414][ T5068] ntfs_fill_super+0x2611/0x9100 [ 107.119397][ T5068] ? parse_options+0x1db0/0x1db0 [ 107.124454][ T5068] ? preempt_count_sub+0x150/0x150 [ 107.129604][ T5068] ? do_raw_spin_lock+0x12e/0x2b0 [ 107.134699][ T5068] ? rwsem_down_write_slowpath+0x12a0/0x12a0 [ 107.140702][ T5068] ? sb_set_blocksize+0xf6/0x120 [ 107.145657][ T5068] ? setup_bdev_super+0x3b5/0x780 [ 107.150738][ T5068] ? parse_options+0x1db0/0x1db0 [ 107.155751][ T5068] mount_bdev+0x1f3/0x2e0 [ 107.160138][ T5068] ? sget+0x640/0x640 [ 107.164142][ T5068] ? selinux_sb_eat_lsm_opts+0x594/0x700 [ 107.169809][ T5068] ? cap_capable+0x1d8/0x240 [ 107.174441][ T5068] ? ntfs_rl_punch_nolock+0x15d0/0x15d0 [ 107.180022][ T5068] legacy_get_tree+0x109/0x220 [ 107.184822][ T5068] vfs_get_tree+0x8c/0x370 [ 107.189297][ T5068] path_mount+0x1492/0x1ed0 [ 107.193833][ T5068] ? lockdep_hardirqs_on+0x7d/0x100 [ 107.199052][ T5068] ? finish_automount+0xa40/0xa40 [ 107.204125][ T5068] ? putname+0x12e/0x170 [ 107.208433][ T5068] __x64_sys_mount+0x293/0x310 [ 107.213227][ T5068] ? copy_mnt_ns+0xb60/0xb60 [ 107.217841][ T5068] ? lockdep_hardirqs_on+0x7d/0x100 [ 107.223060][ T5068] ? _raw_spin_unlock_irq+0x2e/0x50 [ 107.228303][ T5068] ? ptrace_notify+0xf4/0x130 [ 107.233085][ T5068] do_syscall_64+0x3f/0x110 [ 107.237632][ T5068] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 107.243542][ T5068] RIP: 0033:0x7fa86d22fdaa [ 107.247998][ T5068] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 107.267627][ T5068] RSP: 002b:00007ffe495fd7f8 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 107.276060][ T5068] RAX: ffffffffffffffda RBX: 00007ffe495fd800 RCX: 00007fa86d22fdaa [ 107.284046][ T5068] RDX: 000000002001f6c0 RSI: 000000002001f640 RDI: 00007ffe495fd800 [ 107.292033][ T5068] RBP: 0000000000000004 R08: 00007ffe495fd840 R09: 000000000001f61d [ 107.300034][ T5068] R10: 0000000000008703 R11: 0000000000000286 R12: 00007ffe495fd840 [ 107.308026][ T5068] R13: 0000000000000003 R14: 0000000000200000 R15: 00007fa86d27703b [ 107.316020][ T5068] [ 107.319339][ T5068] Kernel Offset: disabled [ 107.323666][ T5068] Rebooting in 86400 seconds..