Warning: Permanently added '10.128.0.161' (ED25519) to the list of known hosts. executing program [ 38.621966][ T4294] loop0: detected capacity change from 0 to 4096 [ 38.635328][ T4294] ntfs: (device loop0): check_mft_mirror(): $MFT and $MFTMirr (record 1) do not match. Run ntfsfix or chkdsk. [ 38.638461][ T4294] ntfs: (device loop0): load_system_files(): $MFTMirr does not match $MFT. Mounting read-only. Run ntfsfix and/or chkdsk. [ 38.643430][ T4294] ntfs: (device loop0): ntfs_read_locked_inode(): First extent of $DATA attribute has non zero lowest_vcn. [ 38.646566][ T4294] ntfs: (device loop0): ntfs_read_locked_inode(): Failed with error code -5. Marking corrupt inode 0xa as bad. Run chkdsk. [ 38.649978][ T4294] ntfs: (device loop0): load_and_init_upcase(): Failed to load $UpCase from the volume. Using default. [ 38.654791][ T4294] ntfs: volume version 3.1. [ 38.657296][ T4294] ntfs: (device loop0): ntfs_check_logfile(): Did not find any restart pages in $LogFile and it was not empty. [ 38.660981][ T4294] ntfs: (device loop0): load_system_files(): Failed to load $LogFile. Will not be able to remount read-write. Mount in Windows. [ 38.664938][ T4294] ntfs: (device loop0): ntfs_lookup_inode_by_name(): Index entry out of bounds in directory inode 0x5. [ 38.667890][ T4294] ntfs: (device loop0): check_windows_hibernation_status(): Failed to find inode number for hiberfil.sys. [ 38.671089][ T4294] ntfs: (device loop0): load_system_files(): Failed to determine if Windows is hibernated. Will not be able to remount read-write. Run chkdsk. [ 38.677434][ T4294] ================================================================== [ 38.679626][ T4294] BUG: KASAN: use-after-free in ntfs_read_folio+0x6a8/0x1d40 [ 38.681645][ T4294] Read of size 285212680 at addr ffff0000e3164a9a by task syz-executor114/4294 [ 38.684095][ T4294] [ 38.684701][ T4294] CPU: 1 PID: 4294 Comm: syz-executor114 Not tainted 6.1.140-syzkaller #0 [ 38.687020][ T4294] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 38.689789][ T4294] Call trace: [ 38.690679][ T4294] dump_backtrace+0x1c8/0x1f4 [ 38.691985][ T4294] show_stack+0x2c/0x3c [ 38.693097][ T4294] __dump_stack+0x30/0x40 [ 38.694287][ T4294] dump_stack_lvl+0xf8/0x160 [ 38.695541][ T4294] print_address_description+0x88/0x220 [ 38.697017][ T4294] print_report+0x50/0x68 [ 38.698182][ T4294] kasan_report+0xa8/0x100 [ 38.699353][ T4294] kasan_check_range+0x260/0x2a0 [ 38.700715][ T4294] memcpy+0x48/0x90 [ 38.701730][ T4294] ntfs_read_folio+0x6a8/0x1d40 [ 38.703039][ T4294] filemap_read_folio+0x130/0x37c [ 38.704409][ T4294] do_read_cache_folio+0x24c/0x544 [ 38.705813][ T4294] read_cache_page+0x6c/0x184 [ 38.707103][ T4294] ntfs_readdir+0x544/0x2b88 [ 38.708347][ T4294] iterate_dir+0x1f0/0x4cc [ 38.709594][ T4294] __arm64_sys_getdents64+0x11c/0x318 [ 38.711050][ T4294] invoke_syscall+0x98/0x2bc [ 38.712269][ T4294] el0_svc_common+0x138/0x258 [ 38.713583][ T4294] do_el0_svc+0x58/0x13c [ 38.714736][ T4294] el0_svc+0x58/0x138 [ 38.715814][ T4294] el0t_64_sync_handler+0x84/0xf0 [ 38.717198][ T4294] el0t_64_sync+0x18c/0x190 [ 38.718445][ T4294] [ 38.719132][ T4294] The buggy address belongs to the physical page: [ 38.720861][ T4294] page:0000000087937fe0 refcount:3 mapcount:0 mapping:00000000e6697c65 index:0x2 pfn:0x123164 [ 38.723540][ T4294] memcg:ffff0000c0940000 [ 38.724707][ T4294] aops:ntfs_mst_aops ino:0 [ 38.725900][ T4294] flags: 0x5ffd60000002056(referenced|uptodate|lru|workingset|private|node=0|zone=2|lastcpupid=0x7ff) [ 38.728975][ T4294] raw: 05ffd60000002056 fffffc00038c4d48 fffffc00039094c8 ffff0000e1f48548 [ 38.731313][ T4294] raw: 0000000000000002 ffff0000e1e232b8 00000003ffffffff ffff0000c0940000 [ 38.733780][ T4294] page dumped because: kasan: bad access detected [ 38.735470][ T4294] [ 38.736120][ T4294] Memory state around the buggy address: [ 38.737681][ T4294] ffff0000e3175f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 38.739901][ T4294] ffff0000e3175f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 38.742173][ T4294] >ffff0000e3176000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 38.744337][ T4294] ^ [ 38.745392][ T4294] ffff0000e3176080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 38.747581][ T4294] ffff0000e3176100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 38.749838][ T4294] ================================================================== [ 38.752162][ T4294] Disabling lock debugging due to kernel taint