Warning: Permanently added '10.128.0.17' (ED25519) to the list of known hosts. executing program [ 51.015449][ T3501] loop0: detected capacity change from 0 to 4096 [ 51.024966][ T3501] ntfs: (device loop0): parse_options(): Option utf8 is no longer supported, using option nls=utf8. Please use option nls=utf8 in the future and make sure utf8 is compiled either as a module or into the kernel. [ 51.058769][ T3501] ntfs: volume version 3.1. [ 51.073849][ T3501] ================================================================== [ 51.082136][ T3501] BUG: KASAN: use-after-free in ntfs_readpage+0x7fb/0x2210 [ 51.089404][ T3501] Read of size 10 at addr ffff888072952170 by task syz-executor156/3501 [ 51.097758][ T3501] [ 51.100117][ T3501] CPU: 1 PID: 3501 Comm: syz-executor156 Not tainted 5.15.145-syzkaller #0 [ 51.108703][ T3501] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 51.118770][ T3501] Call Trace: [ 51.122060][ T3501] [ 51.124988][ T3501] dump_stack_lvl+0x1e3/0x2cb [ 51.129673][ T3501] ? io_uring_drop_tctx_refs+0x19d/0x19d [ 51.135307][ T3501] ? _printk+0xd1/0x111 [ 51.139461][ T3501] ? __wake_up_klogd+0xcc/0x100 [ 51.144308][ T3501] ? panic+0x84d/0x84d [ 51.148375][ T3501] ? _raw_spin_lock_irqsave+0xdd/0x120 [ 51.153836][ T3501] print_address_description+0x63/0x3b0 [ 51.159388][ T3501] ? ntfs_readpage+0x7fb/0x2210 [ 51.164238][ T3501] kasan_report+0x16b/0x1c0 [ 51.168745][ T3501] ? ntfs_readpage+0x7fb/0x2210 [ 51.173598][ T3501] kasan_check_range+0x27e/0x290 [ 51.178535][ T3501] ? ntfs_readpage+0x7fb/0x2210 [ 51.183390][ T3501] memcpy+0x25/0x60 [ 51.187200][ T3501] ntfs_readpage+0x7fb/0x2210 [ 51.191904][ T3501] ? xa_load+0x3df/0x460 [ 51.196171][ T3501] ? xas_find_conflict+0x890/0x890 [ 51.201293][ T3501] ? ntfs_writepage+0x12c0/0x12c0 [ 51.206322][ T3501] ? readahead_page+0x2c8/0x400 [ 51.211172][ T3501] ? ntfs_writepage+0x12c0/0x12c0 [ 51.216198][ T3501] read_pages+0x605/0x8e0 [ 51.220535][ T3501] ? page_cache_ra_unbounded+0x930/0x930 [ 51.226179][ T3501] ? add_to_page_cache_locked+0x40/0x40 [ 51.231774][ T3501] ? down_read+0x1b3/0x2e0 [ 51.236201][ T3501] page_cache_ra_unbounded+0x7b0/0x930 [ 51.241685][ T3501] ? read_cache_pages_invalidate_pages+0x1c0/0x1c0 [ 51.248190][ T3501] ? blk_cgroup_congested+0x30c/0x390 [ 51.253568][ T3501] filemap_read+0x71c/0x2980 [ 51.258181][ T3501] ? unwind_get_return_address+0x49/0x80 [ 51.263822][ T3501] ? find_get_pages_range_tag+0x500/0x500 [ 51.269575][ T3501] ? stack_trace_save+0x113/0x1c0 [ 51.274623][ T3501] ? deref_stack_reg+0xbe/0x110 [ 51.279485][ T3501] ? generic_file_read_iter+0x93/0x460 [ 51.284950][ T3501] __kernel_read+0x5ac/0xa60 [ 51.289549][ T3501] ? path_openat+0x2745/0x2f20 [ 51.294318][ T3501] ? rw_verify_area+0x1b0/0x1b0 [ 51.299185][ T3501] integrity_kernel_read+0xac/0xf0 [ 51.304304][ T3501] ? integrity_inode_free+0x170/0x170 [ 51.309678][ T3501] ? ima_calc_file_hash+0xa20/0x1c00 [ 51.314967][ T3501] ima_calc_file_hash+0xa5d/0x1c00 [ 51.320108][ T3501] ? validate_chain+0x13bd/0x5930 [ 51.325145][ T3501] ? look_up_lock_class+0x77/0x120 [ 51.330273][ T3501] ? register_lock_class+0x100/0x9a0 [ 51.335565][ T3501] ? ima_alloc_tfm+0x310/0x310 [ 51.340451][ T3501] ? read_lock_is_recursive+0x10/0x10 [ 51.345828][ T3501] ? __mutex_trylock_common+0x17e/0x2e0 [ 51.351505][ T3501] ? __might_sleep+0xc0/0xc0 [ 51.356100][ T3501] ? rcu_lock_release+0x20/0x20 [ 51.360971][ T3501] ima_collect_measurement+0x37e/0x800 [ 51.366453][ T3501] ? ima_get_action+0xa0/0xa0 [ 51.371134][ T3501] ? ima_get_cache_status+0x1c0/0x1c0 [ 51.376530][ T3501] process_measurement+0x1363/0x21c0 [ 51.381830][ T3501] ? ima_file_mmap+0x1c0/0x1c0 [ 51.386615][ T3501] ? apparmor_file_open+0x3e3/0x820 [ 51.391826][ T3501] ? apparmor_task_getsecid+0xb2/0x110 [ 51.397288][ T3501] ima_file_check+0xf3/0x180 [ 51.401904][ T3501] ? do_dentry_open+0xc15/0xfb0 [ 51.406755][ T3501] ? ima_bprm_check+0x2b0/0x2b0 [ 51.411616][ T3501] path_openat+0x2745/0x2f20 [ 51.416226][ T3501] ? do_filp_open+0x460/0x460 [ 51.420922][ T3501] do_filp_open+0x21c/0x460 [ 51.425423][ T3501] ? vfs_tmpfile+0x2e0/0x2e0 [ 51.430027][ T3501] ? _raw_spin_unlock+0x24/0x40 [ 51.434885][ T3501] ? alloc_fd+0x594/0x630 [ 51.439219][ T3501] do_sys_openat2+0x13b/0x500 [ 51.443929][ T3501] ? read_lock_is_recursive+0x10/0x10 [ 51.449304][ T3501] ? do_sys_open+0x220/0x220 [ 51.453901][ T3501] __x64_sys_openat+0x243/0x290 [ 51.458758][ T3501] ? __ia32_sys_open+0x270/0x270 [ 51.463733][ T3501] ? syscall_enter_from_user_mode+0x2e/0x230 [ 51.469716][ T3501] ? lockdep_hardirqs_on+0x94/0x130 [ 51.474925][ T3501] ? syscall_enter_from_user_mode+0x2e/0x230 [ 51.480906][ T3501] do_syscall_64+0x3d/0xb0 [ 51.485324][ T3501] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 51.491215][ T3501] RIP: 0033:0x7ffa8b6a0789 [ 51.495629][ T3501] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 d1 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 51.515228][ T3501] RSP: 002b:00007ffcd68a94a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 51.523645][ T3501] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ffa8b6a0789 [ 51.531612][ T3501] RDX: 0000000000141842 RSI: 0000000020000100 RDI: 00000000ffffff9c [ 51.539589][ T3501] RBP: 00007ffa8b6e20e5 R08: 000000000001ee7c R09: 00007ffcd68a9564 [ 51.547577][ T3501] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcd68a9590 [ 51.555574][ T3501] R13: 00007ffcd68a9670 R14: 431bde82d7b634db R15: 00007ffa8b6e201d [ 51.563553][ T3501] [ 51.566571][ T3501] [ 51.568897][ T3501] The buggy address belongs to the page: [ 51.574514][ T3501] page:ffffea0001ca5480 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x72952 [ 51.584654][ T3501] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 51.591763][ T3501] raw: 00fff00000000000 ffffea0001ca54c8 ffffea0001ca5448 0000000000000000 [ 51.600342][ T3501] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 51.608915][ T3501] page dumped because: kasan: bad access detected [ 51.615315][ T3501] page_owner tracks the page as freed [ 51.620669][ T3501] page last allocated via order 0, migratetype Movable, gfp_mask 0x1100dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO), pid 3501, ts 50983929210, free_ts 51014238464 [ 51.636223][ T3501] get_page_from_freelist+0x322a/0x33c0 [ 51.641797][ T3501] __alloc_pages+0x272/0x700 [ 51.646402][ T3501] alloc_pages_vma+0x39a/0x800 [ 51.651160][ T3501] handle_mm_fault+0x2f49/0x5950 [ 51.656094][ T3501] exc_page_fault+0x271/0x740 [ 51.660796][ T3501] asm_exc_page_fault+0x22/0x30 [ 51.665645][ T3501] page last free stack trace: [ 51.670305][ T3501] free_unref_page_prepare+0xc34/0xcf0 [ 51.675759][ T3501] free_unref_page_list+0x1f7/0x8e0 [ 51.680952][ T3501] release_pages+0x1bb9/0x1f40 [ 51.685723][ T3501] tlb_finish_mmu+0x177/0x320 [ 51.690412][ T3501] unmap_region+0x304/0x350 [ 51.694911][ T3501] __do_munmap+0x12db/0x1740 [ 51.699495][ T3501] __vm_munmap+0x134/0x230 [ 51.703900][ T3501] __x64_sys_munmap+0x67/0x70 [ 51.708567][ T3501] do_syscall_64+0x3d/0xb0 [ 51.712976][ T3501] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 51.718862][ T3501] [ 51.721199][ T3501] Memory state around the buggy address: [ 51.726819][ T3501] ffff888072952000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 51.734870][ T3501] ffff888072952080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 51.742924][ T3501] >ffff888072952100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 51.750973][ T3501] ^ [ 51.758686][ T3501] ffff888072952180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 51.766754][ T3501] ffff888072952200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 51.774806][ T3501] ================================================================== [ 51.782855][ T3501] Disabling lock debugging due to kernel taint [ 51.789241][ T3501] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 51.796458][ T3501] CPU: 1 PID: 3501 Comm: syz-executor156 Tainted: G B 5.15.145-syzkaller #0 [ 51.806478][ T3501] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 51.816550][ T3501] Call Trace: [ 51.819821][ T3501] [ 51.822746][ T3501] dump_stack_lvl+0x1e3/0x2cb [ 51.827426][ T3501] ? io_uring_drop_tctx_refs+0x19d/0x19d [ 51.833054][ T3501] ? panic+0x84d/0x84d [ 51.837115][ T3501] ? lock_release+0xb9/0x9a0 [ 51.841716][ T3501] ? rcu_is_watching+0x11/0xa0 [ 51.846475][ T3501] panic+0x318/0x84d [ 51.850366][ T3501] ? check_panic_on_warn+0x1d/0xa0 [ 51.855470][ T3501] ? fb_is_primary_device+0xcc/0xcc [ 51.860658][ T3501] ? _raw_spin_unlock_irqrestore+0xd4/0x130 [ 51.866546][ T3501] ? _raw_spin_unlock_irqrestore+0xd9/0x130 [ 51.872432][ T3501] ? _raw_spin_unlock+0x40/0x40 [ 51.877274][ T3501] ? print_memory_metadata+0xe2/0x140 [ 51.882644][ T3501] check_panic_on_warn+0x7e/0xa0 [ 51.887573][ T3501] ? ntfs_readpage+0x7fb/0x2210 [ 51.892431][ T3501] end_report+0x6d/0xf0 [ 51.896623][ T3501] kasan_report+0x18e/0x1c0 [ 51.901133][ T3501] ? ntfs_readpage+0x7fb/0x2210 [ 51.905979][ T3501] kasan_check_range+0x27e/0x290 [ 51.910915][ T3501] ? ntfs_readpage+0x7fb/0x2210 [ 51.915771][ T3501] memcpy+0x25/0x60 [ 51.919588][ T3501] ntfs_readpage+0x7fb/0x2210 [ 51.924267][ T3501] ? xa_load+0x3df/0x460 [ 51.928508][ T3501] ? xas_find_conflict+0x890/0x890 [ 51.933646][ T3501] ? ntfs_writepage+0x12c0/0x12c0 [ 51.938677][ T3501] ? readahead_page+0x2c8/0x400 [ 51.943534][ T3501] ? ntfs_writepage+0x12c0/0x12c0 [ 51.948573][ T3501] read_pages+0x605/0x8e0 [ 51.952904][ T3501] ? page_cache_ra_unbounded+0x930/0x930 [ 51.958535][ T3501] ? add_to_page_cache_locked+0x40/0x40 [ 51.964076][ T3501] ? down_read+0x1b3/0x2e0 [ 51.968518][ T3501] page_cache_ra_unbounded+0x7b0/0x930 [ 51.973976][ T3501] ? read_cache_pages_invalidate_pages+0x1c0/0x1c0 [ 51.980472][ T3501] ? blk_cgroup_congested+0x30c/0x390 [ 51.985840][ T3501] filemap_read+0x71c/0x2980 [ 51.990434][ T3501] ? unwind_get_return_address+0x49/0x80 [ 51.996065][ T3501] ? find_get_pages_range_tag+0x500/0x500 [ 52.001785][ T3501] ? stack_trace_save+0x113/0x1c0 [ 52.006959][ T3501] ? deref_stack_reg+0xbe/0x110 [ 52.011838][ T3501] ? generic_file_read_iter+0x93/0x460 [ 52.017300][ T3501] __kernel_read+0x5ac/0xa60 [ 52.021896][ T3501] ? path_openat+0x2745/0x2f20 [ 52.026661][ T3501] ? rw_verify_area+0x1b0/0x1b0 [ 52.031514][ T3501] integrity_kernel_read+0xac/0xf0 [ 52.036626][ T3501] ? integrity_inode_free+0x170/0x170 [ 52.042003][ T3501] ? ima_calc_file_hash+0xa20/0x1c00 [ 52.047283][ T3501] ima_calc_file_hash+0xa5d/0x1c00 [ 52.052390][ T3501] ? validate_chain+0x13bd/0x5930 [ 52.057435][ T3501] ? look_up_lock_class+0x77/0x120 [ 52.062544][ T3501] ? register_lock_class+0x100/0x9a0 [ 52.067833][ T3501] ? ima_alloc_tfm+0x310/0x310 [ 52.072614][ T3501] ? read_lock_is_recursive+0x10/0x10 [ 52.077983][ T3501] ? __mutex_trylock_common+0x17e/0x2e0 [ 52.083522][ T3501] ? __might_sleep+0xc0/0xc0 [ 52.088106][ T3501] ? rcu_lock_release+0x20/0x20 [ 52.092958][ T3501] ima_collect_measurement+0x37e/0x800 [ 52.098422][ T3501] ? ima_get_action+0xa0/0xa0 [ 52.103094][ T3501] ? ima_get_cache_status+0x1c0/0x1c0 [ 52.108468][ T3501] process_measurement+0x1363/0x21c0 [ 52.113756][ T3501] ? ima_file_mmap+0x1c0/0x1c0 [ 52.118528][ T3501] ? apparmor_file_open+0x3e3/0x820 [ 52.123729][ T3501] ? apparmor_task_getsecid+0xb2/0x110 [ 52.129189][ T3501] ima_file_check+0xf3/0x180 [ 52.133799][ T3501] ? do_dentry_open+0xc15/0xfb0 [ 52.138643][ T3501] ? ima_bprm_check+0x2b0/0x2b0 [ 52.143492][ T3501] path_openat+0x2745/0x2f20 [ 52.148092][ T3501] ? do_filp_open+0x460/0x460 [ 52.152810][ T3501] do_filp_open+0x21c/0x460 [ 52.157310][ T3501] ? vfs_tmpfile+0x2e0/0x2e0 [ 52.161907][ T3501] ? _raw_spin_unlock+0x24/0x40 [ 52.166757][ T3501] ? alloc_fd+0x594/0x630 [ 52.171102][ T3501] do_sys_openat2+0x13b/0x500 [ 52.175792][ T3501] ? read_lock_is_recursive+0x10/0x10 [ 52.181167][ T3501] ? do_sys_open+0x220/0x220 [ 52.185785][ T3501] __x64_sys_openat+0x243/0x290 [ 52.190653][ T3501] ? __ia32_sys_open+0x270/0x270 [ 52.195617][ T3501] ? syscall_enter_from_user_mode+0x2e/0x230 [ 52.201601][ T3501] ? lockdep_hardirqs_on+0x94/0x130 [ 52.206796][ T3501] ? syscall_enter_from_user_mode+0x2e/0x230 [ 52.212805][ T3501] do_syscall_64+0x3d/0xb0 [ 52.217221][ T3501] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 52.223114][ T3501] RIP: 0033:0x7ffa8b6a0789 [ 52.227524][ T3501] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 d1 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 52.247121][ T3501] RSP: 002b:00007ffcd68a94a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 52.255533][ T3501] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ffa8b6a0789 [ 52.263502][ T3501] RDX: 0000000000141842 RSI: 0000000020000100 RDI: 00000000ffffff9c [ 52.271469][ T3501] RBP: 00007ffa8b6e20e5 R08: 000000000001ee7c R09: 00007ffcd68a9564 [ 52.279434][ T3501] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcd68a9590 [ 52.287399][ T3501] R13: 00007ffcd68a9670 R14: 431bde82d7b634db R15: 00007ffa8b6e201d [ 52.295370][ T3501] [ 52.298626][ T3501] Kernel Offset: disabled [ 52.302950][ T3501] Rebooting in 86400 seconds..