./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3430534757
<...>
Warning: Permanently added '10.128.0.119' (ECDSA) to the list of known hosts.
execve("./syz-executor3430534757", ["./syz-executor3430534757"], 0x7ffe3e97ef90 /* 10 vars */) = 0
brk(NULL) = 0x555555641000
brk(0x555555641c40) = 0x555555641c40
arch_prctl(ARCH_SET_FS, 0x555555641300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor3430534757", 4096) = 28
brk(0x555555662c40) = 0x555555662c40
brk(0x555555663000) = 0x555555663000
mprotect(0x7f3c7f11d000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555556415d0) = 3632
./strace-static-x86_64: Process 3632 attached
[pid 3632] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 3632] setpgid(0, 0) = 0
[pid 3632] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 3632] write(3, "1000", 4) = 4
[pid 3632] close(3) = 0
[pid 3632] memfd_create("syzkaller", 0) = 3
[pid 3632] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c76c00000
[pid 3632] write(3, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x10\x20\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x80\x00\xff\x03\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\x00\x00\xf4\x00\x00\x00\xf4\x00\x00\x00\x92\x9d\x3e\x59\x8b\x7e\x69\x31\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00"..., 4194304) = 4194304
[pid 3632] munmap(0x7f3c76c00000, 4194304) = 0
[pid 3632] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 3632] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 3632] close(3) = 0
[pid 3632] mkdir("./file1", 0777) = 0
syzkaller login: [ 54.008476][ T3632] loop0: detected capacity change from 0 to 8192
[ 54.020031][ T3632] ntfs3: loop0: Different NTFS' sector size (4096) and media sector size (512)
[ 54.031575][ T3632] ==================================================================
[ 54.039660][ T3632] BUG: KASAN: use-after-free in mi_enum_attr+0x583/0x6a0
[ 54.046692][ T3632] Read of size 4 at addr ffff8881729e604b by task syz-executor343/3632
[ 54.054910][ T3632]
[ 54.057220][ T3632] CPU: 0 PID: 3632 Comm: syz-executor343 Not tainted 6.1.0-rc7-syzkaller #0
[ 54.065870][ T3632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 54.075904][ T3632] Call Trace:
[ 54.079166][ T3632]
[ 54.082094][ T3632] dump_stack_lvl+0x1b1/0x28e
[ 54.086765][ T3632] ? nf_tcp_handle_invalid+0x62e/0x62e
[ 54.092203][ T3632] ? __wake_up_klogd+0xcd/0x100
[ 54.097055][ T3632] ? panic+0x710/0x710
[ 54.101105][ T3632] ? _printk+0xc0/0x100
[ 54.105244][ T3632] ? _raw_spin_lock_irqsave+0x8e/0x100
[ 54.110689][ T3632] print_address_description+0x74/0x340
[ 54.116224][ T3632] print_report+0x107/0x1f0
[ 54.120719][ T3632] ? __virt_addr_valid+0x21b/0x2d0
[ 54.125828][ T3632] ? __phys_addr+0xb5/0x160
[ 54.130328][ T3632] ? mi_enum_attr+0x583/0x6a0
[ 54.135002][ T3632] kasan_report+0xcd/0x100
[ 54.139412][ T3632] ? mi_enum_attr+0x583/0x6a0
[ 54.144088][ T3632] mi_enum_attr+0x583/0x6a0
[ 54.148588][ T3632] ni_enum_attr_ex+0x2f6/0x6d0
[ 54.153346][ T3632] ? ni_find_attr+0x8c0/0x8c0
[ 54.158025][ T3632] ? mi_read+0x260/0x510
[ 54.162264][ T3632] ntfs_iget5+0x1d3e/0x36f0
[ 54.166763][ T3632] ? do_raw_spin_unlock+0x134/0x8a0
[ 54.171962][ T3632] ? check_index_root+0x680/0x680
[ 54.176985][ T3632] ntfs_loadlog_and_replay+0x1ac/0x5c0
[ 54.182444][ T3632] ? ntfs_extend_init+0x5a0/0x5a0
[ 54.187468][ T3632] ? evict+0x5d5/0x620
[ 54.191534][ T3632] ntfs_fill_super+0x2333/0x42a0
[ 54.196477][ T3632] ? put_ntfs+0x2a0/0x2a0
[ 54.200805][ T3632] ? vscnprintf+0x80/0x80
[ 54.205130][ T3632] ? set_blocksize+0x1d5/0x360
[ 54.209886][ T3632] get_tree_bdev+0x400/0x620
[ 54.214469][ T3632] ? put_ntfs+0x2a0/0x2a0
[ 54.218794][ T3632] vfs_get_tree+0x88/0x270
[ 54.223208][ T3632] do_new_mount+0x289/0xad0
[ 54.227704][ T3632] ? do_move_mount_old+0x150/0x150
[ 54.232809][ T3632] ? user_path_at_empty+0x149/0x1a0
[ 54.238000][ T3632] __se_sys_mount+0x2d3/0x3c0
[ 54.242678][ T3632] ? __x64_sys_mount+0xc0/0xc0
[ 54.247431][ T3632] ? syscall_enter_from_user_mode+0x2e/0x1d0
[ 54.253411][ T3632] ? __x64_sys_mount+0x1c/0xc0
[ 54.258169][ T3632] do_syscall_64+0x3d/0xb0
[ 54.262580][ T3632] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 54.268467][ T3632] RIP: 0033:0x7f3c7f09066a
[ 54.272877][ T3632] Code: 48 c7 c2 c0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 a8 00 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 54.292499][ T3632] RSP: 002b:00007fff7c2d9f68 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
[ 54.300908][ T3632] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f3c7f09066a
[ 54.308874][ T3632] RDX: 0000000020020bc0 RSI: 0000000020020c00 RDI: 00007fff7c2d9f80
[ 54.316838][ T3632] RBP: 00007fff7c2d9f80 R08: 00007fff7c2d9fc0 R09: 0000000000000000
[ 54.324806][ T3632] R10: 0000000000018882 R11: 0000000000000286 R12: 0000000000000004
[ 54.332781][ T3632] R13: 00005555556412c0 R14: 0000000000018882 R15: 00007fff7c2d9fc0
[ 54.340754][ T3632]
[ 54.343767][ T3632]
[ 54.346082][ T3632] The buggy address belongs to the physical page:
[ 54.352479][ T3632] page:ffffea0005ca7980 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1729e6
[ 54.362706][ T3632] flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff)
[ 54.369896][ T3632] raw: 057ff00000000000 ffffea0005ca7988 ffffea0005ca7988 0000000000000000
[ 54.378469][ T3632] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 54.387038][ T3632] page dumped because: kasan: bad access detected
[ 54.393444][ T3632] page_owner info is not present (never set?)
[ 54.399497][ T3632]
[ 54.401807][ T3632] Memory state around the buggy address:
[ 54.407422][ T3632] ffff8881729e5f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 54.415469][ T3632] ffff8881729e5f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 54.423515][ T3632] >ffff8881729e6000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 54.431561][ T3632] ^
[ 54.437958][ T3632] ffff8881729e6080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 54.446023][ T3632] ffff8881729e6100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 54.454093][ T3632] ==================================================================
[ 54.462448][ T3632] Kernel panic - not syncing: panic_on_warn set ...
[ 54.469041][ T3632] CPU: 1 PID: 3632 Comm: syz-executor343 Not tainted 6.1.0-rc7-syzkaller #0
[ 54.477721][ T3632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 54.487769][ T3632] Call Trace:
[ 54.491041][ T3632]
[ 54.493964][ T3632] dump_stack_lvl+0x1b1/0x28e
[ 54.498637][ T3632] ? nf_tcp_handle_invalid+0x62e/0x62e
[ 54.504090][ T3632] ? panic+0x710/0x710
[ 54.508157][ T3632] ? preempt_schedule_common+0xb7/0xe0
[ 54.513618][ T3632] ? vscnprintf+0x59/0x80
[ 54.517942][ T3632] panic+0x2d6/0x710
[ 54.521832][ T3632] ? memcpy_page_flushcache+0xfc/0xfc
[ 54.527201][ T3632] ? _raw_spin_unlock_irqrestore+0x110/0x120
[ 54.533180][ T3632] ? print_report+0x1b4/0x1f0
[ 54.537855][ T3632] ? mi_enum_attr+0x583/0x6a0
[ 54.542528][ T3632] end_report+0x91/0xa0
[ 54.546672][ T3632] kasan_report+0xda/0x100
[ 54.551080][ T3632] ? mi_enum_attr+0x583/0x6a0
[ 54.555752][ T3632] mi_enum_attr+0x583/0x6a0
[ 54.560251][ T3632] ni_enum_attr_ex+0x2f6/0x6d0
[ 54.565006][ T3632] ? ni_find_attr+0x8c0/0x8c0
[ 54.569670][ T3632] ? mi_read+0x260/0x510
[ 54.573912][ T3632] ntfs_iget5+0x1d3e/0x36f0
[ 54.578412][ T3632] ? do_raw_spin_unlock+0x134/0x8a0
[ 54.583615][ T3632] ? check_index_root+0x680/0x680
[ 54.588639][ T3632] ntfs_loadlog_and_replay+0x1ac/0x5c0
[ 54.594099][ T3632] ? ntfs_extend_init+0x5a0/0x5a0
[ 54.599123][ T3632] ? evict+0x5d5/0x620
[ 54.603192][ T3632] ntfs_fill_super+0x2333/0x42a0
[ 54.608137][ T3632] ? put_ntfs+0x2a0/0x2a0
[ 54.612467][ T3632] ? vscnprintf+0x80/0x80
[ 54.616794][ T3632] ? set_blocksize+0x1d5/0x360
[ 54.621554][ T3632] get_tree_bdev+0x400/0x620
[ 54.626140][ T3632] ? put_ntfs+0x2a0/0x2a0
[ 54.630473][ T3632] vfs_get_tree+0x88/0x270
[ 54.634880][ T3632] do_new_mount+0x289/0xad0
[ 54.639385][ T3632] ? do_move_mount_old+0x150/0x150
[ 54.644492][ T3632] ? user_path_at_empty+0x149/0x1a0
[ 54.649684][ T3632] __se_sys_mount+0x2d3/0x3c0
[ 54.654363][ T3632] ? __x64_sys_mount+0xc0/0xc0
[ 54.659120][ T3632] ? syscall_enter_from_user_mode+0x2e/0x1d0
[ 54.665102][ T3632] ? __x64_sys_mount+0x1c/0xc0
[ 54.669858][ T3632] do_syscall_64+0x3d/0xb0
[ 54.674269][ T3632] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 54.680162][ T3632] RIP: 0033:0x7f3c7f09066a
[ 54.684574][ T3632] Code: 48 c7 c2 c0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 a8 00 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 54.704184][ T3632] RSP: 002b:00007fff7c2d9f68 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
[ 54.712597][ T3632] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f3c7f09066a
[ 54.720563][ T3632] RDX: 0000000020020bc0 RSI: 0000000020020c00 RDI: 00007fff7c2d9f80
[ 54.728526][ T3632] RBP: 00007fff7c2d9f80 R08: 00007fff7c2d9fc0 R09: 0000000000000000
[ 54.736490][ T3632] R10: 0000000000018882 R11: 0000000000000286 R12: 0000000000000004
[ 54.744455][ T3632] R13: 00005555556412c0 R14: 0000000000018882 R15: 00007fff7c2d9fc0
[ 54.752426][ T3632]
[ 54.755594][ T3632] Kernel Offset: disabled
[ 54.759911][ T3632] Rebooting in 86400 seconds..