DUID 00:04:e3:a1:4c:5b:a4:47:39:93:9a:5d:f6:69:14:97:a9:57
forked to background, child pid 3184
[ 23.682428][ T3185] 8021q: adding VLAN 0 to HW filter on device bond0
[ 23.691224][ T3185] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.1.1' (ECDSA) to the list of known hosts.
executing program
syzkaller login: [ 42.823075][ T3607] loop0: detected capacity change from 0 to 4119
[ 42.831085][ T3607] ntfs3: loop0: Different NTFS' sector size (2048) and media sector size (512)
[ 42.840854][ T3607] ==================================================================
[ 42.848917][ T3607] BUG: KASAN: use-after-free in run_unpack+0x8b7/0x970
[ 42.855762][ T3607] Read of size 1 at addr ffff888017772f02 by task syz-executor142/3607
[ 42.864040][ T3607]
[ 42.866348][ T3607] CPU: 0 PID: 3607 Comm: syz-executor142 Not tainted 6.0.0-rc3-next-20220901-syzkaller #0
[ 42.876312][ T3607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
[ 42.886354][ T3607] Call Trace:
[ 42.889617][ T3607]
[ 42.892534][ T3607] dump_stack_lvl+0xcd/0x134
[ 42.897114][ T3607] print_report.cold+0x2ba/0x719
[ 42.902042][ T3607] ? run_unpack+0x8b7/0x970
[ 42.906535][ T3607] kasan_report+0xb1/0x1e0
[ 42.911033][ T3607] ? run_unpack+0x8b7/0x970
[ 42.915530][ T3607] run_unpack+0x8b7/0x970
[ 42.919853][ T3607] ? run_pack+0x1100/0x1100
[ 42.924344][ T3607] ? ntfs_bread_run+0x310/0x310
[ 42.929205][ T3607] run_unpack_ex+0xb0/0x7c0
[ 42.933819][ T3607] ? mi_enum_attr+0x34f/0x630
[ 42.938487][ T3607] ? ni_enum_attr_ex+0x281/0x400
[ 42.943408][ T3607] ? run_unpack+0x970/0x970
[ 42.947911][ T3607] ? ni_fname_type.part.0+0x1e0/0x1e0
[ 42.953291][ T3607] ? mi_read+0x27f/0x5b0
[ 42.957550][ T3607] ntfs_iget5+0xc20/0x3280
[ 42.961982][ T3607] ? ntfs_write_end+0x7f0/0x7f0
[ 42.966846][ T3607] ntfs_loadlog_and_replay+0x124/0x5d0
[ 42.972327][ T3607] ? ntfs_write_end+0x7f0/0x7f0
[ 42.977185][ T3607] ? ntfs_bio_fill_1+0xa10/0xa10
[ 42.982137][ T3607] ? destroy_inode+0xc4/0x1b0
[ 42.986821][ T3607] ? iput.part.0+0x55d/0x810
[ 42.991417][ T3607] ntfs_fill_super+0x1eff/0x37f0
[ 42.996374][ T3607] ? put_ntfs+0x330/0x330
[ 43.000720][ T3607] ? set_blocksize+0x2e5/0x370
[ 43.005499][ T3607] get_tree_bdev+0x440/0x760
[ 43.010093][ T3607] ? put_ntfs+0x330/0x330
[ 43.014435][ T3607] vfs_get_tree+0x89/0x2f0
[ 43.018857][ T3607] path_mount+0x1326/0x1e20
[ 43.023367][ T3607] ? kmem_cache_free+0xe7/0x5b0
[ 43.028228][ T3607] ? finish_automount+0x960/0x960
[ 43.033256][ T3607] ? putname+0xfe/0x140
[ 43.037419][ T3607] __x64_sys_mount+0x27f/0x300
[ 43.042202][ T3607] ? copy_mnt_ns+0xae0/0xae0
[ 43.046806][ T3607] ? trace_hardirqs_on+0x2d/0x120
[ 43.051839][ T3607] do_syscall_64+0x35/0xb0
[ 43.056267][ T3607] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 43.062173][ T3607] RIP: 0033:0x7fa277d03b7a
[ 43.066590][ T3607] Code: 48 c7 c2 c0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 d8 00 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 43.086201][ T3607] RSP: 002b:00007ffded869598 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
[ 43.094634][ T3607] RAX: ffffffffffffffda RBX: 00007ffded8695f0 RCX: 00007fa277d03b7a
[ 43.102608][ T3607] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffded8695b0
[ 43.110578][ T3607] RBP: 00007ffded8695b0 R08: 00007ffded8695f0 R09: 0000000000000000
[ 43.118548][ T3607] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000020000338
[ 43.126516][ T3607] R13: 0000000000000003 R14: 0000000000000004 R15: 000000000000000d
[ 43.134496][ T3607]
[ 43.137511][ T3607]
[ 43.139831][ T3607] Allocated by task 3496:
[ 43.144152][ T3607] kasan_save_stack+0x1e/0x40
[ 43.148849][ T3607] __kasan_kmalloc+0xa9/0xd0
[ 43.153449][ T3607] __kmalloc+0x54/0xc0
[ 43.157518][ T3607] tomoyo_realpath_from_path+0xbf/0x600
[ 43.163073][ T3607] tomoyo_path_perm+0x21b/0x400
[ 43.167929][ T3607] security_inode_getattr+0xcf/0x140
[ 43.173218][ T3607] vfs_statx+0x16a/0x390
[ 43.177464][ T3607] vfs_fstatat+0x8c/0xb0
[ 43.181711][ T3607] __do_sys_newfstatat+0x91/0x110
[ 43.186743][ T3607] do_syscall_64+0x35/0xb0
[ 43.191164][ T3607] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 43.197092][ T3607]
[ 43.199413][ T3607] Freed by task 3496:
[ 43.203386][ T3607] kasan_save_stack+0x1e/0x40
[ 43.208073][ T3607] kasan_set_track+0x21/0x30
[ 43.212674][ T3607] kasan_set_free_info+0x20/0x30
[ 43.217618][ T3607] ____kasan_slab_free+0x166/0x1c0
[ 43.222740][ T3607] slab_free_freelist_hook+0x8b/0x1c0
[ 43.228117][ T3607] __kmem_cache_free+0xab/0x3b0
[ 43.232999][ T3607] tomoyo_realpath_from_path+0x18c/0x600
[ 43.238644][ T3607] tomoyo_path_perm+0x21b/0x400
[ 43.243501][ T3607] security_inode_getattr+0xcf/0x140
[ 43.248795][ T3607] vfs_statx+0x16a/0x390
[ 43.253046][ T3607] vfs_fstatat+0x8c/0xb0
[ 43.257296][ T3607] __do_sys_newfstatat+0x91/0x110
[ 43.262325][ T3607] do_syscall_64+0x35/0xb0
[ 43.266746][ T3607] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 43.272647][ T3607]
[ 43.274965][ T3607] The buggy address belongs to the object at ffff888017772000
[ 43.274965][ T3607] which belongs to the cache kmalloc-4k of size 4096
[ 43.289013][ T3607] The buggy address is located 3842 bytes inside of
[ 43.289013][ T3607] 4096-byte region [ffff888017772000, ffff888017773000)
[ 43.302481][ T3607]
[ 43.304798][ T3607] The buggy address belongs to the physical page:
[ 43.311201][ T3607] page:ffffea00005ddc00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x17770
[ 43.321349][ T3607] head:ffffea00005ddc00 order:3 compound_mapcount:0 compound_pincount:0
[ 43.329673][ T3607] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 43.337658][ T3607] raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888011842140
[ 43.346244][ T3607] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000
[ 43.354842][ T3607] page dumped because: kasan: bad access detected
[ 43.361247][ T3607] page_owner tracks the page as allocated
[ 43.366953][ T3607] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 2681847427, free_ts 0
[ 43.386585][ T3607] get_page_from_freelist+0x109b/0x2ce0
[ 43.392138][ T3607] __alloc_pages+0x1c7/0x510
[ 43.396728][ T3607] alloc_page_interleave+0x1e/0x200
[ 43.401936][ T3607] alloc_pages+0x22f/0x270
[ 43.406364][ T3607] allocate_slab+0x228/0x370
[ 43.410962][ T3607] ___slab_alloc+0xad0/0x1440
[ 43.415647][ T3607] __slab_alloc.constprop.0+0x4d/0xa0
[ 43.421036][ T3607] __kmem_cache_alloc_node+0x18a/0x3d0
[ 43.426502][ T3607] kmalloc_trace+0x22/0x60
[ 43.430938][ T3607] kobject_uevent_env+0x230/0x1640
[ 43.436057][ T3607] acpi_add_single_object+0x9be/0x1b00
[ 43.441531][ T3607] acpi_bus_check_add+0x1a4/0x5c0
[ 43.446572][ T3607] acpi_ns_walk_namespace+0x24c/0x42e
[ 43.451954][ T3607] acpi_walk_namespace+0xee/0x127
[ 43.456989][ T3607] acpi_bus_scan+0x171/0x1c0
[ 43.461591][ T3607] acpi_scan_init+0x2f3/0x692
[ 43.466276][ T3607] page_owner free stack trace missing
[ 43.471645][ T3607]
[ 43.473961][ T3607] Memory state around the buggy address:
[ 43.479586][ T3607] ffff888017772e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 43.487669][ T3607] ffff888017772e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 43.495747][ T3607] >ffff888017772f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 43.503805][ T3607] ^
[ 43.507874][ T3607] ffff888017772f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 43.515931][ T3607] ffff888017773000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 43.523984][ T3607] ==================================================================
[ 43.532288][ T3607] Kernel panic - not syncing: panic_on_warn set ...
[ 43.538889][ T3607] CPU: 0 PID: 3607 Comm: syz-executor142 Not tainted 6.0.0-rc3-next-20220901-syzkaller #0
[ 43.548792][ T3607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
[ 43.558849][ T3607] Call Trace:
[ 43.562127][ T3607]
[ 43.565056][ T3607] dump_stack_lvl+0xcd/0x134
[ 43.569654][ T3607] panic+0x2c8/0x622
[ 43.573564][ T3607] ? panic_print_sys_info.part.0+0x110/0x110
[ 43.579563][ T3607] ? preempt_schedule_common+0x59/0xc0
[ 43.585033][ T3607] ? preempt_schedule_thunk+0x16/0x18
[ 43.590425][ T3607] ? run_unpack+0x8b7/0x970
[ 43.594941][ T3607] end_report.part.0+0x3f/0x7c
[ 43.599711][ T3607] kasan_report.cold+0xa/0xf
[ 43.604306][ T3607] ? run_unpack+0x8b7/0x970
[ 43.608823][ T3607] run_unpack+0x8b7/0x970
[ 43.613169][ T3607] ? run_pack+0x1100/0x1100
[ 43.617685][ T3607] ? ntfs_bread_run+0x310/0x310
[ 43.622569][ T3607] run_unpack_ex+0xb0/0x7c0
[ 43.627085][ T3607] ? mi_enum_attr+0x34f/0x630
[ 43.631775][ T3607] ? ni_enum_attr_ex+0x281/0x400
[ 43.636731][ T3607] ? run_unpack+0x970/0x970
[ 43.641244][ T3607] ? ni_fname_type.part.0+0x1e0/0x1e0
[ 43.646626][ T3607] ? mi_read+0x27f/0x5b0
[ 43.650887][ T3607] ntfs_iget5+0xc20/0x3280
[ 43.655319][ T3607] ? ntfs_write_end+0x7f0/0x7f0
[ 43.660183][ T3607] ntfs_loadlog_and_replay+0x124/0x5d0
[ 43.665660][ T3607] ? ntfs_write_end+0x7f0/0x7f0
[ 43.670518][ T3607] ? ntfs_bio_fill_1+0xa10/0xa10
[ 43.675471][ T3607] ? destroy_inode+0xc4/0x1b0
[ 43.680154][ T3607] ? iput.part.0+0x55d/0x810
[ 43.684752][ T3607] ntfs_fill_super+0x1eff/0x37f0
[ 43.689714][ T3607] ? put_ntfs+0x330/0x330
[ 43.694056][ T3607] ? set_blocksize+0x2e5/0x370
[ 43.698837][ T3607] get_tree_bdev+0x440/0x760
[ 43.703429][ T3607] ? put_ntfs+0x330/0x330
[ 43.707772][ T3607] vfs_get_tree+0x89/0x2f0
[ 43.712191][ T3607] path_mount+0x1326/0x1e20
[ 43.716698][ T3607] ? kmem_cache_free+0xe7/0x5b0
[ 43.721561][ T3607] ? finish_automount+0x960/0x960
[ 43.726592][ T3607] ? putname+0xfe/0x140
[ 43.730750][ T3607] __x64_sys_mount+0x27f/0x300
[ 43.735516][ T3607] ? copy_mnt_ns+0xae0/0xae0
[ 43.740149][ T3607] ? trace_hardirqs_on+0x2d/0x120
[ 43.745204][ T3607] do_syscall_64+0x35/0xb0
[ 43.749650][ T3607] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 43.755642][ T3607] RIP: 0033:0x7fa277d03b7a
[ 43.760058][ T3607] Code: 48 c7 c2 c0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 d8 00 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 43.779705][ T3607] RSP: 002b:00007ffded869598 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
[ 43.788129][ T3607] RAX: ffffffffffffffda RBX: 00007ffded8695f0 RCX: 00007fa277d03b7a
[ 43.796110][ T3607] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffded8695b0
[ 43.804099][ T3607] RBP: 00007ffded8695b0 R08: 00007ffded8695f0 R09: 0000000000000000
[ 43.812165][ T3607] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000020000338
[ 43.820171][ T3607] R13: 0000000000000003 R14: 0000000000000004 R15: 000000000000000d
[ 43.828154][ T3607]
[ 43.831339][ T3607] Kernel Offset: disabled
[ 43.835660][ T3607] Rebooting in 86400 seconds..