./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1405793958 <...> DUID 00:04:76:8b:f6:84:a4:3b:36:39:6c:68:e7:10:38:dd:b7:2c forked to background, child pid 3186 [ 24.834918][ T3187] 8021q: adding VLAN 0 to HW filter on device bond0 [ 24.846424][ T3187] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.158' (ECDSA) to the list of known hosts. execve("./syz-executor1405793958", ["./syz-executor1405793958"], 0x7ffc26143ff0 /* 10 vars */) = 0 brk(NULL) = 0x55555642c000 brk(0x55555642cc40) = 0x55555642cc40 arch_prctl(ARCH_SET_FS, 0x55555642c300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor1405793958", 4096) = 28 brk(0x55555644dc40) = 0x55555644dc40 brk(0x55555644e000) = 0x55555644e000 mprotect(0x7f3f9c2de000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 sendto(4, [{nlmsg_len=36, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0d\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x35\x34\x00\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=680, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=3607}, "\x01\x02\x00\x00\x0d\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x35\x34\x00\x00\x00\x00\x06\x00\x01\x00\x1c\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x25\x00\x00\x00\x48\x02\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x05\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x03\x00"...], 4096, 0, NULL, NULL) = 680 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=3607}, {error=0, msg={nlmsg_len=36, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 access("/proc/net", R_OK) = 0 access("/proc/net/unix", R_OK) = 0 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan0", ifr_ifindex=11}) = 0 close(5) = 0 sendto(4, [{nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x0b\x00\x00\x00\x08\x00\x03\x00\x0b\x00\x00\x00\x06\x00\x0a\x00\xa0\xaa\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=3607}, {error=0, msg={nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan0", ifr_ifindex=11}) = 0 close(5) = 0 sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0c\x00\x01\x00\x02\x00\xaa\xaa\xaa\xaa\xaa\xaa"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=3607}, {error=0, msg={nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 sendto(3, [{nlmsg_len=68, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=0, ifi_flags=0, ifi_change=0}, [[{nla_len=11, nla_type=IFLA_IFNAME}, "lowpan0"...], [{nla_len=16, nla_type=IFLA_LINKINFO}, [{nla_len=10, nla_type=IFLA_INFO_KIND}, "lowpan"...]], [{nla_len=8, nla_type=IFLA_LINK}, 11]]], 68, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 68 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=3607}, {error=0, msg={nlmsg_len=68, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan1", ifr_ifindex=12}) = 0 close(5) = 0 sendto(4, [{nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x0b\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x06\x00\x0a\x00\xa1\xaa\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=3607}, {error=0, msg={nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan1", ifr_ifindex=12}) = 0 close(5) = 0 sendto(3, [{nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=if_nametoindex("wpan1"), ifi_flags=IFF_UP, ifi_change=0x1}, [{nla_len=12, nla_type=IFLA_ADDRESS}, 02:01:aa:aa:aa:aa:aa]], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=3607}, {error=0, msg={nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 close(3) = 0 close(4) = 0 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555642c5d0) = 3609 ./strace-static-x86_64: Process 3609 attached [pid 3609] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 3609] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3609] setsid() = 1 [pid 3609] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 3609] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 3609] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 3609] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 3609] prlimit64(0, RLIMIT_CORE, {rlim_cur=0, rlim_max=0}, NULL) = 0 [pid 3609] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 3609] unshare(CLONE_NEWNS) = 0 [pid 3609] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 3609] unshare(CLONE_NEWIPC) = 0 [pid 3609] unshare(CLONE_NEWCGROUP) = 0 [pid 3609] unshare(CLONE_NEWUTS) = 0 [pid 3609] unshare(CLONE_SYSVSEM) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "16777216", 8) = 8 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "536870912", 9) = 9 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "1024", 4) = 4 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "8192", 4) = 4 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "1024", 4) = 4 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "1024", 4) = 4 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "1024 1048576 500 1024", 21) = 21 [pid 3609] close(3) = 0 [pid 3609] getpid() = 1 [pid 3609] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< volume size 0.00 Gb. Mount in read-only [ 49.242311][ T3609] ================================================================== [ 49.250376][ T3609] BUG: KASAN: slab-out-of-bounds in run_unpack+0x84f/0xd00 [ 49.257567][ T3609] Read of size 1 at addr ffff88807cbc2ef3 by task syz-executor140/3609 [ 49.265798][ T3609] [ 49.268102][ T3609] CPU: 0 PID: 3609 Comm: syz-executor140 Not tainted 6.0.0-rc7-syzkaller-00081-gc3e0e1e23c70 #0 [ 49.278492][ T3609] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 [ 49.288524][ T3609] Call Trace: [ 49.291785][ T3609] [ 49.294701][ T3609] dump_stack_lvl+0x1b1/0x28e [ 49.299374][ T3609] ? fortify_panic+0x13/0x13 [ 49.303949][ T3609] ? __wake_up_klogd+0xcd/0x100 [ 49.308784][ T3609] ? panic+0x715/0x715 [ 49.312849][ T3609] ? _printk+0xc0/0x100 [ 49.316988][ T3609] print_address_description+0x65/0x4b0 [ 49.322522][ T3609] print_report+0x108/0x1f0 [ 49.327006][ T3609] ? _raw_spin_lock+0x40/0x40 [ 49.331671][ T3609] ? run_lookup_entry+0x3f4/0x560 [ 49.336682][ T3609] ? ntfs_read_run_nb+0x51c/0xde0 [ 49.341692][ T3609] ? run_unpack+0x84f/0xd00 [ 49.346178][ T3609] kasan_report+0xc3/0xf0 [ 49.350493][ T3609] ? run_unpack+0x84f/0xd00 [ 49.354981][ T3609] run_unpack+0x84f/0xd00 [ 49.359306][ T3609] run_unpack_ex+0xcc/0x870 [ 49.363793][ T3609] ? kvmalloc_node+0x6e/0x160 [ 49.368457][ T3609] ? ni_enum_attr_ex+0x2f6/0x6d0 [ 49.373377][ T3609] ? run_unpack+0xd00/0xd00 [ 49.377863][ T3609] ? ni_find_attr+0x8c0/0x8c0 [ 49.382533][ T3609] ? mi_read+0x260/0x510 [ 49.386760][ T3609] ntfs_iget5+0x1cf2/0x36a0 [ 49.391258][ T3609] ? check_index_root+0x680/0x680 [ 49.396268][ T3609] ntfs_loadlog_and_replay+0x1ac/0x5c0 [ 49.401713][ T3609] ? ntfs_extend_init+0x5a0/0x5a0 [ 49.406725][ T3609] ? evict+0x5d5/0x620 [ 49.410781][ T3609] ntfs_fill_super+0x2333/0x42a0 [ 49.415714][ T3609] ? put_ntfs+0x2a0/0x2a0 [ 49.420029][ T3609] ? vscnprintf+0x80/0x80 [ 49.424366][ T3609] ? set_blocksize+0x1d5/0x360 [ 49.429138][ T3609] get_tree_bdev+0x400/0x620 [ 49.433730][ T3609] ? put_ntfs+0x2a0/0x2a0 [ 49.438058][ T3609] vfs_get_tree+0x88/0x270 [ 49.442466][ T3609] do_new_mount+0x289/0xad0 [ 49.446959][ T3609] ? do_move_mount_old+0x150/0x150 [ 49.452061][ T3609] ? user_path_at_empty+0x149/0x1a0 [ 49.457248][ T3609] __se_sys_mount+0x2d3/0x3c0 [ 49.461910][ T3609] ? __x64_sys_mount+0xc0/0xc0 [ 49.466657][ T3609] ? syscall_enter_from_user_mode+0x2e/0x1d0 [ 49.472623][ T3609] ? __x64_sys_mount+0x1c/0xc0 [ 49.477375][ T3609] do_syscall_64+0x3d/0xb0 [ 49.481777][ T3609] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 49.487680][ T3609] RIP: 0033:0x7f3f9c24f13a [ 49.492089][ T3609] Code: 48 c7 c2 c0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 08 01 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 49.511686][ T3609] RSP: 002b:00007ffd7a45dfe8 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 49.520103][ T3609] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f3f9c24f13a [ 49.528067][ T3609] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffd7a45e000 [ 49.536043][ T3609] RBP: 00007ffd7a45e000 R08: 00007ffd7a45e040 R09: 000055555642c2c0 [ 49.544013][ T3609] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000004 [ 49.551990][ T3609] R13: 00007ffd7a45e040 R14: 000000000000000d R15: 0000000020000338 [ 49.559962][ T3609] [ 49.562969][ T3609] [ 49.565278][ T3609] Allocated by task 3187: [ 49.569600][ T3609] ____kasan_kmalloc+0xcd/0x100 [ 49.574466][ T3609] __kmalloc_node_track_caller+0x265/0x400 [ 49.580268][ T3609] __alloc_skb+0x112/0x2b0 [ 49.584679][ T3609] netlink_dump+0x1f5/0xc40 [ 49.589167][ T3609] netlink_recvmsg+0x637/0x10a0 [ 49.593998][ T3609] ____sys_recvmsg+0x27e/0x550 [ 49.598747][ T3609] __sys_recvmsg+0x233/0x330 [ 49.603333][ T3609] do_syscall_64+0x3d/0xb0 [ 49.607745][ T3609] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 49.613631][ T3609] [ 49.615947][ T3609] Freed by task 3187: [ 49.619917][ T3609] kasan_set_track+0x3d/0x60 [ 49.624500][ T3609] kasan_set_free_info+0x1f/0x40 [ 49.629420][ T3609] ____kasan_slab_free+0xd8/0x120 [ 49.634427][ T3609] slab_free_freelist_hook+0x12e/0x1a0 [ 49.639866][ T3609] kfree+0xda/0x210 [ 49.643659][ T3609] skb_release_data+0x586/0x790 [ 49.648493][ T3609] __kfree_skb+0x56/0x1d0 [ 49.652805][ T3609] netlink_recvmsg+0x587/0x10a0 [ 49.657637][ T3609] ____sys_recvmsg+0x27e/0x550 [ 49.662383][ T3609] __sys_recvmsg+0x233/0x330 [ 49.666956][ T3609] do_syscall_64+0x3d/0xb0 [ 49.671353][ T3609] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 49.677240][ T3609] [ 49.679547][ T3609] The buggy address belongs to the object at ffff88807cbc0000 [ 49.679547][ T3609] which belongs to the cache kmalloc-8k of size 8192 [ 49.693595][ T3609] The buggy address is located 3827 bytes to the right of [ 49.693595][ T3609] 8192-byte region [ffff88807cbc0000, ffff88807cbc2000) [ 49.707566][ T3609] [ 49.709878][ T3609] The buggy address belongs to the physical page: [ 49.716270][ T3609] page:ffffea0001f2f000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7cbc0 [ 49.726401][ T3609] head:ffffea0001f2f000 order:3 compound_mapcount:0 compound_pincount:0 [ 49.734705][ T3609] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 49.742671][ T3609] raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888012042280 [ 49.751236][ T3609] raw: 0000000000000000 0000000000020002 00000001ffffffff 0000000000000000 [ 49.759809][ T3609] page dumped because: kasan: bad access detected [ 49.766197][ T3609] page_owner tracks the page as allocated [ 49.771898][ T3609] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3187, tgid 3187 (dhcpcd), ts 25907696129, free_ts 25819332375 [ 49.793668][ T3609] get_page_from_freelist+0x742/0x7c0 [ 49.799026][ T3609] __alloc_pages+0x259/0x560 [ 49.803598][ T3609] alloc_slab_page+0x70/0xf0 [ 49.808179][ T3609] allocate_slab+0x5e/0x520 [ 49.812665][ T3609] ___slab_alloc+0x3ee/0xc40 [ 49.817237][ T3609] __kmalloc_node_track_caller+0x2c3/0x400 [ 49.823025][ T3609] __alloc_skb+0x112/0x2b0 [ 49.827424][ T3609] netlink_dump+0x1f5/0xc40 [ 49.831908][ T3609] netlink_recvmsg+0x637/0x10a0 [ 49.836745][ T3609] ____sys_recvmsg+0x27e/0x550 [ 49.841492][ T3609] __sys_recvmsg+0x233/0x330 [ 49.846066][ T3609] do_syscall_64+0x3d/0xb0 [ 49.850471][ T3609] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 49.856355][ T3609] page last free stack trace: [ 49.861004][ T3609] free_pcp_prepare+0x812/0x900 [ 49.865839][ T3609] free_unref_page+0x7d/0x5f0 [ 49.870497][ T3609] __unfreeze_partials+0x1ab/0x200 [ 49.875594][ T3609] put_cpu_partial+0x106/0x170 [ 49.880341][ T3609] qlist_free_all+0x2b/0x70 [ 49.884828][ T3609] kasan_quarantine_reduce+0x169/0x180 [ 49.890270][ T3609] __kasan_slab_alloc+0x2f/0xd0 [ 49.895104][ T3609] kmem_cache_alloc+0x1a6/0x310 [ 49.899936][ T3609] getname_flags+0xb8/0x4e0 [ 49.904423][ T3609] __se_sys_newfstatat+0xbd/0x7c0 [ 49.909429][ T3609] do_syscall_64+0x3d/0xb0 [ 49.913840][ T3609] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 49.919721][ T3609] [ 49.922029][ T3609] Memory state around the buggy address: [ 49.927637][ T3609] ffff88807cbc2d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 49.935682][ T3609] ffff88807cbc2e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 49.943723][ T3609] >ffff88807cbc2e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 49.951762][ T3609] ^ [ 49.959456][ T3609] ffff88807cbc2f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 49.967494][ T3609] ffff88807cbc2f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 49.975534][ T3609] ================================================================== [ 49.983786][ T3609] Kernel panic - not syncing: panic_on_warn set ... [ 49.990389][ T3609] CPU: 1 PID: 3609 Comm: syz-executor140 Not tainted 6.0.0-rc7-syzkaller-00081-gc3e0e1e23c70 #0 [ 50.000799][ T3609] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 [ 50.010842][ T3609] Call Trace: [ 50.014110][ T3609] [ 50.017026][ T3609] dump_stack_lvl+0x1b1/0x28e [ 50.021689][ T3609] ? fortify_panic+0x13/0x13 [ 50.026263][ T3609] ? panic+0x715/0x715 [ 50.030319][ T3609] ? preempt_schedule_common+0xb7/0xe0 [ 50.035763][ T3609] ? vscnprintf+0x59/0x80 [ 50.040081][ T3609] panic+0x2d6/0x715 [ 50.043963][ T3609] ? fb_is_primary_device+0xcc/0xcc [ 50.049146][ T3609] ? _raw_spin_unlock_irqrestore+0x110/0x120 [ 50.055110][ T3609] ? print_report+0x1b4/0x1f0 [ 50.059773][ T3609] ? run_unpack+0x84f/0xd00 [ 50.064265][ T3609] end_report+0x91/0xa0 [ 50.068405][ T3609] kasan_report+0xd0/0xf0 [ 50.072719][ T3609] ? run_unpack+0x84f/0xd00 [ 50.077209][ T3609] run_unpack+0x84f/0xd00 [ 50.081526][ T3609] run_unpack_ex+0xcc/0x870 [ 50.086015][ T3609] ? kvmalloc_node+0x6e/0x160 [ 50.090678][ T3609] ? ni_enum_attr_ex+0x2f6/0x6d0 [ 50.095598][ T3609] ? run_unpack+0xd00/0xd00 [ 50.100087][ T3609] ? ni_find_attr+0x8c0/0x8c0 [ 50.104746][ T3609] ? mi_read+0x260/0x510 [ 50.108973][ T3609] ntfs_iget5+0x1cf2/0x36a0 [ 50.113472][ T3609] ? check_index_root+0x680/0x680 [ 50.118483][ T3609] ntfs_loadlog_and_replay+0x1ac/0x5c0 [ 50.123940][ T3609] ? ntfs_extend_init+0x5a0/0x5a0 [ 50.128951][ T3609] ? evict+0x5d5/0x620 [ 50.133007][ T3609] ntfs_fill_super+0x2333/0x42a0 [ 50.138378][ T3609] ? put_ntfs+0x2a0/0x2a0 [ 50.142697][ T3609] ? vscnprintf+0x80/0x80 [ 50.147011][ T3609] ? set_blocksize+0x1d5/0x360 [ 50.151761][ T3609] get_tree_bdev+0x400/0x620 [ 50.156335][ T3609] ? put_ntfs+0x2a0/0x2a0 [ 50.160656][ T3609] vfs_get_tree+0x88/0x270 [ 50.165059][ T3609] do_new_mount+0x289/0xad0 [ 50.169548][ T3609] ? do_move_mount_old+0x150/0x150 [ 50.174645][ T3609] ? user_path_at_empty+0x149/0x1a0 [ 50.179826][ T3609] __se_sys_mount+0x2d3/0x3c0 [ 50.184487][ T3609] ? __x64_sys_mount+0xc0/0xc0 [ 50.189237][ T3609] ? syscall_enter_from_user_mode+0x2e/0x1d0 [ 50.195202][ T3609] ? __x64_sys_mount+0x1c/0xc0 [ 50.199953][ T3609] do_syscall_64+0x3d/0xb0 [ 50.204354][ T3609] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 50.210232][ T3609] RIP: 0033:0x7f3f9c24f13a [ 50.214632][ T3609] Code: 48 c7 c2 c0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 08 01 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 50.234221][ T3609] RSP: 002b:00007ffd7a45dfe8 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 50.242620][ T3609] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f3f9c24f13a [ 50.250578][ T3609] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffd7a45e000 [ 50.258531][ T3609] RBP: 00007ffd7a45e000 R08: 00007ffd7a45e040 R09: 000055555642c2c0 [ 50.266486][ T3609] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000004 [ 50.274439][ T3609] R13: 00007ffd7a45e040 R14: 000000000000000d R15: 0000000020000338 [ 50.282399][ T3609] [ 50.285560][ T3609] Kernel Offset: disabled [ 50.289876][ T3609] Rebooting in 86400 seconds..