Warning: Permanently added '10.128.0.196' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 35.104598][ T5968] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=5968 'syz-executor177' [ 35.132316][ T5968] loop0: detected capacity change from 0 to 4096 [ 35.137031][ T5968] ntfs: (device loop0): ntfs_is_extended_system_file(): Corrupt file name attribute. You should run chkdsk. [ 35.139527][ T5968] ntfs: (device loop0): ntfs_read_locked_inode(): $DATA attribute is missing. [ 35.141409][ T5968] ntfs: (device loop0): ntfs_read_locked_inode(): Failed with error code -2. Marking corrupt inode 0x1 as bad. Run chkdsk. [ 35.144351][ T5968] ntfs: (device loop0): load_system_files(): Failed to load $MFTMirr. Mounting read-only. Run ntfsfix and/or chkdsk. [ 35.152031][ T5968] ntfs: volume version 3.1. [ 35.154367][ T5968] ntfs: (device loop0): ntfs_lookup_inode_by_name(): Corrupt directory. Aborting lookup. [ 35.156535][ T5968] ntfs: (device loop0): check_windows_hibernation_status(): Failed to find inode number for hiberfil.sys. [ 35.158829][ T5968] ntfs: (device loop0): load_system_files(): Failed to determine if Windows is hibernated. Will not be able to remount read-write. Run chkdsk. [ 35.163701][ T5968] ================================================================== [ 35.165416][ T5968] BUG: KASAN: slab-out-of-bounds in ntfs_readdir+0xb00/0x2be8 [ 35.166984][ T5968] Read of size 1 at addr ffff0000cd70d571 by task syz-executor177/5968 [ 35.168825][ T5968] [ 35.169345][ T5968] CPU: 1 PID: 5968 Comm: syz-executor177 Not tainted 6.4.0-rc4-syzkaller-g7579d8f9bf90 #0 [ 35.171550][ T5968] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 [ 35.173807][ T5968] Call trace: [ 35.174537][ T5968] dump_backtrace+0x1b8/0x1e4 [ 35.175534][ T5968] show_stack+0x2c/0x44 [ 35.176391][ T5968] dump_stack_lvl+0xd0/0x124 [ 35.177465][ T5968] print_report+0x174/0x514 [ 35.178535][ T5968] kasan_report+0xd4/0x130 [ 35.179477][ T5968] __asan_report_load1_noabort+0x20/0x2c [ 35.180704][ T5968] ntfs_readdir+0xb00/0x2be8 [ 35.181672][ T5968] iterate_dir+0x1f4/0x4e4 [ 35.182620][ T5968] __arm64_sys_getdents64+0x1c4/0x4a0 [ 35.183924][ T5968] invoke_syscall+0x98/0x2c0 [ 35.185001][ T5968] el0_svc_common+0x138/0x258 [ 35.186146][ T5968] do_el0_svc+0x64/0x198 [ 35.187081][ T5968] el0_svc+0x4c/0x160 [ 35.187955][ T5968] el0t_64_sync_handler+0x84/0xfc [ 35.189068][ T5968] el0t_64_sync+0x190/0x194 [ 35.190025][ T5968] [ 35.190529][ T5968] Allocated by task 5968: [ 35.191388][ T5968] kasan_set_track+0x4c/0x7c [ 35.192448][ T5968] kasan_save_alloc_info+0x24/0x30 [ 35.193645][ T5968] __kasan_kmalloc+0xac/0xc4 [ 35.194675][ T5968] __kmalloc+0xcc/0x1b8 [ 35.195582][ T5968] ntfs_readdir+0x65c/0x2be8 [ 35.196597][ T5968] iterate_dir+0x1f4/0x4e4 [ 35.197500][ T5968] __arm64_sys_getdents64+0x1c4/0x4a0 [ 35.198616][ T5968] invoke_syscall+0x98/0x2c0 [ 35.199668][ T5968] el0_svc_common+0x138/0x258 [ 35.200673][ T5968] do_el0_svc+0x64/0x198 [ 35.201601][ T5968] el0_svc+0x4c/0x160 [ 35.202583][ T5968] el0t_64_sync_handler+0x84/0xfc [ 35.203644][ T5968] el0t_64_sync+0x190/0x194 [ 35.204676][ T5968] [ 35.205203][ T5968] The buggy address belongs to the object at ffff0000cd70d500 [ 35.205203][ T5968] which belongs to the cache kmalloc-128 of size 128 [ 35.208423][ T5968] The buggy address is located 57 bytes to the right of [ 35.208423][ T5968] allocated 56-byte region [ffff0000cd70d500, ffff0000cd70d538) [ 35.211515][ T5968] [ 35.212009][ T5968] The buggy address belongs to the physical page: [ 35.213352][ T5968] page:00000000dc38a5df refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10d70d [ 35.215591][ T5968] flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff) [ 35.217263][ T5968] page_type: 0xffffffff() [ 35.218275][ T5968] raw: 05ffc00000000200 ffff0000c0002300 dead000000000100 dead000000000122 [ 35.220108][ T5968] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 35.222126][ T5968] page dumped because: kasan: bad access detected [ 35.223555][ T5968] [ 35.224115][ T5968] Memory state around the buggy address: [ 35.225398][ T5968] ffff0000cd70d400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 35.227296][ T5968] ffff0000cd70d480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.229118][ T5968] >ffff0000cd70d500: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc [ 35.230817][ T5968] ^ [ 35.232447][ T5968] ffff0000cd70d580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.234245][ T5968] ffff0000cd70d600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 35.236065][ T5968] ================================================================== [ 35.237897][ T5968] Disabling lock debugging due to kernel taint