[  OK  ] Reached target Multi-User System.
[  OK  ] Reached target Graphical Interface.
         Starting Update UTMP about System Runlevel Changes...
[  OK  ] Started Update UTMP about System Runlevel Changes.
[  OK  ] Listening on Load/Save RF Kill Switch Status /dev/rfkill Watch.


Debian GNU/Linux 9 syzkaller ttyS0

Warning: Permanently added '10.128.0.245' (ECDSA) to the list of known hosts.
executing program
syzkaller login: [   32.108397] audit: type=1400 audit(1601537642.898:8): avc:  denied  { execmem } for  pid=6352 comm="syz-executor242" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
[   32.113593] ntfs: (device loop0): is_boot_sector_ntfs(): Invalid end of sector marker.
[   32.139459] ==================================================================
[   32.146842] BUG: KASAN: use-after-free in ntfs_attr_find+0x8df/0xa10
[   32.153306] Read of size 4 at addr ffff8880974f3d00 by task syz-executor242/6352
[   32.160843] 
[   32.162452] CPU: 1 PID: 6352 Comm: syz-executor242 Not tainted 4.14.198-syzkaller #0
[   32.170300] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   32.179624] Call Trace:
[   32.182198]  dump_stack+0x1b2/0x283
[   32.185836]  print_address_description.cold+0x54/0x1d3
[   32.191085]  kasan_report_error.cold+0x8a/0x194
[   32.195758]  ? ntfs_attr_find+0x8df/0xa10
[   32.199877]  __asan_report_load_n_noabort+0x6b/0x80
[   32.204865]  ? ntfs_attr_find+0x8df/0xa10
[   32.208984]  ntfs_attr_find+0x8df/0xa10
[   32.212943]  ntfs_attr_lookup+0xeca/0x1f30
[   32.217153]  ? do_raw_spin_unlock+0x164/0x220
[   32.221618]  ? _raw_spin_unlock+0x29/0x40
[   32.225736]  ? cache_alloc_refill+0x2fa/0x350
[   32.230215]  ? check_preemption_disabled+0x35/0x240
[   32.235200]  ? ntfs_attr_reinit_search_ctx+0x3c0/0x3c0
[   32.240444]  ? kmem_cache_alloc+0x2f8/0x3c0
[   32.244736]  ntfs_read_inode_mount+0x6b4/0x1fb0
[   32.249409]  ntfs_fill_super+0x9a6/0x7170
[   32.253527]  ? vsnprintf+0x260/0x1340
[   32.257298]  ? pointer+0x9e0/0x9e0
[   32.260810]  ? lock_downgrade+0x740/0x740
[   32.264925]  ? ntfs_big_inode_init_once+0x20/0x20
[   32.269738]  ? snprintf+0xa5/0xd0
[   32.273160]  ? vsprintf+0x30/0x30
[   32.276583]  ? ns_test_super+0x50/0x50
[   32.280443]  ? set_blocksize+0x125/0x380
[   32.284474]  mount_bdev+0x2b3/0x360
[   32.288071]  ? ntfs_big_inode_init_once+0x20/0x20
[   32.292883]  mount_fs+0x92/0x2a0
[   32.296224]  vfs_kern_mount.part.0+0x5b/0x470
[   32.300700]  do_mount+0xe53/0x2a00
[   32.304211]  ? copy_mount_string+0x40/0x40
[   32.308415]  ? rcu_read_lock_sched_held+0x16c/0x1d0
[   32.313412]  ? copy_mnt_ns+0xa30/0xa30
[   32.317269]  ? copy_mount_options+0x1fa/0x2f0
[   32.321745]  ? copy_mnt_ns+0xa30/0xa30
[   32.325600]  SyS_mount+0xa8/0x120
[   32.329023]  ? copy_mnt_ns+0xa30/0xa30
[   32.332892]  do_syscall_64+0x1d5/0x640
[   32.336762]  entry_SYSCALL_64_after_hwframe+0x46/0xbb
[   32.341920] RIP: 0033:0x44753a
[   32.345089] RSP: 002b:00007ffc0a8bb868 EFLAGS: 00000287 ORIG_RAX: 00000000000000a5
[   32.352767] RAX: ffffffffffffffda RBX: 00007ffc0a8bb8c0 RCX: 000000000044753a
[   32.360006] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffc0a8bb880
[   32.367258] RBP: 00007ffc0a8bb880 R08: 00007ffc0a8bb8c0 R09: 00007ffc00000015
[   32.374498] R10: 0000000000000000 R11: 0000000000000287 R12: 000000000000003a
[   32.381737] R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000003
[   32.388980] 
[   32.390577] The buggy address belongs to the page:
[   32.395475] page:ffffea00025d3cc0 count:0 mapcount:0 mapping:          (null) index:0x0
[   32.403585] flags: 0xfffe0000000000()
[   32.407360] raw: 00fffe0000000000 0000000000000000 0000000000000000 00000000ffffffff
[   32.415223] raw: 0000000000000000 0000000100000001 0000000000000000 0000000000000000
[   32.423075] page dumped because: kasan: bad access detected
[   32.428762] 
[   32.430359] Memory state around the buggy address:
[   32.435266]  ffff8880974f3c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   32.442595]  ffff8880974f3c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   32.449923] >ffff8880974f3d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   32.457263]                    ^
[   32.460600]  ffff8880974f3d80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   32.467939]  ffff8880974f3e00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   32.475277] ==================================================================
[   32.482603] Disabling lock debugging due to kernel taint
[   32.488388] Kernel panic - not syncing: panic_on_warn set ...
[   32.488388] 
[   32.495746] CPU: 1 PID: 6352 Comm: syz-executor242 Tainted: G    B           4.14.198-syzkaller #0
[   32.504831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   32.514182] Call Trace:
[   32.516745]  dump_stack+0x1b2/0x283
[   32.520346]  panic+0x1f9/0x42d
[   32.523528]  ? add_taint.cold+0x16/0x16
[   32.527484]  ? ___preempt_schedule+0x16/0x18
[   32.531880]  kasan_end_report+0x43/0x49
[   32.535828]  kasan_report_error.cold+0xa7/0x194
[   32.540469]  ? ntfs_attr_find+0x8df/0xa10
[   32.544586]  __asan_report_load_n_noabort+0x6b/0x80
[   32.549572]  ? ntfs_attr_find+0x8df/0xa10
[   32.553708]  ntfs_attr_find+0x8df/0xa10
[   32.557652]  ntfs_attr_lookup+0xeca/0x1f30
[   32.561858]  ? do_raw_spin_unlock+0x164/0x220
[   32.566331]  ? _raw_spin_unlock+0x29/0x40
[   32.570447]  ? cache_alloc_refill+0x2fa/0x350
[   32.574913]  ? check_preemption_disabled+0x35/0x240
[   32.579900]  ? ntfs_attr_reinit_search_ctx+0x3c0/0x3c0
[   32.585146]  ? kmem_cache_alloc+0x2f8/0x3c0
[   32.589439]  ntfs_read_inode_mount+0x6b4/0x1fb0
[   32.594080]  ntfs_fill_super+0x9a6/0x7170
[   32.598200]  ? vsnprintf+0x260/0x1340
[   32.601968]  ? pointer+0x9e0/0x9e0
[   32.605478]  ? lock_downgrade+0x740/0x740
[   32.609605]  ? ntfs_big_inode_init_once+0x20/0x20
[   32.614421]  ? snprintf+0xa5/0xd0
[   32.617853]  ? vsprintf+0x30/0x30
[   32.621277]  ? ns_test_super+0x50/0x50
[   32.625153]  ? set_blocksize+0x125/0x380
[   32.629185]  mount_bdev+0x2b3/0x360
[   32.632782]  ? ntfs_big_inode_init_once+0x20/0x20
[   32.637595]  mount_fs+0x92/0x2a0
[   32.640934]  vfs_kern_mount.part.0+0x5b/0x470
[   32.645397]  do_mount+0xe53/0x2a00
[   32.648910]  ? copy_mount_string+0x40/0x40
[   32.653115]  ? rcu_read_lock_sched_held+0x16c/0x1d0
[   32.658230]  ? copy_mnt_ns+0xa30/0xa30
[   32.662087]  ? copy_mount_options+0x1fa/0x2f0
[   32.666563]  ? copy_mnt_ns+0xa30/0xa30
[   32.670423]  SyS_mount+0xa8/0x120
[   32.673851]  ? copy_mnt_ns+0xa30/0xa30
[   32.677715]  do_syscall_64+0x1d5/0x640
[   32.681637]  entry_SYSCALL_64_after_hwframe+0x46/0xbb
[   32.686798] RIP: 0033:0x44753a
[   32.689958] RSP: 002b:00007ffc0a8bb868 EFLAGS: 00000287 ORIG_RAX: 00000000000000a5
[   32.697640] RAX: ffffffffffffffda RBX: 00007ffc0a8bb8c0 RCX: 000000000044753a
[   32.704881] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffc0a8bb880
[   32.712191] RBP: 00007ffc0a8bb880 R08: 00007ffc0a8bb8c0 R09: 00007ffc00000015
[   32.719446] R10: 0000000000000000 R11: 0000000000000287 R12: 000000000000003a
[   32.726709] R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000003
[   32.735261] Kernel Offset: disabled
[   32.738911] Rebooting in 86400 seconds..