Warning: Permanently added '10.128.0.252' (ED25519) to the list of known hosts. executing program [ 32.085442][ T6168] loop0: detected capacity change from 0 to 4096 [ 32.094817][ T6168] ntfs: (device loop0): check_mft_mirror(): Incomplete multi sector transfer detected in mft mirror record 0. [ 32.097466][ T6168] ntfs: (device loop0): load_system_files(): $MFTMirr does not match $MFT. Mounting read-only. Run ntfsfix and/or chkdsk. [ 32.101477][ T6168] ntfs: (device loop0): ntfs_read_locked_inode(): First extent of $DATA attribute has non zero lowest_vcn. [ 32.104104][ T6168] ntfs: (device loop0): ntfs_read_locked_inode(): Failed with error code -5. Marking corrupt inode 0xa as bad. Run chkdsk. [ 32.107140][ T6168] ntfs: (device loop0): load_and_init_upcase(): Failed to load $UpCase from the volume. Using default. [ 32.110714][ T6168] ntfs: volume version 3.1. [ 32.113079][ T6168] ntfs: (device loop0): ntfs_check_logfile(): Did not find any restart pages in $LogFile and it was not empty. [ 32.115866][ T6168] ntfs: (device loop0): load_system_files(): Failed to load $LogFile. Will not be able to remount read-write. Mount in Windows. [ 32.119188][ T6168] ntfs: (device loop0): ntfs_lookup_inode_by_name(): Index entry out of bounds in directory inode 0x5. [ 32.122384][ T6168] ntfs: (device loop0): check_windows_hibernation_status(): Failed to find inode number for hiberfil.sys. [ 32.124985][ T6168] ntfs: (device loop0): load_system_files(): Failed to determine if Windows is hibernated. Will not be able to remount read-write. Run chkdsk. [ 32.129865][ T6168] ================================================================== [ 32.131704][ T6168] BUG: KASAN: slab-out-of-bounds in ntfs_readdir+0xb00/0x2bf0 [ 32.133305][ T6168] Read of size 1 at addr ffff0000ce567871 by task syz-executor319/6168 [ 32.135211][ T6168] [ 32.135685][ T6168] CPU: 1 PID: 6168 Comm: syz-executor319 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 32.137910][ T6168] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 [ 32.140210][ T6168] Call trace: [ 32.141015][ T6168] dump_backtrace+0x1b8/0x1e4 [ 32.142166][ T6168] show_stack+0x2c/0x3c [ 32.143240][ T6168] dump_stack_lvl+0xd0/0x124 [ 32.144380][ T6168] print_report+0x178/0x518 [ 32.145554][ T6168] kasan_report+0xd8/0x138 [ 32.146640][ T6168] __asan_report_load1_noabort+0x20/0x2c [ 32.148084][ T6168] ntfs_readdir+0xb00/0x2bf0 [ 32.149208][ T6168] wrap_directory_iterator+0xa8/0xf4 [ 32.150637][ T6168] shared_ntfs_readdir+0x30/0x40 [ 32.151976][ T6168] iterate_dir+0x3f8/0x580 [ 32.153105][ T6168] __arm64_sys_getdents64+0x1c4/0x4a0 [ 32.154433][ T6168] invoke_syscall+0x98/0x2b8 [ 32.155614][ T6168] el0_svc_common+0x130/0x23c [ 32.156862][ T6168] do_el0_svc+0x48/0x58 [ 32.157878][ T6168] el0_svc+0x54/0x168 [ 32.158884][ T6168] el0t_64_sync_handler+0x84/0xfc [ 32.160225][ T6168] el0t_64_sync+0x190/0x194 [ 32.161345][ T6168] [ 32.161865][ T6168] Allocated by task 6168: [ 32.162930][ T6168] kasan_save_track+0x40/0x78 [ 32.164093][ T6168] kasan_save_alloc_info+0x40/0x50 [ 32.165394][ T6168] __kasan_kmalloc+0xac/0xc4 [ 32.166550][ T6168] __kmalloc+0x2bc/0x5d4 [ 32.167568][ T6168] ntfs_readdir+0x65c/0x2bf0 [ 32.168750][ T6168] wrap_directory_iterator+0xa8/0xf4 [ 32.170092][ T6168] shared_ntfs_readdir+0x30/0x40 [ 32.171286][ T6168] iterate_dir+0x3f8/0x580 [ 32.172462][ T6168] __arm64_sys_getdents64+0x1c4/0x4a0 [ 32.173845][ T6168] invoke_syscall+0x98/0x2b8 [ 32.175006][ T6168] el0_svc_common+0x130/0x23c [ 32.176142][ T6168] do_el0_svc+0x48/0x58 [ 32.177224][ T6168] el0_svc+0x54/0x168 [ 32.178195][ T6168] el0t_64_sync_handler+0x84/0xfc [ 32.179454][ T6168] el0t_64_sync+0x190/0x194 [ 32.180613][ T6168] [ 32.181163][ T6168] The buggy address belongs to the object at ffff0000ce567800 [ 32.181163][ T6168] which belongs to the cache kmalloc-64 of size 64 [ 32.184595][ T6168] The buggy address is located 57 bytes to the right of [ 32.184595][ T6168] allocated 56-byte region [ffff0000ce567800, ffff0000ce567838) [ 32.188279][ T6168] [ 32.188893][ T6168] The buggy address belongs to the physical page: [ 32.190415][ T6168] page:000000001fd6e074 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10e567 [ 32.193078][ T6168] anon flags: 0x5ffc00000000800(slab|node=0|zone=2|lastcpupid=0x7ff) [ 32.195148][ T6168] page_type: 0xffffffff() [ 32.196218][ T6168] raw: 05ffc00000000800 ffff0000c0001640 0000000000000000 dead000000000001 [ 32.198373][ T6168] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 32.200542][ T6168] page dumped because: kasan: bad access detected [ 32.202225][ T6168] [ 32.202812][ T6168] Memory state around the buggy address: [ 32.204233][ T6168] ffff0000ce567700: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 32.206262][ T6168] ffff0000ce567780: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 32.208408][ T6168] >ffff0000ce567800: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc [ 32.210518][ T6168] ^ [ 32.212349][ T6168] ffff0000ce567880: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 32.214403][ T6168] ffff0000ce567900: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 32.216545][ T6168] ================================================================== [ 32.218743][ T6168] Disabling lock debugging due to kernel taint