Warning: Permanently added '10.128.0.7' (ED25519) to the list of known hosts. executing program [ 38.726010][ T4291] loop0: detected capacity change from 0 to 4096 [ 38.731353][ T4291] ntfs: (device loop0): check_mft_mirror(): Incomplete multi sector transfer detected in mft mirror record 0. [ 38.733828][ T4291] ntfs: (device loop0): load_system_files(): $MFTMirr does not match $MFT. Mounting read-only. Run ntfsfix and/or chkdsk. [ 38.737232][ T4291] ntfs: (device loop0): ntfs_read_locked_inode(): First extent of $DATA attribute has non zero lowest_vcn. [ 38.740086][ T4291] ntfs: (device loop0): ntfs_read_locked_inode(): Failed with error code -5. Marking corrupt inode 0xa as bad. Run chkdsk. [ 38.742907][ T4291] ntfs: (device loop0): load_and_init_upcase(): Failed to load $UpCase from the volume. Using default. [ 38.747046][ T4291] ntfs: volume version 3.1. [ 38.750840][ T4291] ntfs: (device loop0): ntfs_check_logfile(): Did not find any restart pages in $LogFile and it was not empty. [ 38.753918][ T4291] ntfs: (device loop0): load_system_files(): Failed to load $LogFile. Will not be able to remount read-write. Mount in Windows. [ 38.757232][ T4291] ntfs: (device loop0): ntfs_lookup_inode_by_name(): Index entry out of bounds in directory inode 0x5. [ 38.765860][ T4291] ntfs: (device loop0): check_windows_hibernation_status(): Failed to find inode number for hiberfil.sys. [ 38.768366][ T4291] ntfs: (device loop0): load_system_files(): Failed to determine if Windows is hibernated. Will not be able to remount read-write. Run chkdsk. [ 38.773751][ T4291] ================================================================== [ 38.775524][ T4291] BUG: KASAN: slab-out-of-bounds in ntfs_readdir+0xb00/0x2be8 [ 38.777005][ T4291] Read of size 1 at addr ffff0000d4445771 by task syz-executor262/4291 [ 38.778768][ T4291] [ 38.779259][ T4291] CPU: 1 PID: 4291 Comm: syz-executor262 Tainted: G W 6.1.122-syzkaller #0 [ 38.781350][ T4291] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 38.783671][ T4291] Call trace: [ 38.784395][ T4291] dump_backtrace+0x1c8/0x1f4 [ 38.785492][ T4291] show_stack+0x2c/0x3c [ 38.786455][ T4291] dump_stack_lvl+0x108/0x170 [ 38.787474][ T4291] print_report+0x174/0x4c0 [ 38.788482][ T4291] kasan_report+0xd4/0x130 [ 38.789530][ T4291] __asan_report_load1_noabort+0x2c/0x38 [ 38.790799][ T4291] ntfs_readdir+0xb00/0x2be8 [ 38.791920][ T4291] iterate_dir+0x1f4/0x4ec [ 38.792845][ T4291] __arm64_sys_getdents64+0x1c4/0x4a0 [ 38.793992][ T4291] invoke_syscall+0x98/0x2bc [ 38.794974][ T4291] el0_svc_common+0x138/0x258 [ 38.795968][ T4291] do_el0_svc+0x58/0x13c [ 38.796874][ T4291] el0_svc+0x58/0x168 [ 38.797787][ T4291] el0t_64_sync_handler+0x84/0xf0 [ 38.798868][ T4291] el0t_64_sync+0x18c/0x190 [ 38.799942][ T4291] [ 38.800425][ T4291] Allocated by task 4291: [ 38.801409][ T4291] kasan_set_track+0x4c/0x80 [ 38.802481][ T4291] kasan_save_alloc_info+0x24/0x30 [ 38.803707][ T4291] __kasan_kmalloc+0xac/0xc4 [ 38.804671][ T4291] __kmalloc+0xd8/0x1c4 [ 38.805540][ T4291] ntfs_readdir+0x65c/0x2be8 [ 38.806415][ T4291] iterate_dir+0x1f4/0x4ec [ 38.807322][ T4291] __arm64_sys_getdents64+0x1c4/0x4a0 [ 38.808909][ T4291] invoke_syscall+0x98/0x2bc [ 38.809936][ T4291] el0_svc_common+0x138/0x258 [ 38.811027][ T4291] do_el0_svc+0x58/0x13c [ 38.811956][ T4291] el0_svc+0x58/0x168 [ 38.812886][ T4291] el0t_64_sync_handler+0x84/0xf0 [ 38.814008][ T4291] el0t_64_sync+0x18c/0x190 [ 38.815010][ T4291] [ 38.815541][ T4291] The buggy address belongs to the object at ffff0000d4445700 [ 38.815541][ T4291] which belongs to the cache kmalloc-128 of size 128 [ 38.818649][ T4291] The buggy address is located 113 bytes inside of [ 38.818649][ T4291] 128-byte region [ffff0000d4445700, ffff0000d4445780) [ 38.821438][ T4291] [ 38.821910][ T4291] The buggy address belongs to the physical page: [ 38.823268][ T4291] page:00000000c336e63c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x114445 [ 38.825497][ T4291] flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff) [ 38.827154][ T4291] raw: 05ffc00000000200 fffffc00034e3740 dead000000000002 ffff0000c0002300 [ 38.828984][ T4291] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 38.830940][ T4291] page dumped because: kasan: bad access detected [ 38.832474][ T4291] [ 38.832976][ T4291] Memory state around the buggy address: [ 38.834299][ T4291] ffff0000d4445600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 38.836044][ T4291] ffff0000d4445680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 38.837751][ T4291] >ffff0000d4445700: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc [ 38.839440][ T4291] ^ [ 38.840993][ T4291] ffff0000d4445780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 38.842619][ T4291] ffff0000d4445800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 38.844248][ T4291] ================================================================== [ 38.846013][ T4291] Disabling lock debugging due to kernel taint