./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2431080975 <...> Warning: Permanently added '10.128.1.31' (ED25519) to the list of known hosts. execve("./syz-executor2431080975", ["./syz-executor2431080975"], 0x7fffc616bfd0 /* 10 vars */) = 0 brk(NULL) = 0x55556d8c2000 brk(0x55556d8c2d00) = 0x55556d8c2d00 arch_prctl(ARCH_SET_FS, 0x55556d8c2380) = 0 set_tid_address(0x55556d8c2650) = 5823 set_robust_list(0x55556d8c2660, 24) = 0 rseq(0x55556d8c2ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2431080975", 4096) = 28 getrandom("\x35\x2f\x81\x74\xee\xc2\x2b\x7c", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55556d8c2d00 brk(0x55556d8e3d00) = 0x55556d8e3d00 brk(0x55556d8e4000) = 0x55556d8e4000 mprotect(0x7f3418a51000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5824 attached [pid 5824] set_robust_list(0x55556d8c2660, 24 [pid 5823] <... clone resumed>, child_tidptr=0x55556d8c2650) = 5824 [pid 5824] <... set_robust_list resumed>) = 0 [pid 5824] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5824] setpgid(0, 0) = 0 [pid 5824] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5824] write(3, "1000", 4) = 4 [pid 5824] close(3) = 0 executing program [pid 5824] write(1, "executing program\n", 18) = 18 [pid 5824] memfd_create("syzkaller", 0) = 3 [pid 5824] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3410400000 [pid 5824] write(3, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x02\x08\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x80\x00\xff\x0f\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\xff\x00\x00\x00\x00\x00\x00\x00\xf6\x00\x00\x00\x01\x00\x00\x00\x51\x49\x92\x54\x8e\xa5\x9a\x39\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00"..., 2097152) = 2097152 [pid 5824] munmap(0x7f3410400000, 138412032) = 0 [pid 5824] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5824] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5824] close(3) = 0 [pid 5824] close(4) = 0 [pid 5824] mkdir("./file0", 0777) = 0 syzkaller login: [ 93.913916][ T5824] loop0: detected capacity change from 0 to 4096 [pid 5824] mount("/dev/loop0", "./file0", "ntfs3", MS_SILENT|MS_POSIXACL, "iocharset=euc-jp,showmeta,fmask=00000000000000000004143,discard,force,iocharset=maccroatian,prealloc"...) = 0 [pid 5824] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5824] chdir("./file0") = 0 [pid 5824] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [ 93.975486][ T5824] ntfs3(loop0): Failed to initialize $Extend/$ObjId. [pid 5824] mkdir("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 0105) = 0 [pid 5824] symlink("./file0", "./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa") = 0 [pid 5824] symlink("./file0", "./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa") = 0 [pid 5824] mknod("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", S_IFIFO|000) = 0 [pid 5824] openat(AT_FDCWD, ".", O_RDONLY|O_SYNC) = 4 [ 94.063014][ T5824] ntfs3(loop0): failed to convert "0000" to maccroatian [ 94.070451][ T5824] ================================================================== [ 94.078524][ T5824] BUG: KASAN: slab-out-of-bounds in ntfs_utf16_to_nls+0x3c9/0x5a0 [ 94.086381][ T5824] Read of size 2 at addr ffff88807c7f1000 by task syz-executor243/5824 [ 94.094657][ T5824] [ 94.097052][ T5824] CPU: 0 UID: 0 PID: 5824 Comm: syz-executor243 Not tainted 6.15.0-syzkaller-09161-g0f70f5b08a47 #0 PREEMPT(full) [ 94.097072][ T5824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 94.097083][ T5824] Call Trace: [ 94.097093][ T5824] [ 94.097101][ T5824] dump_stack_lvl+0x189/0x250 [ 94.097127][ T5824] ? __virt_addr_valid+0x1c8/0x5c0 [ 94.097146][ T5824] ? rcu_is_watching+0x15/0xb0 [ 94.097162][ T5824] ? __kasan_check_byte+0x12/0x40 [ 94.097183][ T5824] ? __pfx_dump_stack_lvl+0x10/0x10 [ 94.097203][ T5824] ? rcu_is_watching+0x15/0xb0 [ 94.097219][ T5824] ? lock_release+0x4b/0x3e0 [ 94.097234][ T5824] ? __virt_addr_valid+0x1c8/0x5c0 [ 94.097253][ T5824] ? __virt_addr_valid+0x4a5/0x5c0 [ 94.097272][ T5824] print_report+0xd2/0x2b0 [ 94.097289][ T5824] ? ntfs_utf16_to_nls+0x3c9/0x5a0 [ 94.097303][ T5824] kasan_report+0x118/0x150 [ 94.097325][ T5824] ? ntfs_utf16_to_nls+0x3c9/0x5a0 [ 94.097342][ T5824] ntfs_utf16_to_nls+0x3c9/0x5a0 [ 94.097361][ T5824] ? __pfx_ntfs_utf16_to_nls+0x10/0x10 [ 94.097379][ T5824] ntfs_read_hdr+0x508/0xbc0 [ 94.097399][ T5824] ntfs_readdir+0xa5c/0xdd0 [ 94.097418][ T5824] ? __pfx_ntfs_readdir+0x10/0x10 [ 94.097434][ T5824] ? iterate_dir+0x49f/0x770 [ 94.097452][ T5824] ? down_read_killable+0x1d1/0x350 [ 94.097474][ T5824] iterate_dir+0x5ac/0x770 [ 94.097495][ T5824] __se_sys_getdents64+0xe4/0x260 [ 94.097515][ T5824] ? __pfx___se_sys_getdents64+0x10/0x10 [ 94.097534][ T5824] ? __pfx_filldir64+0x10/0x10 [ 94.097558][ T5824] do_syscall_64+0xfa/0x3b0 [ 94.097573][ T5824] ? lockdep_hardirqs_on+0x9c/0x150 [ 94.097585][ T5824] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.097599][ T5824] ? clear_bhb_loop+0x60/0xb0 [ 94.097615][ T5824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.097629][ T5824] RIP: 0033:0x7f34189bde59 [ 94.097646][ T5824] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 94.097660][ T5824] RSP: 002b:00007fff44014e48 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9 [ 94.097676][ T5824] RAX: ffffffffffffffda RBX: 0000200000000080 RCX: 00007f34189bde59 [ 94.097686][ T5824] RDX: 0000000000001000 RSI: 0000200000000f80 RDI: 0000000000000004 [ 94.097696][ T5824] RBP: 00007f3418a515f0 R08: 000055556d8c34c0 R09: 000055556d8c34c0 [ 94.097706][ T5824] R10: 000055556d8c34c0 R11: 0000000000000246 R12: 00007fff44014e70 [ 94.097715][ T5824] R13: 00007fff44015098 R14: 431bde82d7b634db R15: 00007f3418a0703b [ 94.097732][ T5824] [ 94.097737][ T5824] [ 94.348635][ T5824] Allocated by task 5824: [ 94.352968][ T5824] kasan_save_track+0x3e/0x80 [ 94.357663][ T5824] __kasan_kmalloc+0x93/0xb0 [ 94.362265][ T5824] __kmalloc_noprof+0x27a/0x4f0 [ 94.367124][ T5824] indx_read+0x27c/0xc20 [ 94.371398][ T5824] ntfs_readdir+0x9d8/0xdd0 [ 94.376073][ T5824] iterate_dir+0x5ac/0x770 [ 94.380788][ T5824] __se_sys_getdents64+0xe4/0x260 [ 94.385833][ T5824] do_syscall_64+0xfa/0x3b0 [ 94.390356][ T5824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.396287][ T5824] [ 94.398649][ T5824] The buggy address belongs to the object at ffff88807c7f0000 [ 94.398649][ T5824] which belongs to the cache kmalloc-4k of size 4096 [ 94.412713][ T5824] The buggy address is located 0 bytes to the right of [ 94.412713][ T5824] allocated 4096-byte region [ffff88807c7f0000, ffff88807c7f1000) [ 94.427420][ T5824] [ 94.429757][ T5824] The buggy address belongs to the physical page: [ 94.436280][ T5824] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7c7f0 [ 94.445141][ T5824] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 94.453737][ T5824] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 94.461470][ T5824] page_type: f5(slab) [ 94.465456][ T5824] raw: 00fff00000000040 ffff88801a442140 dead000000000122 0000000000000000 [ 94.474054][ T5824] raw: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 94.483177][ T5824] head: 00fff00000000040 ffff88801a442140 dead000000000122 0000000000000000 [ 94.491869][ T5824] head: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 94.500578][ T5824] head: 00fff00000000003 ffffea0001f1fc01 00000000ffffffff 00000000ffffffff [ 94.509442][ T5824] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 94.518201][ T5824] page dumped because: kasan: bad access detected [ 94.524795][ T5824] page_owner tracks the page as allocated [ 94.530686][ T5824] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5824, tgid 5824 (syz-executor243), ts 94062103587, free_ts 87837995758 [ 94.551560][ T5824] post_alloc_hook+0x240/0x2a0 [ 94.556330][ T5824] get_page_from_freelist+0x21d1/0x22b0 [ 94.561886][ T5824] __alloc_frozen_pages_noprof+0x181/0x370 [ 94.567699][ T5824] alloc_pages_mpol+0x232/0x4a0 [ 94.572559][ T5824] allocate_slab+0x8a/0x3b0 [ 94.577067][ T5824] ___slab_alloc+0xbfc/0x1480 [ 94.581748][ T5824] __kmalloc_noprof+0x305/0x4f0 [ 94.586614][ T5824] indx_read+0x27c/0xc20 [ 94.590957][ T5824] ntfs_readdir+0x9d8/0xdd0 [ 94.595469][ T5824] iterate_dir+0x5ac/0x770 [ 94.599922][ T5824] __se_sys_getdents64+0xe4/0x260 [ 94.604957][ T5824] do_syscall_64+0xfa/0x3b0 [ 94.609490][ T5824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.615537][ T5824] page last free pid 5814 tgid 5814 stack trace: [ 94.621952][ T5824] __free_frozen_pages+0xc65/0xe50 [ 94.627265][ T5824] __put_partials+0x161/0x1c0 [ 94.632040][ T5824] put_cpu_partial+0x17c/0x250 [ 94.636809][ T5824] __slab_free+0x2f7/0x400 [ 94.641241][ T5824] qlist_free_all+0x97/0x140 [ 94.645878][ T5824] kasan_quarantine_reduce+0x148/0x160 [ 94.651345][ T5824] __kasan_slab_alloc+0x22/0x80 [ 94.656382][ T5824] kmem_cache_alloc_noprof+0x1c1/0x3c0 [ 94.661877][ T5824] vm_area_dup+0x28/0x540 [ 94.666236][ T5824] __split_vma+0x1a0/0x9b0 [ 94.670662][ T5824] vms_gather_munmap_vmas+0x2de/0x12b0 [ 94.676129][ T5824] do_vmi_align_munmap+0x25d/0x420 [ 94.682046][ T5824] __se_sys_brk+0x74e/0xb90 [ 94.686657][ T5824] do_syscall_64+0xfa/0x3b0 [ 94.691255][ T5824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.697153][ T5824] [ 94.699487][ T5824] Memory state around the buggy address: [ 94.705113][ T5824] ffff88807c7f0f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.713173][ T5824] ffff88807c7f0f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.721426][ T5824] >ffff88807c7f1000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 94.729487][ T5824] ^ [ 94.733643][ T5824] ffff88807c7f1080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 94.741774][ T5824] ffff88807c7f1100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 94.749922][ T5824] ================================================================== [ 94.762886][ T5824] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 94.770229][ T5824] CPU: 1 UID: 0 PID: 5824 Comm: syz-executor243 Not tainted 6.15.0-syzkaller-09161-g0f70f5b08a47 #0 PREEMPT(full) [ 94.782305][ T5824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 94.792394][ T5824] Call Trace: [ 94.795778][ T5824] [ 94.798717][ T5824] dump_stack_lvl+0x99/0x250 [ 94.803430][ T5824] ? __asan_memcpy+0x40/0x70 [ 94.808118][ T5824] ? __pfx_dump_stack_lvl+0x10/0x10 [ 94.813433][ T5824] ? __pfx__printk+0x10/0x10 [ 94.818126][ T5824] panic+0x2db/0x790 [ 94.822055][ T5824] ? __pfx_panic+0x10/0x10 [ 94.826486][ T5824] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 94.832390][ T5824] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 94.838904][ T5824] ? print_memory_metadata+0x314/0x400 [ 94.844370][ T5824] ? ntfs_utf16_to_nls+0x3c9/0x5a0 [ 94.849576][ T5824] check_panic_on_warn+0x89/0xb0 [ 94.854531][ T5824] ? ntfs_utf16_to_nls+0x3c9/0x5a0 [ 94.859659][ T5824] end_report+0x78/0x160 [ 94.863943][ T5824] kasan_report+0x129/0x150 [ 94.868561][ T5824] ? ntfs_utf16_to_nls+0x3c9/0x5a0 [ 94.873699][ T5824] ntfs_utf16_to_nls+0x3c9/0x5a0 [ 94.878656][ T5824] ? __pfx_ntfs_utf16_to_nls+0x10/0x10 [ 94.884212][ T5824] ntfs_read_hdr+0x508/0xbc0 [ 94.888848][ T5824] ntfs_readdir+0xa5c/0xdd0 [ 94.893362][ T5824] ? __pfx_ntfs_readdir+0x10/0x10 [ 94.898498][ T5824] ? iterate_dir+0x49f/0x770 [ 94.903149][ T5824] ? down_read_killable+0x1d1/0x350 [ 94.908470][ T5824] iterate_dir+0x5ac/0x770 [ 94.912948][ T5824] __se_sys_getdents64+0xe4/0x260 [ 94.918173][ T5824] ? __pfx___se_sys_getdents64+0x10/0x10 [ 94.924022][ T5824] ? __pfx_filldir64+0x10/0x10 [ 94.928811][ T5824] do_syscall_64+0xfa/0x3b0 [ 94.933326][ T5824] ? lockdep_hardirqs_on+0x9c/0x150 [ 94.938540][ T5824] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.944625][ T5824] ? clear_bhb_loop+0x60/0xb0 [ 94.949570][ T5824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.955646][ T5824] RIP: 0033:0x7f34189bde59 [ 94.960070][ T5824] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 94.979693][ T5824] RSP: 002b:00007fff44014e48 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9 [ 94.988210][ T5824] RAX: ffffffffffffffda RBX: 0000200000000080 RCX: 00007f34189bde59 [ 94.996363][ T5824] RDX: 0000000000001000 RSI: 0000200000000f80 RDI: 0000000000000004 [ 95.004352][ T5824] RBP: 00007f3418a515f0 R08: 000055556d8c34c0 R09: 000055556d8c34c0 [ 95.012337][ T5824] R10: 000055556d8c34c0 R11: 0000000000000246 R12: 00007fff44014e70 [ 95.020595][ T5824] R13: 00007fff44015098 R14: 431bde82d7b634db R15: 00007f3418a0703b [ 95.028674][ T5824] [ 95.032050][ T5824] Kernel Offset: disabled [ 95.036405][ T5824] Rebooting in 86400 seconds..