loop0: detected capacity change from 0 to 8192 ntfs3: loop0: Different NTFS' sector size (4096) and media sector size (512) ================================================================== BUG: KASAN: use-after-free in mi_enum_attr+0x583/0x6a0 fs/ntfs3/record.c:227 Read of size 4 at addr ffff888178a6204b by task syz-executor311/3638 CPU: 0 PID: 3638 Comm: syz-executor311 Not tainted 6.1.0-rc6-syzkaller-00315-gfaf68e3523c2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:284 print_report+0x107/0x1f0 mm/kasan/report.c:395 kasan_report+0xcd/0x100 mm/kasan/report.c:495 mi_enum_attr+0x583/0x6a0 fs/ntfs3/record.c:227 ni_enum_attr_ex+0x2f6/0x6d0 fs/ntfs3/frecord.c:259 ntfs_read_mft fs/ntfs3/inode.c:114 [inline] ntfs_iget5+0x1d3e/0x36f0 fs/ntfs3/inode.c:501 ntfs_loadlog_and_replay+0x1ac/0x5c0 fs/ntfs3/fsntfs.c:272 ntfs_fill_super+0x2333/0x42a0 fs/ntfs3/super.c:1018 get_tree_bdev+0x400/0x620 fs/super.c:1324 vfs_get_tree+0x88/0x270 fs/super.c:1531 do_new_mount+0x289/0xad0 fs/namespace.c:3040 do_mount fs/namespace.c:3383 [inline] __do_sys_mount fs/namespace.c:3591 [inline] __se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3568 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f7b7124f92a Code: 48 c7 c2 c0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 a8 00 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc98428db8 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f7b7124f92a RDX: 0000000020020bc0 RSI: 0000000020020c00 RDI: 00007ffc98428dd0 RBP: 00007ffc98428dd0 R08: 00007ffc98428e10 R09: 0000000000000000 R10: 0000000000018882 R11: 0000000000000286 R12: 0000000000000004 R13: 00005555571a02c0 R14: 0000000000018882 R15: 00007ffc98428e10 The buggy address belongs to the physical page: page:ffffea0005e29880 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x178a62 flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff) raw: 057ff00000000000 ffffea0005e29888 ffffea0005e29888 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner info is not present (never set?) Memory state around the buggy address: ffff888178a61f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888178a61f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff888178a62000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff888178a62080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888178a62100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================