loop0: detected capacity change from 0 to 8189 ntfs3: loop0: Different NTFS' sector size and media sector size ntfs3: loop0: Mark volume as dirty due to NTFS errors ================================================================== BUG: KASAN: slab-out-of-bounds in ntfs_trim_fs+0x64f/0x820 fs/ntfs3/bitmap.c:1470 Read of size 2 at addr ffff888014bc5642 by task syz-executor.0/5940 CPU: 0 PID: 5940 Comm: syz-executor.0 Not tainted 5.14.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x57/0x7d lib/dump_stack.c:105 print_address_description.constprop.0.cold+0x6c/0x309 mm/kasan/report.c:233 __kasan_report mm/kasan/report.c:419 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:436 ntfs_trim_fs+0x64f/0x820 fs/ntfs3/bitmap.c:1470 ntfs_ioctl_fitrim+0x1bd/0x270 fs/ntfs3/file.c:39 ntfs_ioctl+0x151/0x1b0 fs/ntfs3/file.c:63 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:1069 [inline] __se_sys_ioctl fs/ioctl.c:1055 [inline] __x64_sys_ioctl+0x11f/0x190 fs/ioctl.c:1055 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f3619c8a669 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f36193fe168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f3619dabf80 RCX: 00007f3619c8a669 RDX: 0000000020000000 RSI: 00000000c0185879 RDI: 0000000000000003 RBP: 00007f3619ce5560 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fffdae8b3df R14: 00007f36193fe300 R15: 0000000000022000 Allocated by task 5940: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] ____kasan_kmalloc mm/kasan/common.c:513 [inline] ____kasan_kmalloc mm/kasan/common.c:472 [inline] __kasan_kmalloc+0x9b/0xd0 mm/kasan/common.c:522 kmalloc include/linux/slab.h:596 [inline] kzalloc include/linux/slab.h:721 [inline] wnd_init+0x258/0x380 fs/ntfs3/bitmap.c:686 ntfs_fill_super+0x201e/0x3550 fs/ntfs3/super.c:1156 mount_bdev+0x2cb/0x3b0 fs/super.c:1368 legacy_get_tree+0xfa/0x1f0 fs/fs_context.c:610 vfs_get_tree+0x7f/0x2c0 fs/super.c:1498 do_new_mount fs/namespace.c:2905 [inline] path_mount+0x7f3/0x1a40 fs/namespace.c:3235 do_mount fs/namespace.c:3248 [inline] __do_sys_mount fs/namespace.c:3456 [inline] __se_sys_mount fs/namespace.c:3433 [inline] __x64_sys_mount+0x1f5/0x260 fs/namespace.c:3433 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae The buggy address belongs to the object at ffff888014bc5640 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 2 bytes inside of 8-byte region [ffff888014bc5640, ffff888014bc5648) The buggy address belongs to the page: page:ffffea000052f140 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14bc5 flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 ffffea0000592cc0 0000000f0000000f ffff888010441280 raw: 0000000000000000 0000000080660066 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 4250587443, free_ts 4247381894 prep_new_page mm/page_alloc.c:2436 [inline] get_page_from_freelist+0xa6f/0x2f50 mm/page_alloc.c:4169 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5391 alloc_page_interleave+0xf/0x1c0 mm/mempolicy.c:2119 alloc_slab_page mm/slub.c:1688 [inline] allocate_slab+0x32e/0x4b0 mm/slub.c:1828 new_slab mm/slub.c:1891 [inline] new_slab_objects mm/slub.c:2637 [inline] ___slab_alloc+0x4ba/0x820 mm/slub.c:2800 __slab_alloc.constprop.0+0xa7/0xf0 mm/slub.c:2840 slab_alloc_node mm/slub.c:2922 [inline] slab_alloc mm/slub.c:2964 [inline] __kmalloc+0x312/0x330 mm/slub.c:4108 acpi_ns_internalize_name drivers/acpi/acpica/nsutils.c:331 [inline] acpi_ns_internalize_name+0xcc/0x159 drivers/acpi/acpica/nsutils.c:312 acpi_ns_get_node_unlocked drivers/acpi/acpica/nsutils.c:666 [inline] acpi_ns_get_node_unlocked+0x194/0x219 drivers/acpi/acpica/nsutils.c:635 acpi_ns_get_node+0x3d/0x55 drivers/acpi/acpica/nsutils.c:726 acpi_ns_evaluate+0xae/0x873 drivers/acpi/acpica/nseval.c:62 acpi_ut_evaluate_object+0xdd/0x32c drivers/acpi/acpica/uteval.c:60 acpi_ut_execute_STA+0x72/0x13f drivers/acpi/acpica/uteval.c:223 acpi_ns_get_device_callback drivers/acpi/acpica/nsxfeval.c:723 [inline] acpi_ns_get_device_callback+0xf4/0x324 drivers/acpi/acpica/nsxfeval.c:635 acpi_ns_walk_namespace+0x168/0x29a drivers/acpi/acpica/nswalk.c:230 acpi_get_devices+0xae/0xf6 drivers/acpi/acpica/nsxfeval.c:805 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1346 [inline] free_pcp_prepare+0x2c5/0x780 mm/page_alloc.c:1397 free_unref_page_prepare mm/page_alloc.c:3332 [inline] free_unref_page+0x19/0x690 mm/page_alloc.c:3411 __vunmap+0x5a3/0x960 mm/vmalloc.c:2587 free_work+0x4b/0x70 mm/vmalloc.c:82 process_one_work+0x84c/0x13d0 kernel/workqueue.c:2276 worker_thread+0x598/0x1040 kernel/workqueue.c:2422 kthread+0x38b/0x460 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Memory state around the buggy address: ffff888014bc5500: fb fc fc fc fc fb fc fc fc fc fb fc fc fc fc fb ffff888014bc5580: fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc 00 fc >ffff888014bc5600: fc fc fc 00 fc fc fc fc 02 fc fc fc fc 02 fc fc ^ ffff888014bc5680: fc fc 00 fc fc fc fc fa fc fc fc fc fa fc fc fc ffff888014bc5700: fc fa fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc ==================================================================