ntfs3: loop5: Failed to initialize $Extend/$Reparse. ntfs3: loop5: Mark volume as dirty due to NTFS errors ================================================================== BUG: KFENCE: out-of-bounds read in memcpy_orig+0x64/0x120 arch/x86/lib/memcpy_64.S:93 Out-of-bounds read at 0xffff88823bd3b018 (88B right of kfence-#156): memcpy_orig+0x64/0x120 arch/x86/lib/memcpy_64.S:93 ntfs_list_ea fs/ntfs3/xattr.c:232 [inline] ntfs_listxattr+0x28f/0x4d0 fs/ntfs3/xattr.c:733 vfs_listxattr+0xb3/0x130 fs/xattr.c:494 listxattr+0x69/0x180 fs/xattr.c:841 path_listxattr+0xc3/0x160 fs/xattr.c:865 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd3/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b kfence-#156: 0xffff88823bd3afc0-0xffff88823bd3affb, size=60, cache=kmalloc-64 allocated by task 5610 on cpu 0 at 182.116883s: kmalloc include/linux/slab.h:594 [inline] ntfs_read_ea+0x435/0xa70 fs/ntfs3/xattr.c:118 ntfs_list_ea fs/ntfs3/xattr.c:204 [inline] ntfs_listxattr+0x159/0x4d0 fs/ntfs3/xattr.c:733 vfs_listxattr+0xb3/0x130 fs/xattr.c:494 listxattr+0x69/0x180 fs/xattr.c:841 path_listxattr+0xc3/0x160 fs/xattr.c:865 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd3/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b CPU: 0 PID: 5610 Comm: syz-executor.5 Not tainted 6.7.0-syzkaller-10085-g1b1934dbbdcf #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 RIP: 0010:memcpy_orig+0x64/0x120 arch/x86/lib/memcpy_64.S:94 Code: 57 10 4c 89 5f 18 48 8d 7f 20 73 d4 83 c2 20 eb 4c 48 01 d6 48 01 d7 48 83 ea 20 66 66 2e 0f 1f 84 00 00 00 00 00 48 83 ea 20 <4c> 8b 46 f8 4c 8b 4e f0 4c 8b 56 e8 4c 8b 5e e0 48 8d 76 e0 4c 89 RSP: 0018:ffffc9000a247d38 EFLAGS: 00010287 RAX: ffff88802b30c00e RBX: ffff88823bd3afe8 RCX: ffffffff82c90d4b RDX: fffffffffffffff0 RSI: ffff88823bd3b020 RDI: ffff88802b30c03e RBP: 0000000000000030 R08: 0000000000000006 R09: 0000000000000098 R10: 000000000000003f R11: 00000081ed00444f R12: 000000000000003f R13: 000000000000000e R14: 000000000000003c R15: ffff88823bd3afed FS: 00007f075f6b86c0(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff88823bd3b018 CR3: 00000000202fb000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ntfs_list_ea fs/ntfs3/xattr.c:232 [inline] ntfs_listxattr+0x28f/0x4d0 fs/ntfs3/xattr.c:733 vfs_listxattr+0xb3/0x130 fs/xattr.c:494 listxattr+0x69/0x180 fs/xattr.c:841 path_listxattr+0xc3/0x160 fs/xattr.c:865 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd3/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7f075e87cda9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f075f6b80c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000c2 RAX: ffffffffffffffda RBX: 00007f075e9abf80 RCX: 00007f075e87cda9 RDX: 0000000000000098 RSI: 0000000020000100 RDI: 0000000020000040 RBP: 00007f075e8c947a R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007f075e9abf80 R15: 00007ffe3fda4798 ================================================================== ---------------- Code disassembly (best guess): 0: 57 push %rdi 1: 10 4c 89 5f adc %cl,0x5f(%rcx,%rcx,4) 5: 18 48 8d sbb %cl,-0x73(%rax) 8: 7f 20 jg 0x2a a: 73 d4 jae 0xffffffe0 c: 83 c2 20 add $0x20,%edx f: eb 4c jmp 0x5d 11: 48 01 d6 add %rdx,%rsi 14: 48 01 d7 add %rdx,%rdi 17: 48 83 ea 20 sub $0x20,%rdx 1b: 66 66 2e 0f 1f 84 00 data16 cs nopw 0x0(%rax,%rax,1) 22: 00 00 00 00 26: 48 83 ea 20 sub $0x20,%rdx * 2a: 4c 8b 46 f8 mov -0x8(%rsi),%r8 <-- trapping instruction 2e: 4c 8b 4e f0 mov -0x10(%rsi),%r9 32: 4c 8b 56 e8 mov -0x18(%rsi),%r10 36: 4c 8b 5e e0 mov -0x20(%rsi),%r11 3a: 48 8d 76 e0 lea -0x20(%rsi),%rsi 3e: 4c rex.WR 3f: 89 .byte 0x89