Warning: Permanently added '10.128.1.34' (ED25519) to the list of known hosts. 2023/09/27 17:03:05 ignoring optional flag "sandboxArg"="0" 2023/09/27 17:03:05 parsed 1 programs 2023/09/27 17:03:05 executed programs: 0 [ 54.699094][ T1994] loop0: detected capacity change from 0 to 4096 [ 54.719054][ T1994] ntfs: volume version 3.1. [ 54.726054][ T1994] ================================================================== [ 54.734214][ T1994] BUG: KASAN: use-after-free in ntfs_lookup_inode_by_name+0xfd8/0x2e80 [ 54.742897][ T1994] Read of size 8 at addr ffff88806a88955a by task syz-executor.0/1994 [ 54.751420][ T1994] [ 54.753846][ T1994] CPU: 1 PID: 1994 Comm: syz-executor.0 Not tainted 6.1.55-syzkaller #0 [ 54.762433][ T1994] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 [ 54.772752][ T1994] Call Trace: [ 54.776027][ T1994] [ 54.779078][ T1994] dump_stack_lvl+0xf4/0x251 [ 54.783656][ T1994] ? nf_tcp_handle_invalid+0x2f3/0x2f3 [ 54.789090][ T1994] ? panic+0x3f7/0x3f7 [ 54.793139][ T1994] ? _printk+0xca/0x10a [ 54.797301][ T1994] print_report+0x15f/0x4f0 [ 54.802031][ T1994] ? __kasan_slab_alloc+0x65/0x70 [ 54.807252][ T1994] ? ntfs_lookup_inode_by_name+0xfd8/0x2e80 [ 54.814002][ T1994] kasan_report+0x136/0x160 [ 54.818488][ T1994] ? ntfs_lookup_inode_by_name+0xfd8/0x2e80 [ 54.824365][ T1994] ntfs_lookup_inode_by_name+0xfd8/0x2e80 [ 54.830061][ T1994] ? rcu_is_watching+0x1b/0x90 [ 54.834799][ T1994] ? lock_acquire+0xbe/0x390 [ 54.839456][ T1994] ? __down_write_common+0x12a/0x1e0 [ 54.844748][ T1994] check_windows_hibernation_status+0xfc/0x560 [ 54.850883][ T1994] ? ntfs_test_inode+0x230/0x230 [ 54.855801][ T1994] ? load_and_check_logfile+0xc0/0xc0 [ 54.861441][ T1994] ? load_system_files+0x34e8/0x4880 [ 54.866710][ T1994] ? rcu_is_watching+0x1b/0x90 [ 54.871453][ T1994] load_system_files+0x35a0/0x4880 [ 54.877069][ T1994] ? ntfs_setup_allocators+0x250/0x250 [ 54.882707][ T1994] ? generate_default_upcase+0x66/0x8e0 [ 54.888424][ T1994] ? vmalloc+0x70/0x80 [ 54.892682][ T1994] ntfs_fill_super+0x1239/0x23c0 [ 54.897604][ T1994] mount_bdev+0x26b/0x340 [ 54.901914][ T1994] ? ntfs_mount+0x10/0x10 [ 54.906290][ T1994] legacy_get_tree+0xe5/0x170 [ 54.911395][ T1994] ? ntfs_rl_punch_nolock+0x1130/0x1130 [ 54.917179][ T1994] vfs_get_tree+0x7a/0x170 [ 54.921748][ T1994] do_new_mount+0x1e1/0x8f0 [ 54.926320][ T1994] ? do_move_mount_old+0x120/0x120 [ 54.931403][ T1994] ? user_path_at_empty+0xed/0x140 [ 54.936576][ T1994] __se_sys_mount+0x23e/0x2d0 [ 54.941231][ T1994] ? __x64_sys_mount+0xc0/0xc0 [ 54.945970][ T1994] ? fpregs_assert_state_consistent+0x43/0x50 [ 54.952011][ T1994] do_syscall_64+0x3d/0x80 [ 54.956491][ T1994] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 54.962378][ T1994] RIP: 0033:0x7f1ecf07e05a [ 54.966792][ T1994] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 09 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 54.987172][ T1994] RSP: 002b:00007f1ecfeb6ee8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 54.995825][ T1994] RAX: ffffffffffffffda RBX: 00007f1ecfeb6f80 RCX: 00007f1ecf07e05a [ 55.003785][ T1994] RDX: 000000002001ec80 RSI: 000000002001ecc0 RDI: 00007f1ecfeb6f40 [ 55.012007][ T1994] RBP: 000000002001ec80 R08: 00007f1ecfeb6f80 R09: 0000000000000000 [ 55.020051][ T1994] R10: 0000000000000000 R11: 0000000000000246 R12: 000000002001ecc0 [ 55.027999][ T1994] R13: 00007f1ecfeb6f40 R14: 000000000001ec6a R15: 000000002001ed00 [ 55.036052][ T1994] [ 55.039229][ T1994] [ 55.041537][ T1994] The buggy address belongs to the physical page: [ 55.048294][ T1994] page:ffffea0001aa2240 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x6a889 [ 55.058694][ T1994] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 55.065867][ T1994] raw: 00fff00000000000 ffffea0001aa2088 ffffea0001aa1848 0000000000000000 [ 55.074945][ T1994] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 55.083497][ T1994] page dumped because: kasan: bad access detected [ 55.089902][ T1994] page_owner tracks the page as freed [ 55.095351][ T1994] page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 1978, tgid 1978 (modprobe), ts 54512453332, free_ts 54521980357 [ 55.113116][ T1994] post_alloc_hook+0x286/0x2b0 [ 55.117865][ T1994] get_page_from_freelist+0x3100/0x32a0 [ 55.123500][ T1994] __alloc_pages+0x251/0x640 [ 55.128355][ T1994] __folio_alloc+0xf/0x30 [ 55.132676][ T1994] vma_alloc_folio+0x484/0x9e0 [ 55.137540][ T1994] handle_mm_fault+0x1ff9/0x4260 [ 55.142485][ T1994] exc_page_fault+0x22a/0x5e0 [ 55.147233][ T1994] asm_exc_page_fault+0x22/0x30 [ 55.152152][ T1994] page last free stack trace: [ 55.156802][ T1994] free_unref_page_prepare+0xd4b/0xee0 [ 55.162326][ T1994] free_unref_page_list+0xf6/0x6d0 [ 55.167678][ T1994] release_pages+0x175c/0x1900 [ 55.172713][ T1994] tlb_flush_mmu+0xe5/0x1d0 [ 55.177201][ T1994] tlb_finish_mmu+0xb0/0x1b0 [ 55.181780][ T1994] exit_mmap+0x341/0x730 [ 55.186097][ T1994] __mmput+0x9b/0x2d0 [ 55.190328][ T1994] exit_mm+0x122/0x1b0 [ 55.194383][ T1994] do_exit+0x81e/0x23a0 [ 55.198590][ T1994] do_group_exit+0x1b5/0x280 [ 55.203355][ T1994] __x64_sys_exit_group+0x3b/0x40 [ 55.208369][ T1994] do_syscall_64+0x3d/0x80 [ 55.213029][ T1994] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 55.218988][ T1994] [ 55.221295][ T1994] Memory state around the buggy address: [ 55.226909][ T1994] ffff88806a889400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 55.235076][ T1994] ffff88806a889480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 55.243470][ T1994] >ffff88806a889500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 55.251517][ T1994] ^ [ 55.258957][ T1994] ffff88806a889580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 55.267344][ T1994] ffff88806a889600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 55.275466][ T1994] ================================================================== [ 55.283603][ T1994] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 55.291246][ T1994] Kernel Offset: disabled [ 55.295565][ T1994] Rebooting in 86400 seconds..