(unnamed net_device) (uninitialized): option min_links: invalid value (18446744073709551614)
(unnamed net_device) (uninitialized): option min_links: allowed values 0 - 2147483647
==================================================================
BUG: KASAN: slab-out-of-bounds in ntfs_filldir fs/ntfs/dir.c:1021 [inline]
BUG: KASAN: slab-out-of-bounds in ntfs_readdir+0xaa0/0x2b88 fs/ntfs/dir.c:1200
Read of size 1 at addr ffff0000ddda1761 by task syz.1.256/5880

CPU: 0 PID: 5880 Comm: syz.1.256 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025
Call trace:
 dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
 print_address_description+0x88/0x218 mm/kasan/report.c:316
 print_report+0x50/0x68 mm/kasan/report.c:420
 kasan_report+0xa8/0x100 mm/kasan/report.c:524
 __asan_report_load1_noabort+0x2c/0x38 mm/kasan/report_generic.c:348
 ntfs_filldir fs/ntfs/dir.c:1021 [inline]
 ntfs_readdir+0xaa0/0x2b88 fs/ntfs/dir.c:1200
 iterate_dir+0x1f0/0x4cc fs/readdir.c:-1
 __do_sys_getdents64 fs/readdir.c:369 [inline]
 __se_sys_getdents64 fs/readdir.c:354 [inline]
 __arm64_sys_getdents64+0x11c/0x318 fs/readdir.c:354
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Allocated by task 5880:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4c/0x80 mm/kasan/common.c:52
 kasan_save_alloc_info+0x28/0x34 mm/kasan/generic.c:505
 ____kasan_kmalloc mm/kasan/common.c:374 [inline]
 __kasan_kmalloc+0xa0/0xb8 mm/kasan/common.c:383
 kasan_kmalloc include/linux/kasan.h:211 [inline]
 __do_kmalloc_node mm/slab_common.c:936 [inline]
 __kmalloc+0xec/0x178 mm/slab_common.c:949
 kmalloc include/linux/slab.h:568 [inline]
 ntfs_readdir+0x63c/0x2b88 fs/ntfs/dir.c:1162
 iterate_dir+0x1f0/0x4cc fs/readdir.c:-1
 __do_sys_getdents64 fs/readdir.c:369 [inline]
 __se_sys_getdents64 fs/readdir.c:354 [inline]
 __arm64_sys_getdents64+0x11c/0x318 fs/readdir.c:354
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Last potentially related work creation:
 kasan_save_stack+0x40/0x70 mm/kasan/common.c:45
 __kasan_record_aux_stack+0xc0/0xdc mm/kasan/generic.c:486
 kasan_record_aux_stack_noalloc+0x14/0x20 mm/kasan/generic.c:496
 kvfree_call_rcu+0xb4/0x6f0 kernel/rcu/tree.c:3405
 cfg80211_update_known_bss+0x11c/0x7f8 net/wireless/scan.c:-1
 cfg80211_bss_update+0x150/0x1c7c net/wireless/scan.c:1853
 cfg80211_inform_single_bss_frame_data net/wireless/scan.c:2512 [inline]
 cfg80211_inform_bss_frame_data+0x884/0x10b4 net/wireless/scan.c:2545
 ieee80211_bss_info_update+0x5d0/0x9b4 net/mac80211/scan.c:190
 ieee80211_rx_bss_info net/mac80211/ibss.c:1120 [inline]
 ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1609 [inline]
 ieee80211_ibss_rx_queued_mgmt+0x86c/0x2490 net/mac80211/ibss.c:1638
 ieee80211_iface_process_skb net/mac80211/iface.c:1679 [inline]
 ieee80211_iface_work+0x598/0xa34 net/mac80211/iface.c:1733
 process_one_work+0x7f4/0x13a8 kernel/workqueue.c:2292
 worker_thread+0x8c8/0xfbc kernel/workqueue.c:2439
 kthread+0x250/0x2d8 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850

The buggy address belongs to the object at ffff0000ddda1700
 which belongs to the cache kmalloc-128 of size 128
The buggy address is located 97 bytes inside of
 128-byte region [ffff0000ddda1700, ffff0000ddda1780)

The buggy address belongs to the physical page:
page:00000000ac69525d refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11dda1
flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000200 dead000000000100 dead000000000122 ffff0000c0002300
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000ddda1600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff0000ddda1680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff0000ddda1700: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
                                                       ^
 ffff0000ddda1780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff0000ddda1800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================