[syzbot] [ntfs3?] WARNING in wnd_add_free_ext (2)
13 views
Skip to first unread message
syzbot
Jul 5, 2023, 11:39:08 AM7/5/23
to almaz.ale...@paragon-software.com, linux-...@vger.kernel.org, linux-...@vger.kernel.org, nt...@lists.linux.dev, syzkall...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: d528014517f2 Revert ".gitignore: ignore *.cover and *.mbx"
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1785ad94a80000
kernel config: https://syzkaller.appspot.com/x/.config?x=d576750da57ebbb5
dashboard link: https://syzkaller.appspot.com/bug?extid=5b2f934f08ab03d473ff
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: i386
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7bc7510fe41f/non_bootable_disk-d5280145.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/84fcf20c8c27/vmlinux-d5280145.xz
kernel image: https://storage.googleapis.com/syzbot-assets/1ab1ac572337/bzImage-d5280145.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+5b2f93...@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: CPU: 3 PID: 1577 at fs/ntfs3/bitmap.c:216 rb_insert_start fs/ntfs3/bitmap.c:216 [inline]
WARNING: CPU: 3 PID: 1577 at fs/ntfs3/bitmap.c:216 wnd_add_free_ext+0xd29/0x10e0 fs/ntfs3/bitmap.c:351
Modules linked in:
CPU: 3 PID: 1577 Comm: syz-executor.1 Not tainted 6.4.0-syzkaller-11478-gd528014517f2 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
RIP: 0010:rb_insert_start fs/ntfs3/bitmap.c:216 [inline]
RIP: 0010:wnd_add_free_ext+0xd29/0x10e0 fs/ntfs3/bitmap.c:351
Code: c1 ea 03 80 3c 02 00 0f 85 3b 02 00 00 49 8d 85 e0 00 00 00 4d 89 b5 00 01 00 00 48 89 44 24 10 e9 b9 f9 ff ff e8 87 1a cf fe <0f> 0b e9 40 fd ff ff e8 7b 1a cf fe 48 8b 7c 24 10 e8 31 19 5b 07
RSP: 0018:ffffc900079bec10 EFLAGS: 00010216
RAX: 000000000003c404 RBX: 0000000000000000 RCX: ffffc90028037000
RDX: 0000000000040000 RSI: ffffffff82b5c4e9 RDI: 0000000000000006
RBP: ffff888029643ba0 R08: 0000000000000006 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: ffff88804a80e1f0 R14: dffffc0000000000 R15: ffff888029643360
FS: 0000000000000000(0000) GS:ffff88802c900000(0063) knlGS:00000000f7f36b40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000edbfe800 CR3: 0000000074033000 CR4: 0000000000352ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
wnd_zone_set+0x159/0x1b0 fs/ntfs3/bitmap.c:1419
ntfs_look_for_free_space+0x479/0x740 fs/ntfs3/fsntfs.c:421
attr_allocate_clusters+0x3ee/0x6e0 fs/ntfs3/attrib.c:159
attr_set_size+0x1452/0x2ac0 fs/ntfs3/attrib.c:572
ntfs_extend_mft+0x296/0x430 fs/ntfs3/fsntfs.c:526
ntfs_look_free_mft+0x548/0xe60 fs/ntfs3/fsntfs.c:589
ni_create_attr_list+0xbdd/0x12c0 fs/ntfs3/frecord.c:873
ni_ins_attr_ext+0x3ca/0xba0 fs/ntfs3/frecord.c:968
ni_insert_attr+0x3ea/0x850 fs/ntfs3/frecord.c:1135
ni_insert_resident+0xd9/0x3a0 fs/ntfs3/frecord.c:1519
ntfs_set_ea+0xa3b/0x1380 fs/ntfs3/xattr.c:433
ntfs_save_wsl_perm+0x12b/0x3d0 fs/ntfs3/xattr.c:944
ntfs3_setattr+0xa2b/0xc30 fs/ntfs3/file.c:708
notify_change+0xb2c/0x1180 fs/attr.c:483
chown_common+0x57f/0x650 fs/open.c:768
do_fchownat+0x12a/0x1e0 fs/open.c:799
ksys_lchown include/linux/syscalls.h:1342 [inline]
__do_sys_lchown16 kernel/uid16.c:30 [inline]
__se_sys_lchown16 kernel/uid16.c:28 [inline]
__ia32_sys_lchown16+0xe3/0x110 kernel/uid16.c:28
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178
do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203
entry_SYSENTER_compat_after_hwframe+0x70/0x82
RIP: 0023:0xf7f3b579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000f7f365cc EFLAGS: 00000296 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000282 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
----------------
Code disassembly (best guess), 2 bytes skipped:
0: 10 06 adc %al,(%rsi)
2: 03 74 b4 01 add 0x1(%rsp,%rsi,4),%esi
6: 10 07 adc %al,(%rdi)
8: 03 74 b0 01 add 0x1(%rax,%rsi,4),%esi
c: 10 08 adc %cl,(%rax)
e: 03 74 d8 01 add 0x1(%rax,%rbx,8),%esi
1e: 00 51 52 add %dl,0x52(%rcx)
21: 55 push %rbp
22: 89 e5 mov %esp,%ebp
24: 0f 34 sysenter
26: cd 80 int $0x80
* 28: 5d pop %rbp <-- trapping instruction
29: 5a pop %rdx
2a: 59 pop %rcx
2b: c3 retq
2c: 90 nop
2d: 90 nop
2e: 90 nop
2f: 90 nop
30: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
37: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: d528014517f2 Revert ".gitignore: ignore *.cover and *.mbx"
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1785ad94a80000
kernel config: https://syzkaller.appspot.com/x/.config?x=d576750da57ebbb5
dashboard link: https://syzkaller.appspot.com/bug?extid=5b2f934f08ab03d473ff
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: i386
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7bc7510fe41f/non_bootable_disk-d5280145.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/84fcf20c8c27/vmlinux-d5280145.xz
kernel image: https://storage.googleapis.com/syzbot-assets/1ab1ac572337/bzImage-d5280145.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+5b2f93...@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: CPU: 3 PID: 1577 at fs/ntfs3/bitmap.c:216 rb_insert_start fs/ntfs3/bitmap.c:216 [inline]
WARNING: CPU: 3 PID: 1577 at fs/ntfs3/bitmap.c:216 wnd_add_free_ext+0xd29/0x10e0 fs/ntfs3/bitmap.c:351
Modules linked in:
CPU: 3 PID: 1577 Comm: syz-executor.1 Not tainted 6.4.0-syzkaller-11478-gd528014517f2 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
RIP: 0010:rb_insert_start fs/ntfs3/bitmap.c:216 [inline]
RIP: 0010:wnd_add_free_ext+0xd29/0x10e0 fs/ntfs3/bitmap.c:351
Code: c1 ea 03 80 3c 02 00 0f 85 3b 02 00 00 49 8d 85 e0 00 00 00 4d 89 b5 00 01 00 00 48 89 44 24 10 e9 b9 f9 ff ff e8 87 1a cf fe <0f> 0b e9 40 fd ff ff e8 7b 1a cf fe 48 8b 7c 24 10 e8 31 19 5b 07
RSP: 0018:ffffc900079bec10 EFLAGS: 00010216
RAX: 000000000003c404 RBX: 0000000000000000 RCX: ffffc90028037000
RDX: 0000000000040000 RSI: ffffffff82b5c4e9 RDI: 0000000000000006
RBP: ffff888029643ba0 R08: 0000000000000006 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: ffff88804a80e1f0 R14: dffffc0000000000 R15: ffff888029643360
FS: 0000000000000000(0000) GS:ffff88802c900000(0063) knlGS:00000000f7f36b40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000edbfe800 CR3: 0000000074033000 CR4: 0000000000352ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
wnd_zone_set+0x159/0x1b0 fs/ntfs3/bitmap.c:1419
ntfs_look_for_free_space+0x479/0x740 fs/ntfs3/fsntfs.c:421
attr_allocate_clusters+0x3ee/0x6e0 fs/ntfs3/attrib.c:159
attr_set_size+0x1452/0x2ac0 fs/ntfs3/attrib.c:572
ntfs_extend_mft+0x296/0x430 fs/ntfs3/fsntfs.c:526
ntfs_look_free_mft+0x548/0xe60 fs/ntfs3/fsntfs.c:589
ni_create_attr_list+0xbdd/0x12c0 fs/ntfs3/frecord.c:873
ni_ins_attr_ext+0x3ca/0xba0 fs/ntfs3/frecord.c:968
ni_insert_attr+0x3ea/0x850 fs/ntfs3/frecord.c:1135
ni_insert_resident+0xd9/0x3a0 fs/ntfs3/frecord.c:1519
ntfs_set_ea+0xa3b/0x1380 fs/ntfs3/xattr.c:433
ntfs_save_wsl_perm+0x12b/0x3d0 fs/ntfs3/xattr.c:944
ntfs3_setattr+0xa2b/0xc30 fs/ntfs3/file.c:708
notify_change+0xb2c/0x1180 fs/attr.c:483
chown_common+0x57f/0x650 fs/open.c:768
do_fchownat+0x12a/0x1e0 fs/open.c:799
ksys_lchown include/linux/syscalls.h:1342 [inline]
__do_sys_lchown16 kernel/uid16.c:30 [inline]
__se_sys_lchown16 kernel/uid16.c:28 [inline]
__ia32_sys_lchown16+0xe3/0x110 kernel/uid16.c:28
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178
do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203
entry_SYSENTER_compat_after_hwframe+0x70/0x82
RIP: 0023:0xf7f3b579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000f7f365cc EFLAGS: 00000296 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000282 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
----------------
Code disassembly (best guess), 2 bytes skipped:
0: 10 06 adc %al,(%rsi)
2: 03 74 b4 01 add 0x1(%rsp,%rsi,4),%esi
6: 10 07 adc %al,(%rdi)
8: 03 74 b0 01 add 0x1(%rax,%rsi,4),%esi
c: 10 08 adc %cl,(%rax)
e: 03 74 d8 01 add 0x1(%rax,%rbx,8),%esi
1e: 00 51 52 add %dl,0x52(%rcx)
21: 55 push %rbp
22: 89 e5 mov %esp,%ebp
24: 0f 34 sysenter
26: cd 80 int $0x80
* 28: 5d pop %rbp <-- trapping instruction
29: 5a pop %rdx
2a: 59 pop %rcx
2b: c3 retq
2c: 90 nop
2d: 90 nop
2e: 90 nop
2f: 90 nop
30: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
37: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Aug 5, 2023, 11:48:15 PM8/5/23
to almaz.ale...@paragon-software.com, linux-...@vger.kernel.org, linux-...@vger.kernel.org, nt...@lists.linux.dev, syzkall...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 86d7896480b0 Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=17f7a295a80000
kernel config: https://syzkaller.appspot.com/x/.config?x=21762bc8221a1ed3
dashboard link: https://syzkaller.appspot.com/bug?extid=5b2f934f08ab03d473ff
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15f0b171a80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=129e5713a80000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/136ba9602d1f/disk-86d78964.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/dcd3ab5ec39d/vmlinux-86d78964.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3041f85d1a44/Image-86d78964.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/02dc44470901/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+5b2f93...@syzkaller.appspotmail.com
el0_svc_common+0x138/0x244 arch/arm64/kernel/syscall.c:139
do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:188
el0_svc+0x4c/0x160 arch/arm64/kernel/entry-common.c:647
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5986 at fs/ntfs3/bitmap.c:216 wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
Modules linked in:
CPU: 0 PID: 5986 Comm: syz-executor496 Not tainted 6.5.0-rc4-syzkaller-g86d7896480b0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
lr : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
sp : ffff8000969a71e0
x29: ffff8000969a7210 x28: 1fffe0001c052c4b x27: dfff800000000000
x26: dfff800000000000 x25: ffff0000e0296278 x24: ffff0000e02961e0
x23: ffff0000e0296258 x22: 00000000000001e7 x21: ffff0000dbdae2d0
x20: ffff0000e0296240 x19: 00000000000001e7 x18: 1fffe0003683adc6
x17: 0000000000000000 x16: ffff80008a57089c x15: 0000000000000001
x14: 000000008a56c67c x13: 0000000071fb52ff x12: 00000000a7effed4
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : ffff0000c583d340 x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000000040 x4 : 0000000000000000 x3 : 0000000000000001
x2 : ffffffffffffffc0 x1 : 00000000000001e7 x0 : 00000000000001e7
Call trace:
wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
wnd_set_free+0x570/0x5cc fs/ntfs3/bitmap.c:749
mark_as_free_ex+0x134/0x310 fs/ntfs3/fsntfs.c:2485
run_deallocate_ex+0x1e0/0x4ac fs/ntfs3/attrib.c:122
attr_set_size+0x1128/0x342c fs/ntfs3/attrib.c:750
ntfs_truncate fs/ntfs3/file.c:393 [inline]
ntfs3_setattr+0x424/0x8fc fs/ntfs3/file.c:682
notify_change+0xa84/0xd20 fs/attr.c:483
do_truncate+0x1c0/0x28c fs/open.c:66
vfs_truncate+0x2b8/0x360 fs/open.c:112
do_sys_truncate+0xec/0x1b4 fs/open.c:135
__do_sys_truncate fs/open.c:147 [inline]
__se_sys_truncate fs/open.c:145 [inline]
__arm64_sys_truncate+0x5c/0x70 fs/open.c:145
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x244 arch/arm64/kernel/syscall.c:139
do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:188
el0_svc+0x4c/0x160 arch/arm64/kernel/entry-common.c:647
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
irq event stamp: 20656
hardirqs last enabled at (20655): [<ffff800080b723d4>] lookup_bh_lru fs/buffer.c:1403 [inline]
hardirqs last enabled at (20655): [<ffff800080b723d4>] __find_get_block+0x1a0/0xd18 fs/buffer.c:1415
hardirqs last disabled at (20656): [<ffff80008a56c1dc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:407
softirqs last enabled at (19642): [<ffff8000800218ec>] softirq_handle_end kernel/softirq.c:399 [inline]
softirqs last enabled at (19642): [<ffff8000800218ec>] __do_softirq+0xac0/0xd54 kernel/softirq.c:582
softirqs last disabled at (19633): [<ffff80008002aad4>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5986 at fs/ntfs3/bitmap.c:216 wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
Modules linked in:
CPU: 0 PID: 5986 Comm: syz-executor496 Tainted: G W 6.5.0-rc4-syzkaller-g86d7896480b0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
lr : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
sp : ffff8000969a71e0
x29: ffff8000969a7210 x28: 1fffe0001c052c57 x27: dfff800000000000
x26: dfff800000000000 x25: ffff0000e02962d8 x24: ffff0000e02961e0
x23: ffff0000e02962b8 x22: 00000000000001e7 x21: ffff0000dbdae2d0
x20: ffff0000e02962a0 x19: 00000000000001e7 x18: 1fffe0003683adc6
x17: 0000000000000000 x16: ffff80008a57089c x15: 0000000000000001
x14: 000000008a56c67c x13: 0000000071fb52ff x12: 00000000a7effed4
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : ffff0000c583d340 x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000000040 x4 : 0000000000000000 x3 : 0000000000000001
x2 : ffffffffffffffc0 x1 : 00000000000001e7 x0 : 00000000000001e7
Call trace:
wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
wnd_set_free+0x570/0x5cc fs/ntfs3/bitmap.c:749
mark_as_free_ex+0x134/0x310 fs/ntfs3/fsntfs.c:2485
run_deallocate_ex+0x1e0/0x4ac fs/ntfs3/attrib.c:122
attr_set_size+0x1128/0x342c fs/ntfs3/attrib.c:750
ntfs_truncate fs/ntfs3/file.c:393 [inline]
ntfs3_setattr+0x424/0x8fc fs/ntfs3/file.c:682
notify_change+0xa84/0xd20 fs/attr.c:483
do_truncate+0x1c0/0x28c fs/open.c:66
vfs_truncate+0x2b8/0x360 fs/open.c:112
do_sys_truncate+0xec/0x1b4 fs/open.c:135
__do_sys_truncate fs/open.c:147 [inline]
__se_sys_truncate fs/open.c:145 [inline]
__arm64_sys_truncate+0x5c/0x70 fs/open.c:145
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x244 arch/arm64/kernel/syscall.c:139
do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:188
el0_svc+0x4c/0x160 arch/arm64/kernel/entry-common.c:647
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
irq event stamp: 21126
hardirqs last enabled at (21125): [<ffff800080b723d4>] lookup_bh_lru fs/buffer.c:1403 [inline]
hardirqs last enabled at (21125): [<ffff800080b723d4>] __find_get_block+0x1a0/0xd18 fs/buffer.c:1415
hardirqs last disabled at (21126): [<ffff80008a56c1dc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:407
softirqs last enabled at (20772): [<ffff8000800218ec>] softirq_handle_end kernel/softirq.c:399 [inline]
softirqs last enabled at (20772): [<ffff8000800218ec>] __do_softirq+0xac0/0xd54 kernel/softirq.c:582
softirqs last disabled at (20659): [<ffff80008002aad4>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5986 at fs/ntfs3/bitmap.c:216 wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
Modules linked in:
CPU: 0 PID: 5986 Comm: syz-executor496 Tainted: G W 6.5.0-rc4-syzkaller-g86d7896480b0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
lr : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
sp : ffff8000969a71e0
x29: ffff8000969a7210 x28: 1fffe0001c052c63 x27: dfff800000000000
x26: dfff800000000000 x25: ffff0000e0296338 x24: ffff0000e02961e0
x23: ffff0000e0296318 x22: 00000000000001e7 x21: ffff0000dbdae2d0
x20: ffff0000e0296300 x19: 00000000000001e7 x18: 1fffe0003683adc6
x17: 0000000000000000 x16: ffff80008a57089c x15: 0000000000000001
x14: 000000008a56c67c x13: 0000000071fb52ff x12: 00000000a7effed4
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : ffff0000c583d340 x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000000040 x4 : 0000000000000000 x3 : 0000000000000001
x2 : ffffffffffffffc0 x1 : 00000000000001e7 x0 : 00000000000001e7
Call trace:
wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
wnd_set_free+0x570/0x5cc fs/ntfs3/bitmap.c:749
mark_as_free_ex+0x134/0x310 fs/ntfs3/fsntfs.c:2485
run_deallocate_ex+0x1e0/0x4ac fs/ntfs3/attrib.c:122
attr_set_size+0x1128/0x342c fs/ntfs3/attrib.c:750
ntfs_truncate fs/ntfs3/file.c:393 [inline]
ntfs3_setattr+0x424/0x8fc fs/ntfs3/file.c:682
notify_change+0xa84/0xd20 fs/attr.c:483
do_truncate+0x1c0/0x28c fs/open.c:66
vfs_truncate+0x2b8/0x360 fs/open.c:112
do_sys_truncate+0xec/0x1b4 fs/open.c:135
__do_sys_truncate fs/open.c:147 [inline]
__se_sys_truncate fs/open.c:145 [inline]
__arm64_sys_truncate+0x5c/0x70 fs/open.c:145
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x244 arch/arm64/kernel/syscall.c:139
do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:188
el0_svc+0x4c/0x160 arch/arm64/kernel/entry-common.c:647
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
irq event stamp: 21568
hardirqs last enabled at (21567): [<ffff800080b723d4>] lookup_bh_lru fs/buffer.c:1403 [inline]
hardirqs last enabled at (21567): [<ffff800080b723d4>] __find_get_block+0x1a0/0xd18 fs/buffer.c:1415
hardirqs last disabled at (21568): [<ffff80008a56c1dc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:407
softirqs last enabled at (21214): [<ffff8000800218ec>] softirq_handle_end kernel/softirq.c:399 [inline]
softirqs last enabled at (21214): [<ffff8000800218ec>] __do_softirq+0xac0/0xd54 kernel/softirq.c:582
softirqs last disabled at (21129): [<ffff80008002aad4>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5986 at fs/ntfs3/bitmap.c:216 wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
Modules linked in:
CPU: 0 PID: 5986 Comm: syz-executor496 Tainted: G W 6.5.0-rc4-syzkaller-g86d7896480b0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
lr : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
sp : ffff8000969a71e0
x29: ffff8000969a7210 x28: 1fffe0001c052c6f x27: dfff800000000000
x26: dfff800000000000 x25: ffff0000e0296398 x24: ffff0000e02961e0
x23: ffff0000e0296378 x22: 00000000000001e7 x21: ffff0000dbdae2d0
x20: ffff0000e0296360 x19: 00000000000001e7 x18: 1fffe0003683adc6
x17: 0000000000000000 x16: ffff80008a57089c x15: 0000000000000001
x14: 000000008a56c67c x13: 0000000071fb52ff x12: 00000000a7effed4
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : ffff0000c583d340 x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000000040 x4 : 0000000000000000 x3 : 0000000000000001
x2 : ffffffffffffffc0 x1 : 00000000000001e7 x0 : 00000000000001e7
Call trace:
wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
wnd_set_free+0x570/0x5cc fs/ntfs3/bitmap.c:749
mark_as_free_ex+0x134/0x310 fs/ntfs3/fsntfs.c:2485
run_deallocate_ex+0x1e0/0x4ac fs/ntfs3/attrib.c:122
attr_set_size+0x1128/0x342c fs/ntfs3/attrib.c:750
ntfs_truncate fs/ntfs3/file.c:393 [inline]
ntfs3_setattr+0x424/0x8fc fs/ntfs3/file.c:682
notify_change+0xa84/0xd20 fs/attr.c:483
do_truncate+0x1c0/0x28c fs/open.c:66
vfs_truncate+0x2b8/0x360 fs/open.c:112
do_sys_truncate+0xec/0x1b4 fs/open.c:135
__do_sys_truncate fs/open.c:147 [inline]
__se_sys_truncate fs/open.c:145 [inline]
__arm64_sys_truncate+0x5c/0x70 fs/open.c:145
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x244 arch/arm64/kernel/syscall.c:139
do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:188
el0_svc+0x4c/0x160 arch/arm64/kernel/entry-common.c:647
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
irq event stamp: 21948
hardirqs last enabled at (21947): [<ffff800080b723d4>] lookup_bh_lru fs/buffer.c:1403 [inline]
hardirqs last enabled at (21947): [<ffff800080b723d4>] __find_get_block+0x1a0/0xd18 fs/buffer.c:1415
hardirqs last disabled at (21948): [<ffff80008a56c1dc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:407
softirqs last enabled at (21584): [<ffff8000800218ec>] softirq_handle_end kernel/softirq.c:399 [inline]
softirqs last enabled at (21584): [<ffff8000800218ec>] __do_softirq+0xac0/0xd54 kernel/softirq.c:582
softirqs last disabled at (21571): [<ffff80008002aad4>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5986 at fs/ntfs3/bitmap.c:216 wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
Modules linked in:
CPU: 0 PID: 5986 Comm: syz-executor496 Tainted: G W 6.5.0-rc4-syzkaller-g86d7896480b0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
lr : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
sp : ffff8000969a71e0
x29: ffff8000969a7210 x28: 1fffe0001c052c7b x27: dfff800000000000
x26: dfff800000000000 x25: ffff0000e02963f8 x24: ffff0000e02961e0
x23: ffff0000e02963d8 x22: 00000000000001e7 x21: ffff0000dbdae2d0
x20: ffff0000e02963c0 x19: 00000000000001e7 x18: 1fffe0003683adc6
x17: 0000000000000000 x16: ffff80008a57089c x15: 0000000000000001
x14: 000000008a56c67c x13: 0000000071fb52ff x12: 00000000a7effed4
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : ffff0000c583d340 x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000000040 x4 : 0000000000000000 x3 : 0000000000000001
x2 : ffffffffffffffc0 x1 : 00000000000001e7 x0 : 00000000000001e7
Call trace:
wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
wnd_set_free+0x570/0x5cc fs/ntfs3/bitmap.c:749
mark_as_free_ex+0x134/0x310 fs/ntfs3/fsntfs.c:2485
run_deallocate_ex+0x1e0/0x4ac fs/ntfs3/attrib.c:122
attr_set_size+0x1128/0x342c fs/ntfs3/attrib.c:750
ntfs_truncate fs/ntfs3/file.c:393 [inline]
ntfs3_setattr+0x424/0x8fc fs/ntfs3/file.c:682
notify_change+0xa84/0xd20 fs/attr.c:483
do_truncate+0x1c0/0x28c fs/open.c:66
vfs_truncate+0x2b8/0x360 fs/open.c:112
do_sys_truncate+0xec/0x1b4 fs/open.c:135
__do_sys_truncate fs/open.c:147 [inline]
__se_sys_truncate fs/open.c:145 [inline]
__arm64_sys_truncate+0x5c/0x70 fs/open.c:145
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x244 arch/arm64/kernel/syscall.c:139
do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:188
el0_svc+0x4c/0x160 arch/arm64/kernel/entry-common.c:647
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
irq event stamp: 22332
hardirqs last enabled at (22331): [<ffff800080b723d4>] lookup_bh_lru fs/buffer.c:1403 [inline]
hardirqs last enabled at (22331): [<ffff800080b723d4>] __find_get_block+0x1a0/0xd18 fs/buffer.c:1415
hardirqs last disabled at (22332): [<ffff80008a56c1dc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:407
softirqs last enabled at (21958): [<ffff8000800218ec>] softirq_handle_end kernel/softirq.c:399 [inline]
softirqs last enabled at (21958): [<ffff8000800218ec>] __do_softirq+0xac0/0xd54 kernel/softirq.c:582
softirqs last disabled at (21951): [<ffff80008002aad4>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5986 at fs/ntfs3/bitmap.c:216 wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
Modules linked in:
CPU: 0 PID: 5986 Comm: syz-executor496 Tainted: G W 6.5.0-rc4-syzkaller-g86d7896480b0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
lr : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
sp : ffff8000969a71e0
x29: ffff8000969a7210 x28: 1fffe0001c052c87 x27: dfff800000000000
x26: dfff800000000000 x25: ffff0000e0296458 x24: ffff0000e02961e0
x23: ffff0000e0296438 x22: 00000000000001e7 x21: ffff0000dbdae2d0
x20: ffff0000e0296420 x19: 00000000000001e7 x18: 1fffe0003683adc6
x17: 0000000000000000 x16: ffff80008a57089c x15: 0000000000000001
x14: 000000008a56c67c x13: 0000000071fb52ff x12: 00000000a7effed4
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : ffff0000c583d340 x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000000040 x4 : 0000000000000000 x3 : 0000000000000001
x2 : ffffffffffffffc0 x1 : 00000000000001e7 x0 : 00000000000001e7
Call trace:
wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
wnd_set_free+0x570/0x5cc fs/ntfs3/bitmap.c:749
mark_as_free_ex+0x134/0x310 fs/ntfs3/fsntfs.c:2485
run_deallocate_ex+0x1e0/0x4ac fs/ntfs3/attrib.c:122
attr_set_size+0x1128/0x342c fs/ntfs3/attrib.c:750
ntfs_truncate fs/ntfs3/file.c:393 [inline]
ntfs3_setattr+0x424/0x8fc fs/ntfs3/file.c:682
notify_change+0xa84/0xd20 fs/attr.c:483
do_truncate+0x1c0/0x28c fs/open.c:66
vfs_truncate+0x2b8/0x360 fs/open.c:112
do_sys_truncate+0xec/0x1b4 fs/open.c:135
__do_sys_truncate fs/open.c:147 [inline]
__se_sys_truncate fs/open.c:145 [inline]
__arm64_sys_truncate+0x5c/0x70 fs/open.c:145
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x244 arch/arm64/kernel/syscall.c:139
do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:188
el0_svc+0x4c/0x160 arch/arm64/kernel/entry-common.c:647
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
irq event stamp: 22732
hardirqs last enabled at (22731): [<ffff800080b723d4>] lookup_bh_lru fs/buffer.c:1403 [inline]
hardirqs last enabled at (22731): [<ffff800080b723d4>] __find_get_block+0x1a0/0xd18 fs/buffer.c:1415
hardirqs last disabled at (22732): [<ffff80008a56c1dc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:407
softirqs last enabled at (22354): [<ffff8000800218ec>] softirq_handle_end kernel/softirq.c:399 [inline]
softirqs last enabled at (22354): [<ffff8000800218ec>] __do_softirq+0xac0/0xd54 kernel/softirq.c:582
softirqs last disabled at (22335): [<ffff80008002aad4>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5986 at fs/ntfs3/bitmap.c:216 wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
Modules linked in:
CPU: 0 PID: 5986 Comm: syz-executor496 Tainted: G W 6.5.0-rc4-syzkaller-g86d7896480b0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
lr : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
sp : ffff8000969a71e0
x29: ffff8000969a7210 x28: 1fffe0001c052c93 x27: dfff800000000000
x26: dfff800000000000 x25: ffff0000e02964b8 x24: ffff0000e02961e0
x23: ffff0000e0296498 x22: 00000000000001e7 x21: ffff0000dbdae2d0
x20: ffff0000e0296480 x19: 00000000000001e7 x18: 1fffe0003683adc6
x17: 0000000000000000 x16: ffff80008a57089c x15: 0000000000000001
x14: 000000008a56c67c x13: 0000000071fb52ff x12: 00000000a7effed4
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : ffff0000c583d340 x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000000040 x4 : 0000000000000000 x3 : 0000000000000001
x2 : ffffffffffffffc0 x1 : 00000000000001e7 x0 : 00000000000001e7
Call trace:
wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
wnd_set_free+0x570/0x5cc fs/ntfs3/bitmap.c:749
mark_as_free_ex+0x134/0x310 fs/ntfs3/fsntfs.c:2485
run_deallocate_ex+0x1e0/0x4ac fs/ntfs3/attrib.c:122
attr_set_size+0x1128/0x342c fs/ntfs3/attrib.c:750
ntfs_truncate fs/ntfs3/file.c:393 [inline]
ntfs3_setattr+0x424/0x8fc fs/ntfs3/file.c:682
notify_change+0xa84/0xd20 fs/attr.c:483
do_truncate+0x1c0/0x28c fs/open.c:66
vfs_truncate+0x2b8/0x360 fs/open.c:112
do_sys_truncate+0xec/0x1b4 fs/open.c:135
__do_sys_truncate fs/open.c:147 [inline]
__se_sys_truncate fs/open.c:145 [inline]
__arm64_sys_truncate+0x5c/0x70 fs/open.c:145
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x244 arch/arm64/kernel/syscall.c:139
do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:188
el0_svc+0x4c/0x160 arch/arm64/kernel/entry-common.c:647
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
irq event stamp: 23126
hardirqs last enabled at (23125): [<ffff800080b723d4>] lookup_bh_lru fs/buffer.c:1403 [inline]
hardirqs last enabled at (23125): [<ffff800080b723d4>] __find_get_block+0x1a0/0xd18 fs/buffer.c:1415
hardirqs last disabled at (23126): [<ffff80008a56c1dc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:407
softirqs last enabled at (22744): [<ffff8000800218ec>] softirq_handle_end kernel/softirq.c:399 [inline]
softirqs last enabled at (22744): [<ffff8000800218ec>] __do_softirq+0xac0/0xd54 kernel/softirq.c:582
softirqs last disabled at (22735): [<ffff80008002aad4>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5986 at fs/ntfs3/bitmap.c:216 wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
Modules linked in:
CPU: 0 PID: 5986 Comm: syz-executor496 Tainted: G W 6.5.0-rc4-syzkaller-g86d7896480b0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
lr : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
sp : ffff8000969a71e0
x29: ffff8000969a7210 x28: 1fffe0001c052c9f x27: dfff800000000000
x26: dfff800000000000 x25: ffff0000e0296518 x24: ffff0000e02961e0
x23: ffff0000e02964f8 x22: 00000000000001e7 x21: ffff0000dbdae2d0
x20: ffff0000e02964e0 x19: 00000000000001e7 x18: 1fffe0003683adc6
x17: 0000000000000000 x16: ffff80008a57089c x15: 0000000000000001
x14: 1ffff00011d18abf x13: 0000000000000000 x12: 0000000000000003
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : ffff0000c583d340 x7 : 0000000000000000 x6 : ffff800080063870
x5 : ffff0000d477e9c8 x4 : 0000000000000000 x3 : 0000000000000000
x2 : ffffffffffffffc0 x1 : 00000000000001e7 x0 : 00000000000001e7
Call trace:
wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
wnd_set_free+0x570/0x5cc fs/ntfs3/bitmap.c:749
mark_as_free_ex+0x1c8/0x310 fs/ntfs3/fsntfs.c:2495
run_deallocate_ex+0x1e0/0x4ac fs/ntfs3/attrib.c:122
attr_set_size+0x1128/0x342c fs/ntfs3/attrib.c:750
ntfs_truncate fs/ntfs3/file.c:393 [inline]
ntfs3_setattr+0x424/0x8fc fs/ntfs3/file.c:682
notify_change+0xa84/0xd20 fs/attr.c:483
do_truncate+0x1c0/0x28c fs/open.c:66
vfs_truncate+0x2b8/0x360 fs/open.c:112
do_sys_truncate+0xec/0x1b4 fs/open.c:135
__do_sys_truncate fs/open.c:147 [inline]
__se_sys_truncate fs/open.c:145 [inline]
__arm64_sys_truncate+0x5c/0x70 fs/open.c:145
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x244 arch/arm64/kernel/syscall.c:139
do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:188
el0_svc+0x4c/0x160 arch/arm64/kernel/entry-common.c:647
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
irq event stamp: 23528
hardirqs last enabled at (23527): [<ffff80008a65a7c0>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last enabled at (23527): [<ffff80008a65a7c0>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:194
hardirqs last disabled at (23528): [<ffff80008a56c1dc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:407
softirqs last enabled at (23142): [<ffff8000800218ec>] softirq_handle_end kernel/softirq.c:399 [inline]
softirqs last enabled at (23142): [<ffff8000800218ec>] __do_softirq+0xac0/0xd54 kernel/softirq.c:582
softirqs last disabled at (23129): [<ffff80008002aad4>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
---[ end trace 0000000000000000 ]---
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: 86d7896480b0 Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=17f7a295a80000
kernel config: https://syzkaller.appspot.com/x/.config?x=21762bc8221a1ed3
dashboard link: https://syzkaller.appspot.com/bug?extid=5b2f934f08ab03d473ff
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15f0b171a80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=129e5713a80000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/136ba9602d1f/disk-86d78964.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/dcd3ab5ec39d/vmlinux-86d78964.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3041f85d1a44/Image-86d78964.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/02dc44470901/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+5b2f93...@syzkaller.appspotmail.com
do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:188
el0_svc+0x4c/0x160 arch/arm64/kernel/entry-common.c:647
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5986 at fs/ntfs3/bitmap.c:216 wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
Modules linked in:
CPU: 0 PID: 5986 Comm: syz-executor496 Not tainted 6.5.0-rc4-syzkaller-g86d7896480b0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
lr : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
sp : ffff8000969a71e0
x29: ffff8000969a7210 x28: 1fffe0001c052c4b x27: dfff800000000000
x26: dfff800000000000 x25: ffff0000e0296278 x24: ffff0000e02961e0
x23: ffff0000e0296258 x22: 00000000000001e7 x21: ffff0000dbdae2d0
x20: ffff0000e0296240 x19: 00000000000001e7 x18: 1fffe0003683adc6
x17: 0000000000000000 x16: ffff80008a57089c x15: 0000000000000001
x14: 000000008a56c67c x13: 0000000071fb52ff x12: 00000000a7effed4
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : ffff0000c583d340 x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000000040 x4 : 0000000000000000 x3 : 0000000000000001
x2 : ffffffffffffffc0 x1 : 00000000000001e7 x0 : 00000000000001e7
Call trace:
wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
wnd_set_free+0x570/0x5cc fs/ntfs3/bitmap.c:749
mark_as_free_ex+0x134/0x310 fs/ntfs3/fsntfs.c:2485
run_deallocate_ex+0x1e0/0x4ac fs/ntfs3/attrib.c:122
attr_set_size+0x1128/0x342c fs/ntfs3/attrib.c:750
ntfs_truncate fs/ntfs3/file.c:393 [inline]
ntfs3_setattr+0x424/0x8fc fs/ntfs3/file.c:682
notify_change+0xa84/0xd20 fs/attr.c:483
do_truncate+0x1c0/0x28c fs/open.c:66
vfs_truncate+0x2b8/0x360 fs/open.c:112
do_sys_truncate+0xec/0x1b4 fs/open.c:135
__do_sys_truncate fs/open.c:147 [inline]
__se_sys_truncate fs/open.c:145 [inline]
__arm64_sys_truncate+0x5c/0x70 fs/open.c:145
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x244 arch/arm64/kernel/syscall.c:139
do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:188
el0_svc+0x4c/0x160 arch/arm64/kernel/entry-common.c:647
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
irq event stamp: 20656
hardirqs last enabled at (20655): [<ffff800080b723d4>] lookup_bh_lru fs/buffer.c:1403 [inline]
hardirqs last enabled at (20655): [<ffff800080b723d4>] __find_get_block+0x1a0/0xd18 fs/buffer.c:1415
hardirqs last disabled at (20656): [<ffff80008a56c1dc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:407
softirqs last enabled at (19642): [<ffff8000800218ec>] softirq_handle_end kernel/softirq.c:399 [inline]
softirqs last enabled at (19642): [<ffff8000800218ec>] __do_softirq+0xac0/0xd54 kernel/softirq.c:582
softirqs last disabled at (19633): [<ffff80008002aad4>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5986 at fs/ntfs3/bitmap.c:216 wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
Modules linked in:
CPU: 0 PID: 5986 Comm: syz-executor496 Tainted: G W 6.5.0-rc4-syzkaller-g86d7896480b0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
lr : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
sp : ffff8000969a71e0
x29: ffff8000969a7210 x28: 1fffe0001c052c57 x27: dfff800000000000
x26: dfff800000000000 x25: ffff0000e02962d8 x24: ffff0000e02961e0
x23: ffff0000e02962b8 x22: 00000000000001e7 x21: ffff0000dbdae2d0
x20: ffff0000e02962a0 x19: 00000000000001e7 x18: 1fffe0003683adc6
x17: 0000000000000000 x16: ffff80008a57089c x15: 0000000000000001
x14: 000000008a56c67c x13: 0000000071fb52ff x12: 00000000a7effed4
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : ffff0000c583d340 x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000000040 x4 : 0000000000000000 x3 : 0000000000000001
x2 : ffffffffffffffc0 x1 : 00000000000001e7 x0 : 00000000000001e7
Call trace:
wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
wnd_set_free+0x570/0x5cc fs/ntfs3/bitmap.c:749
mark_as_free_ex+0x134/0x310 fs/ntfs3/fsntfs.c:2485
run_deallocate_ex+0x1e0/0x4ac fs/ntfs3/attrib.c:122
attr_set_size+0x1128/0x342c fs/ntfs3/attrib.c:750
ntfs_truncate fs/ntfs3/file.c:393 [inline]
ntfs3_setattr+0x424/0x8fc fs/ntfs3/file.c:682
notify_change+0xa84/0xd20 fs/attr.c:483
do_truncate+0x1c0/0x28c fs/open.c:66
vfs_truncate+0x2b8/0x360 fs/open.c:112
do_sys_truncate+0xec/0x1b4 fs/open.c:135
__do_sys_truncate fs/open.c:147 [inline]
__se_sys_truncate fs/open.c:145 [inline]
__arm64_sys_truncate+0x5c/0x70 fs/open.c:145
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x244 arch/arm64/kernel/syscall.c:139
do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:188
el0_svc+0x4c/0x160 arch/arm64/kernel/entry-common.c:647
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
irq event stamp: 21126
hardirqs last enabled at (21125): [<ffff800080b723d4>] lookup_bh_lru fs/buffer.c:1403 [inline]
hardirqs last enabled at (21125): [<ffff800080b723d4>] __find_get_block+0x1a0/0xd18 fs/buffer.c:1415
hardirqs last disabled at (21126): [<ffff80008a56c1dc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:407
softirqs last enabled at (20772): [<ffff8000800218ec>] softirq_handle_end kernel/softirq.c:399 [inline]
softirqs last enabled at (20772): [<ffff8000800218ec>] __do_softirq+0xac0/0xd54 kernel/softirq.c:582
softirqs last disabled at (20659): [<ffff80008002aad4>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5986 at fs/ntfs3/bitmap.c:216 wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
Modules linked in:
CPU: 0 PID: 5986 Comm: syz-executor496 Tainted: G W 6.5.0-rc4-syzkaller-g86d7896480b0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
lr : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
sp : ffff8000969a71e0
x29: ffff8000969a7210 x28: 1fffe0001c052c63 x27: dfff800000000000
x26: dfff800000000000 x25: ffff0000e0296338 x24: ffff0000e02961e0
x23: ffff0000e0296318 x22: 00000000000001e7 x21: ffff0000dbdae2d0
x20: ffff0000e0296300 x19: 00000000000001e7 x18: 1fffe0003683adc6
x17: 0000000000000000 x16: ffff80008a57089c x15: 0000000000000001
x14: 000000008a56c67c x13: 0000000071fb52ff x12: 00000000a7effed4
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : ffff0000c583d340 x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000000040 x4 : 0000000000000000 x3 : 0000000000000001
x2 : ffffffffffffffc0 x1 : 00000000000001e7 x0 : 00000000000001e7
Call trace:
wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
wnd_set_free+0x570/0x5cc fs/ntfs3/bitmap.c:749
mark_as_free_ex+0x134/0x310 fs/ntfs3/fsntfs.c:2485
run_deallocate_ex+0x1e0/0x4ac fs/ntfs3/attrib.c:122
attr_set_size+0x1128/0x342c fs/ntfs3/attrib.c:750
ntfs_truncate fs/ntfs3/file.c:393 [inline]
ntfs3_setattr+0x424/0x8fc fs/ntfs3/file.c:682
notify_change+0xa84/0xd20 fs/attr.c:483
do_truncate+0x1c0/0x28c fs/open.c:66
vfs_truncate+0x2b8/0x360 fs/open.c:112
do_sys_truncate+0xec/0x1b4 fs/open.c:135
__do_sys_truncate fs/open.c:147 [inline]
__se_sys_truncate fs/open.c:145 [inline]
__arm64_sys_truncate+0x5c/0x70 fs/open.c:145
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x244 arch/arm64/kernel/syscall.c:139
do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:188
el0_svc+0x4c/0x160 arch/arm64/kernel/entry-common.c:647
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
irq event stamp: 21568
hardirqs last enabled at (21567): [<ffff800080b723d4>] lookup_bh_lru fs/buffer.c:1403 [inline]
hardirqs last enabled at (21567): [<ffff800080b723d4>] __find_get_block+0x1a0/0xd18 fs/buffer.c:1415
hardirqs last disabled at (21568): [<ffff80008a56c1dc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:407
softirqs last enabled at (21214): [<ffff8000800218ec>] softirq_handle_end kernel/softirq.c:399 [inline]
softirqs last enabled at (21214): [<ffff8000800218ec>] __do_softirq+0xac0/0xd54 kernel/softirq.c:582
softirqs last disabled at (21129): [<ffff80008002aad4>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5986 at fs/ntfs3/bitmap.c:216 wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
Modules linked in:
CPU: 0 PID: 5986 Comm: syz-executor496 Tainted: G W 6.5.0-rc4-syzkaller-g86d7896480b0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
lr : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
sp : ffff8000969a71e0
x29: ffff8000969a7210 x28: 1fffe0001c052c6f x27: dfff800000000000
x26: dfff800000000000 x25: ffff0000e0296398 x24: ffff0000e02961e0
x23: ffff0000e0296378 x22: 00000000000001e7 x21: ffff0000dbdae2d0
x20: ffff0000e0296360 x19: 00000000000001e7 x18: 1fffe0003683adc6
x17: 0000000000000000 x16: ffff80008a57089c x15: 0000000000000001
x14: 000000008a56c67c x13: 0000000071fb52ff x12: 00000000a7effed4
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : ffff0000c583d340 x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000000040 x4 : 0000000000000000 x3 : 0000000000000001
x2 : ffffffffffffffc0 x1 : 00000000000001e7 x0 : 00000000000001e7
Call trace:
wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
wnd_set_free+0x570/0x5cc fs/ntfs3/bitmap.c:749
mark_as_free_ex+0x134/0x310 fs/ntfs3/fsntfs.c:2485
run_deallocate_ex+0x1e0/0x4ac fs/ntfs3/attrib.c:122
attr_set_size+0x1128/0x342c fs/ntfs3/attrib.c:750
ntfs_truncate fs/ntfs3/file.c:393 [inline]
ntfs3_setattr+0x424/0x8fc fs/ntfs3/file.c:682
notify_change+0xa84/0xd20 fs/attr.c:483
do_truncate+0x1c0/0x28c fs/open.c:66
vfs_truncate+0x2b8/0x360 fs/open.c:112
do_sys_truncate+0xec/0x1b4 fs/open.c:135
__do_sys_truncate fs/open.c:147 [inline]
__se_sys_truncate fs/open.c:145 [inline]
__arm64_sys_truncate+0x5c/0x70 fs/open.c:145
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x244 arch/arm64/kernel/syscall.c:139
do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:188
el0_svc+0x4c/0x160 arch/arm64/kernel/entry-common.c:647
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
irq event stamp: 21948
hardirqs last enabled at (21947): [<ffff800080b723d4>] lookup_bh_lru fs/buffer.c:1403 [inline]
hardirqs last enabled at (21947): [<ffff800080b723d4>] __find_get_block+0x1a0/0xd18 fs/buffer.c:1415
hardirqs last disabled at (21948): [<ffff80008a56c1dc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:407
softirqs last enabled at (21584): [<ffff8000800218ec>] softirq_handle_end kernel/softirq.c:399 [inline]
softirqs last enabled at (21584): [<ffff8000800218ec>] __do_softirq+0xac0/0xd54 kernel/softirq.c:582
softirqs last disabled at (21571): [<ffff80008002aad4>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5986 at fs/ntfs3/bitmap.c:216 wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
Modules linked in:
CPU: 0 PID: 5986 Comm: syz-executor496 Tainted: G W 6.5.0-rc4-syzkaller-g86d7896480b0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
lr : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
sp : ffff8000969a71e0
x29: ffff8000969a7210 x28: 1fffe0001c052c7b x27: dfff800000000000
x26: dfff800000000000 x25: ffff0000e02963f8 x24: ffff0000e02961e0
x23: ffff0000e02963d8 x22: 00000000000001e7 x21: ffff0000dbdae2d0
x20: ffff0000e02963c0 x19: 00000000000001e7 x18: 1fffe0003683adc6
x17: 0000000000000000 x16: ffff80008a57089c x15: 0000000000000001
x14: 000000008a56c67c x13: 0000000071fb52ff x12: 00000000a7effed4
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : ffff0000c583d340 x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000000040 x4 : 0000000000000000 x3 : 0000000000000001
x2 : ffffffffffffffc0 x1 : 00000000000001e7 x0 : 00000000000001e7
Call trace:
wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
wnd_set_free+0x570/0x5cc fs/ntfs3/bitmap.c:749
mark_as_free_ex+0x134/0x310 fs/ntfs3/fsntfs.c:2485
run_deallocate_ex+0x1e0/0x4ac fs/ntfs3/attrib.c:122
attr_set_size+0x1128/0x342c fs/ntfs3/attrib.c:750
ntfs_truncate fs/ntfs3/file.c:393 [inline]
ntfs3_setattr+0x424/0x8fc fs/ntfs3/file.c:682
notify_change+0xa84/0xd20 fs/attr.c:483
do_truncate+0x1c0/0x28c fs/open.c:66
vfs_truncate+0x2b8/0x360 fs/open.c:112
do_sys_truncate+0xec/0x1b4 fs/open.c:135
__do_sys_truncate fs/open.c:147 [inline]
__se_sys_truncate fs/open.c:145 [inline]
__arm64_sys_truncate+0x5c/0x70 fs/open.c:145
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x244 arch/arm64/kernel/syscall.c:139
do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:188
el0_svc+0x4c/0x160 arch/arm64/kernel/entry-common.c:647
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
irq event stamp: 22332
hardirqs last enabled at (22331): [<ffff800080b723d4>] lookup_bh_lru fs/buffer.c:1403 [inline]
hardirqs last enabled at (22331): [<ffff800080b723d4>] __find_get_block+0x1a0/0xd18 fs/buffer.c:1415
hardirqs last disabled at (22332): [<ffff80008a56c1dc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:407
softirqs last enabled at (21958): [<ffff8000800218ec>] softirq_handle_end kernel/softirq.c:399 [inline]
softirqs last enabled at (21958): [<ffff8000800218ec>] __do_softirq+0xac0/0xd54 kernel/softirq.c:582
softirqs last disabled at (21951): [<ffff80008002aad4>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5986 at fs/ntfs3/bitmap.c:216 wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
Modules linked in:
CPU: 0 PID: 5986 Comm: syz-executor496 Tainted: G W 6.5.0-rc4-syzkaller-g86d7896480b0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
lr : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
sp : ffff8000969a71e0
x29: ffff8000969a7210 x28: 1fffe0001c052c87 x27: dfff800000000000
x26: dfff800000000000 x25: ffff0000e0296458 x24: ffff0000e02961e0
x23: ffff0000e0296438 x22: 00000000000001e7 x21: ffff0000dbdae2d0
x20: ffff0000e0296420 x19: 00000000000001e7 x18: 1fffe0003683adc6
x17: 0000000000000000 x16: ffff80008a57089c x15: 0000000000000001
x14: 000000008a56c67c x13: 0000000071fb52ff x12: 00000000a7effed4
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : ffff0000c583d340 x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000000040 x4 : 0000000000000000 x3 : 0000000000000001
x2 : ffffffffffffffc0 x1 : 00000000000001e7 x0 : 00000000000001e7
Call trace:
wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
wnd_set_free+0x570/0x5cc fs/ntfs3/bitmap.c:749
mark_as_free_ex+0x134/0x310 fs/ntfs3/fsntfs.c:2485
run_deallocate_ex+0x1e0/0x4ac fs/ntfs3/attrib.c:122
attr_set_size+0x1128/0x342c fs/ntfs3/attrib.c:750
ntfs_truncate fs/ntfs3/file.c:393 [inline]
ntfs3_setattr+0x424/0x8fc fs/ntfs3/file.c:682
notify_change+0xa84/0xd20 fs/attr.c:483
do_truncate+0x1c0/0x28c fs/open.c:66
vfs_truncate+0x2b8/0x360 fs/open.c:112
do_sys_truncate+0xec/0x1b4 fs/open.c:135
__do_sys_truncate fs/open.c:147 [inline]
__se_sys_truncate fs/open.c:145 [inline]
__arm64_sys_truncate+0x5c/0x70 fs/open.c:145
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x244 arch/arm64/kernel/syscall.c:139
do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:188
el0_svc+0x4c/0x160 arch/arm64/kernel/entry-common.c:647
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
irq event stamp: 22732
hardirqs last enabled at (22731): [<ffff800080b723d4>] lookup_bh_lru fs/buffer.c:1403 [inline]
hardirqs last enabled at (22731): [<ffff800080b723d4>] __find_get_block+0x1a0/0xd18 fs/buffer.c:1415
hardirqs last disabled at (22732): [<ffff80008a56c1dc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:407
softirqs last enabled at (22354): [<ffff8000800218ec>] softirq_handle_end kernel/softirq.c:399 [inline]
softirqs last enabled at (22354): [<ffff8000800218ec>] __do_softirq+0xac0/0xd54 kernel/softirq.c:582
softirqs last disabled at (22335): [<ffff80008002aad4>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5986 at fs/ntfs3/bitmap.c:216 wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
Modules linked in:
CPU: 0 PID: 5986 Comm: syz-executor496 Tainted: G W 6.5.0-rc4-syzkaller-g86d7896480b0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
lr : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
sp : ffff8000969a71e0
x29: ffff8000969a7210 x28: 1fffe0001c052c93 x27: dfff800000000000
x26: dfff800000000000 x25: ffff0000e02964b8 x24: ffff0000e02961e0
x23: ffff0000e0296498 x22: 00000000000001e7 x21: ffff0000dbdae2d0
x20: ffff0000e0296480 x19: 00000000000001e7 x18: 1fffe0003683adc6
x17: 0000000000000000 x16: ffff80008a57089c x15: 0000000000000001
x14: 000000008a56c67c x13: 0000000071fb52ff x12: 00000000a7effed4
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : ffff0000c583d340 x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000000040 x4 : 0000000000000000 x3 : 0000000000000001
x2 : ffffffffffffffc0 x1 : 00000000000001e7 x0 : 00000000000001e7
Call trace:
wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
wnd_set_free+0x570/0x5cc fs/ntfs3/bitmap.c:749
mark_as_free_ex+0x134/0x310 fs/ntfs3/fsntfs.c:2485
run_deallocate_ex+0x1e0/0x4ac fs/ntfs3/attrib.c:122
attr_set_size+0x1128/0x342c fs/ntfs3/attrib.c:750
ntfs_truncate fs/ntfs3/file.c:393 [inline]
ntfs3_setattr+0x424/0x8fc fs/ntfs3/file.c:682
notify_change+0xa84/0xd20 fs/attr.c:483
do_truncate+0x1c0/0x28c fs/open.c:66
vfs_truncate+0x2b8/0x360 fs/open.c:112
do_sys_truncate+0xec/0x1b4 fs/open.c:135
__do_sys_truncate fs/open.c:147 [inline]
__se_sys_truncate fs/open.c:145 [inline]
__arm64_sys_truncate+0x5c/0x70 fs/open.c:145
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x244 arch/arm64/kernel/syscall.c:139
do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:188
el0_svc+0x4c/0x160 arch/arm64/kernel/entry-common.c:647
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
irq event stamp: 23126
hardirqs last enabled at (23125): [<ffff800080b723d4>] lookup_bh_lru fs/buffer.c:1403 [inline]
hardirqs last enabled at (23125): [<ffff800080b723d4>] __find_get_block+0x1a0/0xd18 fs/buffer.c:1415
hardirqs last disabled at (23126): [<ffff80008a56c1dc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:407
softirqs last enabled at (22744): [<ffff8000800218ec>] softirq_handle_end kernel/softirq.c:399 [inline]
softirqs last enabled at (22744): [<ffff8000800218ec>] __do_softirq+0xac0/0xd54 kernel/softirq.c:582
softirqs last disabled at (22735): [<ffff80008002aad4>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5986 at fs/ntfs3/bitmap.c:216 wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
Modules linked in:
CPU: 0 PID: 5986 Comm: syz-executor496 Tainted: G W 6.5.0-rc4-syzkaller-g86d7896480b0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
lr : wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
sp : ffff8000969a71e0
x29: ffff8000969a7210 x28: 1fffe0001c052c9f x27: dfff800000000000
x26: dfff800000000000 x25: ffff0000e0296518 x24: ffff0000e02961e0
x23: ffff0000e02964f8 x22: 00000000000001e7 x21: ffff0000dbdae2d0
x20: ffff0000e02964e0 x19: 00000000000001e7 x18: 1fffe0003683adc6
x17: 0000000000000000 x16: ffff80008a57089c x15: 0000000000000001
x14: 1ffff00011d18abf x13: 0000000000000000 x12: 0000000000000003
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : ffff0000c583d340 x7 : 0000000000000000 x6 : ffff800080063870
x5 : ffff0000d477e9c8 x4 : 0000000000000000 x3 : 0000000000000000
x2 : ffffffffffffffc0 x1 : 00000000000001e7 x0 : 00000000000001e7
Call trace:
wnd_add_free_ext+0x9b0/0xc00 fs/ntfs3/bitmap.c:351
wnd_set_free+0x570/0x5cc fs/ntfs3/bitmap.c:749
mark_as_free_ex+0x1c8/0x310 fs/ntfs3/fsntfs.c:2495
run_deallocate_ex+0x1e0/0x4ac fs/ntfs3/attrib.c:122
attr_set_size+0x1128/0x342c fs/ntfs3/attrib.c:750
ntfs_truncate fs/ntfs3/file.c:393 [inline]
ntfs3_setattr+0x424/0x8fc fs/ntfs3/file.c:682
notify_change+0xa84/0xd20 fs/attr.c:483
do_truncate+0x1c0/0x28c fs/open.c:66
vfs_truncate+0x2b8/0x360 fs/open.c:112
do_sys_truncate+0xec/0x1b4 fs/open.c:135
__do_sys_truncate fs/open.c:147 [inline]
__se_sys_truncate fs/open.c:145 [inline]
__arm64_sys_truncate+0x5c/0x70 fs/open.c:145
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x244 arch/arm64/kernel/syscall.c:139
do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:188
el0_svc+0x4c/0x160 arch/arm64/kernel/entry-common.c:647
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
irq event stamp: 23528
hardirqs last enabled at (23527): [<ffff80008a65a7c0>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last enabled at (23527): [<ffff80008a65a7c0>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:194
hardirqs last disabled at (23528): [<ffff80008a56c1dc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:407
softirqs last enabled at (23142): [<ffff8000800218ec>] softirq_handle_end kernel/softirq.c:399 [inline]
softirqs last enabled at (23142): [<ffff8000800218ec>] __do_softirq+0xac0/0xd54 kernel/softirq.c:582
softirqs last disabled at (23129): [<ffff80008002aad4>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
---[ end trace 0000000000000000 ]---
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
syzbot
Aug 10, 2023, 6:14:41 PM8/10/23
to almaz.ale...@paragon-software.com, linux-...@vger.kernel.org, linux-...@vger.kernel.org, nt...@lists.linux.dev, syzkall...@googlegroups.com
syzbot has bisected this issue to:
commit 3880f2b816a7e4ca889b7e8a42e6c62c5706ed36
Author: Konstantin Komarov <almaz.ale...@paragon-software.com>
Date: Mon Oct 25 15:31:28 2021 +0000
fs/ntfs3: Fix fiemap + fix shrink file size (to remove preallocated space)
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=168fd89ba80000
start commit: f6a691685962 Merge tag '6.5-rc4-smb3-client-fix' of git://..
git tree: upstream
final oops: https://syzkaller.appspot.com/x/report.txt?x=158fd89ba80000
console output: https://syzkaller.appspot.com/x/log.txt?x=118fd89ba80000
kernel config: https://syzkaller.appspot.com/x/.config?x=1e3d5175079af5a4
dashboard link: https://syzkaller.appspot.com/bug?extid=5b2f934f08ab03d473ff
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13f56679a80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=118b8eeda80000
Reported-by: syzbot+5b2f93...@syzkaller.appspotmail.com
Fixes: 3880f2b816a7 ("fs/ntfs3: Fix fiemap + fix shrink file size (to remove preallocated space)")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
commit 3880f2b816a7e4ca889b7e8a42e6c62c5706ed36
Author: Konstantin Komarov <almaz.ale...@paragon-software.com>
Date: Mon Oct 25 15:31:28 2021 +0000
fs/ntfs3: Fix fiemap + fix shrink file size (to remove preallocated space)
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=168fd89ba80000
start commit: f6a691685962 Merge tag '6.5-rc4-smb3-client-fix' of git://..
git tree: upstream
final oops: https://syzkaller.appspot.com/x/report.txt?x=158fd89ba80000
console output: https://syzkaller.appspot.com/x/log.txt?x=118fd89ba80000
kernel config: https://syzkaller.appspot.com/x/.config?x=1e3d5175079af5a4
dashboard link: https://syzkaller.appspot.com/bug?extid=5b2f934f08ab03d473ff
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13f56679a80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=118b8eeda80000
Reported-by: syzbot+5b2f93...@syzkaller.appspotmail.com
Fixes: 3880f2b816a7 ("fs/ntfs3: Fix fiemap + fix shrink file size (to remove preallocated space)")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
syzbot
Nov 20, 2023, 6:01:07 PM11/20/23
to almaz.ale...@paragon-software.com, linux-...@vger.kernel.org, linux-...@vger.kernel.org, nt...@lists.linux.dev, syzkall...@googlegroups.com
syzbot suspects this issue was fixed by commit:
commit 4ad5c924df6cd6d85708fa23f9d9a2b78a2e428e
Author: Konstantin Komarov <almaz.ale...@paragon-software.com>
Date: Fri Sep 22 10:07:59 2023 +0000
fs/ntfs3: Allow repeated call to ntfs3_put_sbi
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=15283368e80000
start commit: dd72f9c7e512 Merge tag 'spi-fix-v6-6-rc4' of git://git.ker..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=4471dbb58008c9f2
dashboard link: https://syzkaller.appspot.com/bug?extid=5b2f934f08ab03d473ff
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15665425680000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1618cd9d680000
If the result looks correct, please mark the issue as fixed by replying with:
#syz fix: fs/ntfs3: Allow repeated call to ntfs3_put_sbi
commit 4ad5c924df6cd6d85708fa23f9d9a2b78a2e428e
Author: Konstantin Komarov <almaz.ale...@paragon-software.com>
Date: Fri Sep 22 10:07:59 2023 +0000
fs/ntfs3: Allow repeated call to ntfs3_put_sbi
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=15283368e80000
start commit: dd72f9c7e512 Merge tag 'spi-fix-v6-6-rc4' of git://git.ker..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=4471dbb58008c9f2
dashboard link: https://syzkaller.appspot.com/bug?extid=5b2f934f08ab03d473ff
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15665425680000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1618cd9d680000
If the result looks correct, please mark the issue as fixed by replying with:
#syz fix: fs/ntfs3: Allow repeated call to ntfs3_put_sbi
syzbot
Jan 24, 2024, 7:23:16 AMJan 24
to syzkall...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages