[syzbot] [ntfs?] kernel BUG in ntfs_end_buffer_async_read

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: fe15c26ee26e Linux 6.3-rc1
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=12feadbcc80000
kernel config: https://syzkaller.appspot.com/x/.config?x=7573cbcd881a88c9
dashboard link: https://syzkaller.appspot.com/bug?extid=72ba5fe5556d82ad118b
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/89d41abd07bd/disk-fe15c26e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/fa75f5030ade/vmlinux-fe15c26e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/590d0f5903ee/Image-fe15c26e.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+72ba5f...@syzkaller.appspotmail.com

------------[ cut here ]------------
kernel BUG at fs/ntfs/aops.c:130!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 21 Comm: ksoftirqd/1 Not tainted 6.3.0-rc1-syzkaller-gfe15c26ee26e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : ntfs_end_buffer_async_read+0xa28/0xb78 fs/ntfs/aops.c:130
lr : ntfs_end_buffer_async_read+0xa28/0xb78 fs/ntfs/aops.c:130
sp : ffff80001a477a30
x29: ffff80001a477a50 x28: ffff0001416534a0 x27: 0000000000000019
x26: dfff800000000000 x25: 0000000000001000 x24: ffff00013f9ed3a0
x23: 0000000000000000 x22: ffff00013f9ed6c0 x21: 0000000000000001
x20: 0000000000020211 x19: 0000000000000330 x18: 1fffe000368995b6
x17: ffff800015cdd000 x16: ffff80000826e470 x15: 0000000000000000
x14: 1ffff00002b9c0b2 x13: dfff800000000000 x12: 0000000000000003
x11: ff8080000965190c x10: 0000000000000000 x9 : ffff80000965190c
x8 : ffff0000c0af1b40 x7 : ffff800009651140 x6 : 0000000000000000
x5 : 0000000000000001 x4 : 0000000000000001 x3 : 0000000000000000
x2 : ffff80001a477940 x1 : 0000000000020211 x0 : 0000000000001000
Call trace:
ntfs_end_buffer_async_read+0xa28/0xb78 fs/ntfs/aops.c:130
end_bio_bh_io_sync+0xb0/0x194 fs/buffer.c:2703
bio_endio+0x940/0x984 block/bio.c:1607
req_bio_endio block/blk-mq.c:795 [inline]
blk_update_request+0x444/0xdc0 block/blk-mq.c:927
blk_mq_end_request+0x54/0x88 block/blk-mq.c:1054
lo_complete_rq+0x140/0x258 drivers/block/loop.c:370
blk_complete_reqs block/blk-mq.c:1132 [inline]
blk_done_softirq+0x11c/0x168 block/blk-mq.c:1137
__do_softirq+0x378/0xfbc kernel/softirq.c:571
run_ksoftirqd+0x6c/0x148 kernel/softirq.c:934
smpboot_thread_fn+0x4b0/0x96c kernel/smpboot.c:164
kthread+0x24c/0x2d4 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870
Code: c8097e88 35ffffa9 17fffdb3 97bafdea (d4210000)
---[ end trace 0000000000000000 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: dfab92f27c60 Merge tag 'nfs-for-6.5-1' of git://git.linux-..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=137d57bf280000
kernel config: https://syzkaller.appspot.com/x/.config?x=71a52faf60231bc7

dashboard link: https://syzkaller.appspot.com/bug?extid=72ba5fe5556d82ad118b
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13c987eca80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=144a738f280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/32f183ec0f2c/disk-dfab92f2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e8f47f491184/vmlinux-dfab92f2.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ad90306c0fe6/bzImage-dfab92f2.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/bcae16df5190/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+72ba5f...@syzkaller.appspotmail.com

------------[ cut here ]------------
kernel BUG at fs/ntfs/aops.c:130!

invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 21 Comm: ksoftirqd/1 Not tainted 6.4.0-syzkaller-10096-gdfab92f27c60 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
RIP: 0010:ntfs_end_buffer_async_read+0xc7f/0x1540 fs/ntfs/aops.c:130
Code: ff e8 95 97 c8 fe 4c 89 ff 48 c7 c6 e0 6b 3a 8b e8 86 3b 09 ff 0f 0b e8 7f 97 c8 fe 0f 0b e8 78 97 c8 fe 0f 0b e8 71 97 c8 fe <0f> 0b e8 6a 97 c8 fe 4c 89 ff e8 b2 99 ff ff 48 89 c7 48 c7 c6 20
RSP: 0018:ffffc900001b7b10 EFLAGS: 00010246
RAX: ffffffff82c35a7f RBX: 0000000000000010 RCX: ffff888014e59dc0
RDX: 0000000080000100 RSI: 0000000000020211 RDI: 0000000000001000
RBP: ffff8880771e8270 R08: ffffffff82c3547a R09: 1ffff1100ee3d00a
R10: dffffc0000000000 R11: ffffed100ee3d00b R12: 0000000000000000
R13: 0000000000020211 R14: 0000000000000001 R15: ffffea0001d76500
FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc42b480940 CR3: 00000000219c3000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
end_bio_bh_io_sync+0xb7/0x110 fs/buffer.c:2794
req_bio_endio block/blk-mq.c:766 [inline]
blk_update_request+0x53f/0x1020 block/blk-mq.c:911
blk_mq_end_request+0x50/0x310 block/blk-mq.c:1032
blk_complete_reqs block/blk-mq.c:1110 [inline]
blk_done_softirq+0x103/0x150 block/blk-mq.c:1115
__do_softirq+0x2ab/0x908 kernel/softirq.c:553
run_ksoftirqd+0xc5/0x120 kernel/softirq.c:921
smpboot_thread_fn+0x533/0x9f0 kernel/smpboot.c:164
kthread+0x2b8/0x350 kernel/kthread.c:389
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
Modules linked in:

---[ end trace 0000000000000000 ]---

RIP: 0010:ntfs_end_buffer_async_read+0xc7f/0x1540 fs/ntfs/aops.c:130
Code: ff e8 95 97 c8 fe 4c 89 ff 48 c7 c6 e0 6b 3a 8b e8 86 3b 09 ff 0f 0b e8 7f 97 c8 fe 0f 0b e8 78 97 c8 fe 0f 0b e8 71 97 c8 fe <0f> 0b e8 6a 97 c8 fe 4c 89 ff e8 b2 99 ff ff 48 89 c7 48 c7 c6 20
RSP: 0018:ffffc900001b7b10 EFLAGS: 00010246
RAX: ffffffff82c35a7f RBX: 0000000000000010 RCX: ffff888014e59dc0
RDX: 0000000080000100 RSI: 0000000000020211 RDI: 0000000000001000
RBP: ffff8880771e8270 R08: ffffffff82c3547a R09: 1ffff1100ee3d00a
R10: dffffc0000000000 R11: ffffed100ee3d00b R12: 0000000000000000
R13: 0000000000020211 R14: 0000000000000001 R15: ffffea0001d76500
FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc42b480940 CR3: 00000000219c3000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[syzbot]

syzbot suspects this issue was fixed by commit:

commit 6f861765464f43a71462d52026fbddfc858239a5
Author: Jan Kara <ja...@suse.cz>
Date: Wed Nov 1 17:43:10 2023 +0000

fs: Block writes to mounted block devices

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=14016cf8180000
start commit: dfab92f27c60 Merge tag 'nfs-for-6.5-1' of git://git.linux-..
git tree: upstream

kernel config: https://syzkaller.appspot.com/x/.config?x=71a52faf60231bc7
dashboard link: https://syzkaller.appspot.com/bug?extid=72ba5fe5556d82ad118b

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13c987eca80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=144a738f280000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: fs: Block writes to mounted block devices

For information about bisection process see: https://goo.gl/tpsmEJ#bisection