[syzbot] [reiserfs?] KASAN: null-ptr-deref Read in fix_nodes

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 148341f0a2f5 Merge tag 'vfs.misc.fixes.v6.3-rc6' of git://..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=131e7b5dc80000
kernel config: https://syzkaller.appspot.com/x/.config?x=d3500b143c204867
dashboard link: https://syzkaller.appspot.com/bug?extid=5184326923f180b9d11a
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/bd1a34836b5e/disk-148341f0.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/04a1edfc1dd9/vmlinux-148341f0.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ec7cb22838b5/bzImage-148341f0.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+518432...@syzkaller.appspotmail.com

REISERFS (device loop2): Remounting filesystem read-only
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:72 [inline]
BUG: KASAN: null-ptr-deref in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
BUG: KASAN: null-ptr-deref in buffer_locked include/linux/buffer_head.h:126 [inline]
BUG: KASAN: null-ptr-deref in fix_nodes+0x464/0x8660 fs/reiserfs/fix_node.c:2578
Read of size 8 at addr 0000000000000000 by task syz-executor.2/4037

CPU: 1 PID: 4037 Comm: syz-executor.2 Not tainted 6.3.0-rc5-syzkaller-00005-g148341f0a2f5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
print_report mm/kasan/report.c:433 [inline]
kasan_report+0xec/0x130 mm/kasan/report.c:536
check_region_inline mm/kasan/generic.c:181 [inline]
kasan_check_range+0x141/0x190 mm/kasan/generic.c:187
instrument_atomic_read include/linux/instrumented.h:72 [inline]
_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
buffer_locked include/linux/buffer_head.h:126 [inline]
fix_nodes+0x464/0x8660 fs/reiserfs/fix_node.c:2578
reiserfs_cut_from_item+0x2bd/0x1b20 fs/reiserfs/stree.c:1742
reiserfs_do_truncate+0x630/0x1080 fs/reiserfs/stree.c:1973
reiserfs_truncate_file+0x1b5/0x1070 fs/reiserfs/inode.c:2310
reiserfs_setattr+0xddf/0x1370 fs/reiserfs/inode.c:3395
notify_change+0xb2c/0x1180 fs/attr.c:482
do_truncate+0x143/0x200 fs/open.c:66
handle_truncate fs/namei.c:3219 [inline]
do_open fs/namei.c:3564 [inline]
path_openat+0x2083/0x2750 fs/namei.c:3715
do_filp_open+0x1ba/0x410 fs/namei.c:3742
do_sys_openat2+0x16d/0x4c0 fs/open.c:1348
do_sys_open fs/open.c:1364 [inline]
__do_sys_creat fs/open.c:1440 [inline]
__se_sys_creat fs/open.c:1434 [inline]
__x64_sys_creat+0xcd/0x120 fs/open.c:1434
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fd96be8c169
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd96cb5a168 EFLAGS: 00000246 ORIG_RAX: 0000000000000055
RAX: ffffffffffffffda RBX: 00007fd96bfac1f0 RCX: 00007fd96be8c169
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000040
RBP: 00007fd96bee7ca1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffcd572849f R14: 00007fd96cb5a300 R15: 0000000000022000
</TASK>
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 58390c8ce1bd Merge tag 'iommu-updates-v6.4' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=155bead8280000
kernel config: https://syzkaller.appspot.com/x/.config?x=d56ffc213bf6bf4a

dashboard link: https://syzkaller.appspot.com/bug?extid=5184326923f180b9d11a
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16936ffc280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/64e93dba0330/disk-58390c8c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2b7f3c1154f1/vmlinux-58390c8c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4ad00371a063/bzImage-58390c8c.xz
mounted in repro #1: https://storage.googleapis.com/syzbot-assets/5bd5f6fead6e/mount_1.gz
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/58251a87486a/mount_10.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+518432...@syzkaller.appspotmail.com

REISERFS warning: reiserfs-5093 is_leaf: item entry count seems wrong *3.5*[2 1 0(1) DIR], item_len 35, item_location 4029, free_space(entry_count) 2
REISERFS error (device loop2): vs-5150 search_by_key: invalid format found in block 539. Fsck?
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline]

BUG: KASAN: null-ptr-deref in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
BUG: KASAN: null-ptr-deref in buffer_locked include/linux/buffer_head.h:126 [inline]
BUG: KASAN: null-ptr-deref in fix_nodes+0x464/0x8660 fs/reiserfs/fix_node.c:2578

Read of size 8 at addr 0000000000000000 by task syz-executor.2/5390

CPU: 1 PID: 5390 Comm: syz-executor.2 Not tainted 6.3.0-syzkaller-12049-g58390c8ce1bd #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106

print_report mm/kasan/report.c:465 [inline]
kasan_report+0xec/0x130 mm/kasan/report.c:572

check_region_inline mm/kasan/generic.c:181 [inline]
kasan_check_range+0x141/0x190 mm/kasan/generic.c:187

instrument_atomic_read include/linux/instrumented.h:68 [inline]

_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
buffer_locked include/linux/buffer_head.h:126 [inline]
fix_nodes+0x464/0x8660 fs/reiserfs/fix_node.c:2578

reiserfs_cut_from_item+0x2bd/0x1b20 fs/reiserfs/stree.c:1740
reiserfs_do_truncate+0x630/0x1080 fs/reiserfs/stree.c:1971
reiserfs_truncate_file+0x1b5/0x1070 fs/reiserfs/inode.c:2308
reiserfs_setattr+0xddf/0x1370 fs/reiserfs/inode.c:3393
notify_change+0xb2c/0x1180 fs/attr.c:483
do_truncate+0x143/0x200 fs/open.c:66
handle_truncate fs/namei.c:3295 [inline]
do_open fs/namei.c:3640 [inline]
path_openat+0x2083/0x2750 fs/namei.c:3791
do_filp_open+0x1ba/0x410 fs/namei.c:3818
do_sys_openat2+0x16d/0x4c0 fs/open.c:1356
do_sys_open fs/open.c:1372 [inline]
__do_sys_open fs/open.c:1380 [inline]
__se_sys_open fs/open.c:1376 [inline]
__x64_sys_open+0x11d/0x1c0 fs/open.c:1376

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

RIP: 0033:0x7f4ee868c169

Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007f4ee9456168 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00007f4ee87ac120 RCX: 00007f4ee868c169
RDX: 0000000000000000 RSI: 000000000014937e RDI: 0000000020000180
RBP: 00007f4ee86e7ca1 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007ffe3e91162f R14: 00007f4ee9456300 R15: 0000000000022000
</TASK>
==================================================================


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: b6dad5178cea Merge tag 'nios2_fix_v6.4' of git://git.kerne..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=1495dce3280000
kernel config: https://syzkaller.appspot.com/x/.config?x=ac246111fb601aec

dashboard link: https://syzkaller.appspot.com/bug?extid=5184326923f180b9d11a
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10bbc887280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15c9558b280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/fb7aeb21864c/disk-b6dad517.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3004476364b7/vmlinux-b6dad517.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a143be294854/bzImage-b6dad517.xz
mounted in repro #1: https://storage.googleapis.com/syzbot-assets/92adf3c12845/mount_1.gz
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/3861119d1700/mount_8.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+518432...@syzkaller.appspotmail.com

REISERFS error (device loop2): vs-5150 search_by_key: invalid format found in block 540. Fsck?
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline]

BUG: KASAN: null-ptr-deref in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
BUG: KASAN: null-ptr-deref in buffer_locked include/linux/buffer_head.h:126 [inline]
BUG: KASAN: null-ptr-deref in fix_nodes+0x464/0x8660 fs/reiserfs/fix_node.c:2578

Read of size 8 at addr 0000000000000000 by task syz-executor539/5535

CPU: 0 PID: 5535 Comm: syz-executor539 Not tainted 6.4.0-rc6-syzkaller-00037-gb6dad5178cea #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106

print_report mm/kasan/report.c:465 [inline]
kasan_report+0xec/0x130 mm/kasan/report.c:572

check_region_inline mm/kasan/generic.c:181 [inline]
kasan_check_range+0x141/0x190 mm/kasan/generic.c:187

instrument_atomic_read include/linux/instrumented.h:68 [inline]

_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
buffer_locked include/linux/buffer_head.h:126 [inline]
fix_nodes+0x464/0x8660 fs/reiserfs/fix_node.c:2578

reiserfs_cut_from_item+0x2bd/0x1b20 fs/reiserfs/stree.c:1740
reiserfs_do_truncate+0x630/0x1080 fs/reiserfs/stree.c:1971
reiserfs_truncate_file+0x1b5/0x1070 fs/reiserfs/inode.c:2308
reiserfs_setattr+0xddf/0x1370 fs/reiserfs/inode.c:3393
notify_change+0xb2c/0x1180 fs/attr.c:483

do_truncate+0x143/0x200 fs/open.c:66

handle_truncate fs/namei.c:3295 [inline]
do_open fs/namei.c:3640 [inline]
path_openat+0x2083/0x2750 fs/namei.c:3791
do_filp_open+0x1ba/0x410 fs/namei.c:3818
do_sys_openat2+0x16d/0x4c0 fs/open.c:1356
do_sys_open fs/open.c:1372 [inline]
__do_sys_open fs/open.c:1380 [inline]
__se_sys_open fs/open.c:1376 [inline]
__x64_sys_open+0x11d/0x1c0 fs/open.c:1376

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

RIP: 0033:0x7f7cb89c3be9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 71 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7cb094e2f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00007f7cb8a497f0 RCX: 00007f7cb89c3be9

RDX: 0000000000000000 RSI: 000000000014937e RDI: 0000000020000180

RBP: 00007f7cb8a16410 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000000010f7 R11: 0000000000000246 R12: 0030656c69662f2e
R13: 7366726573696572 R14: 6bd71a7077694d3f R15: 00007f7cb8a497f8

[syzbot]

syzbot has bisected this issue to:

commit d24396c5290ba8ab04ba505176874c4e04a2d53c
Author: Rustam Kovhaev <rkov...@gmail.com>
Date: Sun Nov 1 14:09:58 2020 +0000

reiserfs: add check for an invalid ih_entry_count

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=15244cfa680000
start commit: b6dad5178cea Merge tag 'nios2_fix_v6.4' of git://git.kerne..
git tree: upstream
final oops: https://syzkaller.appspot.com/x/report.txt?x=17244cfa680000
console output: https://syzkaller.appspot.com/x/log.txt?x=13244cfa680000

kernel config: https://syzkaller.appspot.com/x/.config?x=ac246111fb601aec
dashboard link: https://syzkaller.appspot.com/bug?extid=5184326923f180b9d11a

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10bbc887280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15c9558b280000

Reported-by: syzbot+518432...@syzkaller.appspotmail.com
Fixes: d24396c5290b ("reiserfs: add check for an invalid ih_entry_count")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

[syzbot]

syzbot suspects this issue was fixed by commit:

commit 6f861765464f43a71462d52026fbddfc858239a5
Author: Jan Kara <ja...@suse.cz>
Date: Wed Nov 1 17:43:10 2023 +0000

fs: Block writes to mounted block devices

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=14c5b3f0180000
start commit: a4aebe936554 posix-timers: Get rid of [COMPAT_]SYS_NI() uses
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=671af399e2dac0e3
dashboard link: https://syzkaller.appspot.com/bug?extid=5184326923f180b9d11a
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10a4c8cee80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17a59e11e80000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: fs: Block writes to mounted block devices

[syzbot]

Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.