[syzbot] kernel panic: stack is corrupted in writeback_single_inode

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 3db61221f4e8 Merge tag 'io_uring-6.0-2022-09-23' of git://..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16953c4c880000
kernel config: https://syzkaller.appspot.com/x/.config?x=c221af36f6d1d811
dashboard link: https://syzkaller.appspot.com/bug?extid=84b7b87a6430a152c1f4
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+84b7b8...@syzkaller.appspotmail.com

loop3: detected capacity change from 0 to 8189
ntfs3: loop3: Different NTFS' sector size (1024) and media sector size (512)
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: writeback_single_inode+0x8e7/0x8f0
CPU: 0 PID: 6581 Comm: syz-executor.3 Not tainted 6.0.0-rc6-syzkaller-00291-g3db61221f4e8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106
panic+0x2d6/0x715 kernel/panic.c:274
__stack_chk_fail+0x12/0x20 kernel/panic.c:706
writeback_single_inode+0x8e7/0x8f0
write_inode_now+0x1cd/0x260 fs/fs-writeback.c:2723
iput_final fs/inode.c:1735 [inline]
iput+0x3e6/0x760 fs/inode.c:1774
ntfs_fill_super+0x3af3/0x42a0 fs/ntfs3/super.c:1190
get_tree_bdev+0x400/0x620 fs/super.c:1323
vfs_get_tree+0x88/0x270 fs/super.c:1530
do_new_mount+0x289/0xad0 fs/namespace.c:3040
do_mount fs/namespace.c:3383 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3568
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f0bebe8bb9a
Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f0beadfdf88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 00007f0bebe8bb9a
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f0beadfdfe0
RBP: 00007f0beadfe020 R08: 00007f0beadfe020 R09: 0000000020000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000
R13: 0000000020000100 R14: 00007f0beadfdfe0 R15: 000000002007aa80
</TASK>
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 49c13ed0316d Merge tag 'soc-fixes-6.0-rc7' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1124fd74880000
kernel config: https://syzkaller.appspot.com/x/.config?x=4520785fccee9b40

dashboard link: https://syzkaller.appspot.com/bug?extid=84b7b87a6430a152c1f4
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=173f55df080000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+84b7b8...@syzkaller.appspotmail.com

ntfs3: loop1: failed to read volume at offset 0x120000
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: writeback_single_inode+0x8fb/0x910
CPU: 0 PID: 10703 Comm: syz-executor.1 Not tainted 6.0.0-rc7-syzkaller-00068-g49c13ed0316d #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]

dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
panic+0x316/0x76b kernel/panic.c:274
__stack_chk_fail+0x12/0x20 kernel/panic.c:706
writeback_single_inode+0x8fb/0x910

write_inode_now+0x1cd/0x260 fs/fs-writeback.c:2723
iput_final fs/inode.c:1735 [inline]
iput+0x3e6/0x760 fs/inode.c:1774

ntfs_fill_super+0x3c6c/0x4420 fs/ntfs3/super.c:1190

get_tree_bdev+0x400/0x620 fs/super.c:1323
vfs_get_tree+0x88/0x270 fs/super.c:1530
do_new_mount+0x289/0xad0 fs/namespace.c:3040
do_mount fs/namespace.c:3383 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]

__se_sys_mount+0x2e3/0x3d0 fs/namespace.c:3568
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f102428bada

Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007f10253dff88 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 00007f102428bada
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f10253dffe0
RBP: 00007f10253e0020 R08: 00007f10253e0020 R09: 0000000020000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000000
R13: 0000000020000100 R14: 00007f10253dffe0 R15: 0000000020003580

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: c3e0e1e23c70 Merge tag 'irq_urgent_for_v6.0' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17ab519c880000
kernel config: https://syzkaller.appspot.com/x/.config?x=ba0d23aa7e1ffaf5

dashboard link: https://syzkaller.appspot.com/bug?extid=84b7b87a6430a152c1f4
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=157c2000880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=105224b8880000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e7f1f925f94e/disk-c3e0e1e2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/830dabeedf0d/vmlinux-c3e0e1e2.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+84b7b8...@syzkaller.appspotmail.com

loop0: detected capacity change from 0 to 8226

Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: writeback_single_inode+0x8e7/0x8f0

CPU: 0 PID: 10213 Comm: syz-executor262 Not tainted 6.0.0-rc7-syzkaller-00081-gc3e0e1e23c70 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106
panic+0x2d6/0x715 kernel/panic.c:274
__stack_chk_fail+0x12/0x20 kernel/panic.c:706
writeback_single_inode+0x8e7/0x8f0
write_inode_now+0x1cd/0x260 fs/fs-writeback.c:2723
iput_final fs/inode.c:1735 [inline]
iput+0x3e6/0x760 fs/inode.c:1774
ntfs_fill_super+0x3af3/0x42a0 fs/ntfs3/super.c:1190
get_tree_bdev+0x400/0x620 fs/super.c:1323
vfs_get_tree+0x88/0x270 fs/super.c:1530
do_new_mount+0x289/0xad0 fs/namespace.c:3040
do_mount fs/namespace.c:3383 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3568
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

RIP: 0033:0x7f5a7dd5549a
Code: 48 c7 c2 c0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 98 03 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffedfc06378 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f5a7dd5549a
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffedfc06390
RBP: 00007ffedfc06390 R08: 00007ffedfc063d0 R09: 00005555563ee2c0
R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000004
R13: 00007ffedfc063d0 R14: 0000000000000015 R15: 0000000020000db8

[Al Viro]

On Thu, Sep 29, 2022 at 01:25:36PM -0700, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: c3e0e1e23c70 Merge tag 'irq_urgent_for_v6.0' of git://git...
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=17ab519c880000
> kernel config: https://syzkaller.appspot.com/x/.config?x=ba0d23aa7e1ffaf5
> dashboard link: https://syzkaller.appspot.com/bug?extid=84b7b87a6430a152c1f4
> compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=157c2000880000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=105224b8880000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/e7f1f925f94e/disk-c3e0e1e2.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/830dabeedf0d/vmlinux-c3e0e1e2.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+84b7b8...@syzkaller.appspotmail.com

... and you _still_ have not bothered to Cc ntfs maintainers.
Once more, with feeling:
If you are fuzzing something (ntfs, in this case), the people most
interested in your report are the maintainers of the code in question.
You know that from the moment you put the test together. No matter where
exactly the oops gets triggered, what it looks like, etc.

[Marco Elver]

On Thu, 29 Sept 2022 at 22:50, Al Viro <vi...@zeniv.linux.org.uk> wrote:
[...]

> ... and you _still_ have not bothered to Cc ntfs maintainers.
> Once more, with feeling:
> If you are fuzzing something (ntfs, in this case), the people most
> interested in your report are the maintainers of the code in question.
> You know that from the moment you put the test together. No matter where
> exactly the oops gets triggered, what it looks like, etc.

Apologies - we just updated syzbot to do better, so for bugs like this
it should now pick appropriate sub-filesystem maintainers.

Thanks,
~~ Marco

[syzbot]

Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.