[syzbot] [ntfs3?] BUG: unable to handle kernel NULL pointer dereference in hdr_find_e (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 4b954598a47b Merge tag 'exfat-for-6.5-rc5' of git://git.ke..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=17c9ee5ea80000
kernel config: https://syzkaller.appspot.com/x/.config?x=1e3d5175079af5a4
dashboard link: https://syzkaller.appspot.com/bug?extid=60cf892fc31d1f4358fc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11ee0aa6a80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=100eaedea80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0032b69f541f/disk-4b954598.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/03d8f0d906d0/vmlinux-4b954598.xz
kernel image: https://storage.googleapis.com/syzbot-assets/564663ea69f2/bzImage-4b954598.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/0942a51fa81c/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+60cf89...@syzkaller.appspotmail.com

loop0: detected capacity change from 0 to 4096
ntfs3: loop0: Different NTFS sector size (2048) and media sector size (512).
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 7ce85067 P4D 7ce85067 PUD 7de36067 PMD 0
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 5020 Comm: syz-executor569 Not tainted 6.5.0-rc4-syzkaller-00009-g4b954598a47b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
RIP: 0010:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 0018:ffffc90003c1f778 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000
RDX: ffff88807a700210 RSI: 0000000000000000 RDI: ffff888021486600
RBP: ffffc90003c1f9b0 R08: ffff88807c3dc000 R09: 0000000000000000
R10: ffffc90003c1f820 R11: fffff52000783f24 R12: 0000000000000000
R13: ffff88807a700200 R14: dffffc0000000000 R15: 00000000000000d0
FS: 0000555557244380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 000000002adce000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
hdr_find_e+0x33e/0x600 fs/ntfs3/index.c:759
indx_find+0x317/0xb60 fs/ntfs3/index.c:1166
dir_search_u+0x1b7/0x3a0 fs/ntfs3/dir.c:254
ntfs_lookup+0x106/0x1f0 fs/ntfs3/namei.c:85
lookup_one_qstr_excl+0x11b/0x250 fs/namei.c:1605
do_renameat2+0x650/0x1660 fs/namei.c:4950
__do_sys_rename fs/namei.c:5055 [inline]
__se_sys_rename fs/namei.c:5053 [inline]
__x64_sys_rename+0x86/0x90 fs/namei.c:5053
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f20709905f9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcfe70b878 EFLAGS: 00000246 ORIG_RAX: 0000000000000052
RAX: ffffffffffffffda RBX: 0031656c69662f2e RCX: 00007f20709905f9
RDX: 00007f207098f8f0 RSI: 00000000200000c0 RDI: 0000000020000040
RBP: 00007f2070a22610 R08: 000000000001f3d5 R09: 0000000000000000
R10: 00007ffcfe70b740 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffcfe70ba48 R14: 0000000000000001 R15: 0000000000000001
</TASK>
Modules linked in:
CR2: 0000000000000000
---[ end trace 0000000000000000 ]---
RIP: 0010:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 0018:ffffc90003c1f778 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000
RDX: ffff88807a700210 RSI: 0000000000000000 RDI: ffff888021486600
RBP: ffffc90003c1f9b0 R08: ffff88807c3dc000 R09: 0000000000000000
R10: ffffc90003c1f820 R11: fffff52000783f24 R12: 0000000000000000
R13: ffff88807a700200 R14: dffffc0000000000 R15: 00000000000000d0
FS: 0000555557244380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 000000002adce000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Ziqi Zhao]

Upon investigation of the C reproducer provided by Syzbot, it seemed
the reproducer was trying to mount a corrupted NTFS filesystem, then
issue a rename syscall to some nodes in the filesystem. This can be
shown by modifying the reproducer to only include the mount syscall,
and investigating the filesystem by e.g. `ls` and `rm` commands. As a
result, during the problematic call to `hdr_fine_e`, the `inode` being
supplied did not go through `indx_init`, hence the `cmp` function
pointer was never set.

The fix is simply to check whether `cmp` is not set, and return NULL
if that's the case, in order to be consistent with other error
scenarios of the `hdr_find_e` method. The rationale behind this patch
is that:

- We should prevent crashing the kernel even if the mounted filesystem
is corrupted. Any syscalls made on the filesystem could return
invalid, but the kernel should be able to sustain these calls.

- Only very specific corruption would lead to this bug, so it would be
a pretty rare case in actual usage anyways. Therefore, introducing a
check to specifically protect against this bug seems appropriate.
Because of its rarity, an `unlikely` clause is used to wrap around
this nullity check.

Reported-by: syzbot+60cf89...@syzkaller.appspotmail.com
Signed-off-by: Ziqi Zhao <astr...@yahoo.com>
---
fs/ntfs3/index.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
index 124c6e822623..cf92b2433f7a 100644
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -729,6 +729,9 @@ static struct NTFS_DE *hdr_find_e(const struct ntfs_index *indx,
u32 total = le32_to_cpu(hdr->total);
u16 offs[128];

+ if (unlikely(!cmp))
+ return NULL;
+
fill_table:
if (end > total)
return NULL;
--
2.34.1

[Ziqi Zhao]

#syz test:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

[Ziqi Zhao]

[Ziqi Zhao]

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to apply patch:
checking file fs/ntfs3/index.c
patch: **** unexpected end of file in patch



Tested on:

commit: cacc6e22 tpm: Add a helper for checking hwrng enabled
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

kernel config: https://syzkaller.appspot.com/x/.config?x=1e3d5175079af5a4
dashboard link: https://syzkaller.appspot.com/bug?extid=60cf892fc31d1f4358fc
compiler:

patch: https://syzkaller.appspot.com/x/patch.diff?x=1291ed2da80000

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+60cf89...@syzkaller.appspotmail.com

Tested on:

commit: cacc6e22 tpm: Add a helper for checking hwrng enabled
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

console output: https://syzkaller.appspot.com/x/log.txt?x=113bdb5da80000
kernel config: https://syzkaller.appspot.com/x/.config?x=171b698bc2e613cf
dashboard link: https://syzkaller.appspot.com/bug?extid=60cf892fc31d1f4358fc

compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=1252c6eda80000

Note: testing is done by a robot and is best-effort only.

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+60cf89...@syzkaller.appspotmail.com

Tested on:

commit: cacc6e22 tpm: Add a helper for checking hwrng enabled
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

console output: https://syzkaller.appspot.com/x/log.txt?x=1107f5a5a80000

kernel config: https://syzkaller.appspot.com/x/.config?x=171b698bc2e613cf
dashboard link: https://syzkaller.appspot.com/bug?extid=60cf892fc31d1f4358fc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=11e4f5fda80000

[syzbot]

syzbot has bisected this issue to:

commit 6e5be40d32fb1907285277c02e74493ed43d77fe
Author: Konstantin Komarov <almaz.ale...@paragon-software.com>
Date: Fri Aug 13 14:21:30 2021 +0000

fs/ntfs3: Add NTFS3 in fs/Kconfig and fs/Makefile

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=151f20a8680000
start commit: 4b954598a47b Merge tag 'exfat-for-6.5-rc5' of git://git.ke..
git tree: upstream
final oops: https://syzkaller.appspot.com/x/report.txt?x=171f20a8680000
console output: https://syzkaller.appspot.com/x/log.txt?x=131f20a8680000

kernel config: https://syzkaller.appspot.com/x/.config?x=1e3d5175079af5a4
dashboard link: https://syzkaller.appspot.com/bug?extid=60cf892fc31d1f4358fc

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11ee0aa6a80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=100eaedea80000

Reported-by: syzbot+60cf89...@syzkaller.appspotmail.com
Fixes: 6e5be40d32fb ("fs/ntfs3: Add NTFS3 in fs/Kconfig and fs/Makefile")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection