[syzbot] KASAN: slab-out-of-bounds Read in ntfs_fill_super
14 views
Skip to first unread message
syzbot
Oct 1, 2022, 10:27:41 AM10/1/22
to an...@tuxera.com, linux-...@vger.kernel.org, linux-n...@lists.sourceforge.net, syzkall...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: ffb4d94b4314 Merge tag 'drm-fixes-2022-10-01' of git://ano..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13212ee0880000
kernel config: https://syzkaller.appspot.com/x/.config?x=755695d26ad09807
dashboard link: https://syzkaller.appspot.com/bug?extid=bd6d0c83fe8442ad6ef5
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f626c46d9422/disk-ffb4d94b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9140d7085b55/vmlinux-ffb4d94b.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bd6d0c...@syzkaller.appspotmail.com
loop1: detected capacity change from 0 to 4096
==================================================================
BUG: KASAN: slab-out-of-bounds in load_system_files fs/ntfs/super.c:1833 [inline]
BUG: KASAN: slab-out-of-bounds in ntfs_fill_super+0x7317/0x92d0 fs/ntfs/super.c:2892
Read of size 1 at addr ffff88802baf332a by task syz-executor.1/14735
CPU: 0 PID: 14735 Comm: syz-executor.1 Not tainted 6.0.0-rc7-syzkaller-00220-gffb4d94b4314 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:317 [inline]
print_report.cold+0x2ba/0x719 mm/kasan/report.c:433
kasan_report+0xb1/0x1e0 mm/kasan/report.c:495
load_system_files fs/ntfs/super.c:1833 [inline]
ntfs_fill_super+0x7317/0x92d0 fs/ntfs/super.c:2892
mount_bdev+0x34d/0x410 fs/super.c:1400
legacy_get_tree+0x105/0x220 fs/fs_context.c:610
vfs_get_tree+0x89/0x2f0 fs/super.c:1530
do_new_mount fs/namespace.c:3040 [inline]
path_mount+0x1326/0x1e20 fs/namespace.c:3370
do_mount fs/namespace.c:3383 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount fs/namespace.c:3568 [inline]
__x64_sys_mount+0x27f/0x300 fs/namespace.c:3568
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f7b1608bada
Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7b17226f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 00007f7b1608bada
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f7b17226fe0
RBP: 00007f7b17227020 R08: 00007f7b17227020 R09: 0000000020000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000
R13: 0000000020000100 R14: 00007f7b17226fe0 R15: 0000000020076700
</TASK>
Allocated by task 10867:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:437 [inline]
__kasan_slab_alloc+0x90/0xc0 mm/kasan/common.c:470
kasan_slab_alloc include/linux/kasan.h:224 [inline]
slab_post_alloc_hook mm/slab.h:727 [inline]
slab_alloc_node mm/slub.c:3248 [inline]
slab_alloc mm/slub.c:3256 [inline]
__kmem_cache_alloc_lru mm/slub.c:3263 [inline]
kmem_cache_alloc_lru+0x255/0x720 mm/slub.c:3280
alloc_inode_sb include/linux/fs.h:3103 [inline]
nilfs_alloc_inode+0x24/0x150 fs/nilfs2/super.c:154
alloc_inode+0x61/0x230 fs/inode.c:260
iget5_locked fs/inode.c:1242 [inline]
iget5_locked+0x1cb/0x2c0 fs/inode.c:1235
nilfs_iget_locked+0xa0/0xd0 fs/nilfs2/inode.c:588
nilfs_ifile_read+0x2c/0x1a0 fs/nilfs2/ifile.c:187
nilfs_attach_checkpoint+0x258/0x4b0 fs/nilfs2/super.c:541
nilfs_fill_super fs/nilfs2/super.c:1064 [inline]
nilfs_mount+0xb12/0xfb0 fs/nilfs2/super.c:1317
legacy_get_tree+0x105/0x220 fs/fs_context.c:610
vfs_get_tree+0x89/0x2f0 fs/super.c:1530
do_new_mount fs/namespace.c:3040 [inline]
path_mount+0x1326/0x1e20 fs/namespace.c:3370
do_mount fs/namespace.c:3383 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount fs/namespace.c:3568 [inline]
__x64_sys_mount+0x27f/0x300 fs/namespace.c:3568
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348
call_rcu+0x99/0x790 kernel/rcu/tree.c:2793
destroy_inode+0x129/0x1b0 fs/inode.c:315
iput_final fs/inode.c:1748 [inline]
iput.part.0+0x55d/0x810 fs/inode.c:1774
iput+0x58/0x70 fs/inode.c:1764
nilfs_put_super+0xac/0x1a0 fs/nilfs2/super.c:476
generic_shutdown_super+0x14c/0x400 fs/super.c:491
kill_block_super+0x97/0xf0 fs/super.c:1427
deactivate_locked_super+0x94/0x160 fs/super.c:332
deactivate_super+0xad/0xd0 fs/super.c:363
cleanup_mnt+0x2ae/0x3d0 fs/namespace.c:1186
task_work_run+0xdd/0x1a0 kernel/task_work.c:177
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop kernel/entry/common.c:169 [inline]
exit_to_user_mode_prepare+0x23c/0x250 kernel/entry/common.c:201
__syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline]
syscall_exit_to_user_mode+0x19/0x50 kernel/entry/common.c:294
do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Second to last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348
call_rcu+0x99/0x790 kernel/rcu/tree.c:2793
destroy_inode+0x129/0x1b0 fs/inode.c:315
iput_final fs/inode.c:1748 [inline]
iput.part.0+0x55d/0x810 fs/inode.c:1774
iput+0x58/0x70 fs/inode.c:1764
nilfs_put_super+0xac/0x1a0 fs/nilfs2/super.c:476
generic_shutdown_super+0x14c/0x400 fs/super.c:491
kill_block_super+0x97/0xf0 fs/super.c:1427
deactivate_locked_super+0x94/0x160 fs/super.c:332
deactivate_super+0xad/0xd0 fs/super.c:363
cleanup_mnt+0x2ae/0x3d0 fs/namespace.c:1186
task_work_run+0xdd/0x1a0 kernel/task_work.c:177
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop kernel/entry/common.c:169 [inline]
exit_to_user_mode_prepare+0x23c/0x250 kernel/entry/common.c:201
__syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline]
syscall_exit_to_user_mode+0x19/0x50 kernel/entry/common.c:294
do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd
The buggy address belongs to the object at ffff88802baf2cd8
which belongs to the cache nilfs2_inode_cache of size 1512
The buggy address is located 106 bytes to the right of
1512-byte region [ffff88802baf2cd8, ffff88802baf32c0)
The buggy address belongs to the physical page:
page:ffffea0000aebc00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2baf0
head:ffffea0000aebc00 order:3 compound_mapcount:0 compound_pincount:0
memcg:ffff8880493ca901
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888018a8aa00
raw: 0000000000000000 0000000000130013 00000001ffffffff ffff8880493ca901
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Reclaimable, gfp_mask 0x1d2050(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 644, tgid 643 (syz-executor.4), ts 2331907861767, free_ts 2317024789889
prep_new_page mm/page_alloc.c:2532 [inline]
get_page_from_freelist+0x109b/0x2ce0 mm/page_alloc.c:4283
__alloc_pages+0x1c7/0x510 mm/page_alloc.c:5549
alloc_pages+0x1a6/0x270 mm/mempolicy.c:2270
alloc_slab_page mm/slub.c:1829 [inline]
allocate_slab+0x27e/0x3d0 mm/slub.c:1974
new_slab mm/slub.c:2034 [inline]
___slab_alloc+0x7f1/0xe10 mm/slub.c:3036
__slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3123
slab_alloc_node mm/slub.c:3214 [inline]
slab_alloc mm/slub.c:3256 [inline]
__kmem_cache_alloc_lru mm/slub.c:3263 [inline]
kmem_cache_alloc_lru+0x528/0x720 mm/slub.c:3280
alloc_inode_sb include/linux/fs.h:3103 [inline]
nilfs_alloc_inode+0x24/0x150 fs/nilfs2/super.c:154
alloc_inode+0x61/0x230 fs/inode.c:260
iget5_locked fs/inode.c:1242 [inline]
iget5_locked+0x1cb/0x2c0 fs/inode.c:1235
nilfs_iget_locked+0xa0/0xd0 fs/nilfs2/inode.c:588
nilfs_cpfile_read+0x83/0x1f0 fs/nilfs2/cpfile.c:991
nilfs_load_super_root fs/nilfs2/the_nilfs.c:125 [inline]
load_nilfs+0x48b/0x1330 fs/nilfs2/the_nilfs.c:269
nilfs_fill_super fs/nilfs2/super.c:1059 [inline]
nilfs_mount+0xa9a/0xfb0 fs/nilfs2/super.c:1317
legacy_get_tree+0x105/0x220 fs/fs_context.c:610
vfs_get_tree+0x89/0x2f0 fs/super.c:1530
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1449 [inline]
free_pcp_prepare+0x5e4/0xd20 mm/page_alloc.c:1499
free_unref_page_prepare mm/page_alloc.c:3380 [inline]
free_unref_page+0x19/0x4d0 mm/page_alloc.c:3476
qlink_free mm/kasan/quarantine.c:168 [inline]
qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187
kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:294
__kasan_slab_alloc+0xa2/0xc0 mm/kasan/common.c:447
kasan_slab_alloc include/linux/kasan.h:224 [inline]
slab_post_alloc_hook mm/slab.h:727 [inline]
slab_alloc_node mm/slub.c:3248 [inline]
slab_alloc mm/slub.c:3256 [inline]
__kmem_cache_alloc_lru mm/slub.c:3263 [inline]
kmem_cache_alloc+0x267/0x3b0 mm/slub.c:3273
getname_flags.part.0+0x50/0x4f0 fs/namei.c:139
getname_flags+0x9a/0xe0 include/linux/audit.h:320
user_path_at_empty+0x2b/0x60 fs/namei.c:2875
user_path_at include/linux/namei.h:57 [inline]
__do_sys_chdir fs/open.c:514 [inline]
__se_sys_chdir fs/open.c:508 [inline]
__x64_sys_chdir+0xb7/0x260 fs/open.c:508
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Memory state around the buggy address:
ffff88802baf3200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88802baf3280: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
>ffff88802baf3300: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
^
ffff88802baf3380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88802baf3400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following issue on:
HEAD commit: ffb4d94b4314 Merge tag 'drm-fixes-2022-10-01' of git://ano..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13212ee0880000
kernel config: https://syzkaller.appspot.com/x/.config?x=755695d26ad09807
dashboard link: https://syzkaller.appspot.com/bug?extid=bd6d0c83fe8442ad6ef5
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f626c46d9422/disk-ffb4d94b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9140d7085b55/vmlinux-ffb4d94b.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bd6d0c...@syzkaller.appspotmail.com
loop1: detected capacity change from 0 to 4096
==================================================================
BUG: KASAN: slab-out-of-bounds in load_system_files fs/ntfs/super.c:1833 [inline]
BUG: KASAN: slab-out-of-bounds in ntfs_fill_super+0x7317/0x92d0 fs/ntfs/super.c:2892
Read of size 1 at addr ffff88802baf332a by task syz-executor.1/14735
CPU: 0 PID: 14735 Comm: syz-executor.1 Not tainted 6.0.0-rc7-syzkaller-00220-gffb4d94b4314 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:317 [inline]
print_report.cold+0x2ba/0x719 mm/kasan/report.c:433
kasan_report+0xb1/0x1e0 mm/kasan/report.c:495
load_system_files fs/ntfs/super.c:1833 [inline]
ntfs_fill_super+0x7317/0x92d0 fs/ntfs/super.c:2892
mount_bdev+0x34d/0x410 fs/super.c:1400
legacy_get_tree+0x105/0x220 fs/fs_context.c:610
vfs_get_tree+0x89/0x2f0 fs/super.c:1530
do_new_mount fs/namespace.c:3040 [inline]
path_mount+0x1326/0x1e20 fs/namespace.c:3370
do_mount fs/namespace.c:3383 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount fs/namespace.c:3568 [inline]
__x64_sys_mount+0x27f/0x300 fs/namespace.c:3568
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f7b1608bada
Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7b17226f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 00007f7b1608bada
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f7b17226fe0
RBP: 00007f7b17227020 R08: 00007f7b17227020 R09: 0000000020000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000
R13: 0000000020000100 R14: 00007f7b17226fe0 R15: 0000000020076700
</TASK>
Allocated by task 10867:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:437 [inline]
__kasan_slab_alloc+0x90/0xc0 mm/kasan/common.c:470
kasan_slab_alloc include/linux/kasan.h:224 [inline]
slab_post_alloc_hook mm/slab.h:727 [inline]
slab_alloc_node mm/slub.c:3248 [inline]
slab_alloc mm/slub.c:3256 [inline]
__kmem_cache_alloc_lru mm/slub.c:3263 [inline]
kmem_cache_alloc_lru+0x255/0x720 mm/slub.c:3280
alloc_inode_sb include/linux/fs.h:3103 [inline]
nilfs_alloc_inode+0x24/0x150 fs/nilfs2/super.c:154
alloc_inode+0x61/0x230 fs/inode.c:260
iget5_locked fs/inode.c:1242 [inline]
iget5_locked+0x1cb/0x2c0 fs/inode.c:1235
nilfs_iget_locked+0xa0/0xd0 fs/nilfs2/inode.c:588
nilfs_ifile_read+0x2c/0x1a0 fs/nilfs2/ifile.c:187
nilfs_attach_checkpoint+0x258/0x4b0 fs/nilfs2/super.c:541
nilfs_fill_super fs/nilfs2/super.c:1064 [inline]
nilfs_mount+0xb12/0xfb0 fs/nilfs2/super.c:1317
legacy_get_tree+0x105/0x220 fs/fs_context.c:610
vfs_get_tree+0x89/0x2f0 fs/super.c:1530
do_new_mount fs/namespace.c:3040 [inline]
path_mount+0x1326/0x1e20 fs/namespace.c:3370
do_mount fs/namespace.c:3383 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount fs/namespace.c:3568 [inline]
__x64_sys_mount+0x27f/0x300 fs/namespace.c:3568
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348
call_rcu+0x99/0x790 kernel/rcu/tree.c:2793
destroy_inode+0x129/0x1b0 fs/inode.c:315
iput_final fs/inode.c:1748 [inline]
iput.part.0+0x55d/0x810 fs/inode.c:1774
iput+0x58/0x70 fs/inode.c:1764
nilfs_put_super+0xac/0x1a0 fs/nilfs2/super.c:476
generic_shutdown_super+0x14c/0x400 fs/super.c:491
kill_block_super+0x97/0xf0 fs/super.c:1427
deactivate_locked_super+0x94/0x160 fs/super.c:332
deactivate_super+0xad/0xd0 fs/super.c:363
cleanup_mnt+0x2ae/0x3d0 fs/namespace.c:1186
task_work_run+0xdd/0x1a0 kernel/task_work.c:177
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop kernel/entry/common.c:169 [inline]
exit_to_user_mode_prepare+0x23c/0x250 kernel/entry/common.c:201
__syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline]
syscall_exit_to_user_mode+0x19/0x50 kernel/entry/common.c:294
do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Second to last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348
call_rcu+0x99/0x790 kernel/rcu/tree.c:2793
destroy_inode+0x129/0x1b0 fs/inode.c:315
iput_final fs/inode.c:1748 [inline]
iput.part.0+0x55d/0x810 fs/inode.c:1774
iput+0x58/0x70 fs/inode.c:1764
nilfs_put_super+0xac/0x1a0 fs/nilfs2/super.c:476
generic_shutdown_super+0x14c/0x400 fs/super.c:491
kill_block_super+0x97/0xf0 fs/super.c:1427
deactivate_locked_super+0x94/0x160 fs/super.c:332
deactivate_super+0xad/0xd0 fs/super.c:363
cleanup_mnt+0x2ae/0x3d0 fs/namespace.c:1186
task_work_run+0xdd/0x1a0 kernel/task_work.c:177
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop kernel/entry/common.c:169 [inline]
exit_to_user_mode_prepare+0x23c/0x250 kernel/entry/common.c:201
__syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline]
syscall_exit_to_user_mode+0x19/0x50 kernel/entry/common.c:294
do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd
The buggy address belongs to the object at ffff88802baf2cd8
which belongs to the cache nilfs2_inode_cache of size 1512
The buggy address is located 106 bytes to the right of
1512-byte region [ffff88802baf2cd8, ffff88802baf32c0)
The buggy address belongs to the physical page:
page:ffffea0000aebc00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2baf0
head:ffffea0000aebc00 order:3 compound_mapcount:0 compound_pincount:0
memcg:ffff8880493ca901
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888018a8aa00
raw: 0000000000000000 0000000000130013 00000001ffffffff ffff8880493ca901
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Reclaimable, gfp_mask 0x1d2050(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 644, tgid 643 (syz-executor.4), ts 2331907861767, free_ts 2317024789889
prep_new_page mm/page_alloc.c:2532 [inline]
get_page_from_freelist+0x109b/0x2ce0 mm/page_alloc.c:4283
__alloc_pages+0x1c7/0x510 mm/page_alloc.c:5549
alloc_pages+0x1a6/0x270 mm/mempolicy.c:2270
alloc_slab_page mm/slub.c:1829 [inline]
allocate_slab+0x27e/0x3d0 mm/slub.c:1974
new_slab mm/slub.c:2034 [inline]
___slab_alloc+0x7f1/0xe10 mm/slub.c:3036
__slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3123
slab_alloc_node mm/slub.c:3214 [inline]
slab_alloc mm/slub.c:3256 [inline]
__kmem_cache_alloc_lru mm/slub.c:3263 [inline]
kmem_cache_alloc_lru+0x528/0x720 mm/slub.c:3280
alloc_inode_sb include/linux/fs.h:3103 [inline]
nilfs_alloc_inode+0x24/0x150 fs/nilfs2/super.c:154
alloc_inode+0x61/0x230 fs/inode.c:260
iget5_locked fs/inode.c:1242 [inline]
iget5_locked+0x1cb/0x2c0 fs/inode.c:1235
nilfs_iget_locked+0xa0/0xd0 fs/nilfs2/inode.c:588
nilfs_cpfile_read+0x83/0x1f0 fs/nilfs2/cpfile.c:991
nilfs_load_super_root fs/nilfs2/the_nilfs.c:125 [inline]
load_nilfs+0x48b/0x1330 fs/nilfs2/the_nilfs.c:269
nilfs_fill_super fs/nilfs2/super.c:1059 [inline]
nilfs_mount+0xa9a/0xfb0 fs/nilfs2/super.c:1317
legacy_get_tree+0x105/0x220 fs/fs_context.c:610
vfs_get_tree+0x89/0x2f0 fs/super.c:1530
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1449 [inline]
free_pcp_prepare+0x5e4/0xd20 mm/page_alloc.c:1499
free_unref_page_prepare mm/page_alloc.c:3380 [inline]
free_unref_page+0x19/0x4d0 mm/page_alloc.c:3476
qlink_free mm/kasan/quarantine.c:168 [inline]
qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187
kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:294
__kasan_slab_alloc+0xa2/0xc0 mm/kasan/common.c:447
kasan_slab_alloc include/linux/kasan.h:224 [inline]
slab_post_alloc_hook mm/slab.h:727 [inline]
slab_alloc_node mm/slub.c:3248 [inline]
slab_alloc mm/slub.c:3256 [inline]
__kmem_cache_alloc_lru mm/slub.c:3263 [inline]
kmem_cache_alloc+0x267/0x3b0 mm/slub.c:3273
getname_flags.part.0+0x50/0x4f0 fs/namei.c:139
getname_flags+0x9a/0xe0 include/linux/audit.h:320
user_path_at_empty+0x2b/0x60 fs/namei.c:2875
user_path_at include/linux/namei.h:57 [inline]
__do_sys_chdir fs/open.c:514 [inline]
__se_sys_chdir fs/open.c:508 [inline]
__x64_sys_chdir+0xb7/0x260 fs/open.c:508
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Memory state around the buggy address:
ffff88802baf3200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88802baf3280: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
>ffff88802baf3300: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
^
ffff88802baf3380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88802baf3400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Oct 10, 2022, 1:12:42 PM10/10/22
to almaz.ale...@paragon-software.com, an...@tuxera.com, linux-...@vger.kernel.org, linux-n...@lists.sourceforge.net, ll...@lists.linux.dev, nat...@kernel.org, ndesau...@google.com, nt...@lists.linux.dev, syzkall...@googlegroups.com, tr...@redhat.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 493ffd6605b2 Merge tag 'ucount-rlimits-cleanups-for-v5.19'..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=126d971c880000
kernel config: https://syzkaller.appspot.com/x/.config?x=d19f5d16783f901
dashboard link: https://syzkaller.appspot.com/bug?extid=bd6d0c83fe8442ad6ef5
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17be583a880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1506f83a880000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f1ff6481e26f/disk-493ffd66.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/101bd3c7ae47/vmlinux-493ffd66.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/8a813f4e8f0b/mount_3.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bd6d0c...@syzkaller.appspotmail.com
ntfs3: loop3: RAW NTFS volume: Filesystem size 0.00 Gb > volume size 0.00 Gb. Mount in read-only
general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 1 PID: 3641 Comm: syz-executor420 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0
RIP: 0010:ntfs_fill_super+0x15b5/0x42a0 fs/ntfs3/super.c:935
Code: 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 ff 14 11 ff 4c 89 2b 4c 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <8a> 04 08 84 c0 0f 85 96 16 00 00 41 c7 45 00 46 49 4c 45 4d 8d 7d
RSP: 0018:ffffc90003fcfae0 EFLAGS: 00010202
RAX: 0000000000000002 RBX: ffff888075460080 RCX: dffffc0000000000
RDX: ffff8880203dd880 RSI: 0000000000000d40 RDI: 0000000000000000
RBP: ffffc90003fcfcb0 R08: ffffffff82c8d6e5 R09: fffffbfff1c19fde
R10: fffffbfff1c19fde R11: 1ffffffff1c19fdd R12: 00000000000001ff
R13: 0000000000000010 R14: ffff888075460320 R15: 0000000000000000
FS: 0000555555f93300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555555f932c0 CR3: 0000000075ed4000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
get_tree_bdev+0x400/0x620 fs/super.c:1323
vfs_get_tree+0x88/0x270 fs/super.c:1530
do_new_mount+0x289/0xad0 fs/namespace.c:3040
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7efc95f6311a
Code: 48 c7 c2 c0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 a8 00 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffde97f1518 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007efc95f6311a
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffde97f1530
RBP: 00007ffde97f1530 R08: 00007ffde97f1570 R09: 0000555555f932c0
R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000005
R13: 00007ffde97f1570 R14: 0000000000000037 R15: 0000000020000728
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ntfs_init_from_boot fs/ntfs3/super.c:844 [inline]
RIP: 0010:ntfs_fill_super+0x15b5/0x42a0 fs/ntfs3/super.c:935
Code: 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 ff 14 11 ff 4c 89 2b 4c 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <8a> 04 08 84 c0 0f 85 96 16 00 00 41 c7 45 00 46 49 4c 45 4d 8d 7d
RSP: 0018:ffffc90003fcfae0 EFLAGS: 00010202
RAX: 0000000000000002 RBX: ffff888075460080 RCX: dffffc0000000000
RDX: ffff8880203dd880 RSI: 0000000000000d40 RDI: 0000000000000000
RBP: ffffc90003fcfcb0 R08: ffffffff82c8d6e5 R09: fffffbfff1c19fde
R10: fffffbfff1c19fde R11: 1ffffffff1c19fdd R12: 00000000000001ff
R13: 0000000000000010 R14: ffff888075460320 R15: 0000000000000000
FS: 0000555555f93300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007efc95f1e668 CR3: 0000000075ed4000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 7 bytes skipped:
0: df 80 3c 08 00 74 filds 0x7400083c(%rax)
6: 08 48 89 or %cl,-0x77(%rax)
9: df e8 fucomip %st(0),%st
b: ff 14 11 callq *(%rcx,%rdx,1)
e: ff 4c 89 2b decl 0x2b(%rcx,%rcx,4)
12: 4c 89 e8 mov %r13,%rax
15: 48 c1 e8 03 shr $0x3,%rax
19: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
20: fc ff df
* 23: 8a 04 08 mov (%rax,%rcx,1),%al <-- trapping instruction
26: 84 c0 test %al,%al
28: 0f 85 96 16 00 00 jne 0x16c4
2e: 41 c7 45 00 46 49 4c movl $0x454c4946,0x0(%r13)
35: 45
36: 4d rex.WRB
37: 8d .byte 0x8d
38: 7d .byte 0x7d
HEAD commit: 493ffd6605b2 Merge tag 'ucount-rlimits-cleanups-for-v5.19'..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=126d971c880000
kernel config: https://syzkaller.appspot.com/x/.config?x=d19f5d16783f901
dashboard link: https://syzkaller.appspot.com/bug?extid=bd6d0c83fe8442ad6ef5
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17be583a880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1506f83a880000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f1ff6481e26f/disk-493ffd66.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/101bd3c7ae47/vmlinux-493ffd66.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/8a813f4e8f0b/mount_3.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bd6d0c...@syzkaller.appspotmail.com
general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 1 PID: 3641 Comm: syz-executor420 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
RIP: 0010:ntfs_init_from_boot fs/ntfs3/super.c:844 [inline]
RIP: 0010:ntfs_fill_super+0x15b5/0x42a0 fs/ntfs3/super.c:935
Code: 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 ff 14 11 ff 4c 89 2b 4c 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <8a> 04 08 84 c0 0f 85 96 16 00 00 41 c7 45 00 46 49 4c 45 4d 8d 7d
RSP: 0018:ffffc90003fcfae0 EFLAGS: 00010202
RAX: 0000000000000002 RBX: ffff888075460080 RCX: dffffc0000000000
RDX: ffff8880203dd880 RSI: 0000000000000d40 RDI: 0000000000000000
RBP: ffffc90003fcfcb0 R08: ffffffff82c8d6e5 R09: fffffbfff1c19fde
R10: fffffbfff1c19fde R11: 1ffffffff1c19fdd R12: 00000000000001ff
R13: 0000000000000010 R14: ffff888075460320 R15: 0000000000000000
FS: 0000555555f93300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555555f932c0 CR3: 0000000075ed4000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
get_tree_bdev+0x400/0x620 fs/super.c:1323
vfs_get_tree+0x88/0x270 fs/super.c:1530
do_new_mount+0x289/0xad0 fs/namespace.c:3040
do_mount fs/namespace.c:3383 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3568
__do_sys_mount fs/namespace.c:3591 [inline]
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7efc95f6311a
Code: 48 c7 c2 c0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 a8 00 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffde97f1518 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007efc95f6311a
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffde97f1530
RBP: 00007ffde97f1530 R08: 00007ffde97f1570 R09: 0000555555f932c0
R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000005
R13: 00007ffde97f1570 R14: 0000000000000037 R15: 0000000020000728
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ntfs_init_from_boot fs/ntfs3/super.c:844 [inline]
RIP: 0010:ntfs_fill_super+0x15b5/0x42a0 fs/ntfs3/super.c:935
Code: 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 ff 14 11 ff 4c 89 2b 4c 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <8a> 04 08 84 c0 0f 85 96 16 00 00 41 c7 45 00 46 49 4c 45 4d 8d 7d
RSP: 0018:ffffc90003fcfae0 EFLAGS: 00010202
RAX: 0000000000000002 RBX: ffff888075460080 RCX: dffffc0000000000
RDX: ffff8880203dd880 RSI: 0000000000000d40 RDI: 0000000000000000
RBP: ffffc90003fcfcb0 R08: ffffffff82c8d6e5 R09: fffffbfff1c19fde
R10: fffffbfff1c19fde R11: 1ffffffff1c19fdd R12: 00000000000001ff
R13: 0000000000000010 R14: ffff888075460320 R15: 0000000000000000
FS: 0000555555f93300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007efc95f1e668 CR3: 0000000075ed4000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 7 bytes skipped:
0: df 80 3c 08 00 74 filds 0x7400083c(%rax)
6: 08 48 89 or %cl,-0x77(%rax)
9: df e8 fucomip %st(0),%st
b: ff 14 11 callq *(%rcx,%rdx,1)
e: ff 4c 89 2b decl 0x2b(%rcx,%rcx,4)
12: 4c 89 e8 mov %r13,%rax
15: 48 c1 e8 03 shr $0x3,%rax
19: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
20: fc ff df
* 23: 8a 04 08 mov (%rax,%rcx,1),%al <-- trapping instruction
26: 84 c0 test %al,%al
28: 0f 85 96 16 00 00 jne 0x16c4
2e: 41 c7 45 00 46 49 4c movl $0x454c4946,0x0(%r13)
35: 45
36: 4d rex.WRB
37: 8d .byte 0x8d
38: 7d .byte 0x7d
syzbot
Dec 20, 2023, 10:26:13 PM12/20/23
to syzkall...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages