[syzbot] [ntfs3?] WARNING in indx_insert_into_buffer

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 037266a5f723 Merge tag 'scsi-fixes' of git://git.kernel.or..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16fa37b7680000
kernel config: https://syzkaller.appspot.com/x/.config?x=af04b7c4d36966d8
dashboard link: https://syzkaller.appspot.com/bug?extid=c5b339d16ffa61fd512d
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16b86f2f680000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=116b289f680000

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7bc7510fe41f/non_bootable_disk-037266a5.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3611d88a1ea6/vmlinux-037266a5.xz
kernel image: https://storage.googleapis.com/syzbot-assets/92866a30a4f7/bzImage-037266a5.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/083e689d86f3/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c5b339...@syzkaller.appspotmail.com

R13: 0000000000000021 R14: 431bde82d7b634db R15: 00007ffc52cb10d0
</TASK>
------------[ cut here ]------------
memcpy: detected field-spanning write (size 3960) of single field "hdr1" at fs/ntfs3/index.c:1912 (size 16)
WARNING: CPU: 2 PID: 5214 at fs/ntfs3/index.c:1912 indx_insert_into_buffer.isra.0+0xfb5/0x1280 fs/ntfs3/index.c:1912
Modules linked in:
CPU: 2 PID: 5214 Comm: syz-executor117 Not tainted 6.7.0-rc1-syzkaller-00344-g037266a5f723 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:indx_insert_into_buffer.isra.0+0xfb5/0x1280 fs/ntfs3/index.c:1912
Code: c1 ca c1 fe c6 05 a3 cb 3d 0c 01 90 48 8b 74 24 70 b9 10 00 00 00 48 c7 c2 80 cf 03 8b 48 c7 c7 e0 cf 03 8b e8 8c e9 87 fe 90 <0f> 0b 90 90 e9 1b fe ff ff 48 c7 44 24 68 00 00 00 00 31 db e9 10
RSP: 0018:ffffc900035c76e8 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 00000000fffffff4 RCX: ffffffff814ca799
RDX: ffff8880287393c0 RSI: ffffffff814ca7a6 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000005 R12: ffff888021065c00
R13: ffff8880143ecc20 R14: ffff888029712800 R15: ffff888018fae018
FS: 0000555556341380(0000) GS:ffff88806b800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd80dde5e00 CR3: 0000000026243000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
indx_insert_entry+0x1a5/0x460 fs/ntfs3/index.c:1981
ni_add_name+0x4d9/0x820 fs/ntfs3/frecord.c:3055
ni_rename+0xa1/0x1a0 fs/ntfs3/frecord.c:3087
ntfs_rename+0x91f/0xec0 fs/ntfs3/namei.c:322
vfs_rename+0x13e0/0x1c30 fs/namei.c:4844
do_renameat2+0xc3c/0xdc0 fs/namei.c:4996
__do_sys_rename fs/namei.c:5042 [inline]
__se_sys_rename fs/namei.c:5040 [inline]
__x64_sys_rename+0x81/0xa0 fs/namei.c:5040
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7fd8160252a9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc52cb1068 EFLAGS: 00000246 ORIG_RAX: 0000000000000052
RAX: ffffffffffffffda RBX: 00007ffc52cb1090 RCX: 00007fd8160252a9
RDX: 00007fd816024370 RSI: 0000000020000a40 RDI: 0000000020000300
RBP: 0000000000000002 R08: 00007ffc52cb0e06 R09: 00007ffc52cb10b0
R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffc52cb108c
R13: 0000000000000021 R14: 431bde82d7b634db R15: 00007ffc52cb10d0
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Lizhi Xu]

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 037266a5f723

diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
index cf92b2433f7a..e6b59cb87769 100644
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -1905,6 +1905,8 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,
}

if (err) {
+ if (err == -ENOMEM || err == -EINVAL)
+ goto out;
/*
* Undo critical operations.
*/

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: out-of-bounds Write in end_buffer_read_sync

==================================================================
BUG: KASAN: out-of-bounds in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: out-of-bounds in atomic_dec include/linux/atomic/atomic-instrumented.h:592 [inline]
BUG: KASAN: out-of-bounds in put_bh include/linux/buffer_head.h:306 [inline]
BUG: KASAN: out-of-bounds in end_buffer_read_sync+0x8f/0xe0 fs/buffer.c:161
Write of size 4 at addr ffffc900037f7898 by task ksoftirqd/1/26

CPU: 1 PID: 26 Comm: ksoftirqd/1 Not tainted 6.7.0-rc1-syzkaller-00344-g037266a5f723-dirty #0

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:364 [inline]
print_report+0xc4/0x620 mm/kasan/report.c:475
kasan_report+0xda/0x110 mm/kasan/report.c:588
check_region_inline mm/kasan/generic.c:181 [inline]
kasan_check_range+0xef/0x190 mm/kasan/generic.c:187
instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
atomic_dec include/linux/atomic/atomic-instrumented.h:592 [inline]
put_bh include/linux/buffer_head.h:306 [inline]
end_buffer_read_sync+0x8f/0xe0 fs/buffer.c:161
end_bio_bh_io_sync+0xdd/0x130 fs/buffer.c:2775
bio_endio+0x596/0x6a0 block/bio.c:1603
req_bio_endio block/blk-mq.c:788 [inline]
blk_update_request+0x67b/0x1700 block/blk-mq.c:933
blk_mq_end_request+0x57/0x520 block/blk-mq.c:1056
lo_complete_rq+0x232/0x2f0 drivers/block/loop.c:370
blk_complete_reqs+0xb2/0xf0 block/blk-mq.c:1131
__do_softirq+0x21a/0x8de kernel/softirq.c:553
run_ksoftirqd kernel/softirq.c:921 [inline]
run_ksoftirqd+0x31/0x60 kernel/softirq.c:913
smpboot_thread_fn+0x660/0xa10 kernel/smpboot.c:164
kthread+0x2c6/0x3a0 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
</TASK>

The buggy address belongs to the virtual mapping at
[ffffc900037f0000, ffffc900037f9000) created by:
kernel_clone+0xfd/0x930 kernel/fork.c:2907

The buggy address belongs to the physical page:
page:ffffea0000810580 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20416
memcg:ffff888021062402
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff ffff888021062402
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102dc2(GFP_HIGHUSER|__GFP_NOWARN|__GFP_ZERO), pid 5624, tgid 5624 (syz-executor.0), ts 88700425268, free_ts 88116212491
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x2d0/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1544 [inline]
get_page_from_freelist+0xa25/0x36d0 mm/page_alloc.c:3312
__alloc_pages+0x22e/0x2420 mm/page_alloc.c:4568
alloc_pages_mpol+0x258/0x5f0 mm/mempolicy.c:2133
vm_area_alloc_pages mm/vmalloc.c:3063 [inline]
__vmalloc_area_node mm/vmalloc.c:3139 [inline]
__vmalloc_node_range+0xa6e/0x1540 mm/vmalloc.c:3320
alloc_thread_stack_node kernel/fork.c:309 [inline]
dup_task_struct kernel/fork.c:1118 [inline]
copy_process+0x138b/0x73f0 kernel/fork.c:2332
kernel_clone+0xfd/0x930 kernel/fork.c:2907
__do_sys_clone3+0x1f1/0x260 kernel/fork.c:3208

do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b

page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1137 [inline]
free_unref_page_prepare+0x4fa/0xaa0 mm/page_alloc.c:2347
free_unref_page+0x33/0x3b0 mm/page_alloc.c:2487
__folio_put_small mm/swap.c:106 [inline]
__folio_put+0xc3/0x110 mm/swap.c:129
folio_put include/linux/mm.h:1483 [inline]
put_page include/linux/mm.h:1552 [inline]
free_page_and_swap_cache+0x25a/0x2d0 mm/swap_state.c:304
__tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline]
__tlb_remove_table_free mm/mmu_gather.c:154 [inline]
tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:209
rcu_do_batch kernel/rcu/tree.c:2158 [inline]
rcu_core+0x819/0x1680 kernel/rcu/tree.c:2431
__do_softirq+0x21a/0x8de kernel/softirq.c:553

Memory state around the buggy address:
ffffc900037f7780: 00 00 00 f1 f1 f1 f1 f1 f1 04 f2 00 f3 f3 f3 00
ffffc900037f7800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1
>ffffc900037f7880: f1 f1 f1 f1 f1 04 f2 00 f3 f3 f3 00 00 00 00 00
^
ffffc900037f7900: 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f2 f2
ffffc900037f7980: f2 00 f2 f2 f2 00 f3 f3 f3 00 00 00 00 00 00 00
==================================================================


Tested on:

commit: 037266a5 Merge tag 'scsi-fixes' of git://git.kernel.or..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=15670d9f680000

kernel config: https://syzkaller.appspot.com/x/.config?x=af04b7c4d36966d8
dashboard link: https://syzkaller.appspot.com/bug?extid=c5b339d16ffa61fd512d
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=11aa257ce80000

[Lizhi Xu]

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 037266a5f723

diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c

index cf92b2433f7a..540886474c0e 100644

--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -1905,6 +1905,8 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,
}

if (err) {

+ if (!hdr1_saved)

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

WARNING in indx_insert_into_buffer

R13: 000000000000000b R14: 00007fd9bef9bf80 R15: 00007ffebe4b2ef8

</TASK>
------------[ cut here ]------------

memcpy: detected field-spanning write (size 3960) of single field "hdr1" at fs/ntfs3/index.c:1914 (size 16)
WARNING: CPU: 2 PID: 5485 at fs/ntfs3/index.c:1914 indx_insert_into_buffer.isra.0+0xfb5/0x1280 fs/ntfs3/index.c:1914
Modules linked in:
CPU: 2 PID: 5485 Comm: syz-executor.0 Not tainted 6.7.0-rc1-syzkaller-00344-g037266a5f723-dirty #0

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014

RIP: 0010:indx_insert_into_buffer.isra.0+0xfb5/0x1280 fs/ntfs3/index.c:1914

Code: c1 ca c1 fe c6 05 a3 cb 3d 0c 01 90 48 8b 74 24 70 b9 10 00 00 00 48 c7 c2 80 cf 03 8b 48 c7 c7 e0 cf 03 8b e8 8c e9 87 fe 90 <0f> 0b 90 90 e9 1b fe ff ff 48 c7 44 24 68 00 00 00 00 31 db e9 10

RSP: 0018:ffffc900038af6e8 EFLAGS: 00010282

RAX: 0000000000000000 RBX: 00000000fffffff4 RCX: ffffffff814ca799

RDX: ffff8880222e4dc0 RSI: ffffffff814ca7a6 RDI: 0000000000000001

RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000

R10: 0000000000000001 R11: 0000000000000005 R12: ffff88802706dc00
R13: ffff88801884e8a0 R14: ffff88802c277800 R15: ffff88803cbfc018
FS: 00007fd9be1fe6c0(0000) GS:ffff88806b800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 000055d70cb94300 CR3: 0000000022a5c000 CR4: 0000000000350ef0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>

indx_insert_entry+0x1a5/0x460 fs/ntfs3/index.c:1983

ni_add_name+0x4d9/0x820 fs/ntfs3/frecord.c:3055
ni_rename+0xa1/0x1a0 fs/ntfs3/frecord.c:3087
ntfs_rename+0x91f/0xec0 fs/ntfs3/namei.c:322
vfs_rename+0x13e0/0x1c30 fs/namei.c:4844
do_renameat2+0xc3c/0xdc0 fs/namei.c:4996
__do_sys_rename fs/namei.c:5042 [inline]
__se_sys_rename fs/namei.c:5040 [inline]
__x64_sys_rename+0x81/0xa0 fs/namei.c:5040

do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b

RIP: 0033:0x7fd9bee7cae9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd9be1fe0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000052
RAX: ffffffffffffffda RBX: 00007fd9bef9bf80 RCX: 00007fd9bee7cae9
RDX: 0000000000000000 RSI: 0000000020000a40 RDI: 0000000020000300
RBP: 00007fd9be1fe120 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 000000000000000b R14: 00007fd9bef9bf80 R15: 00007ffebe4b2ef8
</TASK>

Tested on:

commit: 037266a5 Merge tag 'scsi-fixes' of git://git.kernel.or..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=1108b462e80000

kernel config: https://syzkaller.appspot.com/x/.config?x=af04b7c4d36966d8
dashboard link: https://syzkaller.appspot.com/bug?extid=c5b339d16ffa61fd512d
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=106b88ece80000

[Lizhi Xu]

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 037266a5f723

diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c

index cf92b2433f7a..a2fe5458d41c 100644

--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -1905,6 +1905,8 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,
}

if (err) {

+ if (used1 > le32_to_cpu(hdr1->used))
+ used1 = le32_to_cpu(hdr1->used);

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in indx_insert_into_buffer

R13: 000000000000000b R14: 00007ff4d479bf80 R15: 00007fff510c11d8

</TASK>
------------[ cut here ]------------

memcpy: detected field-spanning write (size 2600) of single field "hdr1" at fs/ntfs3/index.c:1914 (size 16)
WARNING: CPU: 2 PID: 5504 at fs/ntfs3/index.c:1914 indx_insert_into_buffer.isra.0+0xffb/0x12e0 fs/ntfs3/index.c:1914
Modules linked in:
CPU: 2 PID: 5504 Comm: syz-executor.0 Not tainted 6.7.0-rc1-syzkaller-00344-g037266a5f723-dirty #0

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014

RIP: 0010:indx_insert_into_buffer.isra.0+0xffb/0x12e0 fs/ntfs3/index.c:1914
Code: ff e8 79 ca c1 fe c6 05 5b cb 3d 0c 01 90 b9 10 00 00 00 48 c7 c2 c0 cf 03 8b 48 89 ee 48 c7 c7 20 d0 03 8b e8 46 e9 87 fe 90 <0f> 0b 90 90 e9 2d fe ff ff 4c 89 e7 e8 e4 96 17 ff e9 31 f1 ff ff
RSP: 0018:ffffc90003f9f6e8 EFLAGS: 00010282

RAX: 0000000000000000 RBX: 00000000fffffff4 RCX: ffffffff814ca799

RDX: ffff88802c56d0c0 RSI: ffffffff814ca7a6 RDI: 0000000000000001
RBP: 0000000000000a28 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000005 R12: 0000000000000000
R13: 0000000000000f78 R14: ffff88802a0da800 R15: ffff88802c18a018
FS: 00007ff4d532c6c0(0000) GS:ffff88806b800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 0000563e13dbe300 CR3: 000000001bcab000 CR4: 0000000000350ef0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
indx_insert_entry+0x1a5/0x460 fs/ntfs3/index.c:1983
ni_add_name+0x4d9/0x820 fs/ntfs3/frecord.c:3055
ni_rename+0xa1/0x1a0 fs/ntfs3/frecord.c:3087
ntfs_rename+0x91f/0xec0 fs/ntfs3/namei.c:322
vfs_rename+0x13e0/0x1c30 fs/namei.c:4844
do_renameat2+0xc3c/0xdc0 fs/namei.c:4996
__do_sys_rename fs/namei.c:5042 [inline]
__se_sys_rename fs/namei.c:5040 [inline]
__x64_sys_rename+0x81/0xa0 fs/namei.c:5040
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b

RIP: 0033:0x7ff4d467cae9

Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007ff4d532c0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000052
RAX: ffffffffffffffda RBX: 00007ff4d479bf80 RCX: 00007ff4d467cae9

RDX: 0000000000000000 RSI: 0000000020000a40 RDI: 0000000020000300

RBP: 00007ff4d532c120 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002

R13: 000000000000000b R14: 00007ff4d479bf80 R15: 00007fff510c11d8

</TASK>


Tested on:

commit: 037266a5 Merge tag 'scsi-fixes' of git://git.kernel.or..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=12026642e80000

kernel config: https://syzkaller.appspot.com/x/.config?x=af04b7c4d36966d8
dashboard link: https://syzkaller.appspot.com/bug?extid=c5b339d16ffa61fd512d
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=1403cb5ce80000

[Edward Adam Davis]

please test WARNING in indx_insert_into_buffer

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 037266a5f723

diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c

index cf92b2433f7a..350ec6798ffe 100644
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -1865,6 +1865,7 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,
hdr_insert_head(hdr2, de_t, to_copy);

/* Remove all entries (sp including) from hdr1. */
+ printk("u1: %d, tc: %d, ss: %d\n", used1, to_copy, sp_size);
used = used1 - to_copy - sp_size;
memmove(de_t, Add2Ptr(sp, sp_size), used - le32_to_cpu(hdr1->de_off));
hdr1->used = cpu_to_le32(used);
@@ -1892,6 +1893,8 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,
* We've finished splitting everybody, so we are ready to
* insert the promoted entry into the parent.
*/
+ printk("l: %d, e: %d, h1: %p, h1s: %p, u1: %d, %d\n", level, err, hdr1, hdr1_saved,
+ used1, le32_to_cpu(hdr1->used));
if (!level) {
/* Insert in root. */
err = indx_insert_into_root(indx, ni, up_e, NULL, ctx, fnd, 0);
@@ -1909,6 +1912,8 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,

* Undo critical operations.
*/

indx_mark_free(indx, ni, new_vbn >> indx->idx2vbn_bits);
+ printk("%d, e: %d, h1: %p, h1s: %p, u1: %d, %d\n", level, err, hdr1, hdr1_saved,
+ used1, le32_to_cpu(hdr1->used));
memcpy(hdr1, hdr1_saved, used1);
indx_write(indx, ni, n1, 0);
}
@@ -1916,6 +1921,7 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,
out:
kfree(up_e);
kfree(hdr1_saved);
+ printk("h1: %p, e: %d", hdr1, err);

return err;
}

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in indx_insert_into_buffer

0, e: -12, h1: ffff88801d400018, h1s: ffff88801d402000, u1: 3960, 2600
------------[ cut here ]------------
memcpy: detected field-spanning write (size 3960) of single field "hdr1" at fs/ntfs3/index.c:1917 (size 16)
WARNING: CPU: 1 PID: 5567 at fs/ntfs3/index.c:1917 indx_insert_into_buffer.isra.0+0x10a2/0x1370 fs/ntfs3/index.c:1917
Modules linked in:
CPU: 1 PID: 5567 Comm: syz-executor.0 Not tainted 6.7.0-rc1-syzkaller-00344-g037266a5f723-dirty #0

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014

RIP: 0010:indx_insert_into_buffer.isra.0+0x10a2/0x1370 fs/ntfs3/index.c:1917
Code: d4 c9 c1 fe c6 05 b6 cb 3d 0c 01 90 48 8b 74 24 78 b9 10 00 00 00 48 c7 c2 80 d0 03 8b 48 c7 c7 e0 d0 03 8b e8 9f e8 87 fe 90 <0f> 0b 90 90 e9 0d fe ff ff 48 c7 44 24 70 00 00 00 00 31 db e9 20
RSP: 0018:ffffc900036cf6e0 EFLAGS: 00010282

RAX: 0000000000000000 RBX: 00000000fffffff4 RCX: ffffffff814ca799

RDX: ffff88801ead1340 RSI: ffffffff814ca7a6 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000005 R12: ffff88802703a000
R13: ffff88801fac1820 R14: ffff88802def8000 R15: ffff88801d400018
FS: 00007fe44fc446c0(0000) GS:ffff88806b700000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007fe44ea20000 CR3: 0000000020a37000 CR4: 0000000000350ef0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>

indx_insert_entry+0x1a5/0x460 fs/ntfs3/index.c:1987

ni_add_name+0x4d9/0x820 fs/ntfs3/frecord.c:3055
ni_rename+0xa1/0x1a0 fs/ntfs3/frecord.c:3087
ntfs_rename+0x91f/0xec0 fs/ntfs3/namei.c:322
vfs_rename+0x13e0/0x1c30 fs/namei.c:4844
do_renameat2+0xc3c/0xdc0 fs/namei.c:4996
__do_sys_rename fs/namei.c:5042 [inline]
__se_sys_rename fs/namei.c:5040 [inline]
__x64_sys_rename+0x81/0xa0 fs/namei.c:5040
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b

RIP: 0033:0x7fe44ee7cae9

Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007fe44fc440c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000052
RAX: ffffffffffffffda RBX: 00007fe44ef9bf80 RCX: 00007fe44ee7cae9

RDX: 0000000000000000 RSI: 0000000020000a40 RDI: 0000000020000300

RBP: 00007fe44fc44120 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002

R13: 000000000000000b R14: 00007fe44ef9bf80 R15: 00007fff185517f8

</TASK>


Tested on:

commit: 037266a5 Merge tag 'scsi-fixes' of git://git.kernel.or..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=11dade9f680000

kernel config: https://syzkaller.appspot.com/x/.config?x=af04b7c4d36966d8
dashboard link: https://syzkaller.appspot.com/bug?extid=c5b339d16ffa61fd512d
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=141879cce80000

[Edward Adam Davis]

please test WARNING in indx_insert_into_buffer

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 037266a5f723

diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c

index cf92b2433f7a..ea8b605471eb 100644
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -1892,6 +1892,8 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,

* We've finished splitting everybody, so we are ready to
* insert the promoted entry into the parent.
*/
+ printk("l: %d, e: %d, h1: %p, h1s: %p, u1: %d, %d\n", level, err, hdr1, hdr1_saved,
+ used1, le32_to_cpu(hdr1->used));
if (!level) {
/* Insert in root. */
err = indx_insert_into_root(indx, ni, up_e, NULL, ctx, fnd, 0);

@@ -1909,6 +1911,10 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,

* Undo critical operations.
*/
indx_mark_free(indx, ni, new_vbn >> indx->idx2vbn_bits);
+ printk("%d, e: %d, h1: %p, h1s: %p, u1: %d, %d\n", level, err, hdr1, hdr1_saved,
+ used1, le32_to_cpu(hdr1->used));

+ if (!level && err == -ENOMEM)
+ goto out;

memcpy(hdr1, hdr1_saved, used1);
indx_write(indx, ni, n1, 0);
}

@@ -1916,6 +1922,7 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+c5b339...@syzkaller.appspotmail.com

Tested on:

commit: 037266a5 Merge tag 'scsi-fixes' of git://git.kernel.or..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=11cb73cce80000

kernel config: https://syzkaller.appspot.com/x/.config?x=af04b7c4d36966d8
dashboard link: https://syzkaller.appspot.com/bug?extid=c5b339d16ffa61fd512d
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=1743bcd8e80000

Note: testing is done by a robot and is best-effort only.

[Edward Adam Davis]

please test WARNING in indx_insert_into_buffer

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 037266a5f723

diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c

index cf92b2433f7a..92448d922aec 100644
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -1909,6 +1909,10 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,

* Undo critical operations.
*/
indx_mark_free(indx, ni, new_vbn >> indx->idx2vbn_bits);

+ printk("h1: %s\n", (char *)hdr1);
+ printk("h1s: %s\n", (char *)hdr1_saved);

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+c5b339...@syzkaller.appspotmail.com

Tested on:

commit: 037266a5 Merge tag 'scsi-fixes' of git://git.kernel.or..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=12c1e294e80000

kernel config: https://syzkaller.appspot.com/x/.config?x=af04b7c4d36966d8
dashboard link: https://syzkaller.appspot.com/bug?extid=c5b339d16ffa61fd512d
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=1450c3af680000

[Edward Adam Davis]

please test WARNING in indx_insert_into_buffer

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 037266a5f723

diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c

index cf92b2433f7a..67c27e6ce497 100644
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -1816,6 +1816,9 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,
* - Insert sp into parent buffer (or root)
* - Make sp a parent for new buffer
*/
+ printk("l: %d, u1: %d, t: %d, do: %d\n",
+ level, le32_to_cpu(hdr1->used), le32_to_cpu(hdr1->total),
+ le32_to_cpu(hdr1->de_off));
sp = hdr_find_split(hdr1);
if (!sp)
return -EINVAL;
@@ -1833,6 +1836,8 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,
goto out;
}

+ printk("l: %d, u1: %d, sps: %d, t: %d, do: %d\n",
+ level, used1, sp_size, le32_to_cpu(hdr1->total), le32_to_cpu(hdr1->de_off));
if (!hdr1->flags) {
up_e->flags |= NTFS_IE_HAS_SUBNODES;
up_e->size = cpu_to_le16(sp_size + sizeof(u64));
@@ -1895,6 +1900,8 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,

if (!level) {
/* Insert in root. */
err = indx_insert_into_root(indx, ni, up_e, NULL, ctx, fnd, 0);

+ //if (err == -ENOMEM)
+ // goto out;
} else {
/*
* The target buffer's parent is another index buffer.
@@ -1909,6 +1916,8 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,

* Undo critical operations.
*/
indx_mark_free(indx, ni, new_vbn >> indx->idx2vbn_bits);

+ printk("%d, u1: %d, sps: %d, t: %d, do: %d\n",
+ level, used1, sp_size, le32_to_cpu(hdr1->total), le32_to_cpu(hdr1->de_off));

memcpy(hdr1, hdr1_saved, used1);
indx_write(indx, ni, n1, 0);
}

diff --git a/fs/ntfs3/ntfs.h b/fs/ntfs3/ntfs.h
index 86aecbb01a92..67d0fd8f5b7d 100644
--- a/fs/ntfs3/ntfs.h
+++ b/fs/ntfs3/ntfs.h
@@ -759,7 +759,7 @@ static inline bool hdr_has_subnode(const struct INDEX_HDR *hdr)
struct INDEX_BUFFER {
struct NTFS_RECORD_HEADER rhdr; // 'INDX'
__le64 vbn; // 0x10: vcn if index >= cluster or vsn id index < cluster
- struct INDEX_HDR ihdr; // 0x18:
+ DECLARE_FLEX_ARRAY(struct INDEX_HDR, ihdr); // 0x18:
};

static_assert(sizeof(struct INDEX_BUFFER) == 0x28);

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

./include/linux/build_bug.h:78:41: error: static assertion failed: "sizeof(struct INDEX_BUFFER) == 0x28"
fs/ntfs3/ntfs.h:769:52: error: passing argument 1 of 'hdr_first_de' from incompatible pointer type [-Werror=incompatible-pointer-types]
fs/ntfs3/ntfs.h:776:26: error: '(const struct INDEX_HDR *)&ib-><Ueed8>.ihdr' is a pointer; did you mean to use '->'?

Tested on:

commit: 037266a5 Merge tag 'scsi-fixes' of git://git.kernel.or..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

kernel config: https://syzkaller.appspot.com/x/.config?x=af04b7c4d36966d8
dashboard link: https://syzkaller.appspot.com/bug?extid=c5b339d16ffa61fd512d
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=14254c08e80000

[Edward Adam Davis]

please test WARNING in indx_insert_into_buffer

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 037266a5f723

diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
index cf92b2433f7a..67c27e6ce497 100644
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -1816,6 +1816,9 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,
* - Insert sp into parent buffer (or root)
* - Make sp a parent for new buffer
*/
+ printk("l: %d, u1: %d, t: %d, do: %d\n",
+ level, le32_to_cpu(hdr1->used), le32_to_cpu(hdr1->total),
+ le32_to_cpu(hdr1->de_off));
sp = hdr_find_split(hdr1);
if (!sp)
return -EINVAL;
@@ -1833,6 +1836,8 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,
goto out;
}

+ printk("l: %d, u1: %d, sps: %d, t: %d, do: %d\n",
+ level, used1, sp_size, le32_to_cpu(hdr1->total), le32_to_cpu(hdr1->de_off));
if (!hdr1->flags) {
up_e->flags |= NTFS_IE_HAS_SUBNODES;
up_e->size = cpu_to_le16(sp_size + sizeof(u64));

@@ -1895,6 +1900,10 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,

if (!level) {
/* Insert in root. */
err = indx_insert_into_root(indx, ni, up_e, NULL, ctx, fnd, 0);

+ printk("%d, u1: %d, sps: %d, t: %d, do: %d\n",
+ level, used1, sp_size, le32_to_cpu(hdr1->total), le32_to_cpu(hdr1->de_off));

+ if (err == -ENOMEM)
+ goto out;

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+c5b339...@syzkaller.appspotmail.com

Tested on:

commit: 037266a5 Merge tag 'scsi-fixes' of git://git.kernel.or..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=116071c8e80000

kernel config: https://syzkaller.appspot.com/x/.config?x=af04b7c4d36966d8
dashboard link: https://syzkaller.appspot.com/bug?extid=c5b339d16ffa61fd512d
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=10e8a3cce80000

[Edward Adam Davis]

please test WARNING in indx_insert_into_buffer

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 037266a5f723


diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c

index cf92b2433f7a..be08cde7e117 100644
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -1909,8 +1909,11 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,

* Undo critical operations.
*/
indx_mark_free(indx, ni, new_vbn >> indx->idx2vbn_bits);

- memcpy(hdr1, hdr1_saved, used1);
+ n1->index->ihdr = hdr1_saved;
indx_write(indx, ni, n1, 0);
+ kfree(up_e);
+ kfree(hdr1);
+ return err;
}

out:

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

fs/ntfs3/index.c:1912:35: error: incompatible types when assigning to type 'struct INDEX_HDR' from type 'void *'

Tested on:

commit: 037266a5 Merge tag 'scsi-fixes' of git://git.kernel.or..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

kernel config: https://syzkaller.appspot.com/x/.config?x=af04b7c4d36966d8
dashboard link: https://syzkaller.appspot.com/bug?extid=c5b339d16ffa61fd512d
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=15a151a4e80000

[Edward Adam Davis]

please test WARNING in indx_insert_into_buffer

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 037266a5f723

diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c

index cf92b2433f7a..a625302a3b1e 100644

--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -1909,8 +1909,11 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,
* Undo critical operations.
*/
indx_mark_free(indx, ni, new_vbn >> indx->idx2vbn_bits);
- memcpy(hdr1, hdr1_saved, used1);

+ n1->index->ihdr = (struct INDEX_HDR *)hdr1_saved;

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

fs/ntfs3/index.c:1912:35: error: incompatible types when assigning to type 'struct INDEX_HDR' from type 'struct INDEX_HDR *'

Tested on:

commit: 037266a5 Merge tag 'scsi-fixes' of git://git.kernel.or..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel config: https://syzkaller.appspot.com/x/.config?x=af04b7c4d36966d8
dashboard link: https://syzkaller.appspot.com/bug?extid=c5b339d16ffa61fd512d
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=10e9fd9f680000

[Edward Adam Davis]

please test WARNING in indx_insert_into_buffer

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 037266a5f723

diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
index cf92b2433f7a..a625302a3b1e 100644
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -1909,8 +1909,11 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,
* Undo critical operations.
*/
indx_mark_free(indx, ni, new_vbn >> indx->idx2vbn_bits);
- memcpy(hdr1, hdr1_saved, used1);

+ kfree(hdr1);
+ hdr1 = (struct INDEX_HDR *)hdr1_saved;

indx_write(indx, ni, n1, 0);
+ kfree(up_e);

+ return err;
}

out:

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

KASAN: invalid-free in indx_insert_into_buffer

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002

R13: 000000000000000b R14: 00007f1a99f9bf80 R15: 00007ffdd50705e8
</TASK>
==================================================================
BUG: KASAN: invalid-free in indx_insert_into_buffer.isra.0+0xec4/0x11f0 fs/ntfs3/index.c:1912
Free of addr ffff88801c22c018 by task syz-executor.0/5511

CPU: 0 PID: 5511 Comm: syz-executor.0 Not tainted 6.7.0-rc1-syzkaller-00344-g037266a5f723-dirty #0

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:364 [inline]
print_report+0xc4/0x620 mm/kasan/report.c:475

kasan_report_invalid_free+0xab/0xd0 mm/kasan/report.c:550
____kasan_slab_free+0x17d/0x190 mm/kasan/common.c:216
kasan_slab_free include/linux/kasan.h:164 [inline]
__cache_free mm/slab.c:3370 [inline]
__do_kmem_cache_free mm/slab.c:3557 [inline]
__kmem_cache_free+0xcc/0x3d0 mm/slab.c:3564
indx_insert_into_buffer.isra.0+0xec4/0x11f0 fs/ntfs3/index.c:1912
indx_insert_entry+0x1a5/0x460 fs/ntfs3/index.c:1984

ni_add_name+0x4d9/0x820 fs/ntfs3/frecord.c:3055
ni_rename+0xa1/0x1a0 fs/ntfs3/frecord.c:3087
ntfs_rename+0x91f/0xec0 fs/ntfs3/namei.c:322
vfs_rename+0x13e0/0x1c30 fs/namei.c:4844
do_renameat2+0xc3c/0xdc0 fs/namei.c:4996
__do_sys_rename fs/namei.c:5042 [inline]
__se_sys_rename fs/namei.c:5040 [inline]
__x64_sys_rename+0x81/0xa0 fs/namei.c:5040
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b

RIP: 0033:0x7f1a99e7cae9

Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007f1a9ab210c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000052
RAX: ffffffffffffffda RBX: 00007f1a99f9bf80 RCX: 00007f1a99e7cae9

RDX: 0000000000000000 RSI: 0000000020000a40 RDI: 0000000020000300

RBP: 00007f1a9ab21120 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002

R13: 000000000000000b R14: 00007f1a99f9bf80 R15: 00007ffdd50705e8
</TASK>

Allocated by task 5511:
kasan_save_stack+0x33/0x50 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
____kasan_kmalloc mm/kasan/common.c:374 [inline]
__kasan_kmalloc+0xa3/0xb0 mm/kasan/common.c:383
kasan_kmalloc include/linux/kasan.h:198 [inline]
__do_kmalloc_node mm/slab_common.c:1007 [inline]
__kmalloc+0x59/0x90 mm/slab_common.c:1020
kmalloc include/linux/slab.h:604 [inline]
indx_read+0x4f1/0xcd0 fs/ntfs3/index.c:1059
indx_find+0x4a9/0x980 fs/ntfs3/index.c:1181
indx_insert_entry+0x376/0x460 fs/ntfs3/index.c:1961

ni_add_name+0x4d9/0x820 fs/ntfs3/frecord.c:3055
ni_rename+0xa1/0x1a0 fs/ntfs3/frecord.c:3087
ntfs_rename+0x91f/0xec0 fs/ntfs3/namei.c:322
vfs_rename+0x13e0/0x1c30 fs/namei.c:4844
do_renameat2+0xc3c/0xdc0 fs/namei.c:4996
__do_sys_rename fs/namei.c:5042 [inline]
__se_sys_rename fs/namei.c:5040 [inline]
__x64_sys_rename+0x81/0xa0 fs/namei.c:5040
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b

The buggy address belongs to the object at ffff88801c22c000
which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 24 bytes inside of
4096-byte region [ffff88801c22c000, ffff88801c22d000)

The buggy address belongs to the physical page:

page:ffffea0000708b00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1c22c
head:ffffea0000708b00 order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0x1()
raw: 00fff00000000840 ffff888013040900 ffffea0000b89390 ffffea0000701e90
raw: 0000000000000000 ffff88801c22c000 0000000100000001 0000000000000000

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 1, migratetype Unmovable, gfp_mask 0x342040(__GFP_IO|__GFP_NOWARN|__GFP_COMP|__GFP_HARDWALL|__GFP_THISNODE), pid 5318, tgid 5318 (dhcpcd-run-hook), ts 63150203847, free_ts 63102034837

set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x2d0/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1544 [inline]
get_page_from_freelist+0xa25/0x36d0 mm/page_alloc.c:3312
__alloc_pages+0x22e/0x2420 mm/page_alloc.c:4568

__alloc_pages_node include/linux/gfp.h:238 [inline]
kmem_getpages mm/slab.c:1356 [inline]
cache_grow_begin+0x99/0x3a0 mm/slab.c:2550
cache_alloc_refill+0x295/0x3b0 mm/slab.c:2923
____cache_alloc mm/slab.c:2999 [inline]
____cache_alloc mm/slab.c:2982 [inline]
__do_cache_alloc mm/slab.c:3182 [inline]
slab_alloc_node mm/slab.c:3230 [inline]
__kmem_cache_alloc_node+0x3ba/0x460 mm/slab.c:3521
kmalloc_trace+0x25/0x60 mm/slab_common.c:1098
kmalloc include/linux/slab.h:600 [inline]
kzalloc include/linux/slab.h:721 [inline]
tomoyo_environ security/tomoyo/domain.c:633 [inline]
tomoyo_find_next_domain+0xc08/0x2020 security/tomoyo/domain.c:878
tomoyo_bprm_check_security security/tomoyo/tomoyo.c:101 [inline]
tomoyo_bprm_check_security+0x12b/0x1d0 security/tomoyo/tomoyo.c:91
security_bprm_check+0x6a/0xe0 security/security.c:1103
search_binary_handler fs/exec.c:1725 [inline]
exec_binprm fs/exec.c:1779 [inline]
bprm_execve fs/exec.c:1854 [inline]
bprm_execve+0x73a/0x1a90 fs/exec.c:1810
do_execveat_common.isra.0+0x5d3/0x740 fs/exec.c:1962
do_execve fs/exec.c:2036 [inline]
__do_sys_execve fs/exec.c:2112 [inline]
__se_sys_execve fs/exec.c:2107 [inline]
__x64_sys_execve+0x8c/0xb0 fs/exec.c:2107

do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b

page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1137 [inline]
free_unref_page_prepare+0x4fa/0xaa0 mm/page_alloc.c:2347
free_unref_page+0x33/0x3b0 mm/page_alloc.c:2487

slab_destroy mm/slab.c:1608 [inline]
slabs_destroy+0x85/0xc0 mm/slab.c:1628
cache_flusharray mm/slab.c:3341 [inline]
___cache_free+0x2b7/0x420 mm/slab.c:3404
qlink_free mm/kasan/quarantine.c:168 [inline]
qlist_free_all+0x4c/0x1b0 mm/kasan/quarantine.c:187
kasan_quarantine_reduce+0x18e/0x1d0 mm/kasan/quarantine.c:294
__kasan_slab_alloc+0x65/0x90 mm/kasan/common.c:305
kasan_slab_alloc include/linux/kasan.h:188 [inline]
slab_post_alloc_hook mm/slab.h:763 [inline]
slab_alloc_node mm/slab.c:3237 [inline]
slab_alloc mm/slab.c:3246 [inline]
__kmem_cache_alloc_lru mm/slab.c:3423 [inline]
kmem_cache_alloc+0x159/0x360 mm/slab.c:3432
getname_flags.part.0+0x50/0x4e0 fs/namei.c:140
getname_flags+0x9c/0xf0 include/linux/audit.h:321
vfs_fstatat+0x9a/0x140 fs/stat.c:294
__do_sys_newfstatat+0x98/0x110 fs/stat.c:459

do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b

Memory state around the buggy address:

ffff88801c22bf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88801c22bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88801c22c000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
^
ffff88801c22c080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88801c22c100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

Tested on:

commit: 037266a5 Merge tag 'scsi-fixes' of git://git.kernel.or..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=12120b44e80000

kernel config: https://syzkaller.appspot.com/x/.config?x=af04b7c4d36966d8
dashboard link: https://syzkaller.appspot.com/bug?extid=c5b339d16ffa61fd512d
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=106773cce80000

[syzbot]

Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.