[syzbot] [exfat?] general protection fault in exfat_get_dentry_cached
15 views
Skip to first unread message
syzbot
Dec 3, 2024, 1:30:29 PM12/3/24
to linki...@kernel.org, linux-...@vger.kernel.org, linux-...@vger.kernel.org, sj155...@samsung.com, syzkall...@googlegroups.com, yuezh...@sony.com
Hello,
syzbot found the following issue on:
HEAD commit: 40384c840ea1 Linux 6.13-rc1
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1768d5e8580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ad7dafcfaa48849c
dashboard link: https://syzkaller.appspot.com/bug?extid=8f8fe64a30c50b289a18
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/32ee9cd04555/disk-40384c84.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e7894cd1da27/vmlinux-40384c84.xz
kernel image: https://storage.googleapis.com/syzbot-assets/2129df5d769f/bzImage-40384c84.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8f8fe6...@syzkaller.appspotmail.com
syz.2.96: attempt to access beyond end of device
loop2: rw=0, sector=161, nr_sectors = 1 limit=64
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 0 UID: 0 PID: 6259 Comm: syz.2.96 Not tainted 6.13.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:exfat_get_dentry_cached+0x11a/0x1b0 fs/exfat/dir.c:727
Code: df 48 89 da 48 c1 ea 03 80 3c 02 00 0f 85 9d 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 1b 48 8d 7b 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 61 49 8d 7d 18 48 8b 43 28 48 ba 00 00 00 00 00 fc
RSP: 0018:ffffc9000bd8f378 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000009
RDX: 0000000000000005 RSI: ffffffff8270df36 RDI: 0000000000000028
RBP: 0000000000000200 R08: 0000000000000001 R09: 000000000000001f
R10: 0000000000000009 R11: 0000000000000003 R12: ffffc9000bd8f4a0
R13: ffff88805919c000 R14: 0000000000000009 R15: 0000000000000010
FS: 00007f71995436c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b3031cff8 CR3: 000000007b9ce000 CR4: 0000000000350ef0
Call Trace:
<TASK>
exfat_init_ext_entry+0x1b6/0x3b0 fs/exfat/dir.c:498
exfat_add_entry+0x321/0x7a0 fs/exfat/namei.c:517
exfat_create+0x1cf/0x5c0 fs/exfat/namei.c:565
lookup_open.isra.0+0x1177/0x14c0 fs/namei.c:3649
open_last_lookups fs/namei.c:3748 [inline]
path_openat+0x904/0x2d60 fs/namei.c:3984
do_filp_open+0x20c/0x470 fs/namei.c:4014
do_sys_openat2+0x17a/0x1e0 fs/open.c:1402
do_sys_open fs/open.c:1417 [inline]
__do_sys_creat fs/open.c:1495 [inline]
__se_sys_creat fs/open.c:1489 [inline]
__x64_sys_creat+0xcd/0x120 fs/open.c:1489
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7198780849
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7199543058 EFLAGS: 00000246 ORIG_RAX: 0000000000000055
RAX: ffffffffffffffda RBX: 00007f7198946240 RCX: 00007f7198780849
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000e00
RBP: 00007f71987f3986 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007f7198946240 R15: 00007ffd4aed7f08
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:exfat_get_dentry_cached+0x11a/0x1b0 fs/exfat/dir.c:727
Code: df 48 89 da 48 c1 ea 03 80 3c 02 00 0f 85 9d 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 1b 48 8d 7b 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 61 49 8d 7d 18 48 8b 43 28 48 ba 00 00 00 00 00 fc
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 48 89 da mov %rbx,%rdx
3: 48 c1 ea 03 shr $0x3,%rdx
7: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
b: 0f 85 9d 00 00 00 jne 0xae
11: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
18: fc ff df
1b: 48 8b 1b mov (%rbx),%rbx
1e: 48 8d 7b 28 lea 0x28(%rbx),%rdi
22: 48 89 fa mov %rdi,%rdx
25: 48 c1 ea 03 shr $0x3,%rdx
* 29: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2d: 75 61 jne 0x90
2f: 49 8d 7d 18 lea 0x18(%r13),%rdi
33: 48 8b 43 28 mov 0x28(%rbx),%rax
37: 48 rex.W
38: ba 00 00 00 00 mov $0x0,%edx
3d: 00 fc add %bh,%ah
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 40384c840ea1 Linux 6.13-rc1
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1768d5e8580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ad7dafcfaa48849c
dashboard link: https://syzkaller.appspot.com/bug?extid=8f8fe64a30c50b289a18
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/32ee9cd04555/disk-40384c84.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e7894cd1da27/vmlinux-40384c84.xz
kernel image: https://storage.googleapis.com/syzbot-assets/2129df5d769f/bzImage-40384c84.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8f8fe6...@syzkaller.appspotmail.com
syz.2.96: attempt to access beyond end of device
loop2: rw=0, sector=161, nr_sectors = 1 limit=64
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 0 UID: 0 PID: 6259 Comm: syz.2.96 Not tainted 6.13.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:exfat_get_dentry_cached+0x11a/0x1b0 fs/exfat/dir.c:727
Code: df 48 89 da 48 c1 ea 03 80 3c 02 00 0f 85 9d 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 1b 48 8d 7b 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 61 49 8d 7d 18 48 8b 43 28 48 ba 00 00 00 00 00 fc
RSP: 0018:ffffc9000bd8f378 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000009
RDX: 0000000000000005 RSI: ffffffff8270df36 RDI: 0000000000000028
RBP: 0000000000000200 R08: 0000000000000001 R09: 000000000000001f
R10: 0000000000000009 R11: 0000000000000003 R12: ffffc9000bd8f4a0
R13: ffff88805919c000 R14: 0000000000000009 R15: 0000000000000010
FS: 00007f71995436c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b3031cff8 CR3: 000000007b9ce000 CR4: 0000000000350ef0
Call Trace:
<TASK>
exfat_init_ext_entry+0x1b6/0x3b0 fs/exfat/dir.c:498
exfat_add_entry+0x321/0x7a0 fs/exfat/namei.c:517
exfat_create+0x1cf/0x5c0 fs/exfat/namei.c:565
lookup_open.isra.0+0x1177/0x14c0 fs/namei.c:3649
open_last_lookups fs/namei.c:3748 [inline]
path_openat+0x904/0x2d60 fs/namei.c:3984
do_filp_open+0x20c/0x470 fs/namei.c:4014
do_sys_openat2+0x17a/0x1e0 fs/open.c:1402
do_sys_open fs/open.c:1417 [inline]
__do_sys_creat fs/open.c:1495 [inline]
__se_sys_creat fs/open.c:1489 [inline]
__x64_sys_creat+0xcd/0x120 fs/open.c:1489
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7198780849
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7199543058 EFLAGS: 00000246 ORIG_RAX: 0000000000000055
RAX: ffffffffffffffda RBX: 00007f7198946240 RCX: 00007f7198780849
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000e00
RBP: 00007f71987f3986 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007f7198946240 R15: 00007ffd4aed7f08
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:exfat_get_dentry_cached+0x11a/0x1b0 fs/exfat/dir.c:727
Code: df 48 89 da 48 c1 ea 03 80 3c 02 00 0f 85 9d 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 1b 48 8d 7b 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 61 49 8d 7d 18 48 8b 43 28 48 ba 00 00 00 00 00 fc
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 48 89 da mov %rbx,%rdx
3: 48 c1 ea 03 shr $0x3,%rdx
7: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
b: 0f 85 9d 00 00 00 jne 0xae
11: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
18: fc ff df
1b: 48 8b 1b mov (%rbx),%rbx
1e: 48 8d 7b 28 lea 0x28(%rbx),%rdi
22: 48 89 fa mov %rdi,%rdx
25: 48 c1 ea 03 shr $0x3,%rdx
* 29: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2d: 75 61 jne 0x90
2f: 49 8d 7d 18 lea 0x18(%r13),%rdi
33: 48 8b 43 28 mov 0x28(%rbx),%rax
37: 48 rex.W
38: ba 00 00 00 00 mov $0x0,%edx
3d: 00 fc add %bh,%ah
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Dec 11, 2024, 5:55:26 PM12/11/24
to linki...@kernel.org, linux-...@vger.kernel.org, linux-...@vger.kernel.org, sj155...@samsung.com, syzkall...@googlegroups.com, yuezh...@sony.com
syzbot has found a reproducer for the following issue on:
HEAD commit: f92f4749861b Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=144e7544580000
kernel config: https://syzkaller.appspot.com/x/.config?x=df9504e360281ee5
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=124e7544580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ca4977648e90/disk-f92f4749.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f743aedaf863/vmlinux-f92f4749.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9d7aea41c35c/bzImage-f92f4749.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/4e5e94b5fe8e/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8f8fe6...@syzkaller.appspotmail.com
syz-executor248: attempt to access beyond end of device
loop0: rw=524288, sector=165, nr_sectors = 1 limit=64
syz-executor248: attempt to access beyond end of device
loop0: rw=524288, sector=166, nr_sectors = 1 limit=64
syz-executor248: attempt to access beyond end of device
loop0: rw=524288, sector=167, nr_sectors = 1 limit=64
syz-executor248: attempt to access beyond end of device
loop0: rw=0, sector=161, nr_sectors = 1 limit=64
R13: ffff8880350f6000 R14: 0000000000000009 R15: 0000000000000010
FS: 00007f9512b986c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9512b98168 EFLAGS: 00000246 ORIG_RAX: 0000000000000055
RAX: ffffffffffffffda RBX: 00007f9512c8c6d8 RCX: 00007f9512c02be9
RDX: 00007f9512bdc606 RSI: 0000000000000000 RDI: 0000000020000e00
RBP: 00007f9512c8c6d0 R08: 00007ffe09e1cab7 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9512c8c6dc
R13: 000000000000006e R14: 00007ffe09e1c9d0 R15: 00007ffe09e1cab8
R13: ffff8880350f6000 R14: 0000000000000009 R15: 0000000000000010
FS: 00007f9512b986c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: f92f4749861b Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=144e7544580000
kernel config: https://syzkaller.appspot.com/x/.config?x=df9504e360281ee5
dashboard link: https://syzkaller.appspot.com/bug?extid=8f8fe64a30c50b289a18
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10bfbb30580000
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=124e7544580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ca4977648e90/disk-f92f4749.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f743aedaf863/vmlinux-f92f4749.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9d7aea41c35c/bzImage-f92f4749.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/4e5e94b5fe8e/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8f8fe6...@syzkaller.appspotmail.com
loop0: rw=524288, sector=165, nr_sectors = 1 limit=64
syz-executor248: attempt to access beyond end of device
loop0: rw=524288, sector=166, nr_sectors = 1 limit=64
syz-executor248: attempt to access beyond end of device
loop0: rw=524288, sector=167, nr_sectors = 1 limit=64
syz-executor248: attempt to access beyond end of device
loop0: rw=0, sector=161, nr_sectors = 1 limit=64
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 0 UID: 0 PID: 5825 Comm: syz-executor248 Not tainted 6.13.0-rc2-syzkaller-00031-gf92f4749861b #0
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:exfat_get_dentry_cached+0x11a/0x1b0 fs/exfat/dir.c:727
Code: df 48 89 da 48 c1 ea 03 80 3c 02 00 0f 85 9d 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 1b 48 8d 7b 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 61 49 8d 7d 18 48 8b 43 28 48 ba 00 00 00 00 00 fc
RSP: 0018:ffffc900032df378 EFLAGS: 00010216
RIP: 0010:exfat_get_dentry_cached+0x11a/0x1b0 fs/exfat/dir.c:727
Code: df 48 89 da 48 c1 ea 03 80 3c 02 00 0f 85 9d 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 1b 48 8d 7b 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 61 49 8d 7d 18 48 8b 43 28 48 ba 00 00 00 00 00 fc
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000009
RDX: 0000000000000005 RSI: ffffffff82705916 RDI: 0000000000000028
RBP: 0000000000000200 R08: 0000000000000001 R09: 000000000000001f
R10: 0000000000000009 R11: 0000000000000003 R12: ffffc900032df4a0
R13: ffff8880350f6000 R14: 0000000000000009 R15: 0000000000000010
FS: 00007f9512b986c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055ea395f6818 CR3: 000000007542e000 CR4: 0000000000350ef0
Call Trace:
<TASK>
exfat_init_ext_entry+0x1b6/0x3b0 fs/exfat/dir.c:498
exfat_add_entry+0x321/0x7a0 fs/exfat/namei.c:517
exfat_create+0x1cf/0x5c0 fs/exfat/namei.c:565
lookup_open.isra.0+0x1177/0x14c0 fs/namei.c:3649
open_last_lookups fs/namei.c:3748 [inline]
path_openat+0x904/0x2d60 fs/namei.c:3984
do_filp_open+0x20c/0x470 fs/namei.c:4014
do_sys_openat2+0x17a/0x1e0 fs/open.c:1402
do_sys_open fs/open.c:1417 [inline]
__do_sys_creat fs/open.c:1495 [inline]
__se_sys_creat fs/open.c:1489 [inline]
__x64_sys_creat+0xcd/0x120 fs/open.c:1489
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9512c02be9
<TASK>
exfat_init_ext_entry+0x1b6/0x3b0 fs/exfat/dir.c:498
exfat_add_entry+0x321/0x7a0 fs/exfat/namei.c:517
exfat_create+0x1cf/0x5c0 fs/exfat/namei.c:565
lookup_open.isra.0+0x1177/0x14c0 fs/namei.c:3649
open_last_lookups fs/namei.c:3748 [inline]
path_openat+0x904/0x2d60 fs/namei.c:3984
do_filp_open+0x20c/0x470 fs/namei.c:4014
do_sys_openat2+0x17a/0x1e0 fs/open.c:1402
do_sys_open fs/open.c:1417 [inline]
__do_sys_creat fs/open.c:1495 [inline]
__se_sys_creat fs/open.c:1489 [inline]
__x64_sys_creat+0xcd/0x120 fs/open.c:1489
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9512b98168 EFLAGS: 00000246 ORIG_RAX: 0000000000000055
RAX: ffffffffffffffda RBX: 00007f9512c8c6d8 RCX: 00007f9512c02be9
RDX: 00007f9512bdc606 RSI: 0000000000000000 RDI: 0000000020000e00
RBP: 00007f9512c8c6d0 R08: 00007ffe09e1cab7 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9512c8c6dc
R13: 000000000000006e R14: 00007ffe09e1c9d0 R15: 00007ffe09e1cab8
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:exfat_get_dentry_cached+0x11a/0x1b0 fs/exfat/dir.c:727
Code: df 48 89 da 48 c1 ea 03 80 3c 02 00 0f 85 9d 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 1b 48 8d 7b 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 61 49 8d 7d 18 48 8b 43 28 48 ba 00 00 00 00 00 fc
RSP: 0018:ffffc900032df378 EFLAGS: 00010216
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:exfat_get_dentry_cached+0x11a/0x1b0 fs/exfat/dir.c:727
Code: df 48 89 da 48 c1 ea 03 80 3c 02 00 0f 85 9d 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 1b 48 8d 7b 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 61 49 8d 7d 18 48 8b 43 28 48 ba 00 00 00 00 00 fc
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000009
RDX: 0000000000000005 RSI: ffffffff82705916 RDI: 0000000000000028
RBP: 0000000000000200 R08: 0000000000000001 R09: 000000000000001f
R10: 0000000000000009 R11: 0000000000000003 R12: ffffc900032df4a0
R13: ffff8880350f6000 R14: 0000000000000009 R15: 0000000000000010
FS: 00007f9512b986c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055ea395f6818 CR3: 000000007542e000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 48 89 da mov %rbx,%rdx
3: 48 c1 ea 03 shr $0x3,%rdx
7: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
b: 0f 85 9d 00 00 00 jne 0xae
11: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
18: fc ff df
1b: 48 8b 1b mov (%rbx),%rbx
1e: 48 8d 7b 28 lea 0x28(%rbx),%rdi
22: 48 89 fa mov %rdi,%rdx
25: 48 c1 ea 03 shr $0x3,%rdx
* 29: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2d: 75 61 jne 0x90
2f: 49 8d 7d 18 lea 0x18(%r13),%rdi
33: 48 8b 43 28 mov 0x28(%rbx),%rax
37: 48 rex.W
38: ba 00 00 00 00 mov $0x0,%edx
3d: 00 fc add %bh,%ah
---
If you want syzbot to run the reproducer, reply with:
Code disassembly (best guess), 1 bytes skipped:
0: 48 89 da mov %rbx,%rdx
3: 48 c1 ea 03 shr $0x3,%rdx
7: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
b: 0f 85 9d 00 00 00 jne 0xae
11: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
18: fc ff df
1b: 48 8b 1b mov (%rbx),%rbx
1e: 48 8d 7b 28 lea 0x28(%rbx),%rdi
22: 48 89 fa mov %rdi,%rdx
25: 48 c1 ea 03 shr $0x3,%rdx
* 29: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2d: 75 61 jne 0x90
2f: 49 8d 7d 18 lea 0x18(%r13),%rdi
33: 48 8b 43 28 mov 0x28(%rbx),%rax
37: 48 rex.W
38: ba 00 00 00 00 mov $0x0,%edx
3d: 00 fc add %bh,%ah
---
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
syzbot
Dec 12, 2024, 12:45:07 PM12/12/24
to Yuezh...@sony.com, daniel...@sony.com, linki...@kernel.org, linux-...@vger.kernel.org, linux-...@vger.kernel.org, sj155...@samsung.com, syzkall...@googlegroups.com, wataru...@sony.com, yuezh...@sony.com
syzbot has bisected this issue to:
commit 8a3f5711ad74db9881b289a6e34d7f3b700df720
Author: Yuezhang Mo <Yuezh...@sony.com>
Date: Thu Sep 12 08:57:06 2024 +0000
exfat: reduce FAT chain traversal
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17851be8580000
start commit: f92f4749861b Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream
final oops: https://syzkaller.appspot.com/x/report.txt?x=14451be8580000
console output: https://syzkaller.appspot.com/x/log.txt?x=10451be8580000
Fixes: 8a3f5711ad74 ("exfat: reduce FAT chain traversal")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
commit 8a3f5711ad74db9881b289a6e34d7f3b700df720
Author: Yuezhang Mo <Yuezh...@sony.com>
Date: Thu Sep 12 08:57:06 2024 +0000
exfat: reduce FAT chain traversal
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17851be8580000
start commit: f92f4749861b Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream
final oops: https://syzkaller.appspot.com/x/report.txt?x=14451be8580000
console output: https://syzkaller.appspot.com/x/log.txt?x=10451be8580000
kernel config: https://syzkaller.appspot.com/x/.config?x=df9504e360281ee5
dashboard link: https://syzkaller.appspot.com/bug?extid=8f8fe64a30c50b289a18
dashboard link: https://syzkaller.appspot.com/bug?extid=8f8fe64a30c50b289a18
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10bfbb30580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=124e7544580000
Reported-by: syzbot+8f8fe6...@syzkaller.appspotmail.com
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=124e7544580000
Fixes: 8a3f5711ad74 ("exfat: reduce FAT chain traversal")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
syzbot
Dec 13, 2024, 3:17:17 AM12/13/24
to linux-...@vger.kernel.org, syzkall...@googlegroups.com
For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.
***
Subject: Re: general protection fault in exfat_get_dentry_cached()
Author: dman...@yandex.ru
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git f932fb9b40749d1c9a539d89bb3e288c077aafe5
diff --git a/fs/exfat/namei.c b/fs/exfat/namei.c
index 97d2774760fe..c356bde623bf 100644
--- a/fs/exfat/namei.c
+++ b/fs/exfat/namei.c
@@ -329,10 +329,7 @@ static int exfat_find_empty_entry(struct inode *inode,
EXFAT_B_TO_CLU(i_size_read(inode), sbi), ei->flags);
while ((dentry = exfat_search_empty_slot(sb, &hint_femp, p_dir,
- num_entries, es)) < 0) {
- if (dentry == -EIO)
- break;
-
+ num_entries, es)) == -ENOSPC) {
if (exfat_check_max_dentries(inode))
return -ENOSPC;
@@ -395,6 +392,9 @@ static int exfat_find_empty_entry(struct inode *inode,
inode->i_blocks += sbi->cluster_size >> 9;
}
+ if (dentry < 0)
+ return dentry;
+
p_dir->dir = exfat_sector_to_cluster(sbi, es->bh[0]->b_blocknr);
p_dir->size -= dentry / sbi->dentries_per_clu;
linux-...@vger.kernel.org, syzkall...@googlegroups.com.
***
Subject: Re: general protection fault in exfat_get_dentry_cached()
Author: dman...@yandex.ru
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git f932fb9b40749d1c9a539d89bb3e288c077aafe5
diff --git a/fs/exfat/namei.c b/fs/exfat/namei.c
index 97d2774760fe..c356bde623bf 100644
--- a/fs/exfat/namei.c
+++ b/fs/exfat/namei.c
@@ -329,10 +329,7 @@ static int exfat_find_empty_entry(struct inode *inode,
EXFAT_B_TO_CLU(i_size_read(inode), sbi), ei->flags);
while ((dentry = exfat_search_empty_slot(sb, &hint_femp, p_dir,
- num_entries, es)) < 0) {
- if (dentry == -EIO)
- break;
-
+ num_entries, es)) == -ENOSPC) {
if (exfat_check_max_dentries(inode))
return -ENOSPC;
@@ -395,6 +392,9 @@ static int exfat_find_empty_entry(struct inode *inode,
inode->i_blocks += sbi->cluster_size >> 9;
}
+ if (dentry < 0)
+ return dentry;
+
p_dir->dir = exfat_sector_to_cluster(sbi, es->bh[0]->b_blocknr);
p_dir->size -= dentry / sbi->dentries_per_clu;
syzbot
Dec 13, 2024, 3:40:04 AM12/13/24
to dman...@yandex.ru, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+8f8fe6...@syzkaller.appspotmail.com
Tested-by: syzbot+8f8fe6...@syzkaller.appspotmail.com
Tested on:
commit: f932fb9b Merge tag 'v6.13-rc2-ksmbd-server-fixes' of g..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=136a5be8580000
Note: testing is done by a robot and is best-effort only.
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+8f8fe6...@syzkaller.appspotmail.com
Tested-by: syzbot+8f8fe6...@syzkaller.appspotmail.com
Tested on:
commit: f932fb9b Merge tag 'v6.13-rc2-ksmbd-server-fixes' of g..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=136a5be8580000
kernel config: https://syzkaller.appspot.com/x/.config?x=df9504e360281ee5
dashboard link: https://syzkaller.appspot.com/bug?extid=8f8fe64a30c50b289a18
dashboard link: https://syzkaller.appspot.com/bug?extid=8f8fe64a30c50b289a18
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=12204730580000
Note: testing is done by a robot and is best-effort only.
syzbot
Dec 13, 2024, 9:13:55 AM12/13/24
to linux-...@vger.kernel.org, syzkall...@googlegroups.com
For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.
***
Subject: Re: general protection fault in exfat_get_dentry_cached()
Author: dman...@yandex.ru
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git f932fb9b40749d1c9a539d89bb3e288c077aafe5
diff --git a/fs/exfat/namei.c b/fs/exfat/namei.c
index 97d2774760fe..73dbc5cdf388 100644
linux-...@vger.kernel.org, syzkall...@googlegroups.com.
***
Subject: Re: general protection fault in exfat_get_dentry_cached()
Author: dman...@yandex.ru
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git f932fb9b40749d1c9a539d89bb3e288c077aafe5
diff --git a/fs/exfat/namei.c b/fs/exfat/namei.c
--- a/fs/exfat/namei.c
+++ b/fs/exfat/namei.c
@@ -331,7 +331,7 @@ static int exfat_find_empty_entry(struct inode *inode,
while ((dentry = exfat_search_empty_slot(sb, &hint_femp, p_dir,
num_entries, es)) < 0) {
if (dentry == -EIO)
- break;
+ return -EIO;
- break;
if (exfat_check_max_dentries(inode))
return -ENOSPC;
syzbot
Dec 13, 2024, 1:47:04 PM12/13/24
to dman...@yandex.ru, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+8f8fe6...@syzkaller.appspotmail.com
Tested-by: syzbot+8f8fe6...@syzkaller.appspotmail.com
Tested on:
commit: f932fb9b Merge tag 'v6.13-rc2-ksmbd-server-fixes' of g..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=130324f8580000
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+8f8fe6...@syzkaller.appspotmail.com
Tested-by: syzbot+8f8fe6...@syzkaller.appspotmail.com
Tested on:
commit: f932fb9b Merge tag 'v6.13-rc2-ksmbd-server-fixes' of g..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel config: https://syzkaller.appspot.com/x/.config?x=df9504e360281ee5
dashboard link: https://syzkaller.appspot.com/bug?extid=8f8fe64a30c50b289a18
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=11475be8580000
dashboard link: https://syzkaller.appspot.com/bug?extid=8f8fe64a30c50b289a18
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syzbot
Jan 25, 2025, 4:55:06 PM1/25/25
to Yuezh...@sony.com, daniel...@sony.com, dman...@yandex.ru, linki...@kernel.org, linux-...@vger.kernel.org, linux-...@vger.kernel.org, lvc-p...@linuxtesting.org, sj155...@samsung.com, syzkall...@googlegroups.com, wataru...@sony.com, yuezh...@sony.com
syzbot suspects this issue was fixed by commit:
commit 70465acbb0ce1bb69447acf32f136c8153cda0de
Author: Yuezhang Mo <Yuezh...@sony.com>
Date: Mon Dec 2 01:53:17 2024 +0000
exfat: fix exfat_find_empty_entry() not returning error on failure
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=149b5e18580000
#syz fix: exfat: fix exfat_find_empty_entry() not returning error on failure
commit 70465acbb0ce1bb69447acf32f136c8153cda0de
Author: Yuezhang Mo <Yuezh...@sony.com>
Date: Mon Dec 2 01:53:17 2024 +0000
exfat: fix exfat_find_empty_entry() not returning error on failure
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=149b5e18580000
start commit: f92f4749861b Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=df9504e360281ee5
dashboard link: https://syzkaller.appspot.com/bug?extid=8f8fe64a30c50b289a18
dashboard link: https://syzkaller.appspot.com/bug?extid=8f8fe64a30c50b289a18
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10bfbb30580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=124e7544580000
If the result looks correct, please mark the issue as fixed by replying with:
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=124e7544580000
#syz fix: exfat: fix exfat_find_empty_entry() not returning error on failure
syzbot
Mar 5, 2025, 7:48:17 PM3/5/25
to syzkall...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages