[v6.1] kernel BUG in __hfsplus_setxattr

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 3b29299e5f60 Linux 6.1.22
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=133e7b35c80000
kernel config: https://syzkaller.appspot.com/x/.config?x=bbb9a1f6f7f5a1d9
dashboard link: https://syzkaller.appspot.com/bug?extid=a91b43ec91f8e37ccb46
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2affbd06cbfd/disk-3b29299e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8b22d1baf827/vmlinux-3b29299e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d5e3891c88bf/Image-3b29299e.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a91b43...@syzkaller.appspotmail.com

------------[ cut here ]------------
kernel BUG at fs/hfsplus/xattr.c:175!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 18114 Comm: syz-executor.4 Not tainted 6.1.22-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : hfsplus_create_attributes_file fs/hfsplus/xattr.c:175 [inline]
pc : __hfsplus_setxattr+0x1cac/0x1d10 fs/hfsplus/xattr.c:331
lr : hfsplus_create_attributes_file fs/hfsplus/xattr.c:175 [inline]
lr : __hfsplus_setxattr+0x1cac/0x1d10 fs/hfsplus/xattr.c:331
sp : ffff80002c987280
x29: ffff80002c9876f0 x28: ffff0001295d1800 x27: ffff000130d03500
x26: 0000000000000000 x25: ffff0001295d1838 x24: 0000000000000001
x23: 0000000000010000 x22: ffff00012ca623c0 x21: dfff800000000000
x20: ffff700005930e68 x19: ffff0000d7ae4530 x18: ffff80002c986e20
x17: 0000000000000000 x16: ffff80000825e1ac x15: 0000000000042a46
x14: 00000000ffffffff x13: dfff800000000000 x12: 0000000000040000
x11: 0000000000005b85 x10: ffff8000213c9000 x9 : ffff800009083d60
x8 : 0000000000005b86 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000020 x4 : 0000000000000000 x3 : ffff80000831c35c
x2 : 0000000000000001 x1 : 0000000000010000 x0 : 0000000000000000
Call trace:
hfsplus_create_attributes_file fs/hfsplus/xattr.c:175 [inline]
__hfsplus_setxattr+0x1cac/0x1d10 fs/hfsplus/xattr.c:331
hfsplus_setxattr+0xb4/0xec fs/hfsplus/xattr.c:434
hfsplus_trusted_setxattr+0x54/0x6c fs/hfsplus/xattr_trusted.c:30
__vfs_setxattr+0x388/0x3a4 fs/xattr.c:182
__vfs_setxattr_noperm+0x110/0x528 fs/xattr.c:216
__vfs_setxattr_locked+0x1ec/0x218 fs/xattr.c:277
vfs_setxattr+0x1a8/0x344 fs/xattr.c:309
do_setxattr fs/xattr.c:594 [inline]
setxattr+0x230/0x294 fs/xattr.c:617
path_setxattr+0x17c/0x258 fs/xattr.c:636
__do_sys_setxattr fs/xattr.c:652 [inline]
__se_sys_setxattr fs/xattr.c:648 [inline]
__arm64_sys_setxattr+0xbc/0xd8 fs/xattr.c:648
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
Code: d4210000 97d1ccdf d4210000 97d1ccdd (d4210000)
---[ end trace 0000000000000000 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: d86dfc4d95cd Linux 5.15.106
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=101d5e43c80000
kernel config: https://syzkaller.appspot.com/x/.config?x=639d55ab480652c5
dashboard link: https://syzkaller.appspot.com/bug?extid=e738f6e5c8c88da180ef

compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:

disk image: https://storage.googleapis.com/syzbot-assets/b2a94107dd69/disk-d86dfc4d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/398f8d288cb9/vmlinux-d86dfc4d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9b790c7e7c8c/Image-d86dfc4d.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+e738f6...@syzkaller.appspotmail.com

------------[ cut here ]------------
kernel BUG at fs/hfsplus/xattr.c:175!

Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4815 Comm: syz-executor.2 Not tainted 5.15.106-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : hfsplus_create_attributes_file fs/hfsplus/xattr.c:175 [inline]

pc : __hfsplus_setxattr+0x1d48/0x1df0 fs/hfsplus/xattr.c:331

lr : hfsplus_create_attributes_file fs/hfsplus/xattr.c:175 [inline]

lr : __hfsplus_setxattr+0x1d48/0x1df0 fs/hfsplus/xattr.c:331
sp : ffff80001d7c7240
x29: ffff80001d7c76b0 x28: ffff0000d7862800 x27: ffff0000cab7c800
x26: 0000000000000000 x25: ffff0000d7862838 x24: 0000000000000001
x23: 0000000000010000 x22: ffff0000da998200 x21: dfff800000000000
x20: ffff700003af8e60 x19: ffff0000da99cbf0 x18: ffff80001d7c6dc0
x17: ff80800008f8ddac x16: ffff80000824c758 x15: 000000000001fde4
x14: 00000000ffffffff x13: ffffffffffffffff x12: 0000000000040000
x11: 0000000000003c13 x10: ffff80002140a000 x9 : ffff800008fbbd08
x8 : 0000000000003c14 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000020 x4 : 0000000000000000 x3 : ffff800008302764

x2 : 0000000000000001 x1 : 0000000000010000 x0 : 0000000000000000
Call trace:
hfsplus_create_attributes_file fs/hfsplus/xattr.c:175 [inline]

__hfsplus_setxattr+0x1d48/0x1df0 fs/hfsplus/xattr.c:331
hfsplus_setxattr+0xb4/0xec fs/hfsplus/xattr.c:434
hfsplus_security_setxattr+0x54/0x6c fs/hfsplus/xattr_security.c:31

__vfs_setxattr+0x388/0x3a4 fs/xattr.c:182
__vfs_setxattr_noperm+0x110/0x528 fs/xattr.c:216
__vfs_setxattr_locked+0x1ec/0x218 fs/xattr.c:277

vfs_setxattr+0x1a8/0x344 fs/xattr.c:303
do_setxattr fs/xattr.c:588 [inline]
setxattr+0x250/0x2b4 fs/xattr.c:611
path_setxattr+0x17c/0x258 fs/xattr.c:630
__do_sys_setxattr fs/xattr.c:646 [inline]
__se_sys_setxattr fs/xattr.c:642 [inline]
__arm64_sys_setxattr+0xbc/0xd8 fs/xattr.c:642
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Code: d4210000 97d40f4b d4210000 97d40f49 (d4210000)
---[ end trace 1e538e7871f2c84a ]---

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 76ba310227d2 Linux 6.1.32
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11c46ab3280000
kernel config: https://syzkaller.appspot.com/x/.config?x=3d054c5c4a3e2d63

dashboard link: https://syzkaller.appspot.com/bug?extid=a91b43ec91f8e37ccb46
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16d942b3280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13cddcf1280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e0c868320bc7/disk-76ba3102.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f7fcc207e1e7/vmlinux-76ba3102.xz
kernel image: https://storage.googleapis.com/syzbot-assets/5ddc172b4acf/Image-76ba3102.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/8f854cf9aa0f/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a91b43...@syzkaller.appspotmail.com

loop0: detected capacity change from 0 to 1024

------------[ cut here ]------------
kernel BUG at fs/hfsplus/xattr.c:175!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:

CPU: 1 PID: 4215 Comm: syz-executor236 Not tainted 6.1.32-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023

pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : hfsplus_create_attributes_file fs/hfsplus/xattr.c:175 [inline]
pc : __hfsplus_setxattr+0x1cac/0x1d10 fs/hfsplus/xattr.c:331
lr : hfsplus_create_attributes_file fs/hfsplus/xattr.c:175 [inline]
lr : __hfsplus_setxattr+0x1cac/0x1d10 fs/hfsplus/xattr.c:331

sp : ffff80001d7e7280
x29: ffff80001d7e76f0 x28: ffff0000ce5ea000 x27: ffff80001231b640
x26: 0000000000000000 x25: ffff0000ce5ea038 x24: 0000000000000001
x23: 0000000000010000 x22: ffff0000de51aa80 x21: dfff800000000000
x20: ffff700003afce68 x19: ffff0000de51a370 x18: ffff80001d7e6e20
x17: ffff800008ad9f54 x16: ffff80000825f9d8 x15: 000000000000ae74
x14: 000000007da0d915 x13: dfff800000000000 x12: 0000000000000001
x11: ff8080000908aeb4 x10: 0000000000000000 x9 : ffff80000908aeb4
x8 : ffff0000de490000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff800018767ed0 x4 : 0000000000000008 x3 : ffff80000831da0c

x2 : 0000000000000001 x1 : 0000000000010000 x0 : 0000000000000000
Call trace:
hfsplus_create_attributes_file fs/hfsplus/xattr.c:175 [inline]
__hfsplus_setxattr+0x1cac/0x1d10 fs/hfsplus/xattr.c:331
hfsplus_setxattr+0xb4/0xec fs/hfsplus/xattr.c:434
hfsplus_trusted_setxattr+0x54/0x6c fs/hfsplus/xattr_trusted.c:30
__vfs_setxattr+0x388/0x3a4 fs/xattr.c:182
__vfs_setxattr_noperm+0x110/0x528 fs/xattr.c:216
__vfs_setxattr_locked+0x1ec/0x218 fs/xattr.c:277
vfs_setxattr+0x1a8/0x344 fs/xattr.c:309
do_setxattr fs/xattr.c:594 [inline]
setxattr+0x230/0x294 fs/xattr.c:617
path_setxattr+0x17c/0x258 fs/xattr.c:636
__do_sys_setxattr fs/xattr.c:652 [inline]
__se_sys_setxattr fs/xattr.c:648 [inline]
__arm64_sys_setxattr+0xbc/0xd8 fs/xattr.c:648
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581

Code: d4210000 97d1bd37 d4210000 97d1bd35 (d4210000)

---[ end trace 0000000000000000 ]---


---

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: d7af3e5ba454 Linux 5.15.115
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1133d695280000
kernel config: https://syzkaller.appspot.com/x/.config?x=fc49fb9fb40e8b87

dashboard link: https://syzkaller.appspot.com/bug?extid=e738f6e5c8c88da180ef
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=166eecdd280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1567fab3280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/648d6fb5d654/disk-d7af3e5b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a693f550ea71/vmlinux-d7af3e5b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/09afa713a569/Image-d7af3e5b.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/993e98fd8b50/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e738f6...@syzkaller.appspotmail.com

loop0: detected capacity change from 0 to 1024

------------[ cut here ]------------
kernel BUG at fs/hfsplus/xattr.c:175!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
Modules linked in:

CPU: 1 PID: 3961 Comm: syz-executor327 Not tainted 5.15.115-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023

pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : hfsplus_create_attributes_file fs/hfsplus/xattr.c:175 [inline]
pc : __hfsplus_setxattr+0x1d48/0x1df0 fs/hfsplus/xattr.c:331
lr : hfsplus_create_attributes_file fs/hfsplus/xattr.c:175 [inline]
lr : __hfsplus_setxattr+0x1d48/0x1df0 fs/hfsplus/xattr.c:331

sp : ffff800018e87240
x29: ffff800018e876b0 x28: ffff0000c9492000 x27: ffff800011b472a0
x26: 0000000000000000 x25: ffff0000c9492038 x24: 0000000000000001
x23: 0000000000010000 x22: ffff0000c8cb2a80 x21: dfff800000000000
x20: ffff7000031d0e60 x19: ffff0000c8cb2370 x18: ffff800018e86dc0
x17: ff80800008f91950 x16: ffff80000824cbf4 x15: 000000000000b55d
x14: 0000000092ffcef8 x13: ffffffffffffffff x12: 0000000000000000
x11: ff80800008fbf8b0 x10: 0000000000000000 x9 : ffff800008fbf8b0
x8 : ffff0000d6539b40 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff800017547498 x4 : 0000000000000008 x3 : ffff800008303750

x2 : 0000000000000001 x1 : 0000000000010000 x0 : 0000000000000000
Call trace:
hfsplus_create_attributes_file fs/hfsplus/xattr.c:175 [inline]
__hfsplus_setxattr+0x1d48/0x1df0 fs/hfsplus/xattr.c:331
hfsplus_setxattr+0xb4/0xec fs/hfsplus/xattr.c:434

hfsplus_trusted_setxattr+0x54/0x6c fs/hfsplus/xattr_trusted.c:30

__vfs_setxattr+0x388/0x3a4 fs/xattr.c:182
__vfs_setxattr_noperm+0x110/0x528 fs/xattr.c:216
__vfs_setxattr_locked+0x1ec/0x218 fs/xattr.c:277
vfs_setxattr+0x1a8/0x344 fs/xattr.c:303
do_setxattr fs/xattr.c:588 [inline]
setxattr+0x250/0x2b4 fs/xattr.c:611
path_setxattr+0x17c/0x258 fs/xattr.c:630
__do_sys_setxattr fs/xattr.c:646 [inline]
__se_sys_setxattr fs/xattr.c:642 [inline]
__arm64_sys_setxattr+0xbc/0xd8 fs/xattr.c:642
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

Code: d4210000 97d40e16 d4210000 97d40e14 (d4210000)
---[ end trace a6eb3531e4c98363 ]---