[v6.1] kernel BUG in ntfs_lookup_inode_by_name
5 views
Skip to first unread message
syzbot
Jul 21, 2023, 5:47:00 AM7/21/23
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: a456e1743881 Linux 6.1.39
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1495844ea80000
kernel config: https://syzkaller.appspot.com/x/.config?x=5e6478d39ceccfae
dashboard link: https://syzkaller.appspot.com/bug?extid=47be101ffe992f905aab
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/47260b2456c0/disk-a456e174.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ac087687a80a/vmlinux-a456e174.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e2c3d9e7236f/Image-a456e174.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+47be10...@syzkaller.appspotmail.com
ntfs: volume version 3.1.
------------[ cut here ]------------
kernel BUG at fs/ntfs/dir.c:86!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 27302 Comm: syz-executor.2 Not tainted 6.1.39-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : ntfs_lookup_inode_by_name+0x265c/0x2824 fs/ntfs/dir.c:86
lr : ntfs_lookup_inode_by_name+0x265c/0x2824 fs/ntfs/dir.c:86
sp : ffff80001f8b7550
x29: ffff80001f8b7620 x28: ffff80001f8b76a0 x27: 1fffe0001b652f46
x26: ffff0000db297a20 x25: 1ffff00003f16ed0 x24: ffff0000db297800
x23: ffff0000c4bbc000 x22: dfff800000000000 x21: ffff00012eb86b40
x20: ffff0000db297a30 x19: 0000000000000000 x18: 1fffe000368b5976
x17: ffff8000155cd000 x16: ffff8000082fe924 x15: ffff800008ac7f88
x14: ffff800008ac4d30 x13: ffff800008ac7f88 x12: 0000000000040000
x11: 000000000003ffff x10: ffff8000275f8000 x9 : ffff8000095fb9e4
x8 : 0000000000040000 x7 : ffff800008061eec x6 : ffff80000963b16c
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff80001f8b76a0
x2 : 000000000000000c x1 : 0000000000000000 x0 : 0000000000004000
Call trace:
ntfs_lookup_inode_by_name+0x265c/0x2824 fs/ntfs/dir.c:86
check_windows_hibernation_status+0xe4/0x630 fs/ntfs/super.c:1274
load_system_files+0x3494/0x4734 fs/ntfs/super.c:1989
ntfs_fill_super+0x14e0/0x2314 fs/ntfs/super.c:2892
mount_bdev+0x274/0x370 fs/super.c:1423
ntfs_mount+0x44/0x58 fs/ntfs/super.c:3049
legacy_get_tree+0xd4/0x16c fs/fs_context.c:611
vfs_get_tree+0x90/0x274 fs/super.c:1553
do_new_mount+0x25c/0x8c4 fs/namespace.c:3040
path_mount+0x590/0xe58 fs/namespace.c:3370
do_mount fs/namespace.c:3383 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount fs/namespace.c:3568 [inline]
__arm64_sys_mount+0x45c/0x594 fs/namespace.c:3568
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
Code: 97cdc7c5 f85a83a0 17fffe9c 97bbfa36 (d4210000)
---[ end trace 0000000000000000 ]---
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: a456e1743881 Linux 6.1.39
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1495844ea80000
kernel config: https://syzkaller.appspot.com/x/.config?x=5e6478d39ceccfae
dashboard link: https://syzkaller.appspot.com/bug?extid=47be101ffe992f905aab
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/47260b2456c0/disk-a456e174.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ac087687a80a/vmlinux-a456e174.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e2c3d9e7236f/Image-a456e174.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+47be10...@syzkaller.appspotmail.com
ntfs: volume version 3.1.
------------[ cut here ]------------
kernel BUG at fs/ntfs/dir.c:86!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 27302 Comm: syz-executor.2 Not tainted 6.1.39-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : ntfs_lookup_inode_by_name+0x265c/0x2824 fs/ntfs/dir.c:86
lr : ntfs_lookup_inode_by_name+0x265c/0x2824 fs/ntfs/dir.c:86
sp : ffff80001f8b7550
x29: ffff80001f8b7620 x28: ffff80001f8b76a0 x27: 1fffe0001b652f46
x26: ffff0000db297a20 x25: 1ffff00003f16ed0 x24: ffff0000db297800
x23: ffff0000c4bbc000 x22: dfff800000000000 x21: ffff00012eb86b40
x20: ffff0000db297a30 x19: 0000000000000000 x18: 1fffe000368b5976
x17: ffff8000155cd000 x16: ffff8000082fe924 x15: ffff800008ac7f88
x14: ffff800008ac4d30 x13: ffff800008ac7f88 x12: 0000000000040000
x11: 000000000003ffff x10: ffff8000275f8000 x9 : ffff8000095fb9e4
x8 : 0000000000040000 x7 : ffff800008061eec x6 : ffff80000963b16c
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff80001f8b76a0
x2 : 000000000000000c x1 : 0000000000000000 x0 : 0000000000004000
Call trace:
ntfs_lookup_inode_by_name+0x265c/0x2824 fs/ntfs/dir.c:86
check_windows_hibernation_status+0xe4/0x630 fs/ntfs/super.c:1274
load_system_files+0x3494/0x4734 fs/ntfs/super.c:1989
ntfs_fill_super+0x14e0/0x2314 fs/ntfs/super.c:2892
mount_bdev+0x274/0x370 fs/super.c:1423
ntfs_mount+0x44/0x58 fs/ntfs/super.c:3049
legacy_get_tree+0xd4/0x16c fs/fs_context.c:611
vfs_get_tree+0x90/0x274 fs/super.c:1553
do_new_mount+0x25c/0x8c4 fs/namespace.c:3040
path_mount+0x590/0xe58 fs/namespace.c:3370
do_mount fs/namespace.c:3383 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount fs/namespace.c:3568 [inline]
__arm64_sys_mount+0x45c/0x594 fs/namespace.c:3568
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
Code: 97cdc7c5 f85a83a0 17fffe9c 97bbfa36 (d4210000)
---[ end trace 0000000000000000 ]---
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Jul 21, 2023, 9:44:03 AM7/21/23
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: a456e1743881 Linux 6.1.39
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=135a2f8aa80000
kernel config: https://syzkaller.appspot.com/x/.config?x=ab4166c71cf155ea
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=150e7676a80000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e4a94ce282ec/disk-a456e174.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7442cb7a697f/vmlinux-a456e174.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f51a327db171/bzImage-a456e174.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/637424c06780/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+47be10...@syzkaller.appspotmail.com
ntfs: (device loop0): ntfs_read_block(): Failed to read from inode 0xa, attribute type 0x80, vcn 0x0, offset 0x200 because its location on disk could not be determined even after retrying (error code -5).
ntfs: (device loop0): ntfs_mapping_pairs_decompress(): Corrupt attribute.
ntfs: (device loop0): ntfs_read_block(): Failed to read from inode 0xa, attribute type 0x80, vcn 0x1, offset 0x0 because its location on disk could not be determined even after retrying (error code -5).
ntfs: (device loop0): ntfs_mapping_pairs_decompress(): Corrupt attribute.
CPU: 1 PID: 3544 Comm: syz-executor268 Not tainted 6.1.39-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
RIP: 0010:ntfs_lookup_inode_by_name+0x2c8e/0x2ca0 fs/ntfs/dir.c:86
Code: ff 89 d1 80 e1 07 38 c1 0f 8c 8a fa ff ff be 08 00 00 00 48 8b 3c 24 e8 00 32 21 ff 48 8b 14 24 e9 73 fa ff ff e8 92 cd ca fe <0f> 0b e8 8b cd ca fe 0f 0b 66 0f 1f 84 00 00 00 00 00 55 41 57 41
RSP: 0018:ffffc9000393f7f0 EFLAGS: 00010293
RAX: ffffffff82bf0d4e RBX: 0000000000000000 RCX: ffff888017bcd940
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000004000
RBP: ffffc9000393f9d0 R08: ffffffff82bee167 R09: ffffed100e6a55aa
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88807352a940
R13: ffff88807b094000 R14: dffffc0000000000 R15: ffff88807b3ef800
FS: 000055555731d380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7985575e00 CR3: 0000000074e99000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
check_windows_hibernation_status+0xec/0x4c0 fs/ntfs/super.c:1274
load_system_files+0x35d7/0x4830 fs/ntfs/super.c:1989
ntfs_fill_super+0x19b0/0x2bd0 fs/ntfs/super.c:2892
mount_bdev+0x2c9/0x3f0 fs/super.c:1423
legacy_get_tree+0xeb/0x180 fs/fs_context.c:611
vfs_get_tree+0x88/0x270 fs/super.c:1553
do_new_mount+0x28b/0xae0 fs/namespace.c:3040
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f798d7b4cfa
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff0ec3fb58 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fff0ec3fb70 RCX: 00007f798d7b4cfa
RDX: 0000000020000040 RSI: 000000002001ecc0 RDI: 00007fff0ec3fb70
RBP: 0000000000000004 R08: 00007fff0ec3fbb0 R09: 000000000001ec65
R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000000
R13: 00007fff0ec3fbb0 R14: 0000000000000003 R15: 0000000000200000
</TASK>
Modules linked in:
Code: ff 89 d1 80 e1 07 38 c1 0f 8c 8a fa ff ff be 08 00 00 00 48 8b 3c 24 e8 00 32 21 ff 48 8b 14 24 e9 73 fa ff ff e8 92 cd ca fe <0f> 0b e8 8b cd ca fe 0f 0b 66 0f 1f 84 00 00 00 00 00 55 41 57 41
RSP: 0018:ffffc9000393f7f0 EFLAGS: 00010293
RAX: ffffffff82bf0d4e RBX: 0000000000000000 RCX: ffff888017bcd940
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000004000
RBP: ffffc9000393f9d0 R08: ffffffff82bee167 R09: ffffed100e6a55aa
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88807352a940
R13: ffff88807b094000 R14: dffffc0000000000 R15: ffff88807b3ef800
FS: 000055555731d380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000561c3d7090e8 CR3: 0000000074e99000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: a456e1743881 Linux 6.1.39
git tree: linux-6.1.y
kernel config: https://syzkaller.appspot.com/x/.config?x=ab4166c71cf155ea
dashboard link: https://syzkaller.appspot.com/bug?extid=47be101ffe992f905aab
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1670be76a80000
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=150e7676a80000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e4a94ce282ec/disk-a456e174.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7442cb7a697f/vmlinux-a456e174.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f51a327db171/bzImage-a456e174.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/637424c06780/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+47be10...@syzkaller.appspotmail.com
ntfs: (device loop0): ntfs_mapping_pairs_decompress(): Corrupt attribute.
ntfs: (device loop0): ntfs_read_block(): Failed to read from inode 0xa, attribute type 0x80, vcn 0x1, offset 0x0 because its location on disk could not be determined even after retrying (error code -5).
ntfs: (device loop0): ntfs_mapping_pairs_decompress(): Corrupt attribute.
ntfs: volume version 3.1.
------------[ cut here ]------------
kernel BUG at fs/ntfs/dir.c:86!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
------------[ cut here ]------------
kernel BUG at fs/ntfs/dir.c:86!
CPU: 1 PID: 3544 Comm: syz-executor268 Not tainted 6.1.39-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
RIP: 0010:ntfs_lookup_inode_by_name+0x2c8e/0x2ca0 fs/ntfs/dir.c:86
Code: ff 89 d1 80 e1 07 38 c1 0f 8c 8a fa ff ff be 08 00 00 00 48 8b 3c 24 e8 00 32 21 ff 48 8b 14 24 e9 73 fa ff ff e8 92 cd ca fe <0f> 0b e8 8b cd ca fe 0f 0b 66 0f 1f 84 00 00 00 00 00 55 41 57 41
RSP: 0018:ffffc9000393f7f0 EFLAGS: 00010293
RAX: ffffffff82bf0d4e RBX: 0000000000000000 RCX: ffff888017bcd940
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000004000
RBP: ffffc9000393f9d0 R08: ffffffff82bee167 R09: ffffed100e6a55aa
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88807352a940
R13: ffff88807b094000 R14: dffffc0000000000 R15: ffff88807b3ef800
FS: 000055555731d380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7985575e00 CR3: 0000000074e99000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
check_windows_hibernation_status+0xec/0x4c0 fs/ntfs/super.c:1274
load_system_files+0x35d7/0x4830 fs/ntfs/super.c:1989
ntfs_fill_super+0x19b0/0x2bd0 fs/ntfs/super.c:2892
mount_bdev+0x2c9/0x3f0 fs/super.c:1423
legacy_get_tree+0xeb/0x180 fs/fs_context.c:611
vfs_get_tree+0x88/0x270 fs/super.c:1553
do_new_mount+0x28b/0xae0 fs/namespace.c:3040
do_mount fs/namespace.c:3383 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount+0x2d5/0x3c0 fs/namespace.c:3568
__do_sys_mount fs/namespace.c:3591 [inline]
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f798d7b4cfa
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff0ec3fb58 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fff0ec3fb70 RCX: 00007f798d7b4cfa
RDX: 0000000020000040 RSI: 000000002001ecc0 RDI: 00007fff0ec3fb70
RBP: 0000000000000004 R08: 00007fff0ec3fbb0 R09: 000000000001ec65
R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000000
R13: 00007fff0ec3fbb0 R14: 0000000000000003 R15: 0000000000200000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ntfs_lookup_inode_by_name+0x2c8e/0x2ca0 fs/ntfs/dir.c:86
Code: ff 89 d1 80 e1 07 38 c1 0f 8c 8a fa ff ff be 08 00 00 00 48 8b 3c 24 e8 00 32 21 ff 48 8b 14 24 e9 73 fa ff ff e8 92 cd ca fe <0f> 0b e8 8b cd ca fe 0f 0b 66 0f 1f 84 00 00 00 00 00 55 41 57 41
RSP: 0018:ffffc9000393f7f0 EFLAGS: 00010293
RAX: ffffffff82bf0d4e RBX: 0000000000000000 RCX: ffff888017bcd940
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000004000
RBP: ffffc9000393f9d0 R08: ffffffff82bee167 R09: ffffed100e6a55aa
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88807352a940
R13: ffff88807b094000 R14: dffffc0000000000 R15: ffff88807b3ef800
FS: 000055555731d380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000561c3d7090e8 CR3: 0000000074e99000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
syzbot
Jul 21, 2023, 10:47:21 AM7/21/23
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: d54cfc420586 Linux 5.15.120
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14eb9701a80000
kernel config: https://syzkaller.appspot.com/x/.config?x=1cbb66d8f24dbb30
dashboard link: https://syzkaller.appspot.com/bug?extid=ba1b56d761cb7d2aaf7a
disk image: https://storage.googleapis.com/syzbot-assets/a7edb50fe106/disk-d54cfc42.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6d9892e76c6e/vmlinux-d54cfc42.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0fd11af6d33e/Image-d54cfc42.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ba1b56...@syzkaller.appspotmail.com
ntfs: (device loop2): ntfs_mapping_pairs_decompress(): Corrupt attribute.
Modules linked in:
CPU: 1 PID: 30525 Comm: syz-executor.2 Not tainted 5.15.120-syzkaller #0
lr : ntfs_lookup_inode_by_name+0x264c/0x2694 fs/ntfs/dir.c:86
sp : ffff800020ea74d0
x29: ffff800020ea75a0 x28: 1fffe00018245d30 x27: 1fffe00018245d10
x26: ffff0000c122ea20 x25: 1ffff000041d4ec0 x24: ffff800020ea7620
x23: dfff800000000000 x22: 000000000000000c x21: ffff00012a5bca40
x20: ffff0000c122e800 x19: 0000000000000000 x18: 0000000000000000
x17: ff8080000952939c x16: ffff8000088c8db4 x15: ffff800008a023f4
x14: ffff8000089fed1c x13: ffffffffffffffff x12: 0000000000040000
x11: 000000000003ffff x10: ffff8000278ac000 x9 : ffff80000951a9b8
x8 : 0000000000040000 x7 : 0000000000000000 x6 : ffff8000095597c4
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800020ea7620
check_windows_hibernation_status+0xe8/0x5e4 fs/ntfs/super.c:1274
load_system_files+0x31ec/0x4228 fs/ntfs/super.c:1989
ntfs_fill_super+0x1670/0x24e8 fs/ntfs/super.c:2894
mount_bdev+0x274/0x370 fs/super.c:1378
ntfs_mount+0x44/0x58 fs/ntfs/super.c:3051
legacy_get_tree+0xd4/0x16c fs/fs_context.c:610
vfs_get_tree+0x90/0x274 fs/super.c:1508
do_new_mount+0x25c/0x8c4 fs/namespace.c:2994
path_mount+0x590/0x104c fs/namespace.c:3324
do_mount fs/namespace.c:3337 [inline]
__do_sys_mount fs/namespace.c:3545 [inline]
__se_sys_mount fs/namespace.c:3522 [inline]
__arm64_sys_mount+0x510/0x5e0 fs/namespace.c:3522
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Code: 97ceb893 f85b83a0 17fffebc 97bea312 (d4210000)
---[ end trace 4d5f664a2b9d8792 ]---
syzbot found the following issue on:
HEAD commit: d54cfc420586 Linux 5.15.120
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14eb9701a80000
kernel config: https://syzkaller.appspot.com/x/.config?x=1cbb66d8f24dbb30
dashboard link: https://syzkaller.appspot.com/bug?extid=ba1b56d761cb7d2aaf7a
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
Unfortunately, I don't have any reproducer for this issue yet.
disk image: https://storage.googleapis.com/syzbot-assets/a7edb50fe106/disk-d54cfc42.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6d9892e76c6e/vmlinux-d54cfc42.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0fd11af6d33e/Image-d54cfc42.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
ntfs: (device loop2): ntfs_mapping_pairs_decompress(): Corrupt attribute.
ntfs: volume version 3.1.
------------[ cut here ]------------
kernel BUG at fs/ntfs/dir.c:86!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
------------[ cut here ]------------
kernel BUG at fs/ntfs/dir.c:86!
Modules linked in:
CPU: 1 PID: 30525 Comm: syz-executor.2 Not tainted 5.15.120-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : ntfs_lookup_inode_by_name+0x264c/0x2694 fs/ntfs/dir.c:86
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
lr : ntfs_lookup_inode_by_name+0x264c/0x2694 fs/ntfs/dir.c:86
sp : ffff800020ea74d0
x29: ffff800020ea75a0 x28: 1fffe00018245d30 x27: 1fffe00018245d10
x26: ffff0000c122ea20 x25: 1ffff000041d4ec0 x24: ffff800020ea7620
x23: dfff800000000000 x22: 000000000000000c x21: ffff00012a5bca40
x20: ffff0000c122e800 x19: 0000000000000000 x18: 0000000000000000
x17: ff8080000952939c x16: ffff8000088c8db4 x15: ffff800008a023f4
x14: ffff8000089fed1c x13: ffffffffffffffff x12: 0000000000040000
x11: 000000000003ffff x10: ffff8000278ac000 x9 : ffff80000951a9b8
x8 : 0000000000040000 x7 : 0000000000000000 x6 : ffff8000095597c4
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800020ea7620
x2 : 000000000000000c x1 : 0000000000000000 x0 : 0000000000004000
Call trace:
ntfs_lookup_inode_by_name+0x264c/0x2694 fs/ntfs/dir.c:86
Call trace:
check_windows_hibernation_status+0xe8/0x5e4 fs/ntfs/super.c:1274
load_system_files+0x31ec/0x4228 fs/ntfs/super.c:1989
ntfs_fill_super+0x1670/0x24e8 fs/ntfs/super.c:2894
mount_bdev+0x274/0x370 fs/super.c:1378
ntfs_mount+0x44/0x58 fs/ntfs/super.c:3051
legacy_get_tree+0xd4/0x16c fs/fs_context.c:610
vfs_get_tree+0x90/0x274 fs/super.c:1508
do_new_mount+0x25c/0x8c4 fs/namespace.c:2994
path_mount+0x590/0x104c fs/namespace.c:3324
do_mount fs/namespace.c:3337 [inline]
__do_sys_mount fs/namespace.c:3545 [inline]
__se_sys_mount fs/namespace.c:3522 [inline]
__arm64_sys_mount+0x510/0x5e0 fs/namespace.c:3522
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Code: 97ceb893 f85b83a0 17fffebc 97bea312 (d4210000)
---[ end trace 4d5f664a2b9d8792 ]---
syzbot
Jul 22, 2023, 2:04:03 AM7/22/23
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: d54cfc420586 Linux 5.15.120
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=17053df4a80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=141ae452a80000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/a7edb50fe106/disk-d54cfc42.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6d9892e76c6e/vmlinux-d54cfc42.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0fd11af6d33e/Image-d54cfc42.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/8f377788072c/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ba1b56...@syzkaller.appspotmail.com
x29: ffff800018f275a0 x28: 1fffe0001904b530 x27: 1fffe0001904b510
x26: ffff0000c825aa20 x25: 1ffff000031e4ec0 x24: ffff800018f27620
x23: dfff800000000000 x22: 000000000000000c x21: ffff0000dc394200
x20: ffff0000c825a800 x19: 0000000000000000 x18: 0000000000000000
x11: ff8080000951a9b8 x10: 0000000000000000 x9 : ffff80000951a9b8
x8 : ffff0000c12b0000 x7 : 0000000000000000 x6 : ffff8000095597c4
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800018f27620
HEAD commit: d54cfc420586 Linux 5.15.120
git tree: linux-5.15.y
kernel config: https://syzkaller.appspot.com/x/.config?x=1cbb66d8f24dbb30
dashboard link: https://syzkaller.appspot.com/bug?extid=ba1b56d761cb7d2aaf7a
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=175807e1a80000
dashboard link: https://syzkaller.appspot.com/bug?extid=ba1b56d761cb7d2aaf7a
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=141ae452a80000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/a7edb50fe106/disk-d54cfc42.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6d9892e76c6e/vmlinux-d54cfc42.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0fd11af6d33e/Image-d54cfc42.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ba1b56...@syzkaller.appspotmail.com
ntfs: (device loop0): ntfs_read_block(): Failed to read from inode 0xa, attribute type 0x80, vcn 0x1, offset 0x0 because its location on disk could not be determined even after retrying (error code -5).
ntfs: (device loop0): ntfs_mapping_pairs_decompress(): Corrupt attribute.
ntfs: volume version 3.1.
------------[ cut here ]------------
kernel BUG at fs/ntfs/dir.c:86!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 3961 Comm: syz-executor116 Not tainted 5.15.120-syzkaller #0
------------[ cut here ]------------
kernel BUG at fs/ntfs/dir.c:86!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
Modules linked in:
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : ntfs_lookup_inode_by_name+0x264c/0x2694 fs/ntfs/dir.c:86
lr : ntfs_lookup_inode_by_name+0x264c/0x2694 fs/ntfs/dir.c:86
sp : ffff800018f274d0
lr : ntfs_lookup_inode_by_name+0x264c/0x2694 fs/ntfs/dir.c:86
x29: ffff800018f275a0 x28: 1fffe0001904b530 x27: 1fffe0001904b510
x26: ffff0000c825aa20 x25: 1ffff000031e4ec0 x24: ffff800018f27620
x23: dfff800000000000 x22: 000000000000000c x21: ffff0000dc394200
x20: ffff0000c825a800 x19: 0000000000000000 x18: 0000000000000000
x17: ff8080000952939c x16: ffff8000088c8db4 x15: ffff800008a023f4
x14: ffff8000089fed1c x13: ffffffffffffffff x12: 0000000000000000
x11: ff8080000951a9b8 x10: 0000000000000000 x9 : ffff80000951a9b8
x8 : ffff0000c12b0000 x7 : 0000000000000000 x6 : ffff8000095597c4
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800018f27620
x2 : 000000000000000c x1 : 0000000000000000 x0 : 0000000000004000
Call trace:
ntfs_lookup_inode_by_name+0x264c/0x2694 fs/ntfs/dir.c:86
check_windows_hibernation_status+0xe8/0x5e4 fs/ntfs/super.c:1274
load_system_files+0x31ec/0x4228 fs/ntfs/super.c:1989
ntfs_fill_super+0x1670/0x24e8 fs/ntfs/super.c:2894
mount_bdev+0x274/0x370 fs/super.c:1378
ntfs_mount+0x44/0x58 fs/ntfs/super.c:3051
legacy_get_tree+0xd4/0x16c fs/fs_context.c:610
vfs_get_tree+0x90/0x274 fs/super.c:1508
do_new_mount+0x25c/0x8c4 fs/namespace.c:2994
path_mount+0x590/0x104c fs/namespace.c:3324
do_mount fs/namespace.c:3337 [inline]
__do_sys_mount fs/namespace.c:3545 [inline]
__se_sys_mount fs/namespace.c:3522 [inline]
__arm64_sys_mount+0x510/0x5e0 fs/namespace.c:3522
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Code: 97ceb893 f85b83a0 17fffebc 97bea312 (d4210000)
---[ end trace 15505c39a58eadf7 ]---
Call trace:
ntfs_lookup_inode_by_name+0x264c/0x2694 fs/ntfs/dir.c:86
check_windows_hibernation_status+0xe8/0x5e4 fs/ntfs/super.c:1274
load_system_files+0x31ec/0x4228 fs/ntfs/super.c:1989
ntfs_fill_super+0x1670/0x24e8 fs/ntfs/super.c:2894
mount_bdev+0x274/0x370 fs/super.c:1378
ntfs_mount+0x44/0x58 fs/ntfs/super.c:3051
legacy_get_tree+0xd4/0x16c fs/fs_context.c:610
vfs_get_tree+0x90/0x274 fs/super.c:1508
do_new_mount+0x25c/0x8c4 fs/namespace.c:2994
path_mount+0x590/0x104c fs/namespace.c:3324
do_mount fs/namespace.c:3337 [inline]
__do_sys_mount fs/namespace.c:3545 [inline]
__se_sys_mount fs/namespace.c:3522 [inline]
__arm64_sys_mount+0x510/0x5e0 fs/namespace.c:3522
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Code: 97ceb893 f85b83a0 17fffebc 97bea312 (d4210000)
Reply all
Reply to author
Forward
0 new messages