[v6.1] kernel BUG in ntfs_end_buffer_async_read

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: a1c449d00ff8 Linux 6.1.36
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14e009e7280000
kernel config: https://syzkaller.appspot.com/x/.config?x=88fba5343539f90e
dashboard link: https://syzkaller.appspot.com/bug?extid=98127c03503f75a1a4d7
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/46c419b02b39/disk-a1c449d0.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/cc8fc6c3c06c/vmlinux-a1c449d0.xz
kernel image: https://storage.googleapis.com/syzbot-assets/7ed5c1022bfe/Image-a1c449d0.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+98127c...@syzkaller.appspotmail.com

------------[ cut here ]------------
kernel BUG at fs/ntfs/aops.c:130!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 6.1.36-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : ntfs_end_buffer_async_read+0xa28/0xb78 fs/ntfs/aops.c:130
lr : ntfs_end_buffer_async_read+0xa28/0xb78 fs/ntfs/aops.c:130
sp : ffff800019be7a40
x29: ffff800019be7a60 x28: ffff0000df68dde0 x27: 0000000000000019
x26: dfff800000000000 x25: 0000000000001000 x24: ffff0000de7959f8
x23: 0000000000000000 x22: ffff0000de53c238 x21: 0000000000000001
x20: 0000000000020211 x19: 0000000000000330 x18: 1fffe000368b5f76
x17: ffff8000155bd000 x16: ffff80000825f9d8 x15: 0000000000000000
x14: 1ffff00002ab80b0 x13: dfff800000000000 x12: 0000000000000003
x11: ff808000095e7078 x10: 0000000000000000 x9 : ffff8000095e7078
x8 : ffff0000c09a3780 x7 : ffff8000095e68ac x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : ffff800019be7940 x1 : 0000000000020211 x0 : 0000000000001000
Call trace:
ntfs_end_buffer_async_read+0xa28/0xb78 fs/ntfs/aops.c:130
end_bio_bh_io_sync+0xb0/0x1e0 fs/buffer.c:2655
bio_endio+0x7c8/0x80c block/bio.c:1557
req_bio_endio block/blk-mq.c:763 [inline]
blk_update_request+0x4ac/0xdf0 block/blk-mq.c:908
blk_mq_end_request+0x54/0x88 block/blk-mq.c:1035
lo_complete_rq+0x140/0x258 drivers/block/loop.c:370
blk_complete_reqs block/blk-mq.c:1113 [inline]
blk_done_softirq+0x11c/0x168 block/blk-mq.c:1118
__do_softirq+0x30c/0xea0 kernel/softirq.c:571
run_ksoftirqd+0x68/0x258 kernel/softirq.c:934
smpboot_thread_fn+0x4b0/0x96c kernel/smpboot.c:164
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
Code: c8097e88 35ffffa9 17fffdb3 97bc49f1 (d4210000)
---[ end trace 0000000000000000 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: a1c449d00ff8 Linux 6.1.36
git tree: linux-6.1.y

console output: https://syzkaller.appspot.com/x/log.txt?x=14b5622ca80000

kernel config: https://syzkaller.appspot.com/x/.config?x=88fba5343539f90e
dashboard link: https://syzkaller.appspot.com/bug?extid=98127c03503f75a1a4d7
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1094e724a80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1102ddf0a80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/46c419b02b39/disk-a1c449d0.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/cc8fc6c3c06c/vmlinux-a1c449d0.xz
kernel image: https://storage.googleapis.com/syzbot-assets/7ed5c1022bfe/Image-a1c449d0.gz.xz

mounted in repro: https://storage.googleapis.com/syzbot-assets/a1034405adb8/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+98127c...@syzkaller.appspotmail.com

------------[ cut here ]------------
kernel BUG at fs/ntfs/aops.c:130!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 6.1.36-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : ntfs_end_buffer_async_read+0xa28/0xb78 fs/ntfs/aops.c:130
lr : ntfs_end_buffer_async_read+0xa28/0xb78 fs/ntfs/aops.c:130
sp : ffff800019be7a40

x29: ffff800019be7a60 x28: ffff0000df420320 x27: 0000000000000019
x26: dfff800000000000 x25: 0000000000001000 x24: ffff0000df76cae0
x23: 0000000000000000 x22: ffff0000df76ce00 x21: 0000000000000001

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: d54cfc420586 Linux 5.15.120
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1095bacaa80000
kernel config: https://syzkaller.appspot.com/x/.config?x=61785ceccc6bdf75
dashboard link: https://syzkaller.appspot.com/bug?extid=179193426fe51c3f26af

compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14f0deb0a80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14177778a80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/df6c88d1a764/disk-d54cfc42.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/787a9f4e718c/vmlinux-d54cfc42.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4a60832537ff/Image-d54cfc42.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/b5803dd3717c/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+179193...@syzkaller.appspotmail.com

------------[ cut here ]------------
kernel BUG at fs/ntfs/aops.c:130!

Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 20 Comm: ksoftirqd/1 Not tainted 5.15.120-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)

pc : ntfs_end_buffer_async_read+0xa44/0xbd8 fs/ntfs/aops.c:130
lr : ntfs_end_buffer_async_read+0xa44/0xbd8 fs/ntfs/aops.c:130
sp : ffff8000189b7a40
x29: ffff8000189b7a60 x28: fffffc0005a01140 x27: 0000000000000019
x26: dfff800000000000 x25: 0000000000001000 x24: ffff0000df4093a0
x23: 0000000000000000 x22: ffff0000df478320 x21: 0000000000000001
x20: 0000000000020211 x19: 0000000000000330 x18: 0000000000000001
x17: ff8080000823de88 x16: ffff80000824cbf4 x15: ffff80000823de88
x14: 1ffff0000291e06a x13: ffffffffffffffff x12: 0000000000000100
x11: ff808000095084fc x10: 0000000000000000 x9 : ffff8000095084fc
x8 : ffff0000c0a68000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000000 x3 : ffff800008045860
x2 : 0000000000000001 x1 : 0000000000020211 x0 : 0000000000001000
Call trace:
ntfs_end_buffer_async_read+0xa44/0xbd8 fs/ntfs/aops.c:130
end_bio_bh_io_sync+0xb0/0x1b4 fs/buffer.c:3007
bio_endio+0x780/0x7c4 block/bio.c:1476
req_bio_endio block/blk-core.c:261 [inline]
blk_update_request+0x79c/0x1304 block/blk-core.c:1447
blk_mq_end_request+0x54/0x88 block/blk-mq.c:575
lo_complete_rq+0x140/0x258 drivers/block/loop.c:529
blk_complete_reqs block/blk-mq.c:587 [inline]
blk_done_softirq+0x11c/0x168 block/blk-mq.c:592
__do_softirq+0x344/0xe20 kernel/softirq.c:558
run_ksoftirqd+0x68/0x258 kernel/softirq.c:920
smpboot_thread_fn+0x4b0/0x920 kernel/smpboot.c:164
kthread+0x37c/0x45c kernel/kthread.c:319
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870
Code: c8097e88 35ffffa9 17fffdad 97beec41 (d4210000)
---[ end trace fcb5e52d7abf831f ]---

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.