[v6.1] WARNING in hfsplus_cat_read_inode

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 543aff194ab6 Linux 6.1.23
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15cb9483c80000
kernel config: https://syzkaller.appspot.com/x/.config?x=9ccbc3d5467efd1
dashboard link: https://syzkaller.appspot.com/bug?extid=635edbe33f60fd0034c2
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7fe538fc87bf/disk-543aff19.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8df93997601a/vmlinux-543aff19.xz
kernel image: https://storage.googleapis.com/syzbot-assets/03ad7e3bf859/Image-543aff19.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+635edb...@syzkaller.appspotmail.com

------------[ cut here ]------------
WARNING: CPU: 0 PID: 14507 at fs/hfsplus/inode.c:534 hfsplus_cat_read_inode+0x864/0xc38 fs/hfsplus/inode.c:534
Modules linked in:
CPU: 0 PID: 14507 Comm: syz-executor.1 Not tainted 6.1.23-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : hfsplus_cat_read_inode+0x864/0xc38 fs/hfsplus/inode.c:534
lr : hfsplus_cat_read_inode+0x864/0xc38 fs/hfsplus/inode.c:534
sp : ffff800020f77120
x29: ffff800020f77420 x28: 1ffff000041eee9b x27: 1ffff000041eee9d
x26: dfff800000000000 x25: ffff7000041eee28 x24: 0000000000000002
x23: 000000000000004e x22: ffff800020f774d8 x21: ffff800020f774ec
x20: ffff800020f77160 x19: ffff00012deb52b0 x18: 1fffe000368b6b76
x17: ffff80001557d000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000002 x13: 0000000000000002 x12: 0000000000040000
x11: 0000000000015544 x10: ffff8000216aa000 x9 : ffff80000905b184
x8 : 0000000000015545 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff800020f77082 x4 : ffff000131c38032 x3 : ffff80000906dcf4
x2 : 0000000000000002 x1 : 000000000000004e x0 : 00000000000000f8
Call trace:
hfsplus_cat_read_inode+0x864/0xc38 fs/hfsplus/inode.c:534
hfsplus_iget+0x4ac/0x570 fs/hfsplus/super.c:84
hfsplus_fill_super+0x9c0/0x166c fs/hfsplus/super.c:503
mount_bdev+0x26c/0x368 fs/super.c:1423
hfsplus_mount+0x44/0x58 fs/hfsplus/super.c:641
legacy_get_tree+0xd4/0x16c fs/fs_context.c:610
vfs_get_tree+0x90/0x274 fs/super.c:1553
do_new_mount+0x25c/0x8c8 fs/namespace.c:3040
path_mount+0x590/0xe58 fs/namespace.c:3370
do_mount fs/namespace.c:3383 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount fs/namespace.c:3568 [inline]
__arm64_sys_mount+0x45c/0x594 fs/namespace.c:3568
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
irq event stamp: 3830
hardirqs last enabled at (3829): [<ffff8000121b9b0c>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last enabled at (3829): [<ffff8000121b9b0c>] _raw_spin_unlock_irqrestore+0x48/0xac kernel/locking/spinlock.c:194
hardirqs last disabled at (3830): [<ffff8000120d75ac>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (3088): [<ffff800008032b74>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (3086): [<ffff800008032b40>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
---[ end trace 0000000000000000 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: ca48fc16c493 Linux 6.1.27
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=13775f4a280000
kernel config: https://syzkaller.appspot.com/x/.config?x=aea4bb7802570997

dashboard link: https://syzkaller.appspot.com/bug?extid=635edbe33f60fd0034c2
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=158a0dd4280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14d58904280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ec11c1903c52/disk-ca48fc16.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8ce41c1ad391/vmlinux-ca48fc16.xz
kernel image: https://storage.googleapis.com/syzbot-assets/affba5631cad/Image-ca48fc16.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/a2a877926056/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+635edb...@syzkaller.appspotmail.com

loop0: detected capacity change from 0 to 1024
------------[ cut here ]------------
WARNING: CPU: 1 PID: 4218 at fs/hfsplus/inode.c:534 hfsplus_cat_read_inode+0x864/0xc38 fs/hfsplus/inode.c:534
Modules linked in:
CPU: 1 PID: 4218 Comm: syz-executor116 Not tainted 6.1.27-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023

pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : hfsplus_cat_read_inode+0x864/0xc38 fs/hfsplus/inode.c:534
lr : hfsplus_cat_read_inode+0x864/0xc38 fs/hfsplus/inode.c:534

sp : ffff80001d997120
x29: ffff80001d997420 x28: 1ffff00003b32e9b x27: 1ffff00003b32e9d
x26: dfff800000000000 x25: ffff700003b32e28 x24: 0000000000000002
x23: 000000000000004e x22: ffff80001d9974d8 x21: ffff80001d9974ec
x20: ffff80001d997160 x19: ffff0000d60a1cb0 x18: ffff80001d996a40
x17: ffff80001558d000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000002 x12: ffff0000c6313680
x11: ff80800009061c58 x10: 0000000000000000 x9 : ffff800009061c58
x8 : ffff0000c6313680 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff80001d997082 x4 : ffff000176947032 x3 : ffff8000090747c8

x2 : 0000000000000002 x1 : 000000000000004e x0 : 00000000000000f8
Call trace:
hfsplus_cat_read_inode+0x864/0xc38 fs/hfsplus/inode.c:534
hfsplus_iget+0x4ac/0x570 fs/hfsplus/super.c:84
hfsplus_fill_super+0x9c0/0x166c fs/hfsplus/super.c:503
mount_bdev+0x26c/0x368 fs/super.c:1423
hfsplus_mount+0x44/0x58 fs/hfsplus/super.c:641
legacy_get_tree+0xd4/0x16c fs/fs_context.c:610
vfs_get_tree+0x90/0x274 fs/super.c:1553
do_new_mount+0x25c/0x8c8 fs/namespace.c:3040
path_mount+0x590/0xe58 fs/namespace.c:3370
do_mount fs/namespace.c:3383 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount fs/namespace.c:3568 [inline]
__arm64_sys_mount+0x45c/0x594 fs/namespace.c:3568
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581

irq event stamp: 19116
hardirqs last enabled at (19115): [<ffff8000121c463c>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last enabled at (19115): [<ffff8000121c463c>] _raw_spin_unlock_irqrestore+0x48/0xac kernel/locking/spinlock.c:194
hardirqs last disabled at (19116): [<ffff8000120e200c>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (16548): [<ffff800008020d74>] softirq_handle_end kernel/softirq.c:414 [inline]
softirqs last enabled at (16548): [<ffff800008020d74>] __do_softirq+0xc14/0xea0 kernel/softirq.c:600
softirqs last disabled at (16531): [<ffff80000802a948>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:79

---[ end trace 0000000000000000 ]---


---

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[syzbot]

syzbot suspects this issue was fixed by commit:

commit 48960a503fcec76d3f72347b7e679dda08ca43be
Author: Tetsuo Handa <penguin...@I-love.SAKURA.ne.jp>
Date: Tue Apr 11 10:57:33 2023 +0000

fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode()

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=15009650a80000
start commit: ca48fc16c493 Linux 6.1.27
git tree: linux-6.1.y

kernel config: https://syzkaller.appspot.com/x/.config?x=aea4bb7802570997
dashboard link: https://syzkaller.appspot.com/bug?extid=635edbe33f60fd0034c2

userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=158a0dd4280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14d58904280000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode()

For information about bisection process see: https://goo.gl/tpsmEJ#bisection