[syzbot] BUG: unable to handle kernel paging request in mi_enum_attr

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: a41a877bc12d Merge branch 'for-next/fixes' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=11d7f5ad080000
kernel config: https://syzkaller.appspot.com/x/.config?x=5cea15779c42821c
dashboard link: https://syzkaller.appspot.com/bug?extid=28207acc70bbf3d85b74
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+28207a...@syzkaller.appspotmail.com

Unable to handle kernel paging request at virtual address ffff000224d7f83a
Mem abort info:
ESR = 0x0000000096000005
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x05: level 1 translation fault
Data abort info:
ISV = 0, ISS = 0x00000005
CM = 0, WnR = 0
swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000001c5736000
[ffff000224d7f83a] pgd=180000023fff8003, p4d=180000023fff8003, pud=0000000000000000
Internal error: Oops: 96000005 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 28529 Comm: syz-executor.3 Not tainted 6.0.0-rc2-syzkaller-16455-ga41a877bc12d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : mi_enum_attr+0x10c/0x314 fs/ntfs3/record.c:227
lr : mi_enum_attr+0xf0/0x314 fs/ntfs3/record.c:223
sp : ffff8000220f3940
x29: ffff8000220f3940 x28: ffff000124d7f800 x27: ffff000124d7f838
x26: 00000000fffffffe x25: 0000000000000048 x24: 0000000000000000
x23: 0000000000000000 x22: 0000000000000036 x21: 0000000000000198
x20: 0000000000000038 x19: ffff000224d7f836 x18: 0000000000000002
x17: ffff80000c04d6bc x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000064 x13: 0000000000989680 x12: 0000000000040000
x11: 00000000000105f8 x10: ffff800019725000 x9 : ffff800008c10880
x8 : 00000000000105f9 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff000124d7fc00 x4 : ffff00011eb5e400 x3 : 0000000000000000
x2 : ffff8000220f3a70 x1 : 00000000fffffffe x0 : 0000000000000018
Call trace:
mi_enum_attr+0x10c/0x314 fs/ntfs3/record.c:210
ni_enum_attr_ex+0x174/0x29c fs/ntfs3/frecord.c:259
ntfs_read_mft fs/ntfs3/inode.c:114 [inline]
ntfs_iget5+0xf44/0x138c fs/ntfs3/inode.c:501
ntfs_loadlog_and_replay+0x98/0x1ec fs/ntfs3/fsntfs.c:272
ntfs_fill_super+0xc10/0x14a4 fs/ntfs/super.c:2904
get_tree_bdev+0x1e8/0x2a0 fs/super.c:1323
ntfs_fs_get_tree+0x28/0x38 fs/ntfs3/super.c:1358
vfs_get_tree+0x40/0x140 fs/super.c:1530
do_new_mount+0x1dc/0x4e4 fs/namespace.c:3040
path_mount+0x358/0x914 fs/namespace.c:3370
do_mount fs/namespace.c:3383 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount fs/namespace.c:3568 [inline]
__arm64_sys_mount+0x2f8/0x408 fs/namespace.c:3568
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x48/0x154 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:624
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:642
el0t_64_sync+0x18c/0x190
Code: 97da4c0f 14000039 97da4c0d 8b160293 (b9400674)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: 97da4c0f bl 0xffffffffff69303c
4: 14000039 b 0xe8
8: 97da4c0d bl 0xffffffffff69303c
c: 8b160293 add x19, x20, x22
* 10: b9400674 ldr w20, [x19, #4] <-- trapping instruction


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 440b7895c990 Merge tag 'mm-hotfixes-stable-2022-10-20' of ..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=12f15216880000
kernel config: https://syzkaller.appspot.com/x/.config?x=afc317c0f52ce670

dashboard link: https://syzkaller.appspot.com/bug?extid=28207acc70bbf3d85b74
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16d6496a880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13d32fc2880000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/105038975fc9/disk-440b7895.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/edd7302c8fc8/vmlinux-440b7895.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/7e29515d4690/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+28207a...@syzkaller.appspotmail.com

loop0: detected capacity change from 0 to 4096
ntfs3: loop0: Different NTFS' sector size (1024) and media sector size (512)
ntfs3: loop0: Mark volume as dirty due to NTFS errors
==================================================================
BUG: KASAN: use-after-free in mi_enum_attr+0x583/0x6a0 fs/ntfs3/record.c:227
Read of size 4 at addr ffff888177de6993 by task syz-executor131/3605

CPU: 0 PID: 3605 Comm: syz-executor131 Not tainted 6.1.0-rc1-syzkaller-00158-g440b7895c990 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106
print_address_description+0x74/0x340 mm/kasan/report.c:284
print_report+0x107/0x1f0 mm/kasan/report.c:395
kasan_report+0xcd/0x100 mm/kasan/report.c:495
mi_enum_attr+0x583/0x6a0 fs/ntfs3/record.c:227
ni_enum_attr_ex+0x2f6/0x6d0 fs/ntfs3/frecord.c:259
ntfs_read_mft fs/ntfs3/inode.c:114 [inline]
ntfs_iget5+0x1d3e/0x36f0 fs/ntfs3/inode.c:501
ntfs_fill_super+0x3b55/0x42a0 fs/ntfs3/super.c:1195
get_tree_bdev+0x400/0x620 fs/super.c:1323
vfs_get_tree+0x88/0x270 fs/super.c:1530
do_new_mount+0x289/0xad0 fs/namespace.c:3040

do_mount fs/namespace.c:3383 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]

__se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3568
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f43fe5afaca
Code: 48 c7 c2 c0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 f8 03 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd57724258 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f43fe5afaca
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffd57724270
RBP: 00007ffd57724270 R08: 00007ffd577242b0 R09: 00007ffd577242e0
R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000004
R13: 00007ffd577242b0 R14: 0000000000000109 R15: 0000000020001ad8
</TASK>

The buggy address belongs to the physical page:
page:ffffea0005df7980 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x177de6
flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff)
raw: 057ff00000000000 ffffea0005df7988 ffffea0005df7988 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)

Memory state around the buggy address:
ffff888177de6880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888177de6900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888177de6980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888177de6a00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888177de6a80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

[syzbot]

syzbot suspects this issue was fixed by commit:

commit 0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b
Author: Konstantin Komarov <almaz.ale...@paragon-software.com>
Date: Mon Oct 10 10:15:33 2022 +0000

fs/ntfs3: Check fields while reading

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=13c11ba5480000
start commit: f9ff5644bcc0 Merge tag 'hsi-for-6.2' of git://git.kernel.o..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=c163713cf9186fe7
dashboard link: https://syzkaller.appspot.com/bug?extid=28207acc70bbf3d85b74
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1275aed7880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=124f533b880000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: fs/ntfs3: Check fields while reading

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

[Aleksandr Nogikh]

The reproducer was mostly triggering a KASAN: use-after-free in
mi_enum_attr error and the patch indeed looks like the one that could
have fixed this problem.
Let's close the bug, if `unable to handle kernel paging request in
mi_enum_attr` is still not fixed, it will pop up again.

#syz fix: fs/ntfs3: Check fields while reading

>
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection
>

> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bug...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/00000000000067d34605f3e029f7%40google.com.