[syzbot] [ntfs3?] WARNING in attr_data_get_block (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 17214b70a159 Merge tag 'fsverity-for-linus' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17331931c80000
kernel config: https://syzkaller.appspot.com/x/.config?x=d40f6d44826f6cf7
dashboard link: https://syzkaller.appspot.com/bug?extid=a98f21ebda0a437b04d7
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d166fda7fbbd/disk-17214b70.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0c16461022b9/vmlinux-17214b70.xz
kernel image: https://storage.googleapis.com/syzbot-assets/53e9e40da8bb/bzImage-17214b70.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a98f21...@syzkaller.appspotmail.com

------------[ cut here ]------------
WARNING: CPU: 0 PID: 24195 at fs/ntfs3/attrib.c:1060 attr_data_get_block+0x1926/0x2da0
Modules linked in:
CPU: 0 PID: 24195 Comm: syz-executor.2 Not tainted 6.3.0-rc3-syzkaller-00012-g17214b70a159 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
RIP: 0010:attr_data_get_block+0x1926/0x2da0 fs/ntfs3/attrib.c:1060
Code: 80 e1 07 80 c1 03 38 c1 0f 8c 48 ff ff ff 48 8d bc 24 e0 01 00 00 e8 19 5b 1b ff 48 8b 54 24 58 e9 31 ff ff ff e8 9a a9 c5 fe <0f> 0b bb ea ff ff ff e9 11 fa ff ff e8 89 a9 c5 fe e9 0f f9 ff ff
RSP: 0018:ffffc9002245fac0 EFLAGS: 00010293
RAX: ffffffff82c4c386 RBX: 00000000ffffffff RCX: ffff88801f029d40
RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 00000000ffffffff
RBP: ffffc9002245fd28 R08: ffffffff82c4be5f R09: fffffbfff205c062
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff9200448bf78
R13: 0000000000000032 R14: ffff88803fd81760 R15: dffffc0000000000
FS: 00007f61ad5ea700(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4db29fe800 CR3: 000000002fb69000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
ntfs_fallocate+0xca4/0x1190 fs/ntfs3/file.c:614
vfs_fallocate+0x54b/0x6b0 fs/open.c:324
ksys_fallocate fs/open.c:347 [inline]
__do_sys_fallocate fs/open.c:355 [inline]
__se_sys_fallocate fs/open.c:353 [inline]
__x64_sys_fallocate+0xbd/0x100 fs/open.c:353
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f61ac88c0f9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f61ad5ea168 EFLAGS: 00000246 ORIG_RAX: 000000000000011d
RAX: ffffffffffffffda RBX: 00007f61ac9ac120 RCX: 00007f61ac88c0f9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008
RBP: 00007f61ac8e7b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000ff8000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc8413a04f R14: 00007f61ad5ea300 R15: 0000000000022000
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: ffe78bbd5121 Merge tag 'xtensa-20230327' of https://github..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16237c0dc80000
kernel config: https://syzkaller.appspot.com/x/.config?x=9c35b3803e5ad668

dashboard link: https://syzkaller.appspot.com/bug?extid=a98f21ebda0a437b04d7
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=139dca3ec80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15a55a35c80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/595cb07a344c/disk-ffe78bbd.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/13a6464b8ace/vmlinux-ffe78bbd.xz
kernel image: https://storage.googleapis.com/syzbot-assets/640bf4496398/bzImage-ffe78bbd.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/53cbcc1fd741/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a98f21...@syzkaller.appspotmail.com

------------[ cut here ]------------

WARNING: CPU: 0 PID: 5092 at fs/ntfs3/attrib.c:1060 attr_data_get_block+0x1926/0x2da0
Modules linked in:
CPU: 0 PID: 5092 Comm: syz-executor285 Not tainted 6.3.0-rc4-syzkaller-00039-gffe78bbd5121 #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
RIP: 0010:attr_data_get_block+0x1926/0x2da0 fs/ntfs3/attrib.c:1060

Code: 80 e1 07 80 c1 03 38 c1 0f 8c 48 ff ff ff 48 8d bc 24 e0 01 00 00 e8 99 54 1b ff 48 8b 54 24 58 e9 31 ff ff ff e8 fa 9d c5 fe <0f> 0b bb ea ff ff ff e9 11 fa ff ff e8 e9 9d c5 fe e9 0f f9 ff ff
RSP: 0018:ffffc90003cb7ac0 EFLAGS: 00010293
RAX: ffffffff82c4b4f6 RBX: 00000000ffffffff RCX: ffff888076523a80

RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 00000000ffffffff

RBP: ffffc90003cb7d28 R08: ffffffff82c4afcf R09: fffffbfff205c652
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff92000796f78
R13: 0000000000000032 R14: ffff8880756043a0 R15: dffffc0000000000
FS: 00007f2d8728d700(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007f2d8726c718 CR3: 000000007693d000 CR4: 00000000003506f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
ntfs_fallocate+0xca4/0x1190 fs/ntfs3/file.c:614
vfs_fallocate+0x54b/0x6b0 fs/open.c:324
ksys_fallocate fs/open.c:347 [inline]
__do_sys_fallocate fs/open.c:355 [inline]
__se_sys_fallocate fs/open.c:353 [inline]
__x64_sys_fallocate+0xbd/0x100 fs/open.c:353
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

RIP: 0033:0x7f2d8f5027b9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 71 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f2d8728d308 EFLAGS: 00000246 ORIG_RAX: 000000000000011d
RAX: ffffffffffffffda RBX: 00007f2d8f5a67b8 RCX: 00007f2d8f5027b9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006
RBP: 00007f2d8f5a67b0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000ff8000 R11: 0000000000000246 R12: 00007f2d8f5a67bc
R13: 00007f2d8f5734ac R14: 0030656c69662f2e R15: 0000000000022000
</TASK>

[syzbot]

syzbot suspects this issue was fixed by commit:

commit 68674f94ffc9dddc45e7733963ecc35c5eda9efd
Author: Linus Torvalds <torv...@linux-foundation.org>
Date: Sat Apr 15 18:47:06 2023 +0000

x86: don't use REP_GOOD or ERMS for small memory copies

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=12de3271280000
start commit: ffe78bbd5121 Merge tag 'xtensa-20230327' of https://github..
git tree: upstream

kernel config: https://syzkaller.appspot.com/x/.config?x=9c35b3803e5ad668
dashboard link: https://syzkaller.appspot.com/bug?extid=a98f21ebda0a437b04d7

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=139dca3ec80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15a55a35c80000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: x86: don't use REP_GOOD or ERMS for small memory copies

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

[Linus Torvalds]

On Wed, May 31, 2023 at 12:14 AM syzbot
<syzbot+a98f21...@syzkaller.appspotmail.com> wrote:
>
> syzbot suspects this issue was fixed by commit:
>
> commit 68674f94ffc9dddc45e7733963ecc35c5eda9efd

> x86: don't use REP_GOOD or ERMS for small memory copies

That sounds very unlikely.

While we had another similar issue where not using REP_GOOD or ERMS
for user space clearing fixes a bug, that one failed by having
clear_user() oops instead of handling the right exception.

In that case the commit really did fix things, even if it was just by
pure luck, and removing buggy code.

But this one seems to have a failure case that has nothing to do with
exception handling, and I don't think that commit actually fixes any
semantic bug. I suspect the bisection was not entirely repeatable,
and/or might have been timing-dependent, and that the bisection thus
ended up on a random unrelated commit.

Linus

[syzbot]

Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.