[v6.6] WARNING in fscrypt_fname_siphash

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 9247f4e6573a Linux 6.6.98
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15e668f0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=cfe840f14e117c98
dashboard link: https://syzkaller.appspot.com/bug?extid=29b46d845126c2686055
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3855f6db0ca8/disk-9247f4e6.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/fe3d6afeb3a6/vmlinux-9247f4e6.xz
kernel image: https://storage.googleapis.com/syzbot-assets/7d8784621ac6/bzImage-9247f4e6.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+29b46d...@syzkaller.appspotmail.com

EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode
EXT4-fs (loop2): 1 truncate cleaned up
EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
------------[ cut here ]------------
WARNING: CPU: 0 PID: 12586 at fs/crypto/fname.c:567 fscrypt_fname_siphash+0xa8/0xe0 fs/crypto/fname.c:567
Modules linked in:
CPU: 0 PID: 12586 Comm: syz.2.2181 Not tainted 6.6.98-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:fscrypt_fname_siphash+0xa8/0xe0 fs/crypto/fname.c:567
Code: 48 89 d8 48 c1 e8 03 42 0f b6 04 20 84 c0 75 32 8b 33 49 83 c6 40 4c 89 f2 5b 41 5c 41 5e 41 5f e9 dd 26 5a 08 e8 68 df 80 ff <0f> 0b eb b3 44 89 f9 80 e1 07 38 c1 7c 9e 4c 89 ff e8 d2 8d d9 ff
RSP: 0018:ffffc900037d6dd8 EFLAGS: 00010283
RAX: ffffffff8204c708 RBX: ffffc900037d6ee0 RCX: 0000000000080000
RDX: ffffc9000d01b000 RSI: 0000000000011514 RDI: 0000000000011515
RBP: ffffc900037d6f50 R08: ffff88807f3c9e00 R09: 0000000000000007
R10: 0000000000000006 R11: 0000000000000002 R12: dffffc0000000000
R13: ffff88806af31c08 R14: ffff88807f557300 R15: ffff88807f557350
FS: 00007f3f9fb806c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055558c422588 CR3: 0000000030c44000 CR4: 00000000003506f0
Call Trace:
<TASK>
__ext4fs_dirhash+0x33f/0xe20 fs/ext4/hash.c:268
ext4fs_dirhash+0x144/0x2c0 fs/ext4/hash.c:322
htree_dirblock_to_tree+0x6cd/0xe70 fs/ext4/namei.c:1125
ext4_htree_fill_tree+0x5db/0x10f0 fs/ext4/namei.c:1220
ext4_dx_readdir fs/ext4/dir.c:608 [inline]
ext4_readdir+0x2b1d/0x39d0 fs/ext4/dir.c:145
iterate_dir+0x1c2/0x580 fs/readdir.c:106
ovl_dir_read+0xfc/0x560 fs/overlayfs/readdir.c:309
ovl_check_d_type_supported+0x99/0x100 fs/overlayfs/readdir.c:1065
ovl_make_workdir fs/overlayfs/super.c:733 [inline]
ovl_get_workdir+0x487/0x1740 fs/overlayfs/super.c:874
ovl_fill_super+0x1345/0x3560 fs/overlayfs/super.c:1427
vfs_get_super fs/super.c:1346 [inline]
get_tree_nodev+0xb5/0x140 fs/super.c:1365
vfs_get_tree+0x8c/0x280 fs/super.c:1764
do_new_mount+0x24b/0xa40 fs/namespace.c:3366
do_mount fs/namespace.c:3706 [inline]
__do_sys_mount fs/namespace.c:3915 [inline]
__se_sys_mount+0x2da/0x3c0 fs/namespace.c:3892
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f3f9ed8e929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3f9fb80038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f3f9efb5fa0 RCX: 00007f3f9ed8e929
RDX: 0000200000000b80 RSI: 0000200000000100 RDI: 0000000000000000
RBP: 00007f3f9ee10ca1 R08: 0000200000000200 R09: 0000000000000000
R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3f9efb5fa0 R15: 00007fff0997db58
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: d96eb99e2f0e Linux 6.6.99
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=17980b82580000
kernel config: https://syzkaller.appspot.com/x/.config?x=bfd82343ac39d3b

dashboard link: https://syzkaller.appspot.com/bug?extid=29b46d845126c2686055
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17a8d7d4580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10580b82580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/11b332f11d00/disk-d96eb99e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8a063193b98f/vmlinux-d96eb99e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b36214b822e5/bzImage-d96eb99e.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/dd9ddee96cba/mount_0.gz
fsck result: OK (log: https://syzkaller.appspot.com/x/fsck.log?x=111c438c580000)

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+29b46d...@syzkaller.appspotmail.com

EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
EXT4-fs (loop0): 1 truncate cleaned up
EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni"
------------[ cut here ]------------
WARNING: CPU: 1 PID: 5947 at fs/crypto/fname.c:567 fscrypt_fname_siphash+0xa8/0xe0 fs/crypto/fname.c:567
Modules linked in:
CPU: 1 PID: 5947 Comm: syz.0.16 Not tainted 6.6.99-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:fscrypt_fname_siphash+0xa8/0xe0 fs/crypto/fname.c:567

Code: 48 89 d8 48 c1 e8 03 42 0f b6 04 20 84 c0 75 32 8b 33 49 83 c6 40 4c 89 f2 5b 41 5c 41 5e 41 5f e9 cd 1e 5a 08 e8 d8 46 82 ff <0f> 0b eb b3 44 89 f9 80 e1 07 38 c1 7c 9e 4c 89 ff e8 f2 8b d9 ff
RSP: 0018:ffffc90003456dd8 EFLAGS: 00010293
RAX: ffffffff82034f58 RBX: ffffc90003456ee0 RCX: ffff8880236d5a00
RDX: 0000000000000000 RSI: ffffc90003456ee0 RDI: ffff888070f066b0
RBP: ffffc90003456f50 R08: ffff8880236d5a00 R09: 0000000000000007
R10: 0000000000000006 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff88802edb6c08 R14: ffff888070fe5000 R15: ffff888070fe5050
FS: 0000555584fd1500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007fcb75afa440 CR3: 000000002c421000 CR4: 00000000003506e0

Call Trace:
<TASK>
__ext4fs_dirhash+0x33f/0xe20 fs/ext4/hash.c:268
ext4fs_dirhash+0x144/0x2c0 fs/ext4/hash.c:322
htree_dirblock_to_tree+0x6cd/0xe70 fs/ext4/namei.c:1125
ext4_htree_fill_tree+0x5db/0x10f0 fs/ext4/namei.c:1220
ext4_dx_readdir fs/ext4/dir.c:608 [inline]
ext4_readdir+0x2b1d/0x39d0 fs/ext4/dir.c:145
iterate_dir+0x1c2/0x580 fs/readdir.c:106
ovl_dir_read+0xfc/0x560 fs/overlayfs/readdir.c:309
ovl_check_d_type_supported+0x99/0x100 fs/overlayfs/readdir.c:1065
ovl_make_workdir fs/overlayfs/super.c:733 [inline]
ovl_get_workdir+0x487/0x1740 fs/overlayfs/super.c:874
ovl_fill_super+0x1345/0x3560 fs/overlayfs/super.c:1427
vfs_get_super fs/super.c:1346 [inline]
get_tree_nodev+0xb5/0x140 fs/super.c:1365
vfs_get_tree+0x8c/0x280 fs/super.c:1764
do_new_mount+0x24b/0xa40 fs/namespace.c:3366
do_mount fs/namespace.c:3706 [inline]
__do_sys_mount fs/namespace.c:3915 [inline]
__se_sys_mount+0x2da/0x3c0 fs/namespace.c:3892
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2

RIP: 0033:0x7fe61398e9a9

Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007ffc3fede488 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fe613bb5fa0 RCX: 00007fe61398e9a9

RDX: 0000200000000b80 RSI: 0000200000000100 RDI: 0000000000000000

RBP: 00007fe613a10d69 R08: 0000200000000200 R09: 0000000000000000

R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000000

R13: 00007fe613bb5fa0 R14: 00007fe613bb5fa0 R15: 0000000000000005
</TASK>


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[syzbot]

syzbot suspects this issue could be fixed by backporting the following commit:

commit 985b67cd86392310d9e9326de941c22fc9340eec
git tree: upstream
Author: Lizhi Xu <lizh...@windriver.com>
Date: Wed Jun 5 01:23:35 2024 +0000

ext4: filesystems without casefold feature cannot be mounted with siphash

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17361434580000

kernel config: https://syzkaller.appspot.com/x/.config?x=bfd82343ac39d3b
dashboard link: https://syzkaller.appspot.com/bug?extid=29b46d845126c2686055

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17a8d7d4580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10580b82580000

Please keep in mind that other backports might be required as well.

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

[syzbot]

For archival purposes, forwarding an incoming command email to
syzkaller...@googlegroups.com.

***

Subject: Test ext4 patch (2)
Author: spyje...@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git 5fa4793a2d2d70ad08b85387b41020f1fcc2d19e

--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -2459,6 +2459,7 @@ static inline __le16 ext4_rec_len_to_disk(unsigned len, unsigned blocksize)
#define DX_HASH_HALF_MD4_UNSIGNED 4
#define DX_HASH_TEA_UNSIGNED 5
#define DX_HASH_SIPHASH 6
+#define DX_HASH_LAST DX_HASH_SIPHASH

static inline u32 ext4_chksum(struct ext4_sb_info *sbi, u32 crc,
const void *address, unsigned int length)
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 16a6c249580e..613f2bac439d 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -5138,16 +5138,27 @@ static int ext4_load_super(struct super_block *sb, ext4_fsblk_t *lsb,
return ret;
}

-static void ext4_hash_info_init(struct super_block *sb)
+static int ext4_hash_info_init(struct super_block *sb)
{
struct ext4_sb_info *sbi = EXT4_SB(sb);
struct ext4_super_block *es = sbi->s_es;
unsigned int i;

+ sbi->s_def_hash_version = es->s_def_hash_version;
+
+ if (sbi->s_def_hash_version > DX_HASH_LAST) {
+ ext4_msg(sb, KERN_ERR,
+ "Invalid default hash set in the superblock");
+ return -EINVAL;
+ } else if (sbi->s_def_hash_version == DX_HASH_SIPHASH) {
+ ext4_msg(sb, KERN_ERR,
+ "SIPHASH is not a valid default hash value");
+ return -EINVAL;
+ }
+
for (i = 0; i < 4; i++)
sbi->s_hash_seed[i] = le32_to_cpu(es->s_hash_seed[i]);

- sbi->s_def_hash_version = es->s_def_hash_version;
if (ext4_has_feature_dir_index(sb)) {
i = le32_to_cpu(es->s_flags);
if (i & EXT2_FLAGS_UNSIGNED_HASH)
@@ -5165,6 +5176,7 @@ static void ext4_hash_info_init(struct super_block *sb)
#endif
}
}
+ return 0;
}

static int ext4_block_group_meta_init(struct super_block *sb, int silent)
@@ -5309,7 +5321,9 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)
if (err)
goto failed_mount;

- ext4_hash_info_init(sb);
+ err = ext4_hash_info_init(sb);
+ if (err)
+ goto failed_mount;

err = ext4_handle_clustersize(sb);
if (err)

[syzbot]

For archival purposes, forwarding an incoming command email to
syzkaller...@googlegroups.com.

***

Subject: Re: Test ext4 patch (2)

Author: spyje...@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
5fa4793a2d2d70ad08b85387b41020f1fcc2d19e

diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 7afce7b744c0..85ba12a48f26 100644

[syzbot]

[syzbot]

[syzbot]