Hello,
syzbot found the following issue on:
HEAD commit: d569e86915b7 Merge tag 'drm-fixes-2022-04-22' of git://ano..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13285ddcf00000
kernel config: https://syzkaller.appspot.com/x/.config?x=71bf5c8488a4e33a
dashboard link: https://syzkaller.appspot.com/bug?extid=b4084c18420f9fad0b4f
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]
loop2: detected capacity change from 0 to 8185
ntfs3: loop2: Different NTFS' sector size (2048) and media sector size (512)
==================================================================
BUG: KASAN: slab-out-of-bounds in ntfs_iget5+0x2b93/0x3240 fs/ntfs3/inode.c:501
Read of size 8 at addr ffff888073687f28 by task syz-executor.2/9904
CPU: 1 PID: 9904 Comm: syz-executor.2 Not tainted 5.18.0-rc3-syzkaller-00080-gd569e86915b7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313
print_report mm/kasan/report.c:429 [inline]
kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
ntfs_iget5+0x2b93/0x3240 fs/ntfs3/inode.c:501
ntfs_fill_super+0x2529/0x37b0 fs/ntfs3/super.c:1083
get_tree_bdev+0x440/0x760 fs/super.c:1292
vfs_get_tree+0x89/0x2f0 fs/super.c:1497
do_new_mount fs/namespace.c:3040 [inline]
path_mount+0x1320/0x1fa0 fs/namespace.c:3370
do_mount fs/namespace.c:3383 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount fs/namespace.c:3568 [inline]
__x64_sys_mount+0x27f/0x300 fs/namespace.c:3568
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f6e8f88a61a
Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6e90903f88 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 00007f6e8f88a61a
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f6e90903fe0
RBP: 00007f6e90904020 R08: 00007f6e90904020 R09: 0000000020000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000020000000
R13: 0000000020000100 R14: 00007f6e90903fe0 R15: 000000002007a980
</TASK>
Allocated by task 3611:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:436 [inline]
__kasan_slab_alloc+0x90/0xc0 mm/kasan/common.c:469
kasan_slab_alloc include/linux/kasan.h:224 [inline]
slab_post_alloc_hook mm/slab.h:749 [inline]
slab_alloc_node mm/slub.c:3217 [inline]
slab_alloc mm/slub.c:3225 [inline]
__kmem_cache_alloc_lru mm/slub.c:3232 [inline]
kmem_cache_alloc_lru+0x255/0x720 mm/slub.c:3249
alloc_inode_sb include/linux/fs.h:2966 [inline]
sock_alloc_inode+0x23/0x1d0 net/socket.c:304
alloc_inode+0x61/0x230 fs/inode.c:260
new_inode_pseudo+0x14/0xe0 fs/inode.c:1018
sock_alloc+0x3c/0x260 net/socket.c:627
__sock_create+0xb9/0x790 net/socket.c:1432
sock_create net/socket.c:1519 [inline]
__sys_socket+0xef/0x200 net/socket.c:1561
__do_sys_socket net/socket.c:1570 [inline]
__se_sys_socket net/socket.c:1568 [inline]
__x64_sys_socket+0x6f/0xb0 net/socket.c:1568
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
Last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348
call_rcu+0x99/0x790 kernel/rcu/tree.c:3074
destroy_inode+0x129/0x1b0 fs/inode.c:315
iput_final fs/inode.c:1744 [inline]
iput.part.0+0x562/0x820 fs/inode.c:1770
iput+0x58/0x70 fs/inode.c:1760
dentry_unlink_inode+0x2b1/0x460 fs/dcache.c:401
__dentry_kill+0x3c0/0x640 fs/dcache.c:607
dentry_kill fs/dcache.c:733 [inline]
dput+0x806/0xdb0 fs/dcache.c:913
__fput+0x39c/0x9d0 fs/file_table.c:330
task_work_run+0xdd/0x1a0 kernel/task_work.c:164
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop kernel/entry/common.c:169 [inline]
exit_to_user_mode_prepare+0x23c/0x250 kernel/entry/common.c:201
__syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:294
do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x44/0xae
Second to last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348
call_rcu+0x99/0x790 kernel/rcu/tree.c:3074
destroy_inode+0x129/0x1b0 fs/inode.c:315
iput_final fs/inode.c:1744 [inline]
iput.part.0+0x562/0x820 fs/inode.c:1770
iput+0x58/0x70 fs/inode.c:1760
dentry_unlink_inode+0x2b1/0x460 fs/dcache.c:401
__dentry_kill+0x3c0/0x640 fs/dcache.c:607
dentry_kill fs/dcache.c:733 [inline]
dput+0x806/0xdb0 fs/dcache.c:913
__fput+0x39c/0x9d0 fs/file_table.c:330
task_work_run+0xdd/0x1a0 kernel/task_work.c:164
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop kernel/entry/common.c:169 [inline]
exit_to_user_mode_prepare+0x23c/0x250 kernel/entry/common.c:201
__syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:294
do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x44/0xae
The buggy address belongs to the object at ffff888073687800
which belongs to the cache sock_inode_cache of size 1408
The buggy address is located 424 bytes to the right of
1408-byte region [ffff888073687800, ffff888073687d80)
The buggy address belongs to the physical page:
page:ffffea0001cda000 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888073680600 pfn:0x73680
head:ffffea0001cda000 order:3 compound_mapcount:0 compound_pincount:0
memcg:ffff888079fa8401
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 0000000000000000 dead000000000001 ffff888140795500
raw: ffff888073680600 000000008015000b 00000001ffffffff ffff888079fa8401
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_RECLAIMABLE), pid 3171, tgid 3171 (dhcpcd), ts 33789392393, free_ts 10721584612
prep_new_page mm/page_alloc.c:2441 [inline]
get_page_from_freelist+0xba2/0x3e00 mm/page_alloc.c:4182
__alloc_pages+0x1b2/0x500 mm/page_alloc.c:5408
alloc_pages+0x1aa/0x310 mm/mempolicy.c:2272
alloc_slab_page mm/slub.c:1799 [inline]
allocate_slab+0x26c/0x3c0 mm/slub.c:1944
new_slab mm/slub.c:2004 [inline]
___slab_alloc+0x8df/0xf20 mm/slub.c:3005
__slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3092
slab_alloc_node mm/slub.c:3183 [inline]
slab_alloc mm/slub.c:3225 [inline]
__kmem_cache_alloc_lru mm/slub.c:3232 [inline]
kmem_cache_alloc_lru+0x504/0x720 mm/slub.c:3249
alloc_inode_sb include/linux/fs.h:2966 [inline]
sock_alloc_inode+0x23/0x1d0 net/socket.c:304
alloc_inode+0x61/0x230 fs/inode.c:260
new_inode_pseudo+0x14/0xe0 fs/inode.c:1018
sock_alloc+0x3c/0x260 net/socket.c:627
__sock_create+0xb9/0x790 net/socket.c:1432
sock_create net/socket.c:1519 [inline]
__sys_socket+0xef/0x200 net/socket.c:1561
__do_sys_socket net/socket.c:1570 [inline]
__se_sys_socket net/socket.c:1568 [inline]
__x64_sys_socket+0x6f/0xb0 net/socket.c:1568
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1356 [inline]
free_pcp_prepare+0x549/0xd20 mm/page_alloc.c:1406
free_unref_page_prepare mm/page_alloc.c:3328 [inline]
free_unref_page+0x19/0x6a0 mm/page_alloc.c:3423
free_contig_range+0xb1/0x180 mm/page_alloc.c:9418
destroy_args+0xa8/0x646 mm/debug_vm_pgtable.c:1018
debug_vm_pgtable+0x2a51/0x2ae3 mm/debug_vm_pgtable.c:1332
do_one_initcall+0x103/0x650 init/main.c:1298
do_initcall_level init/main.c:1371 [inline]
do_initcalls init/main.c:1387 [inline]
do_basic_setup init/main.c:1406 [inline]
kernel_init_freeable+0x6b1/0x73a init/main.c:1613
kernel_init+0x1a/0x1d0 init/main.c:1502
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
Memory state around the buggy address:
ffff888073687e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888073687e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888073687f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff888073687f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888073688000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at [email protected].
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot has found a reproducer for the following issue on:
HEAD commit: a6b443748715 Merge branch 'for-next/core', remote-tracking..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=15625dbf080000
kernel config: https://syzkaller.appspot.com/x/.config?x=14bf9ec0df433b27
dashboard link: https://syzkaller.appspot.com/bug?extid=b4084c18420f9fad0b4f
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1482f778880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10d9e35d080000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]
ntfs3: loop0: Different NTFS' sector size (4096) and media sector size (512)
ntfs3: loop0: RAW NTFS volume: Filesystem size 0.00 Gb > volume size 0.00 Gb. Mount in read-only
Unable to handle kernel paging request at virtual address dead4ead00000010
Mem abort info:
ESR = 0x0000000096000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004
CM = 0, WnR = 0
[dead4ead00000010] address between user and kernel address ranges
Internal error: Oops: 96000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 3051 Comm: syz-executor281 Not tainted 6.0.0-rc4-syzkaller-17255-ga6b443748715 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : ntfs_iget5+0x88/0x138c fs/ntfs3/inode.c:502
lr : ntfs_iget5+0x78/0x138c fs/ntfs3/inode.c:500
sp : ffff80001275ba40
x29: ffff80001275bae0 x28: ffff0000cb374000 x27: ffff0000c90ce000
x26: ffff80001275bb70 x25: 0000000000000024 x24: ffff80000c1300b4
x23: ffff0000cb3761a8 x22: ffff0000ca8c8250 x21: ffff0000ca8c9708
x20: 0000000000000002 x19: ffff0000ca8c1a30 x18: 00000000000000c0
x17: ffff80000dd3a698 x16: ffff80000db78658 x15: ffff0000c71eb500
x14: ffff80000dd3a698 x13: ffff80000db78658 x12: ffff0000c71eb500
x11: ff80800008bf1798 x10: 0000000000000000 x9 : ffff0000c71eb500
x8 : dead4ead00000000 x7 : ffff8000085eb4a0 x6 : 0000000000000000
x5 : 0000000000000020 x4 : ffff80001275b690 x3 : 0000000000000000
x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
ntfs_iget5+0x88/0x138c fs/ntfs3/inode.c:502
ntfs_fill_super+0xbe8/0x14a4 fs/ntfs/super.c:2902
get_tree_bdev+0x1e8/0x2a0 fs/super.c:1323
ntfs_fs_get_tree+0x28/0x38 fs/ntfs3/super.c:1358
vfs_get_tree+0x40/0x140 fs/super.c:1530
do_new_mount+0x1dc/0x4e4 fs/namespace.c:3040
path_mount+0x358/0x914 fs/namespace.c:3370
do_mount fs/namespace.c:3383 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount fs/namespace.c:3568 [inline]
__arm64_sys_mount+0x2f8/0x408 fs/namespace.c:3568
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:624
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:642
el0t_64_sync+0x18c/0x190
Code: 37180194 d108c268 f9400108 79400f54 (79402115)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: 37180194 tbnz w20, #3, 0x30
4: d108c268 sub x8, x19, #0x230
8: f9400108 ldr x8, [x8]
c: 79400f54 ldrh w20, [x26, #6]
* 10: 79402115 ldrh w21, [x8, #16] <-- trapping instruction
syzbot suspects this issue was fixed by commit:
commit 6f861765464f43a71462d52026fbddfc858239a5
Author: Jan Kara <[email protected]>
Date: Wed Nov 1 17:43:10 2023 +0000
fs: Block writes to mounted block devices
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1649668e180000
start commit: 3800a713b607 Merge tag 'mm-hotfixes-stable-2022-09-26' of ..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=755695d26ad09807
dashboard link: https://syzkaller.appspot.com/bug?extid=b4084c18420f9fad0b4f
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13ccc59c880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10928774880000
If the result looks correct, please mark the issue as fixed by replying with:
#syz fix: fs: Block writes to mounted block devices
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
On Sat 09-03-24 13:19:04, syzbot wrote:
> syzbot suspects this issue was fixed by commit:
>
> commit 6f861765464f43a71462d52026fbddfc858239a5
> Author: Jan Kara <[email protected]>
> Date: Wed Nov 1 17:43:10 2023 +0000
>
> fs: Block writes to mounted block devices
>
> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1649668e180000
> start commit: 3800a713b607 Merge tag 'mm-hotfixes-stable-2022-09-26' of ..
> git tree: upstream
> kernel config: https://syzkaller.appspot.com/x/.config?x=755695d26ad09807
> dashboard link: https://syzkaller.appspot.com/bug?extid=b4084c18420f9fad0b4f
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13ccc59c880000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10928774880000
>
> If the result looks correct, please mark the issue as fixed by replying with:
#syz fix: fs: Block writes to mounted block devices
Honza
--
Jan Kara <[email protected]>
SUSE Labs, CR