Re: [syzbot] [ntfs3?] KASAN: slab-use-after-free Read in chrdev_open

[syzbot <syzbot+5d34cc6474499a5ff516@syzkaller.appspotmail.com>]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

5][    T1] usbcore: registered new interface driver snd_usb_variax
[   11.302247][    T1] drop_monitor: Initializing network drop monitor service
[   11.311701][    T1] NET: Registered PF_LLC protocol family
[   11.318195][    T1] GACT probability on
[   11.322363][    T1] Mirror/redirect action on
[   11.327179][    T1] Simple TC action Loaded
[   11.335693][    T1] netem: version 1.3
[   11.339922][    T1] u32 classifier
[   11.343467][    T1]     Performance counters on
[   11.348165][    T1]     input device check on
[   11.352648][    T1]     Actions configured
[   11.359550][    T1] nf_conntrack_irc: failed to register helpers
[   11.365771][    T1] nf_conntrack_sane: failed to register helpers
[   11.490881][    T1] nf_conntrack_sip: failed to register helpers
[   11.503091][    T1] xt_time: kernel timezone is -0000
[   11.508580][    T1] IPVS: Registered protocols (TCP, UDP, SCTP, AH, ESP)
[   11.515567][    T1] IPVS: Connection hash table configured (size=4096, memory=32Kbytes)
[   11.524749][    T1] IPVS: ipvs loaded.
[   11.528782][    T1] IPVS: [rr] scheduler registered.
[   11.533974][    T1] IPVS: [wrr] scheduler registered.
[   11.539276][    T1] IPVS: [lc] scheduler registered.
[   11.544387][    T1] IPVS: [wlc] scheduler registered.
[   11.549657][    T1] IPVS: [fo] scheduler registered.
[   11.555055][    T1] IPVS: [ovf] scheduler registered.
[   11.560394][    T1] IPVS: [lblc] scheduler registered.
[   11.565729][    T1] IPVS: [lblcr] scheduler registered.
[   11.571680][    T1] IPVS: [dh] scheduler registered.
[   11.576873][    T1] IPVS: [sh] scheduler registered.
[   11.582006][    T1] IPVS: [mh] scheduler registered.
[   11.587293][    T1] IPVS: [sed] scheduler registered.
[   11.592590][    T1] IPVS: [nq] scheduler registered.
[   11.597745][    T1] IPVS: [twos] scheduler registered.
[   11.603473][    T1] IPVS: [sip] pe registered.
[   11.608323][    T1] ipip: IPv4 and MPLS over IPv4 tunneling driver
[   11.618256][    T1] gre: GRE over IPv4 demultiplexor driver
[   11.623995][    T1] ip_gre: GRE over IPv4 tunneling driver
[   11.639361][    T1] IPv4 over IPsec tunneling driver
[   11.649203][    T1] Initializing XFRM netlink socket
[   11.654611][    T1] IPsec XFRM device driver
[   11.660348][    T1] NET: Registered PF_INET6 protocol family
[   11.680421][    T1] Segment Routing with IPv6
[   11.685024][    T1] RPL Segment Routing with IPv6
[   11.690127][    T1] In-situ OAM (IOAM) with IPv6
[   11.695399][    T1] mip6: Mobile IPv6
[   11.703700][    T1] sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver
[   11.718600][    T1] ip6_gre: GRE over IPv6 tunneling driver
[   11.729457][    T1] NET: Registered PF_PACKET protocol family
[   11.735537][    T1] NET: Registered PF_KEY protocol family
[   11.741796][    T1] Bridge firewalling registered
[   11.747696][    T1] NET: Registered PF_X25 protocol family
[   11.753479][    T1] X25: Linux Version 0.2
[   11.802773][    T1] NET: Registered PF_NETROM protocol family
[   11.854444][    T1] NET: Registered PF_ROSE protocol family
[   11.864814][    T1] NET: Registered PF_AX25 protocol family
[   11.871376][    T1] can: controller area network core
[   11.876845][    T1] NET: Registered PF_CAN protocol family
[   11.883711][    T1] can: raw protocol
[   11.887830][    T1] can: broadcast manager protocol
[   11.892941][    T1] can: netlink gateway - max_hops=1
[   11.898365][    T1] can: SAE J1939
[   11.901940][    T1] can: isotp protocol (max_pdu_size 8300)
[   11.909408][    T1] Bluetooth: RFCOMM TTY layer initialized
[   11.915286][    T1] Bluetooth: RFCOMM socket layer initialized
[   11.921464][    T1] Bluetooth: RFCOMM ver 1.11
[   11.926785][    T1] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[   11.933066][    T1] Bluetooth: BNEP filters: protocol multicast
[   11.939343][    T1] Bluetooth: BNEP socket layer initialized
[   11.945147][    T1] Bluetooth: CMTP (CAPI Emulation) ver 1.0
[   11.951046][    T1] Bluetooth: CMTP socket layer initialized
[   11.956926][    T1] Bluetooth: HIDP (Human Interface Emulation) ver 1.2
[   11.963861][    T1] Bluetooth: HIDP socket layer initialized
[   11.973494][    T1] NET: Registered PF_RXRPC protocol family
[   11.979356][    T1] Key type rxrpc registered
[   11.983844][    T1] Key type rxrpc_s registered
[   11.989486][    T1] NET: Registered PF_KCM protocol family
[   11.996107][    T1] lec:lane_module_init: lec.c: initialized
[   12.002004][    T1] mpoa:atm_mpoa_init: mpc.c: initialized
[   12.007965][    T1] l2tp_core: L2TP core driver, V2.0
[   12.013196][    T1] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[   12.018865][    T1] l2tp_ip: L2TP IP encapsulation support (L2TPv3)
[   12.025374][    T1] l2tp_netlink: L2TP netlink interface
[   12.030971][    T1] l2tp_eth: L2TP ethernet pseudowire support (L2TPv3)
[   12.037743][    T1] l2tp_ip6: L2TP IP encapsulation support for IPv6 (L2TPv3)
[   12.045361][    T1] NET: Registered PF_PHONET protocol family
[   12.051559][    T1] 8021q: 802.1Q VLAN Support v1.8
[   12.071027][    T1] DCCP: Activated CCID 2 (TCP-like)
[   12.076392][    T1] DCCP: Activated CCID 3 (TCP-Friendly Rate Control)
[   12.083533][    T1] DCCP is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   12.094738][    T1] sctp: Hash tables configured (bind 32/56)
[   12.102401][    T1] NET: Registered PF_RDS protocol family
[   12.108965][    T1] Registered RDS/infiniband transport
[   12.115714][    T1] Registered RDS/tcp transport
[   12.120748][    T1] tipc: Activated (version 2.0.0)
[   12.126839][    T1] NET: Registered PF_TIPC protocol family
[   12.133861][    T1] tipc: Started in single node mode
[   12.140276][    T1] NET: Registered PF_SMC protocol family
[   12.146254][    T1] 9pnet: Installing 9P2000 support
[   12.152095][    T1] NET: Registered PF_CAIF protocol family
[   12.161729][    T1] NET: Registered PF_IEEE802154 protocol family
[   12.168694][    T1] Key type dns_resolver registered
[   12.173882][    T1] Key type ceph registered
[   12.179243][    T1] libceph: loaded (mon/osd proto 15/24)
[   12.186045][    T1] batman_adv: B.A.T.M.A.N. advanced 2024.2 (compatibility version 15) loaded
[   12.195724][    T1] openvswitch: Open vSwitch switching datapath
[   12.205601][    T1] NET: Registered PF_VSOCK protocol family
[   12.211871][    T1] mpls_gso: MPLS GSO support
[   12.233028][    T1] IPI shorthand broadcast: enabled
[   12.238605][    T1] AVX2 version of gcm_enc/dec engaged.
[   12.244489][    T1] AES CTR mode by8 optimization enabled
[   13.698699][    T1] sched_clock: Marking stable (13660026255, 37434632)->(13707290408, -9829521)
[   13.709929][    T1] Timer migration: 1 hierarchy levels; 8 children per group; 0 crossnode level
[   13.720289][    T1] registered taskstats version 1
[   13.740168][    T1] Loading compiled-in X.509 certificates
[   13.750995][    T1] Loaded X.509 cert 'Build time autogenerated kernel key: 63e2efea038bb0653de0db43cf50bc47660eba33'
[   14.070144][    T1] zswap: loaded using pool lzo/zsmalloc
[   14.078019][    T1] Demotion targets for Node 0: null
[   14.083317][    T1] Demotion targets for Node 1: null
[   14.090223][    T1] debug_vm_pgtable: [debug_vm_pgtable         ]: Validating architecture page table helpers
[   16.421449][    T1] Key type .fscrypt registered
[   16.426326][    T1] Key type fscrypt-provisioning registered
[   16.439567][    T1] kAFS: Red Hat AFS client v0.1 registering.
[   16.463960][    T1] Btrfs loaded, assert=on, ref-verify=on, zoned=yes, fsverity=yes
[   16.472822][    T1] Key type big_key registered
[   16.487177][    T1] Key type encrypted registered
[   16.492433][    T1] ima: No TPM chip found, activating TPM-bypass!
[   16.498975][    T1] Loading compiled-in module X.509 certificates
[   16.508509][    T1] Loaded X.509 cert 'Build time autogenerated kernel key: 63e2efea038bb0653de0db43cf50bc47660eba33'
[   16.519514][    T1] ima: Allocated hash algorithm: sha256
[   16.525779][    T1] ima: No architecture policies found
[   16.531809][    T1] evm: Initialising EVM extended attributes:
[   16.538118][    T1] evm: security.selinux (disabled)
[   16.543309][    T1] evm: security.SMACK64
[   16.547518][    T1] evm: security.SMACK64EXEC
[   16.552013][    T1] evm: security.SMACK64TRANSMUTE
[   16.557098][    T1] evm: security.SMACK64MMAP
[   16.562382][    T1] evm: security.apparmor (disabled)
[   16.567636][    T1] evm: security.ima
[   16.571521][    T1] evm: security.capability
[   16.575929][    T1] evm: HMAC attrs: 0x1
[   16.582546][    T1] PM:   Magic number: 12:706:508
[   16.587780][    T1] usb usb40-port6: hash matches
[   16.593014][    T1] bdi 252:0: hash matches
[   16.597651][    T1] pci 0000:00:01.0: hash matches
[   16.603169][    T1] printk: legacy console [netcon0] enabled
[   16.609033][    T1] netconsole: network logging started
[   16.615160][    T1] gtp: GTP module loaded (pdp ctx size 128 bytes)
[   16.623286][    T1] rdma_rxe: loaded
[   16.628079][    T1] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[   16.639538][    T1] Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[   16.647354][    T1] Loaded X.509 cert 'wens: 61c038651aabdcf94bd0ac7ff06c7248db18c600'
[   16.657611][    T1] clk: Disabling unused clocks
[   16.659517][   T45] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
[   16.662680][    T1] ALSA device list:
[   16.672518][   T45] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db
[   16.676035][    T1]   #0: Dummy 1
[   16.688620][    T1]   #1: Loopback 1
[   16.692338][    T1]   #2: Virtual MIDI Card 1
[   16.700761][    T1] md: Waiting for all devices to be available before autodetect
[   16.708457][    T1] md: If you don't use raid, use raid=noautodetect
[   16.714984][    T1] md: Autodetecting RAID arrays.
[   16.720066][    T1] md: autorun ...
[   16.723703][    T1] md: ... autorun DONE.
[   16.822096][    T1] EXT4-fs (sda1): mounted filesystem 5941fea2-f5fa-4b4e-b5ef-9af118b27b95 ro with ordered data mode. Quota mode: none.
[   16.835388][    T1] VFS: Mounted root (ext4 filesystem) readonly on device 8:1.
[   16.866395][    T1] devtmpfs: mounted
[   16.954288][    T1] Freeing unused kernel image (initmem) memory: 25900K
[   16.965105][    T1] Write protecting the kernel read-only data: 212992k
[   16.982735][    T1] Freeing unused kernel image (rodata/data gap) memory: 752K
[   17.095445][    T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[   17.103701][    T1] x86/mm: Checking user space page tables
[   17.200694][    T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[   17.210306][    T1] Error -EINVAL opening proc file to set sysctl parameter 'kernel.hung_task_all_cpu_backtrace=1'
[   17.221335][    T1] Error -EINVAL opening proc file to set sysctl parameter 'vm.nr_hugepages=4'
[   17.230737][    T1] Error -EINVAL opening proc file to set sysctl parameter 'vm.nr_overcommit_hugepages=4'
[   17.240776][    T1] Failed to set sysctl parameter 'max_rcu_stall_to_panic=1': parameter not found
[   17.250456][    T1] Error -EINVAL opening proc file to set sysctl parameter 'net.core.netdev_unregister_timeout_secs=140'
[   17.262827][    T1] Run /sbin/init as init process
[   17.319704][    T1] Starting init: /sbin/init exists but couldn't execute it (error -22)
[   17.328131][    T1] Run /etc/init as init process
[   17.352410][    T1] Run /bin/init as init process
[   17.358988][    T1] Run /bin/sh as init process
[   17.364086][    T1] Starting init: /bin/sh exists but couldn't execute it (error -22)
[   17.372157][    T1] Kernel panic - not syncing: No working init found.  Try passing init= option to kernel. See Linux Documentation/admin-guide/init.rst for guidance.
[   17.387558][    T1] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.10.0-rc3-syzkaller-dirty #0
[   17.396159][    T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[   17.406298][    T1] Call Trace:
[   17.409570][    T1]  <TASK>
[   17.412494][    T1]  dump_stack_lvl+0x241/0x360
[   17.417178][    T1]  ? __pfx_dump_stack_lvl+0x10/0x10
[   17.422356][    T1]  ? __pfx__printk+0x10/0x10
[   17.426971][    T1]  ? vscnprintf+0x5d/0x90
[   17.431283][    T1]  panic+0x349/0x860
[   17.435244][    T1]  ? __wake_up_klogd+0xcc/0x110
[   17.440250][    T1]  ? __pfx_panic+0x10/0x10
[   17.444652][    T1]  ? kernel_init+0x18f/0x2b0
[   17.449228][    T1]  ? kernel_execve+0x8f8/0xa10
[   17.453988][    T1]  ? pti_clone_pgtable+0x380/0x3c0
[   17.459085][    T1]  ? __pfx_kernel_init+0x10/0x10
[   17.464022][    T1]  kernel_init+0x25e/0x2b0
[   17.468424][    T1]  ret_from_fork+0x4b/0x80
[   17.472821][    T1]  ? __pfx_kernel_init+0x10/0x10
[   17.477743][    T1]  ret_from_fork_asm+0x1a/0x30
[   17.482498][    T1]  </TASK>
[   17.485802][    T1] Kernel Offset: disabled
[   17.490168][    T1] Rebooting in 86400 seconds..


syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.21.4'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2391660754=/tmp/go-build -gno-record-gcc-switches'

git status (err=<nil>)
HEAD detached at 8bdc0f2206
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=8bdc0f220628c9347b3581fead4c026272439799 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240424-152314'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=8bdc0f220628c9347b3581fead4c026272439799 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240424-152314'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=8bdc0f220628c9347b3581fead4c026272439799 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240424-152314'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-stress github.com/google/syzkaller/tools/syz-stress
mkdir -p ./bin/linux_amd64
gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"8bdc0f220628c9347b3581fead4c026272439799\"


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=15dd7646980000


Tested on:

commit:         83a7eefe Linux 6.10-rc3
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel config:  https://syzkaller.appspot.com/x/.config?x=c79815c08cc14227
dashboard link: https://syzkaller.appspot.com/bug?extid=5d34cc6474499a5ff516
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=13d111de980000