From: syzbot <syzbot+af224b63e76b2d869bc3@syzkaller.appspotmail.com>
To: almaz.alexandrovich@paragon-software.com,
linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
ntfs3@lists.linux.dev, syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [ntfs3?] general protection fault in ni_readpage_cmpr
Date: Sun, 07 May 2023 03:30:45 -0700 [thread overview]
Message-ID: <000000000000cdb0e805fb180316@google.com> (raw)
In-Reply-To: <000000000000b0cabf05f90bcb15@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: 14f8db1c0f9a Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=14ecc3b0280000
kernel config: https://syzkaller.appspot.com/x/.config?x=a837a8ba7e88bb45
dashboard link: https://syzkaller.appspot.com/bug?extid=af224b63e76b2d869bc3
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=168ce182280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1308c522280000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ad6ce516eed3/disk-14f8db1c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1f38c2cc7667/vmlinux-14f8db1c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d795115eee39/Image-14f8db1c.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/8a3eac658458/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+af224b63e76b2d869bc3@syzkaller.appspotmail.com
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:193
el0_svc+0x4c/0x15c arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
Unable to handle kernel paging request at virtual address dfff800000000001
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
Mem abort info:
ESR = 0x0000000096000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
[dfff800000000001] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 5930 Comm: syz-executor385 Not tainted 6.3.0-rc7-syzkaller-g14f8db1c0f9a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : _compound_head include/linux/page-flags.h:251 [inline]
pc : unlock_page+0x28/0x74 mm/folio-compat.c:21
lr : unlock_page+0x18/0x74 mm/folio-compat.c:20
sp : ffff80001e4d6fa0
x29: ffff80001e4d6fa0 x28: 0000000000000007 x27: 00000000fffffff4
x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
x23: ffff0000d9371208 x22: 0000000000000001 x21: dfff800000000000
x20: 0000000000000008 x19: 0000000000000000 x18: 1fffe0003684a5b6
x17: 0000000000000000 x16: ffff8000084fa124 x15: 0000000000000001
x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000001
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000001
x8 : dfff800000000000 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff80001e4d61d8 x4 : ffff800015e4ccc0 x3 : ffff80000968c944
x2 : 0000000000000001 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
_compound_head include/linux/page-flags.h:251 [inline]
unlock_page+0x28/0x74 mm/folio-compat.c:21
ni_readpage_cmpr+0x474/0x798 fs/ntfs3/frecord.c:2149
ntfs_read_folio+0x14c/0x1c0 fs/ntfs3/inode.c:703
filemap_read_folio+0x14c/0x39c mm/filemap.c:2424
filemap_create_folio mm/filemap.c:2552 [inline]
filemap_get_pages+0xb3c/0x1640 mm/filemap.c:2605
filemap_read+0x354/0xc98 mm/filemap.c:2693
generic_file_read_iter+0xa0/0x450 mm/filemap.c:2840
ntfs_file_read_iter+0x184/0x1e0 fs/ntfs3/file.c:758
call_read_iter include/linux/fs.h:1845 [inline]
generic_file_splice_read+0x1e0/0x508 fs/splice.c:402
do_splice_to fs/splice.c:885 [inline]
splice_direct_to_actor+0x30c/0x944 fs/splice.c:956
do_splice_direct+0x1f4/0x334 fs/splice.c:1065
do_sendfile+0x4bc/0xc70 fs/read_write.c:1255
__do_sys_sendfile64 fs/read_write.c:1323 [inline]
__se_sys_sendfile64 fs/read_write.c:1309 [inline]
__arm64_sys_sendfile64+0x160/0x3b4 fs/read_write.c:1309
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:193
el0_svc+0x4c/0x15c arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
Code: d2d00008 91002274 f2fbffe8 d343fe89 (38686928)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: d2d00008 mov x8, #0x800000000000 // #140737488355328
4: 91002274 add x20, x19, #0x8
8: f2fbffe8 movk x8, #0xdfff, lsl #48
c: d343fe89 lsr x9, x20, #3
* 10: 38686928 ldrb w8, [x9, x8] <-- trapping instruction
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
next prev parent reply other threads:[~2023-05-07 10:30 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-04-11 9:05 [syzbot] [ntfs3?] general protection fault in ni_readpage_cmpr syzbot
2023-05-07 10:30 ` syzbot [this message]
2023-06-11 22:17 ` syzbot
2023-11-21 15:58 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000cdb0e805fb180316@google.com \
--to=syzbot+af224b63e76b2d869bc3@syzkaller.appspotmail.com \
--cc=almaz.alexandrovich@paragon-software.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=ntfs3@lists.linux.dev \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.