[syzbot] [ntfs?] UBSAN: shift-out-of-bounds in ntfs_iget

[Manas Ghandat <ghandatmanas@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 467 bytes --]

In this bug, the logic at the following line 
(https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/fs/ntfs/inode.c?id=e8f75c0270d930ef675fee22d74d1a3250e96962#n1067) 
is getting skipped. The `if` condition is not triggered and thus the 
compression issue occurs. I was trying to change the `if` conditions so 
that the check occurs but was getting the following error. Can you 
suggest any way so that the condition gets triggered.

Thanks,
Manas

[-- Attachment #2: trace --]
[-- Type: text/plain, Size: 6056 bytes --]


Booting from ROM..
[    0.000000][    T0] Linux version 6.4.0-01406-ge8f75c0270d9-dirty (manas@manas-VirtualBox) (gcc (Ubuntu 12.2.0-3ubuntu1) 12.2.0, GNU ld (GNU Binutils for Ubuntu) 2.39) #8 SMP PREEMPT_DYNAMIC Sat Aug  5 09:08:25 IST 2023
[    0.000000][    T0] Command line: root=/dev/ram rw console=ttyS0 oops=panic panic=1 nokaslr quiet
[    0.000000][    T0] KERNEL supported cpus:
[    0.000000][    T0]   Intel GenuineIntel
[    0.000000][    T0]   AMD AuthenticAMD
[    0.000000][    T0] BIOS-provided physical RAM map:
[    0.000000][    T0] BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable
[    0.000000][    T0] BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved
[    0.000000][    T0] BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved
[    0.000000][    T0] BIOS-e820: [mem 0x0000000000100000-0x000000007ffdffff] usable
[    0.000000][    T0] BIOS-e820: [mem 0x000000007ffe0000-0x000000007fffffff] reserved
[    0.000000][    T0] BIOS-e820: [mem 0x00000000feffc000-0x00000000feffffff] reserved
[    0.000000][    T0] BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved
[    0.000000][    T0] printk: bootconsole [earlyser0] enabled
[    0.000000][    T0] ERROR: earlyprintk= earlyser already used
[    0.000000][    T0] ERROR: earlyprintk= earlyser already used
[    0.000000][    T0] **********************************************************
[    0.000000][    T0] **   NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE   **
[    0.000000][    T0] **                                                      **
[    0.000000][    T0] ** This system shows unhashed kernel memory addresses   **
[    0.000000][    T0] ** via the console, logs, and other interfaces. This    **
[    0.000000][    T0] ** might reduce the security of your system.            **
[    0.000000][    T0] **                                                      **
[    0.000000][    T0] ** If you see this message and you are not debugging    **
[    0.000000][    T0] ** the kernel, report this immediately to your system   **
[    0.000000][    T0] ** administrator!                                       **
[    0.000000][    T0] **                                                      **
[    0.000000][    T0] **   NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE   **
[    0.000000][    T0] **********************************************************
[    0.000000][    T0] Malformed early option 'vsyscall'
[    0.648434][    T0] Spectre V2 : Kernel not compiled with retpoline; no mitigation available!
[    2.612422][    T1] kvm_intel: VMX not supported by CPU 0
[    2.615720][    T1] kvm_amd: SVM not supported by CPU 0, can't execute cpuid_8000000a
[    6.084339][    T1] db_root: cannot open: /etc/target
[    8.756930][    T1] nf_conntrack_irc: failed to register helpers
[    8.763863][    T1] nf_conntrack_sane: failed to register helpers
[    8.877704][    T1] nf_conntrack_sip: failed to register helpers
[   10.157682][    T1] exFAT-fs (ram0): invalid fs_name
[   10.158805][    T1] exFAT-fs (ram0): failed to read boot sector
[   10.159977][    T1] exFAT-fs (ram0): failed to recognize exfat type
[   10.166836][    T1] VFS: could not find a valid V7 on ram0.
[   10.170137][    T1] ntfs: (device ram0): ntfs_attr_find(): Inode is corrupt.  Run chkdsk.
[   10.171733][    T1] ntfs: (device ram0): ntfs_read_locked_inode(): Failed to lookup $DATA attribute.
[   10.173439][    T1] ntfs: (device ram0): ntfs_read_locked_inode(): Failed with error code -5.  Marking corrupt inode 0x1 as bad.  Run chkdsk.
[   10.175815][    T1] ntfs: (device ram0): load_system_files(): Failed to load $MFTMirr.  Mounting read-only.  Run ntfsfix and/or chkdsk.
[   10.178684][    T1] ntfs: (device ram0): ntfs_mapping_pairs_decompress(): Missing length entry in mapping pairs array.
[   10.180886][    T1] ntfs: (device ram0): ntfs_mapping_pairs_decompress(): Invalid length in mapping pairs array.
[   10.182804][    T1] ntfs: (device ram0): ntfs_read_block(): Failed to read from inode 0xa, attribute type 0x80, vcn 0x0, offset 0x0 because its location on disk could not be determined even after retrying (error code -5).
[   10.186410][    T1] ntfs: (device ram0): ntfs_mapping_pairs_decompress(): Missing length entry in mapping pairs array.
[   10.188485][    T1] ntfs: (device ram0): ntfs_mapping_pairs_decompress(): Invalid length in mapping pairs array.
[   10.190411][    T1] ntfs: (device ram0): ntfs_read_block(): Failed to read from inode 0xa, attribute type 0x80, vcn 0x0, offset 0x800 because its location on disk could not be determined even after retrying (error code -5).
[   10.313465][    T1] Failed to set sysctl parameter 'max_rcu_stall_to_panic=1': parameter not found
[   10.316218][    T1] Starting init: /sbin/init exists but couldn't execute it (error -5)
[   10.318268][    T1] Starting init: /etc/init exists but couldn't execute it (error -5)
[   10.320047][    T1] Starting init: /bin/init exists but couldn't execute it (error -5)
[   10.321895][    T1] Starting init: /bin/sh exists but couldn't execute it (error -5)
[   10.323410][    T1] Kernel panic - not syncing: No working init found.  Try passing init= option to kernel. See Linux Documentation/admin-guide/init.rst for guidance.
[   10.326181][    T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.4.0-01406-ge8f75c0270d9-dirty #8
[   10.327781][    T1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-4 04/01/2014
[   10.327781][    T1] Call Trace:
[   10.327781][    T1]  <TASK>
[   10.327781][    T1]  dump_stack_lvl+0xd9/0x1b0
[   10.327781][    T1]  panic+0x6a4/0x750
[   10.327781][    T1]  ? panic_smp_self_stop+0xa0/0xa0
[   10.327781][    T1]  ? putname+0x101/0x140
[   10.327781][    T1]  ? kernel_init+0x265/0x2a0
[   10.327781][    T1]  kernel_init+0x276/0x2a0
[   10.327781][    T1]  ? rest_init+0x2b0/0x2b0
[   10.327781][    T1]  ret_from_fork+0x1f/0x30
[   10.327781][    T1]  </TASK>
[   10.327781][    T1] Kernel Offset: disabled
[   10.327781][    T1] Rebooting in 1 seconds..