syzbot

 sign-in | mailing list | source | docs
🐞 Open [965] ≡ Subsystems 🐞 Fixed [4559] 🐞 Invalid [10500] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KASAN: use-after-free Read in ntfs_test_inode

Status: upstream: reported on 2021/05/17 10:56
Labels: ntfs (incorrect?)
Reported-by: syzbot+2751da923b5eb8307b0b@syzkaller.appspotmail.com
First crash: 774d, last: 3d02h
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
[syzbot] Monthly ntfs report (May 2023) 0 (1) 2023/05/02 07:18
[syzbot] Monthly ntfs report 0 (1) 2023/03/31 15:00
[syzbot] KASAN: use-after-free Read in ntfs_test_inode 0 (1) 2021/05/17 10:56
▶ ▼ Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 KASAN: use-after-free Read in ntfs_test_inode 1 184d 184d 0/1 auto-obsoleted due to no activity on 2023/03/28 18:25
linux-5.15 KASAN: use-after-free Read in ntfs_test_inode 2 27d 67d 0/3 upstream: reported on 2023/03/25 12:26
linux-4.14 KASAN: slab-out-of-bounds Read in ntfs_test_inode 1 469d 469d 0/1 auto-closed as invalid on 2022/06/16 22:11

Sample crash report:
ntfs: volume version 3.1.
==================================================================
BUG: KASAN: use-after-free in instrument_atomic_read include/linux/instrumented.h:71 [inline]
BUG: KASAN: use-after-free in test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline]
BUG: KASAN: use-after-free in NInoAttr fs/ntfs/inode.h:200 [inline]
BUG: KASAN: use-after-free in ntfs_test_inode+0x7b/0x2d0 fs/ntfs/inode.c:55
Read of size 8 at addr ffff8880974790f0 by task syz-executor.3/12887

CPU: 1 PID: 12887 Comm: syz-executor.3 Not tainted 5.12.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x176/0x24e lib/dump_stack.c:120
 print_address_description+0x5f/0x3a0 mm/kasan/report.c:232
 __kasan_report mm/kasan/report.c:399 [inline]
 kasan_report+0x15c/0x200 mm/kasan/report.c:416
 check_region_inline mm/kasan/generic.c:135 [inline]
 kasan_check_range+0x2b5/0x2f0 mm/kasan/generic.c:186
 instrument_atomic_read include/linux/instrumented.h:71 [inline]
 test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline]
 NInoAttr fs/ntfs/inode.h:200 [inline]
 ntfs_test_inode+0x7b/0x2d0 fs/ntfs/inode.c:55
 find_inode+0x10c/0x3e0 fs/inode.c:825
 ilookup5_nowait fs/inode.c:1335 [inline]
 ilookup5+0x9d/0x1f0 fs/inode.c:1364
 iget5_locked+0x30/0x3d0 fs/inode.c:1145
 ntfs_iget+0x73/0x130 fs/ntfs/inode.c:168
 load_and_check_logfile fs/ntfs/super.c:1208 [inline]
 load_system_files fs/ntfs/super.c:1941 [inline]
 ntfs_fill_super+0x58f2/0x88e0 fs/ntfs/super.c:2893
 mount_bdev+0x26c/0x3a0 fs/super.c:1367
 legacy_get_tree+0xea/0x180 fs/fs_context.c:592
 vfs_get_tree+0x86/0x270 fs/super.c:1497
 do_new_mount fs/namespace.c:2903 [inline]
 path_mount+0x188a/0x29a0 fs/namespace.c:3233
 do_mount fs/namespace.c:3246 [inline]
 __do_sys_mount fs/namespace.c:3454 [inline]
 __se_sys_mount+0x28c/0x320 fs/namespace.c:3431
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x46797a
Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f50a372bfa8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 000000000046797a
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f50a372c000
RBP: 00007f50a372c040 R08: 00007f50a372c040 R09: 0000000020000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000020000000
R13: 0000000020000100 R14: 00007f50a372c000 R15: 000000002007dc00

Allocated by task 11540:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:427 [inline]
 __kasan_slab_alloc+0x8f/0xc0 mm/kasan/common.c:460
 kasan_slab_alloc include/linux/kasan.h:223 [inline]
 slab_post_alloc_hook mm/slab.h:516 [inline]
 slab_alloc_node mm/slub.c:2907 [inline]
 slab_alloc mm/slub.c:2915 [inline]
 kmem_cache_alloc+0x1c3/0x350 mm/slub.c:2920
 reiserfs_alloc_inode+0x19/0xb0 fs/reiserfs/super.c:642
 alloc_inode fs/inode.c:234 [inline]
 new_inode_pseudo+0x61/0x220 fs/inode.c:928
 new_inode+0x25/0x1d0 fs/inode.c:957
 reiserfs_mkdir+0x129/0x800 fs/reiserfs/namei.c:812
 xattr_mkdir fs/reiserfs/xattr.c:76 [inline]
 create_privroot fs/reiserfs/xattr.c:889 [inline]
 reiserfs_xattr_init+0x34b/0x730 fs/reiserfs/xattr.c:1012
 reiserfs_fill_super+0x2aac/0x3160 fs/reiserfs/super.c:2177
 mount_bdev+0x26c/0x3a0 fs/super.c:1367
 legacy_get_tree+0xea/0x180 fs/fs_context.c:592
 vfs_get_tree+0x86/0x270 fs/super.c:1497
 do_new_mount fs/namespace.c:2903 [inline]
 path_mount+0x188a/0x29a0 fs/namespace.c:3233
 do_mount fs/namespace.c:3246 [inline]
 __do_sys_mount fs/namespace.c:3454 [inline]
 __se_sys_mount+0x28c/0x320 fs/namespace.c:3431
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Last potentially related work creation:
 kasan_save_stack+0x27/0x50 mm/kasan/common.c:38
 kasan_record_aux_stack+0xee/0x120 mm/kasan/generic.c:345
 __call_rcu kernel/rcu/tree.c:3039 [inline]
 call_rcu+0x130/0x8e0 kernel/rcu/tree.c:3114
 reiserfs_new_inode+0x690/0x2660 fs/reiserfs/inode.c:2164
 reiserfs_mkdir+0x4a0/0x800 fs/reiserfs/namei.c:842
 xattr_mkdir fs/reiserfs/xattr.c:76 [inline]
 create_privroot fs/reiserfs/xattr.c:889 [inline]
 reiserfs_xattr_init+0x34b/0x730 fs/reiserfs/xattr.c:1012
 reiserfs_fill_super+0x2aac/0x3160 fs/reiserfs/super.c:2177
 mount_bdev+0x26c/0x3a0 fs/super.c:1367
 legacy_get_tree+0xea/0x180 fs/fs_context.c:592
 vfs_get_tree+0x86/0x270 fs/super.c:1497
 do_new_mount fs/namespace.c:2903 [inline]
 path_mount+0x188a/0x29a0 fs/namespace.c:3233
 do_mount fs/namespace.c:3246 [inline]
 __do_sys_mount fs/namespace.c:3454 [inline]
 __se_sys_mount+0x28c/0x320 fs/namespace.c:3431
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae

The buggy address belongs to the object at ffff888097478c20
 which belongs to the cache reiser_inode_cache of size 1424
The buggy address is located 1232 bytes inside of
 1424-byte region [ffff888097478c20, ffff8880974791b0)
The buggy address belongs to the page:
page:ffffea00025d1e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888097479840 pfn:0x97478
head:ffffea00025d1e00 order:3 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head)
raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888018116500
raw: ffff888097479840 0000000080150014 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888097478f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888097479000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888097479080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                             ^
 ffff888097479100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888097479180: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
==================================================================

Crashes (285):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Manager Title
2021/04/17 10:24 upstream 9cdbf6467424 7e2b734b .config console log report info ci-upstream-kasan-gce-smack-root KASAN: use-after-free Read in ntfs_test_inode
2023/05/09 12:52 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 14f8db1c0f9a 30aa2a7e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: use-after-free Read in ntfs_test_inode
2023/03/30 04:58 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 59caa87f9dfb f325deb0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: use-after-free Read in ntfs_test_inode
2023/05/28 23:15 upstream 416839029e38 cf184559 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ntfs_test_inode
2023/05/10 06:53 upstream 16a8829130ca 1964022b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ntfs_test_inode
2023/05/06 23:03 upstream 2e1e1337881b 90c93c40 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ntfs_test_inode
2023/05/02 06:49 upstream c8c655c34e33 62df2017 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ntfs_test_inode
2023/04/23 13:40 upstream 622322f53c6d 2b32bd34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ntfs_test_inode
2023/04/21 12:42 upstream 2af3e53a4dc0 2b32bd34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ntfs_test_inode
2023/04/14 19:09 upstream 95abc817ab3a ec410564 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ntfs_test_inode
2023/04/08 20:40 upstream a79d5c76f705 71147e29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ntfs_test_inode
2023/04/08 09:42 upstream aa318c48808c 71147e29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ntfs_test_inode
2023/04/05 15:10 upstream 76f598ba7d8e 8b834965 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ntfs_test_inode
2023/04/01 01:39 upstream 5a57b48fdfcb f325deb0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ntfs_test_inode
2023/03/31 09:04 upstream 62bad54b26db f325deb0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-out-of-bounds Read in ntfs_test_inode
2023/03/31 05:21 upstream 8bb95a1662f8 f325deb0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ntfs_test_inode
2023/03/31 03:59 upstream 8bb95a1662f8 f325deb0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ntfs_test_inode
2023/03/30 17:41 upstream ffe78bbd5121 f325deb0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ntfs_test_inode
2023/03/27 07:55 upstream 18940c888c85 fbf0499a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ntfs_test_inode
2023/03/26 12:44 upstream da8e7da11e4b fbf0499a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-out-of-bounds Read in ntfs_test_inode
2023/03/26 06:19 upstream da8e7da11e4b fbf0499a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ntfs_test_inode
2023/03/25 17:53 upstream 65aca32efdcb fbf0499a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ntfs_test_inode
2023/03/24 16:50 upstream 1e760fa3596e 9700afae .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in ntfs_test_inode
2023/03/23 23:20 upstream 9fd6ba5420ba f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in ntfs_test_inode
2023/03/22 23:16 upstream fff5a5e7f528 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ntfs_test_inode
2023/03/22 06:50 upstream 2faac9a98f01 8b4eb097 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-out-of-bounds Read in ntfs_test_inode
2023/03/20 09:57 upstream e8d018dd0257 7939252e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-use-after-free Read in ntfs_test_inode
2023/03/19 11:09 upstream a3671bd86a97 7939252e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ntfs_test_inode
2023/03/18 02:46 upstream 38e04b3e4240 7939252e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ntfs_test_inode
2023/03/17 08:03 upstream 0ddc84d2dd43 18b58603 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ntfs_test_inode
2023/03/16 20:23 upstream 0ddc84d2dd43 18b58603 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ntfs_test_inode
2023/03/16 12:11 upstream 9c1bec9c0b08 18b58603 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ntfs_test_inode
2023/03/14 09:16 upstream fc89d7fb499b 0d5c4377 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ntfs_test_inode
2023/03/13 15:33 upstream eeac8ede1755 026e2200 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-out-of-bounds Read in ntfs_test_inode
2023/03/05 22:21 upstream f915322fe014 f8902b57 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-use-after-free Read in ntfs_test_inode
2023/03/05 12:08 upstream b01fe98d34f3 f8902b57 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ntfs_test_inode
2023/03/05 06:33 upstream b01fe98d34f3 f8902b57 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-out-of-bounds Read in ntfs_test_inode
2023/03/03 20:50 upstream 2eb29d59ddf0 f8902b57 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-out-of-bounds Read in ntfs_test_inode
2023/03/03 07:32 upstream 04a357b1f6f0 f8902b57 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-out-of-bounds Read in ntfs_test_inode
2022/10/12 18:16 upstream 55be6084c8e0 89b5a509 .config console log report info [disk image] [vmlinux] ci-upstream-kasan-gce-selinux-root KASAN: slab-out-of-bounds Read in ntfs_test_inode
2023/04/01 08:13 linux-next 4b0f4525dc4f f325deb0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-out-of-bounds Read in ntfs_test_inode
2023/03/19 02:27 linux-next 6f08c1de13a9 7939252e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-use-after-free Read in ntfs_test_inode
2023/04/28 16:09 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 14f8db1c0f9a 457a6e0a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-out-of-bounds Read in ntfs_test_inode
2023/04/26 15:31 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 14f8db1c0f9a 19a3dabe .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in ntfs_test_inode
2023/04/22 15:27 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 14f8db1c0f9a 2b32bd34 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in ntfs_test_inode
2023/04/21 04:03 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 14f8db1c0f9a 2b32bd34 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-out-of-bounds Read in ntfs_test_inode
2023/04/18 23:07 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 327bf9bb94cf d931e9f0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in ntfs_test_inode
2023/04/16 12:22 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 1f5b16c51aef ec410564 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in ntfs_test_inode
2023/04/13 03:44 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 7920df21c1b7 82d5e53e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in ntfs_test_inode
2023/04/07 16:43 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 9a03cbd79d3a f7ba566d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-out-of-bounds Read in ntfs_test_inode
2023/04/07 04:15 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 9a03cbd79d3a 00ce4c67 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-out-of-bounds Read in ntfs_test_inode
2023/04/04 23:20 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 59caa87f9dfb 831373d3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in ntfs_test_inode
2023/03/09 10:05 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci fe15c26ee26e f08b59ac .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in ntfs_test_inode
2023/03/03 09:41 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 596b6b709632 f8902b57 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-out-of-bounds Read in ntfs_test_inode
2022/09/10 09:17 https://github.com/google/kmsan.git master 4367d178d9eb 356d8217 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in ntfs_test_inode
2022/07/21 00:18 https://github.com/google/kmsan.git master 97117d69c353 88cb1383 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in ntfs_test_inode
* Struck through repros no longer work on HEAD.