syzbot

 sign-in | mailing list | source | docs
🐞 Open [541] 🐞 Fixed [32] 🐞 Invalid [295] ⬇ Missing Backports [44] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

BUG: unable to handle kernel NULL pointer dereference in indx_find

Status: upstream: reported C repro on 2023/03/15 06:28
Bug presence: origin:lts-only
[Documentation on labels]
Reported-by: syzbot+27cafb45e85fbef7c95a@syzkaller.appspotmail.com
First crash: 406d, last: 341d
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Bug presence (2)
Date Name Commit Repro Result
2023/05/09 linux-5.15.y (ToT) 8a7f2a5c5aa1 C [report] BUG: unable to handle kernel NULL pointer dereference in indx_find
2023/05/09 upstream (ToT) ba0ad6ed89fd C Didn't crash
▶ ▼ Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 BUG: unable to handle kernel NULL pointer dereference in indx_find origin:lts-only C done 3 286d 406d 3/3 fixed on 2023/09/27 12:10
upstream BUG: unable to handle kernel NULL pointer dereference in indx_find ntfs3 3 367d 379d 0/26 auto-obsoleted due to no activity on 2023/08/21 21:54
▶ ▼ Fix bisection attempts (5)
Created Duration User Patch Repo Result
2024/03/22 16:52 0m fix candidate upstream error job log (0)
2024/01/04 13:21 0m fix candidate upstream error job log (0)
2023/12/04 15:57 1m fix candidate upstream error job log (0)
2023/06/19 06:40 0m bisect fix linux-5.15.y error job log (0)
2023/04/22 02:07 52m bisect fix linux-5.15.y job log (0) log

Sample crash report:
loop0: detected capacity change from 0 to 4096
ntfs3: loop0: Different NTFS' sector size (4096) and media sector size (512)
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
  ESR = 0x0000000086000006
  EC = 0x21: IABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x06: level 2 translation fault
user pgtable: 4k pages, 48-bit VAs, pgdp=000000010dbe1000
[0000000000000000] pgd=080000010c3d2003, p4d=080000010c3d2003, pud=080000010cb51003, pmd=0000000000000000
Internal error: Oops: 86000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 4141 Comm: syz-executor342 Not tainted 5.15.103-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : 0x0
lr : hdr_find_e+0x298/0x4e8 fs/ntfs3/index.c:708
sp : ffff80001ccb72e0
x29: ffff80001ccb74c0 x28: 0000000000000000 x27: ffff0000dae18000
x26: 0000000000000000 x25: 0000000000000148 x24: 0000000000000000
x23: dfff800000000000 x22: 0000000000000002 x21: 0000000000000138
x20: ffff0000d0920278 x19: 0000000000000003 x18: 0000000000000000
x17: ff808000095ed72c x16: ffff80000824ff34 x15: ffff800008a0cdb0
x14: ffff800008a096d4 x13: ffffffffffffffff x12: 0000000000000000
x11: ff808000095dca08 x10: 0000000000000000 x9 : 0000000000000003
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000000040 x4 : ffff0000dae18000 x3 : 0000000000000000
x2 : ffff0000d0920288 x1 : 0000000000000000 x0 : ffff800011e41040
Call trace:
 0x0
 indx_find+0x2b4/0x9d4 fs/ntfs3/index.c:1077
 dir_search_u+0x180/0x324 fs/ntfs3/dir.c:254
 ntfs_extend_init+0x174/0x45c fs/ntfs3/fsntfs.c:214
 ntfs_fill_super+0x30dc/0x33ec fs/ntfs3/super.c:1238
 get_tree_bdev+0x360/0x54c fs/super.c:1294
 ntfs_fs_get_tree+0x28/0x38 fs/ntfs3/super.c:1354
 vfs_get_tree+0x90/0x274 fs/super.c:1499
 do_new_mount+0x25c/0x8c8 fs/namespace.c:2994
 path_mount+0x590/0x104c fs/namespace.c:3324
 do_mount fs/namespace.c:3337 [inline]
 __do_sys_mount fs/namespace.c:3545 [inline]
 __se_sys_mount fs/namespace.c:3522 [inline]
 __arm64_sys_mount+0x510/0x5e0 fs/namespace.c:3522
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Code: bad PC value
---[ end trace ea59b7d9fbe0c490 ]---

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/03/22 12:40 linux-5.15.y 8020ae3c051d 8b4eb097 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in indx_find
2023/03/15 06:46 linux-5.15.y 2ddbd0f967b3 0d5c4377 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in indx_find
2023/05/19 20:18 linux-5.15.y 9d6bde853685 96689200 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in indx_find
2023/05/17 14:09 linux-5.15.y 9d6bde853685 eaac4681 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in indx_find
2023/03/15 06:28 linux-5.15.y 2ddbd0f967b3 0d5c4377 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in indx_find
* Struck through repros no longer work on HEAD.