syzbot

 sign-in | mailing list | source | docs
🐞 Open [570] 🐞 Fixed [32] 🐞 Invalid [301] ⬇ Missing Backports [45] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KASAN: use-after-free Write in ntfs_perform_write

Status: upstream: reported C repro on 2023/12/29 14:37
Bug presence: origin:upstream
Labels: missing-backport
[Documentation on labels]
Reported-by: syzbot+5117b878bc7786997c06@syzkaller.appspotmail.com
First crash: 129d, last: 33d
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Bug presence (3)
Date Name Commit Repro Result
2024/04/03 linux-5.15.y (ToT) 9465fef4ae35 C [report] KASAN: use-after-free Write in ntfs_perform_write
2024/01/04 upstream (ToT) ac865f00af29 C [report] KASAN: use-after-free Write in ntfs_perform_write
2024/04/03 upstream (ToT) 3e92c1e6cd87 C Didn't crash
▶ ▼ Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: use-after-free Write in ntfs_perform_write ntfs3 C 2 109d 118d 0/26 auto-obsoleted due to no activity on 2024/04/27 16:18
linux-6.1 KASAN: use-after-free Write in ntfs_perform_write origin:upstream missing-backport C inconclusive 8 5d13h 126d 0/3 upstream: reported C repro on 2024/01/01 16:19

Sample crash report:
ntfs: (device loop0): parse_options(): Option utf8 is no longer supported, using option nls=utf8. Please use option nls=utf8 in the future and make sure utf8 is compiled either as a module or into the kernel.
ntfs: volume version 3.1.
==================================================================
BUG: KASAN: use-after-free in ntfs_commit_pages_after_write fs/ntfs/file.c:1608 [inline]
BUG: KASAN: use-after-free in ntfs_perform_write+0x4110/0x66b8 fs/ntfs/file.c:1864
Write of size 1 at addr ffff0000dd20e170 by task syz-executor159/3968

CPU: 0 PID: 3968 Comm: syz-executor159 Not tainted 5.15.145-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
Call trace:
 dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
 print_address_description+0x7c/0x3f0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:434 [inline]
 kasan_report+0x174/0x1e4 mm/kasan/report.c:451
 kasan_check_range+0x274/0x2b4 mm/kasan/generic.c:189
 memcpy+0xb4/0xe8 mm/kasan/shadow.c:66
 ntfs_commit_pages_after_write fs/ntfs/file.c:1608 [inline]
 ntfs_perform_write+0x4110/0x66b8 fs/ntfs/file.c:1864
 ntfs_file_write_iter+0xfa4/0x170c fs/ntfs/file.c:1921
 call_write_iter include/linux/fs.h:2146 [inline]
 new_sync_write fs/read_write.c:507 [inline]
 vfs_write+0x87c/0xb3c fs/read_write.c:594
 ksys_write+0x15c/0x26c fs/read_write.c:647
 __do_sys_write fs/read_write.c:659 [inline]
 __se_sys_write fs/read_write.c:656 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:656
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

The buggy address belongs to the page:
page:000000008231391d refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x11d20e
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000000 fffffc00037483c8 fffffc0003748348 0000000000000000
raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000dd20e000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff0000dd20e080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff0000dd20e100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                             ^
 ffff0000dd20e180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff0000dd20e200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

Crashes (44):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/01/04 05:42 linux-5.15.y d93fa2c78854 28c42cff .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/02/14 21:19 linux-5.15.y 6139f2a02fe0 d9b1cdd5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/02/14 18:23 linux-5.15.y 6139f2a02fe0 d9b1cdd5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/02/14 07:28 linux-5.15.y 6139f2a02fe0 d902085f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/02/13 20:01 linux-5.15.y 6139f2a02fe0 e66542d7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/02/13 14:19 linux-5.15.y 6139f2a02fe0 e66542d7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/02/08 18:01 linux-5.15.y 6139f2a02fe0 7f07e9b0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/02/06 04:06 linux-5.15.y 6139f2a02fe0 6404acf9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/02/05 15:26 linux-5.15.y 6139f2a02fe0 e23e8c20 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/02/02 20:26 linux-5.15.y 6139f2a02fe0 60bf9982 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/02/02 18:42 linux-5.15.y 6139f2a02fe0 60bf9982 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/02/02 05:13 linux-5.15.y 6139f2a02fe0 d61103fc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/02/01 17:01 linux-5.15.y 6139f2a02fe0 81024119 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/02/01 11:34 linux-5.15.y 6139f2a02fe0 81024119 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/31 15:14 linux-5.15.y 6139f2a02fe0 373b66cd .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/30 18:55 linux-5.15.y 6139f2a02fe0 7f400fcb .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/29 14:49 linux-5.15.y 6139f2a02fe0 991a98f4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/24 17:45 linux-5.15.y ddcaf4999061 1e153dc8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/24 14:29 linux-5.15.y ddcaf4999061 1e153dc8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/23 21:00 linux-5.15.y ddcaf4999061 1e153dc8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/22 20:09 linux-5.15.y ddcaf4999061 9bd8dcda .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/22 12:10 linux-5.15.y ddcaf4999061 9bd8dcda .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/19 15:36 linux-5.15.y ddcaf4999061 9bd8dcda .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/19 01:01 linux-5.15.y ddcaf4999061 21772ce4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/18 17:08 linux-5.15.y ddcaf4999061 239abf84 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/18 12:10 linux-5.15.y ddcaf4999061 239abf84 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/18 02:58 linux-5.15.y ddcaf4999061 915053c7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/16 01:24 linux-5.15.y ddcaf4999061 2a7bcc7f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/15 22:01 linux-5.15.y ddcaf4999061 2a7bcc7f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/15 18:13 linux-5.15.y 26c690eff0a5 2a7bcc7f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/11 23:55 linux-5.15.y 26c690eff0a5 dda5a988 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/11 12:21 linux-5.15.y 26c690eff0a5 00f3cc59 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/11 09:50 linux-5.15.y 26c690eff0a5 00f3cc59 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/10 17:57 linux-5.15.y 26c690eff0a5 04815ef1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/10 00:57 linux-5.15.y 26c690eff0a5 b438bd66 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/09 18:51 linux-5.15.y 26c690eff0a5 4807fb37 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/09 00:08 linux-5.15.y 26c690eff0a5 4c0fd4bb .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/08 19:55 linux-5.15.y 26c690eff0a5 4c0fd4bb .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/06 02:30 linux-5.15.y 26c690eff0a5 d0304e9c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/05 22:37 linux-5.15.y 26c690eff0a5 28c42cff .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/05 15:49 linux-5.15.y 26c690eff0a5 28c42cff .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/04 01:35 linux-5.15.y d93fa2c78854 28c42cff .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2024/01/03 22:14 linux-5.15.y d93fa2c78854 28c42cff .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
2023/12/29 14:36 linux-5.15.y d93fa2c78854 fb427a07 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: use-after-free Write in ntfs_perform_write
* Struck through repros no longer work on HEAD.