syzbot

 sign-in | mailing list | source | docs
🐞 Open [677]
🐞 Fixed [94]
🐞 Invalid [519]
⬇ Missing Backports [36]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

BUG: unable to handle kernel NULL pointer dereference in indx_find

Status: fixed on 2023/09/27 12:10
Bug presence: origin:lts-only
[Documentation on labels]
Reported-by: syzbot+fb47583aa23a75ceb904@syzkaller.appspotmail.com
Fix commit: 000a9a72efa4 fs/ntfs3: Check fields while reading
First crash: 619d, last: 498d
Fix bisection: fixed by (bisect log) :
commit 000a9a72efa4a9df289bab9c9e8ba1639c72e0d6
Author: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Date: Mon Oct 10 10:15:33 2022 +0000

  fs/ntfs3: Check fields while reading

  
▶ ▼ Bug presence (2)
Date Name Commit Repro Result
2023/05/08 linux-6.1.y (ToT) ca48fc16c493 C [report] BUG: unable to handle kernel NULL pointer dereference in indx_find
2023/05/08 upstream (ToT) ac9a78681b92 C Didn't crash
▶ ▼ Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: unable to handle kernel NULL pointer dereference in indx_find ntfs3 3 579d 592d 0/28 auto-obsoleted due to no activity on 2023/08/21 21:54
linux-5.15 BUG: unable to handle kernel NULL pointer dereference in indx_find origin:lts-only C error 5 553d 619d 0/3 auto-obsoleted due to no activity on 2024/10/04 03:43
▶ ▼ Fix bisection attempts (3)
Created Duration User Patch Repo Result
2023/09/23 08:01 5h19m bisect fix linux-6.1.y OK (1) job log
2023/07/13 12:40 3h38m bisect fix linux-6.1.y OK (0) job log log
2023/06/07 21:04 1h00m bisect fix linux-6.1.y OK (0) job log log

Sample crash report:
loop0: detected capacity change from 0 to 4096
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
  ESR = 0x0000000086000006
  EC = 0x21: IABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x06: level 2 translation fault
user pgtable: 4k pages, 48-bit VAs, pgdp=000000010d655000
[0000000000000000] pgd=080000010ae6d003, p4d=080000010ae6d003, pud=0800000109d5a003, pmd=0000000000000000
Internal error: Oops: 0000000086000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4380 Comm: syz-executor357 Not tainted 6.1.19-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : 0x0
lr : hdr_find_e+0x298/0x4e8 fs/ntfs3/index.c:708
sp : ffff80001db27320
x29: ffff80001db27500 x28: 0000000000000000 x27: ffff0000d012e000
x26: 0000000000000000 x25: 0000000000000148 x24: 0000000000000000
x23: dfff800000000000 x22: 0000000000000002 x21: 0000000000000138
x20: ffff0000d81fa268 x19: 0000000000000003 x18: 1fffe000368b0376
x17: ffff80001572d000 x16: ffff8000121a2680 x15: ffff800008ad6924
x14: ffff800008ad36c8 x13: 0000000000000000 x12: 0000000000000004
x11: ff808000096f6f70 x10: 0000000000000000 x9 : 0000000000000003
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000000040 x4 : ffff0000d012e000 x3 : 0000000000000000
x2 : ffff0000d81fa278 x1 : 0000000000000000 x0 : ffff8000126b3260
Call trace:
 0x0
 indx_find+0x2b0/0x9b8 fs/ntfs3/index.c:1074
 dir_search_u+0x180/0x324 fs/ntfs3/dir.c:254
 ntfs_extend_init+0x174/0x45c fs/ntfs3/fsntfs.c:214
 ntfs_fill_super+0x36e8/0x3a04 fs/ntfs3/super.c:1243
 get_tree_bdev+0x360/0x54c fs/super.c:1337
 ntfs_fs_get_tree+0x28/0x38 fs/ntfs3/super.c:1359
 vfs_get_tree+0x90/0x274 fs/super.c:1544
 do_new_mount+0x25c/0x8c8 fs/namespace.c:3040
 path_mount+0x590/0xe58 fs/namespace.c:3370
 do_mount fs/namespace.c:3383 [inline]
 __do_sys_mount fs/namespace.c:3591 [inline]
 __se_sys_mount fs/namespace.c:3568 [inline]
 __arm64_sys_mount+0x45c/0x594 fs/namespace.c:3568
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
Code: bad PC value
---[ end trace 0000000000000000 ]---

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/03/15 07:07 linux-6.1.y 6449a0ba6843 0d5c4377 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in indx_find
2023/03/22 12:26 linux-6.1.y 7eaef76fbc46 8b4eb097 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in indx_find
2023/04/15 06:29 linux-6.1.y 0102425ac76b ec410564 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in indx_find
* Struck through repros no longer work on HEAD.