syzbot

 sign-in | mailing list | source | docs
🐞 Open [968] ≡ Subsystems 🐞 Fixed [4559] 🐞 Invalid [10508] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

UBSAN: shift-out-of-bounds in ntfs_fill_super

Status: fixed on 2023/02/24 13:50
Labels: ntfs3 (incorrect?)
Reported-by: syzbot+1631f09646bc214d2e76@syzkaller.appspotmail.com
Fix commit: a3b774342fa7 fs/ntfs3: validate BOOT sectors_per_clusters
First crash: 407d, last: 97d

Cause bisection: introduced by (bisect log) :
commit adf9ea89c719c1d23794e363f631e376b3ff8cbc
Author: Chao Yu <chao@kernel.org>
Date: Thu Aug 26 02:03:15 2021 +0000

  f2fs: fix unexpected ENOENT comes from f2fs_map_blocks()

Crash: BUG: sleeping function called from invalid context in lock_sock_nested (log)
Repro: C syz .config
▶ ▼ Discussions (8)
Title Replies (including bot) Last reply
[PATCH] fs/ntfs3: fix negative shift size in true_sectors_per_clst() 13 (13) 2022/09/30 16:34
[PATCH 5.18 00/67] 5.18.2-rc1 review 75 (75) 2022/06/05 07:38
[PATCH 5.15 00/66] 5.15.45-rc1 review 73 (73) 2022/06/05 04:15
[PATCH 5.17 00/75] 5.17.13-rc1 review 82 (82) 2022/06/04 19:32
[PATCH v3] fs/ntfs3: validate BOOT sectors_per_clusters 2 (2) 2022/05/03 05:52
[PATCH v2] fs/ntfs3: validate BOOT sectors_per_clusters 3 (3) 2022/04/30 02:40
[PATCH] fs/ntfs3: validate BOOT sectors_per_clusters 6 (6) 2022/04/29 19:16
[syzbot] UBSAN: shift-out-of-bounds in ntfs_fill_super 0 (3) 2022/04/21 12:29
▶ ▼ Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream UBSAN: shift-out-of-bounds in ntfs_fill_super (2) ntfs3 C error 2751 6m 93d 0/24 upstream: reported C repro on 2023/02/28 14:19
linux-5.15 UBSAN: shift-out-of-bounds in ntfs_fill_super origin:upstream C 294 3h57m 86d 0/3 upstream: reported C repro on 2023/03/08 09:55
linux-6.1 UBSAN: shift-out-of-bounds in ntfs_fill_super origin:upstream C 320 6h38m 83d 0/3 upstream: reported C repro on 2023/03/10 12:52
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2022/09/20 15:14 16m penguin-kernel@i-love.sakura.ne.jp patch upstream OK log

Sample crash report:
loop0: detected capacity change from 0 to 4096
================================================================================
UBSAN: shift-out-of-bounds in fs/ntfs3/super.c:736:25
shift exponent 128 is too large for 32-bit type 'unsigned int'
CPU: 1 PID: 5068 Comm: syz-executor137 Not tainted 6.1.0-syzkaller-13031-g77856d911a8c #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106
 ubsan_epilogue lib/ubsan.c:151 [inline]
 __ubsan_handle_shift_out_of_bounds+0x33d/0x3a0 lib/ubsan.c:321
 ntfs_init_from_boot fs/ntfs3/super.c:736 [inline]
 ntfs_fill_super+0x26ea/0x4370 fs/ntfs3/super.c:935
 get_tree_bdev+0x400/0x620 fs/super.c:1282
 vfs_get_tree+0x88/0x270 fs/super.c:1489
 do_new_mount+0x289/0xad0 fs/namespace.c:3145
 do_mount fs/namespace.c:3488 [inline]
 __do_sys_mount fs/namespace.c:3697 [inline]
 __se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3674
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fc55a7ecada
Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdacca93f8 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc55a7ecada
RDX: 000000002001f180 RSI: 000000002001f1c0 RDI: 00007ffdacca9410
RBP: 00007ffdacca9410 R08: 00007ffdacca9450 R09: 000000000001f191
R10: 000000000000000e R11: 0000000000000286 R12: 0000000000000004
R13: 00005555562df2c0 R14: 000000000000000e R15: 00007ffdacca9450
 </TASK>
================================================================================

Crashes (3643):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Manager Title
2022/12/17 20:54 upstream 77856d911a8c 05494336 .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs UBSAN: shift-out-of-bounds in ntfs_fill_super
2022/10/08 18:36 upstream e8bc52cb8df8 aea5da89 .config strace log report syz C [disk image] [vmlinux] [mounted in repro] ci-upstream-kasan-gce-root UBSAN: shift-out-of-bounds in ntfs_fill_super
2022/10/03 04:16 upstream a962b54e162c feb56351 .config strace log report syz C [disk image] [vmlinux] ci2-upstream-fs UBSAN: shift-out-of-bounds in ntfs_fill_super
2022/09/24 16:59 upstream bf682942cd26 0042f2b4 .config strace log report syz C [disk image] [vmlinux] ci2-upstream-fs UBSAN: shift-out-of-bounds in ntfs_fill_super
2022/09/24 16:52 upstream a63f2e7cb110 0042f2b4 .config strace log report syz C ci-upstream-kasan-gce-root UBSAN: shift-out-of-bounds in ntfs_fill_super
2022/08/27 10:06 upstream 3e5c673f0d75 07177916 .config strace log report syz C ci-upstream-kasan-gce-root UBSAN: shift-out-of-bounds in ntfs_fill_super
2022/04/21 08:37 upstream b253435746d9 d4befee1 .config console log report syz C ci-upstream-kasan-gce-root UBSAN: shift-out-of-bounds in ntfs_fill_super
2022/11/04 05:47 linux-next 81214a573d19 6d752409 .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-linux-next-kasan-gce-root UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/24 10:31 upstream d2980d8d8265 9e2ebb3c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/24 05:06 upstream a5c95ca18a98 9e2ebb3c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/23 14:49 upstream 307e14c03906 9e2ebb3c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/23 12:39 upstream 307e14c03906 9e2ebb3c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/23 07:20 upstream 307e14c03906 9f1e2cb3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/23 02:43 upstream 5b7c4cabbb65 9f1e2cb3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/22 21:23 upstream 5b7c4cabbb65 9f1e2cb3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/22 16:50 upstream 5b7c4cabbb65 9f1e2cb3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/22 09:02 upstream 9e58df973d22 42a4d508 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/22 05:23 upstream 4a7d37e824f5 42a4d508 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/22 04:16 upstream 4a7d37e824f5 42a4d508 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/22 02:39 upstream 9e58df973d22 42a4d508 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/21 23:51 upstream 9e58df973d22 42a4d508 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/21 18:02 upstream 89f5349e0673 f949448d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/21 15:03 upstream 89f5349e0673 f949448d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/21 13:48 upstream 89f5349e0673 f949448d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/21 12:46 upstream 89f5349e0673 f949448d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/21 09:50 upstream 89f5349e0673 f949448d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/21 05:19 upstream 91bc559d8d3a 2414209c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/21 01:35 upstream 91bc559d8d3a 4f5f5209 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/20 23:59 upstream 91bc559d8d3a 2414209c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/20 15:49 upstream c9c3395d5e3d 4f5f5209 .config console log report info ci-qemu-upstream UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/20 14:10 upstream c9c3395d5e3d bcdf85f8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/20 11:07 upstream c9c3395d5e3d bcdf85f8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/20 09:17 upstream c9c3395d5e3d bcdf85f8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/20 03:30 upstream c9c3395d5e3d bcdf85f8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/20 01:32 upstream 925cf0457d7e bcdf85f8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: shift-out-of-bounds in ntfs_fill_super
2022/04/21 03:36 upstream b253435746d9 d4befee1 .config console log report info ci-upstream-kasan-gce-root UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/21 20:15 upstream 89f5349e0673 ec0a9fe9 .config console log report info ci-qemu-upstream-386 UBSAN: shift-out-of-bounds in ntfs_fill_super
2022/04/21 00:51 upstream b253435746d9 d4befee1 .config console log report info ci-qemu-upstream-386 UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/22 22:39 linux-next aaf70d5ad5e2 409945bc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/22 20:12 linux-next aaf70d5ad5e2 409945bc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/21 16:49 linux-next 465461cf4846 f949448d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/24 13:01 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a9b06ec42c0f 9e2ebb3c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/24 11:44 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a9b06ec42c0f 9e2ebb3c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/24 08:49 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a9b06ec42c0f 9e2ebb3c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/24 07:26 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a9b06ec42c0f 9e2ebb3c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/24 03:33 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a9b06ec42c0f 9e2ebb3c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/24 02:16 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a9b06ec42c0f 9e2ebb3c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/23 22:45 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a9b06ec42c0f 9e2ebb3c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/23 21:44 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a9b06ec42c0f 9e2ebb3c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/23 20:29 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a9b06ec42c0f 9e2ebb3c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/23 13:48 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a9b06ec42c0f 9e2ebb3c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/23 06:18 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a9b06ec42c0f 9e2ebb3c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/23 05:03 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a9b06ec42c0f 9e2ebb3c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/22 17:58 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a9b06ec42c0f 409945bc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/22 15:08 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a9b06ec42c0f 409945bc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/22 13:47 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a9b06ec42c0f 409945bc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/22 00:57 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a9b06ec42c0f 42a4d508 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/21 22:44 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a9b06ec42c0f 42a4d508 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/21 21:25 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a9b06ec42c0f 42a4d508 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: shift-out-of-bounds in ntfs_fill_super
2023/02/21 18:03 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a9b06ec42c0f f949448d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: shift-out-of-bounds in ntfs_fill_super
* Struck through repros no longer work on HEAD.