[syzbot] [ntfs?] UBSAN: shift-out-of-bounds in ntfs_iget
From: Manas Ghandat
Date: Sat Aug 05 2023 - 00:57:24 EST
In this bug, the logic at the following line
(https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/fs/ntfs/inode.c?id=e8f75c0270d930ef675fee22d74d1a3250e96962#n1067)
is getting skipped. The `if` condition is not triggered and thus the
compression issue occurs. I was trying to change the `if` conditions so
that the check occurs but was getting the following error. Can you
suggest any way so that the condition gets triggered.
Thanks,
Manas
Booting from ROM..
[ 0.000000][ T0] Linux version 6.4.0-01406-ge8f75c0270d9-dirty (manas@manas-VirtualBox) (gcc (Ubuntu 12.2.0-3ubuntu1) 12.2.0, GNU ld (GNU Binutils for Ubuntu) 2.39) #8 SMP PREEMPT_DYNAMIC Sat Aug 5 09:08:25 IST 2023
[ 0.000000][ T0] Command line: root=/dev/ram rw console=ttyS0 oops=panic panic=1 nokaslr quiet
[ 0.000000][ T0] KERNEL supported cpus:
[ 0.000000][ T0] Intel GenuineIntel
[ 0.000000][ T0] AMD AuthenticAMD
[ 0.000000][ T0] BIOS-provided physical RAM map:
[ 0.000000][ T0] BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable
[ 0.000000][ T0] BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved
[ 0.000000][ T0] BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved
[ 0.000000][ T0] BIOS-e820: [mem 0x0000000000100000-0x000000007ffdffff] usable
[ 0.000000][ T0] BIOS-e820: [mem 0x000000007ffe0000-0x000000007fffffff] reserved
[ 0.000000][ T0] BIOS-e820: [mem 0x00000000feffc000-0x00000000feffffff] reserved
[ 0.000000][ T0] BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved
[ 0.000000][ T0] printk: bootconsole [earlyser0] enabled
[ 0.000000][ T0] ERROR: earlyprintk= earlyser already used
[ 0.000000][ T0] ERROR: earlyprintk= earlyser already used
[ 0.000000][ T0] **********************************************************
[ 0.000000][ T0] ** NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE **
[ 0.000000][ T0] ** **
[ 0.000000][ T0] ** This system shows unhashed kernel memory addresses **
[ 0.000000][ T0] ** via the console, logs, and other interfaces. This **
[ 0.000000][ T0] ** might reduce the security of your system. **
[ 0.000000][ T0] ** **
[ 0.000000][ T0] ** If you see this message and you are not debugging **
[ 0.000000][ T0] ** the kernel, report this immediately to your system **
[ 0.000000][ T0] ** administrator! **
[ 0.000000][ T0] ** **
[ 0.000000][ T0] ** NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE **
[ 0.000000][ T0] **********************************************************
[ 0.000000][ T0] Malformed early option 'vsyscall'
[ 0.648434][ T0] Spectre V2 : Kernel not compiled with retpoline; no mitigation available!
[ 2.612422][ T1] kvm_intel: VMX not supported by CPU 0
[ 2.615720][ T1] kvm_amd: SVM not supported by CPU 0, can't execute cpuid_8000000a
[ 6.084339][ T1] db_root: cannot open: /etc/target
[ 8.756930][ T1] nf_conntrack_irc: failed to register helpers
[ 8.763863][ T1] nf_conntrack_sane: failed to register helpers
[ 8.877704][ T1] nf_conntrack_sip: failed to register helpers
[ 10.157682][ T1] exFAT-fs (ram0): invalid fs_name
[ 10.158805][ T1] exFAT-fs (ram0): failed to read boot sector
[ 10.159977][ T1] exFAT-fs (ram0): failed to recognize exfat type
[ 10.166836][ T1] VFS: could not find a valid V7 on ram0.
[ 10.170137][ T1] ntfs: (device ram0): ntfs_attr_find(): Inode is corrupt. Run chkdsk.
[ 10.171733][ T1] ntfs: (device ram0): ntfs_read_locked_inode(): Failed to lookup $DATA attribute.
[ 10.173439][ T1] ntfs: (device ram0): ntfs_read_locked_inode(): Failed with error code -5. Marking corrupt inode 0x1 as bad. Run chkdsk.
[ 10.175815][ T1] ntfs: (device ram0): load_system_files(): Failed to load $MFTMirr. Mounting read-only. Run ntfsfix and/or chkdsk.
[ 10.178684][ T1] ntfs: (device ram0): ntfs_mapping_pairs_decompress(): Missing length entry in mapping pairs array.
[ 10.180886][ T1] ntfs: (device ram0): ntfs_mapping_pairs_decompress(): Invalid length in mapping pairs array.
[ 10.182804][ T1] ntfs: (device ram0): ntfs_read_block(): Failed to read from inode 0xa, attribute type 0x80, vcn 0x0, offset 0x0 because its location on disk could not be determined even after retrying (error code -5).
[ 10.186410][ T1] ntfs: (device ram0): ntfs_mapping_pairs_decompress(): Missing length entry in mapping pairs array.
[ 10.188485][ T1] ntfs: (device ram0): ntfs_mapping_pairs_decompress(): Invalid length in mapping pairs array.
[ 10.190411][ T1] ntfs: (device ram0): ntfs_read_block(): Failed to read from inode 0xa, attribute type 0x80, vcn 0x0, offset 0x800 because its location on disk could not be determined even after retrying (error code -5).
[ 10.313465][ T1] Failed to set sysctl parameter 'max_rcu_stall_to_panic=1': parameter not found
[ 10.316218][ T1] Starting init: /sbin/init exists but couldn't execute it (error -5)
[ 10.318268][ T1] Starting init: /etc/init exists but couldn't execute it (error -5)
[ 10.320047][ T1] Starting init: /bin/init exists but couldn't execute it (error -5)
[ 10.321895][ T1] Starting init: /bin/sh exists but couldn't execute it (error -5)
[ 10.323410][ T1] Kernel panic - not syncing: No working init found. Try passing init= option to kernel. See Linux Documentation/admin-guide/init.rst for guidance.
[ 10.326181][ T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.4.0-01406-ge8f75c0270d9-dirty #8
[ 10.327781][ T1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-4 04/01/2014
[ 10.327781][ T1] Call Trace:
[ 10.327781][ T1] <TASK>
[ 10.327781][ T1] dump_stack_lvl+0xd9/0x1b0
[ 10.327781][ T1] panic+0x6a4/0x750
[ 10.327781][ T1] ? panic_smp_self_stop+0xa0/0xa0
[ 10.327781][ T1] ? putname+0x101/0x140
[ 10.327781][ T1] ? kernel_init+0x265/0x2a0
[ 10.327781][ T1] kernel_init+0x276/0x2a0
[ 10.327781][ T1] ? rest_init+0x2b0/0x2b0
[ 10.327781][ T1] ret_from_fork+0x1f/0x30
[ 10.327781][ T1] </TASK>
[ 10.327781][ T1] Kernel Offset: disabled
[ 10.327781][ T1] Rebooting in 1 seconds..