Hello developers, We hit an issue in ntfs3 filesystem module. A kernel BUG is triggered when mounting an image. HEAD commit: 819837584309 6.12.0-rc5 git tree: upstream kernel config: https://drive.google.com/file/d/1-9pltE-1CMgGgNFu9o5l0BlCHk3Rnzb_/view?usp=sharing console output: https://drive.google.com/file/d/1GUSuByvrJVa5thyAHQv3lKR10KxBfvbJ/view?usp=sharing syz repro: https://drive.google.com/file/d/1w4p_RbxM1XEUb5M2hd-xRBqdcvPBTX6o/view?usp=sharing C reproducer: https://drive.google.com/file/d/1UuEETyVCfUxtrA9z6auBMeZPQoIMEk5s/view?usp=sharing Environment: Ubuntu 22.04 on Linux 5.15 QEMU emulator version 6.2.0 qemu-system-x86_64 \ -m 2G \ -smp 2 \ -kernel /home/wd/bzImage \ -append "console=ttyS0 root=/dev/sda earlyprintk=serial net.ifnames=0" \ -drive file=/home/wd/bullseye.img,format=raw \ -net user,host=10.0.2.10,hostfwd=tcp:127.0.0.1:10021-:22 \ -net nic,model=e1000 \ -enable-kvm \ -nographic \ -pidfile vm.pid \ 2>&1 | tee vm.log If you fix this issue, please add the following tag to the commit: Reported-by: Shihao Jiang<sh.jiang@xxxxxxxxxx> ====================================================== Syzkaller hit 'kernel BUG in zero_user_segments' bug. ------------[ cut here ]------------ kernel BUG at include/linux/highmem.h:275! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 UID: 0 PID: 9416 Comm: syz-executor911 Tainted: G W 6.12.0-rc5 #7 Tainted: [W]=WARN Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:zero_user_segments.constprop.0+0xd0/0x2c0 include/linux/highmem.h:275 Code: 89 ee e8 33 3b ba fe 85 ed 0f 85 3e 93 26 08 e8 f6 37 ba fe 4c 89 fe 4c 89 f7 e8 8b 3a ba fe 4d 39 fe 76 08 e8 e1 37 ba fe 90 <0f> 0b e8 d9 37 ba fe be 08 00 00 00 48 89 df e8 9c 39 1a ff 48 89 RSP: 0018:ffffc9000706f758 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffffea0000ad3140 RCX: ffffffff82d15845 RDX: ffff8880450f8000 RSI: ffffffff82d1584f RDI: 0000000000000006 RBP: 0000000000000000 R08: 0000000000000000 R09: fffff9400015a628 R10: 0000000000001000 R11: 1ffffffff1bb8469 R12: 000000000000100a R13: 000000000000000a R14: 000000000000100a R15: 0000000000001000 FS: 000055555af423c0(0000) GS:ffff88802b800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f26b7f068e8 CR3: 000000004bb72000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> folio_zero_range include/linux/highmem.h:647 [inline] ntfs_extend_initialized_size+0x349/0x6d0 fs/ntfs3/file.c:225 ntfs_extend+0x775/0xa10 fs/ntfs3/file.c:413 ntfs_file_write_iter+0x2d8/0x19c0 fs/ntfs3/file.c:1254 do_iter_readv_writev+0x51f/0x7e0 fs/read_write.c:834 vfs_writev+0x30e/0xd70 fs/read_write.c:1064 do_pwritev+0x1b7/0x270 fs/read_write.c:1165 __do_sys_pwritev2 fs/read_write.c:1224 [inline] __se_sys_pwritev2 fs/read_write.c:1215 [inline] __x64_sys_pwritev2+0xef/0x160 fs/read_write.c:1215 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcb/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd1babc4bfd Code: c3 e8 d7 21 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd6e0c8118 EFLAGS: 00000246 ORIG_RAX: 0000000000000148 RAX: ffffffffffffffda RBX: 00007ffd6e0c8328 RCX: 00007fd1babc4bfd RDX: 0000000000000001 RSI: 0000000020000240 RDI: 0000000000000004 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000009f0a R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd6e0c8318 R14: 00007fd1bac62530 R15: 0000000000000001 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:zero_user_segments.constprop.0+0xd0/0x2c0 include/linux/highmem.h:275 Code: 89 ee e8 33 3b ba fe 85 ed 0f 85 3e 93 26 08 e8 f6 37 ba fe 4c 89 fe 4c 89 f7 e8 8b 3a ba fe 4d 39 fe 76 08 e8 e1 37 ba fe 90 <0f> 0b e8 d9 37 ba fe be 08 00 00 00 48 89 df e8 9c 39 1a ff 48 89 RSP: 0018:ffffc9000706f758 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffffea0000ad3140 RCX: ffffffff82d15845 RDX: ffff8880450f8000 RSI: ffffffff82d1584f RDI: 0000000000000006 RBP: 0000000000000000 R08: 0000000000000000 R09: fffff9400015a628 R10: 0000000000001000 R11: 1ffffffff1bb8469 R12: 000000000000100a R13: 000000000000000a R14: 000000000000100a R15: 0000000000001000 FS: 000055555af423c0(0000) GS:ffff88802b800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f26b7ed0338 CR3: 000000004bb72000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ======================================================
