Hi,

please backport commit fc4992458e0a ("fs/ntfs3: Add null pointer checks") to the 5.15 and 6.1 stable branches.

Commit message

""" Added null pointer checks in function ntfs_security_init. Also added le32_to_cpu in functions ntfs_security_init and indx_read. """

We are able to reproduce below Syzkaller report on these two stable builds. The issue does not reproduce on upstream, older, or newer LTS releases. Above patch fixes the issue.

Best regards, Bjoern

general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 PID: 11283 Comm: syz-executor.7 Not tainted 6.1.74 #31 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-5 04/01/2014 RIP: 0010:ntfs_security_init+0x561/0xac0 fs/ntfs3/fsntfs.c:1865 Code: 03 ff 41 83 fe 1f 0f 86 f8 03 00 00 e8 b8 5b 03 ff 4c 01 e3 e8 b0 5b 03 ff 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 ca RSP: 0018:ffffc90012417a60 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc90007b0c000 RDX: 0000000000000000 RSI: ffffffff827961c0 RDI: 0000000000000005 RBP: ffff888024503000 R08: 0000000000000005 R09: 000000000000001f R10: 0000000000000000 R11: 00000000a5aa35ff R12: ffff888020543230 R13: ffff8880182f05d0 R14: 0000000000000000 R15: 00000000000000c8 FS:  00007f6bb914d6c0(0000) GS:ffff88805ab00000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7ab932ff80 CR3: 00000000553ee001 CR4: 0000000000772ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace:  <TASK> loop6: detected capacity change from 0 to 4096 ntfs3: Unknown parameter 'iE9�ND\���X8+dԧ�*��'  ntfs_fill_super+0x1faf/0x22c0 fs/ntfs3/super.c:1238  get_tree_bdev+0x40a/0x700 fs/super.c:1355  vfs_get_tree+0x86/0x2e0 fs/super.c:1562  do_new_mount+0x2d5/0x630 fs/namespace.c:3040  path_mount+0x4c4/0x17e0 fs/namespace.c:3370  do_mount fs/namespace.c:3383 [inline]  __do_sys_mount fs/namespace.c:3591 [inline]  __se_sys_mount fs/namespace.c:3568 [inline]  __x64_sys_mount+0x287/0x310 fs/namespace.c:3568  do_syscall_x64 arch/x86/entry/common.c:51 [inline]  do_syscall_64+0x37/0x90 arch/x86/entry/common.c:81  entry_SYSCALL_64_after_hwframe+0x64/0xce RIP: 0033:0x7f6bb846377e Code: 0f 1f 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f6bb914cec8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f6bb914cf60 RCX: 00007f6bb846377e RDX: 000000002001f6c0 RSI: 000000002001f700 RDI: 00007f6bb914cf20 RBP: 000000002001f6c0 R08: 00007f6bb914cf60 R09: 00000000000000c0 R10: 00000000000000c0 R11: 0000000000000202 R12: 000000002001f700 R13: 00007f6bb914cf20 R14: 000000000001f6f9 R15: 0000000020000080  </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:ntfs_security_init+0x561/0xac0 fs/ntfs3/fsntfs.c:1865 Code: 03 ff 41 83 fe 1f 0f 86 f8 03 00 00 e8 b8 5b 03 ff 4c 01 e3 e8 b0 5b 03 ff 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 ca RSP: 0018:ffffc90012417a60 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc90007b0c000 RDX: 0000000000000000 RSI: ffffffff827961c0 RDI: 0000000000000005 RBP: ffff888024503000 R08: 0000000000000005 R09: 000000000000001f R10: 0000000000000000 R11: 00000000a5aa35ff R12: ffff888020543230 R13: ffff8880182f05d0 R14: 0000000000000000 R15: 00000000000000c8 FS:  00007f6bb914d6c0(0000) GS:ffff88805ab00000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7ab932ff80 CR3: 00000000553ee001 CR4: 0000000000772ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 ---------------- Code disassembly (best guess):    0:    03 ff                    add    %edi,%edi    2:    41 83 fe 1f              cmp    $0x1f,%r14d    6:    0f 86 f8 03 00 00        jbe    0x404    c:    e8 b8 5b 03 ff           call   0xff035bc9   11:    4c 01 e3                 add    %r12,%rbx   14:    e8 b0 5b 03 ff           call   0xff035bc9   19:    48 89 da                 mov    %rbx,%rdx   1c:    48 b8 00 00 00 00 00     movabs $0xdffffc0000000000,%rax   23:    fc ff df   26:    48 c1 ea 03              shr    $0x3,%rdx * 2a:    0f b6 14 02              movzbl (%rdx,%rax,1),%edx <-- trapping instruction   2e:    48 89 d8                 mov    %rbx,%rax   31:    83 e0 07                 and    $0x7,%eax   34:    83 c0 03                 add    $0x3,%eax   37:    38 d0                    cmp    %dl,%al   39:    7c 08                    jl     0x43   3b:    84 d2                    test   %dl,%dl   3d:    0f                       .byte 0xf   3e:    85 ca                    test   %ecx,%edx

Amazon Development Center Germany GmbH Krausenstr. 38 10117 Berlin Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss Eingetragen am Amtsgericht Charlottenburg unter HRB 149173 B Sitz: Berlin Ust-ID: DE 289 237 879