WARNING in __proc_create (2)

WARNING in __proc_create (2)

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit:    d96d875e Merge tag 'fixes_for_v5.5-rc8' of git://git.kerne..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13b7b80de00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=83c00afca9cf5153
dashboard link: https://syzkaller.appspot.com/bug?extid=b904ba7c947a37b4b291
compiler:       clang version 10.0.0 (https://github.com/llvm/llvm-project/ c2443155a0fb245c8f17f2c1c72b6ea391e86e81)
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=12c96185e00000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=14f859c9e00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+b904ba7c947a37b4b291@syzkaller.appspotmail.com

------------[ cut here ]------------
name '��/]uwo,"�\x16c�ac�����[�\x18$�5x~�s�&�tw}���z\x15�cp\x12('
WARNING: CPU: 0 PID: 3489 at fs/proc/generic.c:178 __xlate_proc_name fs/proc/generic.c:178 [inline]
WARNING: CPU: 0 PID: 3489 at fs/proc/generic.c:178 xlate_proc_name fs/proc/generic.c:194 [inline]
WARNING: CPU: 0 PID: 3489 at fs/proc/generic.c:178 __proc_create+0x25a/0xb60 fs/proc/generic.c:387
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 3489 Comm: kworker/0:8 Not tainted 5.5.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: afs afs_manage_cell
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fb/0x318 lib/dump_stack.c:118
 panic+0x264/0x7a9 kernel/panic.c:221
 __warn+0x209/0x210 kernel/panic.c:582
 report_bug+0x1b6/0x2f0 lib/bug.c:195
 fixup_bug arch/x86/kernel/traps.c:174 [inline]
 do_error_trap+0xda/0x440 arch/x86/kernel/traps.c:267
 do_invalid_op+0x36/0x40 arch/x86/kernel/traps.c:286
 invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1027
RIP: 0010:__xlate_proc_name fs/proc/generic.c:178 [inline]
RIP: 0010:xlate_proc_name fs/proc/generic.c:194 [inline]
RIP: 0010:__proc_create+0x25a/0xb60 fs/proc/generic.c:387
Code: 07 00 00 49 89 c6 e8 f5 48 94 ff e9 56 fe ff ff e8 eb 48 94 ff 48 8b 75 b8 45 31 ed 48 c7 c7 39 52 e1 88 31 c0 e8 36 55 66 ff <0f> 0b 48 c7 c7 88 43 11 89 e8 08 de 1a 06 e9 bc 00 00 00 e8 be 48
RSP: 0018:ffffc9000b617a90 EFLAGS: 00010246
RAX: d5e5b65e165c9c00 RBX: 0000000000000005 RCX: ffff88809bb3e140
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc9000b617b00 R08: ffffffff815f9d24 R09: fffffbfff13cd11e
R10: fffffbfff13cd11e R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000002 R15: 0000000000000000
 proc_mkdir_data+0x8b/0x150 fs/proc/generic.c:473
 proc_net_mkdir include/linux/proc_fs.h:139 [inline]
 afs_proc_cell_setup+0x9d/0x150 fs/afs/proc.c:610
 afs_activate_cell fs/afs/cell.c:591 [inline]
 afs_manage_cell+0x750/0x1500 fs/afs/cell.c:673
 process_one_work+0x7f5/0x10d0 kernel/workqueue.c:2264
 worker_thread+0xbbc/0x1630 kernel/workqueue.c:2410
 kthread+0x332/0x350 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

Re: WARNING in __proc_create (2)

[Dan Carpenter]

On Tue, Jan 21, 2020 at 03:56:08PM -0800, syzbot wrote:
> Hello,
> 
> syzbot found the following crash on:
> 
> HEAD commit:    d96d875e Merge tag 'fixes_for_v5.5-rc8' of git://git.kerne..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=13b7b80de00000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=83c00afca9cf5153
> dashboard link: https://syzkaller.appspot.com/bug?extid=b904ba7c947a37b4b291
> compiler:       clang version 10.0.0 (https://github.com/llvm/llvm-project/ c2443155a0fb245c8f17f2c1c72b6ea391e86e81)
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=12c96185e00000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=14f859c9e00000
> 
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+b904ba7c947a37b4b291@syzkaller.appspotmail.com
> 
> ------------[ cut here ]------------
> name '��/]uwo,"� c�ac�����[� $�5x~�s�&�tw}���z �cp ('
          ^

Hi David,

We should probably ban '/' characters from the cell name in
afs_alloc_cell().

regards,
dan carpenter

Re: WARNING in __proc_create (2)

[David Howells]

Dan Carpenter <dan.carpenter@oracle.com> wrote:

> We should probably ban '/' characters from the cell name in
> afs_alloc_cell().

And non-printable chars too.

David

Re: WARNING in __proc_create (2)

[syzbot]

syzbot has bisected this bug to:

commit f4b3526d83c40dd8bf5948b9d7a1b2c340f0dcc8
Author: David Howells <dhowells@redhat.com>
Date:   Thu Nov 2 15:27:48 2017 +0000

    afs: Connect up the CB.ProbeUuid

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=1627a721e00000
start commit:   d96d875e Merge tag 'fixes_for_v5.5-rc8' of git://git.kerne..
git tree:       upstream
final crash:    https://syzkaller.appspot.com/x/report.txt?x=1527a721e00000
console output: https://syzkaller.appspot.com/x/log.txt?x=1127a721e00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=83c00afca9cf5153
dashboard link: https://syzkaller.appspot.com/bug?extid=b904ba7c947a37b4b291
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=12c96185e00000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=14f859c9e00000

Reported-by: syzbot+b904ba7c947a37b4b291@syzkaller.appspotmail.com
Fixes: f4b3526d83c4 ("afs: Connect up the CB.ProbeUuid")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

Re: WARNING in __proc_create (2)

[David Howells]

Dan Carpenter <dan.carpenter@oracle.com> wrote:

> We should probably ban '/' characters from the cell name in
> afs_alloc_cell().

Sorry, I forgot to cc you on the patch.  It's now upstream:

	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a45ea48e2bcd92c1f678b794f488ca0bda9835b8

David