* general protection fault in strncasecmp @ 2020-09-24 9:26 ` syzbot 2020-09-28 17:40 ` syzbot ` (2 more replies) 0 siblings, 3 replies; 7+ messages in thread From: syzbot @ 2020-09-24 9:26 UTC (permalink / raw) To: dhowells, linux-afs, linux-kernel, syzkaller-bugs Hello, syzbot found the following issue on: HEAD commit: 98477740 Merge branch 'rcu/urgent' of git://git.kernel.org.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=15b4d887900000 kernel config: https://syzkaller.appspot.com/x/.config?x=5f4c828c9e3cef97 dashboard link: https://syzkaller.appspot.com/bug?extid=459a5dce0b4cb70fd076 compiler: gcc (GCC) 10.1.0-syz 20200507 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=125d46c5900000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16c58f8b900000 IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+459a5dce0b4cb70fd076@syzkaller.appspotmail.com general protection fault, probably for non-canonical address 0xf27d208691691fdb: 0000 [#1] PREEMPT SMP KASAN KASAN: maybe wild-memory-access in range [0x93e924348b48fed8-0x93e924348b48fedf] CPU: 1 PID: 10071 Comm: syz-executor152 Not tainted 5.9.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:strncasecmp lib/string.c:52 [inline] RIP: 0010:strncasecmp+0x5f/0x240 lib/string.c:43 Code: 00 40 38 ce 0f 85 ec 01 00 00 4c 39 e2 0f 84 11 01 00 00 4c 89 fe 4c 89 e7 49 83 c4 01 48 89 f8 48 89 f9 48 c1 e8 03 83 e1 07 <42> 0f b6 04 28 38 c8 7f 08 84 c0 0f 85 0f 01 00 00 41 0f b6 6c 24 RSP: 0018:ffffc9000ba7f958 EFLAGS: 00010202 RAX: 127d248691691fdb RBX: dffffc0000000000 RCX: 0000000000000001 RDX: 93e924348b48fee3 RSI: ffff8880a1a65401 RDI: 93e924348b48fed9 RBP: 0000000000000009 R08: 000000000000002e R09: 0000000000000025 R10: 0000000000000000 R11: 0000000000000005 R12: 93e924348b48feda R13: dffffc0000000000 R14: 00000000000000e7 R15: ffffffff82ddbcd0 FS: 00007fd01e732700(0000) GS:ffff8880ae500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000004cdb30 CR3: 00000000929cd000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: afs_lookup_cell_rcu+0x313/0x720 fs/afs/cell.c:88 afs_lookup_cell+0x2ee/0x1440 fs/afs/cell.c:249 afs_parse_source fs/afs/super.c:290 [inline] afs_parse_param+0x404/0x8c0 fs/afs/super.c:326 vfs_parse_fs_param fs/fs_context.c:117 [inline] vfs_parse_fs_param+0x203/0x550 fs/fs_context.c:98 vfs_parse_fs_string+0xe6/0x150 fs/fs_context.c:161 generic_parse_monolithic+0x16f/0x1f0 fs/fs_context.c:201 do_new_mount fs/namespace.c:2871 [inline] path_mount+0x133f/0x20a0 fs/namespace.c:3192 do_mount fs/namespace.c:3205 [inline] __do_sys_mount fs/namespace.c:3413 [inline] __se_sys_mount fs/namespace.c:3390 [inline] __x64_sys_mount+0x27f/0x300 fs/namespace.c:3390 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x44d57a Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 bd 9f fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 9a 9f fb ff c3 66 0f 1f 84 00 00 00 00 00 RSP: 002b:00007fd01e731c48 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007fd01e731c90 RCX: 000000000044d57a RDX: 0000000020000000 RSI: 0000000020000040 RDI: 0000000000000000 RBP: 0000000000000000 R08: 00007fd01e731c90 R09: 00007fd01e732700 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd01e7326d0 R13: 00007ffd130bca8f R14: 00007fd01e7329c0 R15: 0000000000000000 Modules linked in: ---[ end trace d103c481405d6a99 ]--- RIP: 0010:strncasecmp lib/string.c:52 [inline] RIP: 0010:strncasecmp+0x5f/0x240 lib/string.c:43 Code: 00 40 38 ce 0f 85 ec 01 00 00 4c 39 e2 0f 84 11 01 00 00 4c 89 fe 4c 89 e7 49 83 c4 01 48 89 f8 48 89 f9 48 c1 e8 03 83 e1 07 <42> 0f b6 04 28 38 c8 7f 08 84 c0 0f 85 0f 01 00 00 41 0f b6 6c 24 RSP: 0018:ffffc9000ba7f958 EFLAGS: 00010202 RAX: 127d248691691fdb RBX: dffffc0000000000 RCX: 0000000000000001 RDX: 93e924348b48fee3 RSI: ffff8880a1a65401 RDI: 93e924348b48fed9 RBP: 0000000000000009 R08: 000000000000002e R09: 0000000000000025 R10: 0000000000000000 R11: 0000000000000005 R12: 93e924348b48feda R13: dffffc0000000000 R14: 00000000000000e7 R15: ffffffff82ddbcd0 FS: 00007fd01e732700(0000) GS:ffff8880ae500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb63ee2c000 CR3: 00000000929cd000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. syzbot can test patches for this issue, for details see: https://goo.gl/tpsmEJ#testing-patches ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: general protection fault in strncasecmp 2020-09-24 9:26 ` general protection fault in strncasecmp syzbot @ 2020-09-28 17:40 ` syzbot 2020-10-09 10:04 ` David Howells 2020-10-16 13:06 ` David Howells 2 siblings, 0 replies; 7+ messages in thread From: syzbot @ 2020-09-28 17:40 UTC (permalink / raw) To: akpm, coreteam, davem, dhowells, hch, hdanton, kaber, kadlec, linux-afs, linux-kernel, mhiramat, netdev, netfilter-devel, pablo, syzkaller-bugs, torvalds syzbot has bisected this issue to: commit bfd45be0b83e8f711f3abc892850d6047972d127 Author: Christoph Hellwig <hch@lst.de> Date: Tue Oct 11 20:52:22 2016 +0000 kprobes: include <asm/sections.h> instead of <asm-generic/sections.h> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1613329d900000 start commit: 98477740 Merge branch 'rcu/urgent' of git://git.kernel.org.. git tree: upstream final oops: https://syzkaller.appspot.com/x/report.txt?x=1513329d900000 console output: https://syzkaller.appspot.com/x/log.txt?x=1113329d900000 kernel config: https://syzkaller.appspot.com/x/.config?x=5f4c828c9e3cef97 dashboard link: https://syzkaller.appspot.com/bug?extid=459a5dce0b4cb70fd076 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=125d46c5900000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16c58f8b900000 Reported-by: syzbot+459a5dce0b4cb70fd076@syzkaller.appspotmail.com Fixes: bfd45be0b83e ("kprobes: include <asm/sections.h> instead of <asm-generic/sections.h>") For information about bisection process see: https://goo.gl/tpsmEJ#bisection ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: general protection fault in strncasecmp 2020-09-24 9:26 ` general protection fault in strncasecmp syzbot 2020-09-28 17:40 ` syzbot @ 2020-10-09 10:04 ` David Howells 2020-10-16 13:06 ` David Howells 2 siblings, 0 replies; 7+ messages in thread From: David Howells @ 2020-10-09 10:04 UTC (permalink / raw) To: Hillf Danton; +Cc: dhowells, syzbot, linux-afs, linux-kernel, syzkaller-bugs Hillf Danton <hdanton@sina.com> wrote: > + /* > + * care to detect writers because > + * > + * read_seqbegin_or_lock(&net->cells_lock, &seq); > + * > + * is unable to block > + * > + * write_seqlock(&net->cells_lock); > + * > + */ That shouldn't be true. The loop may make one or two passes, the first without the lock, the second with. The RCU read lock is supposed to be held in both cases too (but see below). One of the call sites, however, afs_probe_cell_name(), doesn't call afs_lookup_cell_rcu() with the RCU read lock held - which is an error, but not obviously the one that's biting here. David ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: general protection fault in strncasecmp 2020-09-24 9:26 ` general protection fault in strncasecmp syzbot 2020-09-28 17:40 ` syzbot 2020-10-09 10:04 ` David Howells @ 2020-10-16 13:06 ` David Howells 2020-10-16 13:07 ` syzbot 2 siblings, 1 reply; 7+ messages in thread From: David Howells @ 2020-10-16 13:06 UTC (permalink / raw) To: syzbot; +Cc: dhowells, Hillf Danton, linux-afs, linux-kernel, syzkaller-bugs #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git f25a7033ecb675101f8bc060a7c5fbe0c9076fd3 ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Re: general protection fault in strncasecmp 2020-10-16 13:06 ` David Howells @ 2020-10-16 13:07 ` syzbot 2021-03-09 16:08 ` Dmitry Vyukov 2021-03-09 17:31 ` David Howells 0 siblings, 2 replies; 7+ messages in thread From: syzbot @ 2020-10-16 13:07 UTC (permalink / raw) To: David Howells; +Cc: dhowells, hdanton, linux-afs, linux-kernel, syzkaller-bugs > #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git f25a7033ecb675101f8bc060a7c5fbe0c9076fd3 "\tf25a7033ecb675101f8bc060a7c5fbe0c9076fd3" does not look like a valid git branch or commit. > ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Re: general protection fault in strncasecmp 2020-10-16 13:07 ` syzbot @ 2021-03-09 16:08 ` Dmitry Vyukov 2021-03-09 17:31 ` David Howells 1 sibling, 0 replies; 7+ messages in thread From: Dmitry Vyukov @ 2021-03-09 16:08 UTC (permalink / raw) To: syzbot; +Cc: David Howells, Hillf Danton, linux-afs, LKML, syzkaller-bugs On Fri, Oct 16, 2020 at 3:07 PM syzbot <syzbot+459a5dce0b4cb70fd076@syzkaller.appspotmail.com> wrote: > > > #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git f25a7033ecb675101f8bc060a7c5fbe0c9076fd3 > > "\tf25a7033ecb675101f8bc060a7c5fbe0c9076fd3" does not look like a valid git branch or commit. Hi David, Not sure if you are still interesting in this or not, but fwiw tabs should be supported now: https://github.com/google/syzkaller/commit/26967e354e030f6a022b7a60a7c9899ec25923aa ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: general protection fault in strncasecmp 2020-10-16 13:07 ` syzbot 2021-03-09 16:08 ` Dmitry Vyukov @ 2021-03-09 17:31 ` David Howells 1 sibling, 0 replies; 7+ messages in thread From: David Howells @ 2021-03-09 17:31 UTC (permalink / raw) To: Dmitry Vyukov Cc: dhowells, syzbot, Hillf Danton, linux-afs, LKML, syzkaller-bugs Dmitry Vyukov <dvyukov@google.com> wrote: > Not sure if you are still interesting in this or not, but fwiw tabs > should be supported now: > https://github.com/google/syzkaller/commit/26967e354e030f6a022b7a60a7c9899ec25923aa Not right this minute, but thanks for letting me know! David ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2021-03-09 17:31 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <20200924134052.1156-1-hdanton@sina.com>
2020-09-24 9:26 ` general protection fault in strncasecmp syzbot
2020-09-28 17:40 ` syzbot
2020-10-09 10:04 ` David Howells
2020-10-16 13:06 ` David Howells
2020-10-16 13:07 ` syzbot
2021-03-09 16:08 ` Dmitry Vyukov
2021-03-09 17:31 ` David Howells
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).