general protection fault in strncasecmp

general protection fault in strncasecmp

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    98477740 Merge branch 'rcu/urgent' of git://git.kernel.org..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15b4d887900000
kernel config:  https://syzkaller.appspot.com/x/.config?x=5f4c828c9e3cef97
dashboard link: https://syzkaller.appspot.com/bug?extid=459a5dce0b4cb70fd076
compiler:       gcc (GCC) 10.1.0-syz 20200507
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=125d46c5900000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16c58f8b900000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+459a5dce0b4cb70fd076@syzkaller.appspotmail.com

general protection fault, probably for non-canonical address 0xf27d208691691fdb: 0000 [#1] PREEMPT SMP KASAN
KASAN: maybe wild-memory-access in range [0x93e924348b48fed8-0x93e924348b48fedf]
CPU: 1 PID: 10071 Comm: syz-executor152 Not tainted 5.9.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:strncasecmp lib/string.c:52 [inline]
RIP: 0010:strncasecmp+0x5f/0x240 lib/string.c:43
Code: 00 40 38 ce 0f 85 ec 01 00 00 4c 39 e2 0f 84 11 01 00 00 4c 89 fe 4c 89 e7 49 83 c4 01 48 89 f8 48 89 f9 48 c1 e8 03 83 e1 07 <42> 0f b6 04 28 38 c8 7f 08 84 c0 0f 85 0f 01 00 00 41 0f b6 6c 24
RSP: 0018:ffffc9000ba7f958 EFLAGS: 00010202
RAX: 127d248691691fdb RBX: dffffc0000000000 RCX: 0000000000000001
RDX: 93e924348b48fee3 RSI: ffff8880a1a65401 RDI: 93e924348b48fed9
RBP: 0000000000000009 R08: 000000000000002e R09: 0000000000000025
R10: 0000000000000000 R11: 0000000000000005 R12: 93e924348b48feda
R13: dffffc0000000000 R14: 00000000000000e7 R15: ffffffff82ddbcd0
FS:  00007fd01e732700(0000) GS:ffff8880ae500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004cdb30 CR3: 00000000929cd000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 afs_lookup_cell_rcu+0x313/0x720 fs/afs/cell.c:88
 afs_lookup_cell+0x2ee/0x1440 fs/afs/cell.c:249
 afs_parse_source fs/afs/super.c:290 [inline]
 afs_parse_param+0x404/0x8c0 fs/afs/super.c:326
 vfs_parse_fs_param fs/fs_context.c:117 [inline]
 vfs_parse_fs_param+0x203/0x550 fs/fs_context.c:98
 vfs_parse_fs_string+0xe6/0x150 fs/fs_context.c:161
 generic_parse_monolithic+0x16f/0x1f0 fs/fs_context.c:201
 do_new_mount fs/namespace.c:2871 [inline]
 path_mount+0x133f/0x20a0 fs/namespace.c:3192
 do_mount fs/namespace.c:3205 [inline]
 __do_sys_mount fs/namespace.c:3413 [inline]
 __se_sys_mount fs/namespace.c:3390 [inline]
 __x64_sys_mount+0x27f/0x300 fs/namespace.c:3390
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x44d57a
Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 bd 9f fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 9a 9f fb ff c3 66 0f 1f 84 00 00 00 00 00
RSP: 002b:00007fd01e731c48 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fd01e731c90 RCX: 000000000044d57a
RDX: 0000000020000000 RSI: 0000000020000040 RDI: 0000000000000000
RBP: 0000000000000000 R08: 00007fd01e731c90 R09: 00007fd01e732700
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd01e7326d0
R13: 00007ffd130bca8f R14: 00007fd01e7329c0 R15: 0000000000000000
Modules linked in:
---[ end trace d103c481405d6a99 ]---
RIP: 0010:strncasecmp lib/string.c:52 [inline]
RIP: 0010:strncasecmp+0x5f/0x240 lib/string.c:43
Code: 00 40 38 ce 0f 85 ec 01 00 00 4c 39 e2 0f 84 11 01 00 00 4c 89 fe 4c 89 e7 49 83 c4 01 48 89 f8 48 89 f9 48 c1 e8 03 83 e1 07 <42> 0f b6 04 28 38 c8 7f 08 84 c0 0f 85 0f 01 00 00 41 0f b6 6c 24
RSP: 0018:ffffc9000ba7f958 EFLAGS: 00010202
RAX: 127d248691691fdb RBX: dffffc0000000000 RCX: 0000000000000001
RDX: 93e924348b48fee3 RSI: ffff8880a1a65401 RDI: 93e924348b48fed9
RBP: 0000000000000009 R08: 000000000000002e R09: 0000000000000025
R10: 0000000000000000 R11: 0000000000000005 R12: 93e924348b48feda
R13: dffffc0000000000 R14: 00000000000000e7 R15: ffffffff82ddbcd0
FS:  00007fd01e732700(0000) GS:ffff8880ae500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb63ee2c000 CR3: 00000000929cd000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

Re: general protection fault in strncasecmp

[syzbot]

syzbot has bisected this issue to:

commit bfd45be0b83e8f711f3abc892850d6047972d127
Author: Christoph Hellwig <hch@lst.de>
Date:   Tue Oct 11 20:52:22 2016 +0000

    kprobes: include <asm/sections.h> instead of <asm-generic/sections.h>

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=1613329d900000
start commit:   98477740 Merge branch 'rcu/urgent' of git://git.kernel.org..
git tree:       upstream
final oops:     https://syzkaller.appspot.com/x/report.txt?x=1513329d900000
console output: https://syzkaller.appspot.com/x/log.txt?x=1113329d900000
kernel config:  https://syzkaller.appspot.com/x/.config?x=5f4c828c9e3cef97
dashboard link: https://syzkaller.appspot.com/bug?extid=459a5dce0b4cb70fd076
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=125d46c5900000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16c58f8b900000

Reported-by: syzbot+459a5dce0b4cb70fd076@syzkaller.appspotmail.com
Fixes: bfd45be0b83e ("kprobes: include <asm/sections.h> instead of <asm-generic/sections.h>")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

Re: general protection fault in strncasecmp

[David Howells]

Hillf Danton <hdanton@sina.com> wrote:

> +			/*
> +			 * care to detect writers because
> +			 *
> +			 * read_seqbegin_or_lock(&net->cells_lock, &seq);
> +			 *
> +			 * is unable to block 
> +			 *
> +			 * write_seqlock(&net->cells_lock);
> +			 *
> +			 */

That shouldn't be true.  The loop may make one or two passes, the first
without the lock, the second with.  The RCU read lock is supposed to be held
in both cases too (but see below).

One of the call sites, however, afs_probe_cell_name(), doesn't call
afs_lookup_cell_rcu() with the RCU read lock held - which is an error, but not
obviously the one that's biting here.

David

Re: general protection fault in strncasecmp

[David Howells]

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git 	f25a7033ecb675101f8bc060a7c5fbe0c9076fd3

Re: Re: general protection fault in strncasecmp

[syzbot]

> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git 	f25a7033ecb675101f8bc060a7c5fbe0c9076fd3

"\tf25a7033ecb675101f8bc060a7c5fbe0c9076fd3" does not look like a valid git branch or commit.

>

Re: Re: general protection fault in strncasecmp

[Dmitry Vyukov]

On Fri, Oct 16, 2020 at 3:07 PM syzbot
<syzbot+459a5dce0b4cb70fd076@syzkaller.appspotmail.com> wrote:
>
> > #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git        f25a7033ecb675101f8bc060a7c5fbe0c9076fd3
>
> "\tf25a7033ecb675101f8bc060a7c5fbe0c9076fd3" does not look like a valid git branch or commit.

Hi David,

Not sure if you are still interesting in this or not, but fwiw tabs
should be supported now:
https://github.com/google/syzkaller/commit/26967e354e030f6a022b7a60a7c9899ec25923aa

Re: general protection fault in strncasecmp

[David Howells]

Dmitry Vyukov <dvyukov@google.com> wrote:

> Not sure if you are still interesting in this or not, but fwiw tabs
> should be supported now:
> https://github.com/google/syzkaller/commit/26967e354e030f6a022b7a60a7c9899ec25923aa

Not right this minute, but thanks for letting me know!

David