linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Al Viro <viro@zeniv.linux.org.uk>
To: syzbot <syzbot+6004acbaa1893ad013f0@syzkaller.appspotmail.com>
Cc: arnd@arndb.de, axboe@kernel.dk, bp@alien8.de,
	catalin.marinas@arm.com, christian@brauner.io,
	dhowells@redhat.com, geert@linux-m68k.org, hare@suse.com,
	heiko.carstens@de.ibm.com, hpa@zytor.com,
	linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
	luto@kernel.org, mingo@redhat.com,
	syzkaller-bugs@googlegroups.com, tglx@linutronix.de,
	x86@kernel.org
Subject: Re: general protection fault in do_move_mount (2)
Date: Tue, 18 Jun 2019 15:02:40 +0100	[thread overview]
Message-ID: <20190618140239.GA17978@ZenIV.linux.org.uk> (raw)
In-Reply-To: <000000000000bb362d058b96d54d@google.com>

On Tue, Jun 18, 2019 at 03:47:10AM -0700, syzbot wrote:
> Hello,
> 
> syzbot found the following crash on:
> 
> HEAD commit:    9e0babf2 Linux 5.2-rc5
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=138b310aa00000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=d16883d6c7f0d717
> dashboard link: https://syzkaller.appspot.com/bug?extid=6004acbaa1893ad013f0
> compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=154e8c2aa00000

IDGI...

mkdir(&(0x7f0000632000)='./file0\x00', 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
r0 = open(&(0x7f0000032ff8)='./file0\x00', 0x0, 0x0)
r1 = memfd_create(&(0x7f00000001c0)='\xb3', 0x0)
write$FUSE_DIRENT(r1, &(0x7f0000000080)=ANY=[], 0x29)
move_mount(r0, &(0x7f0000000040)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x66)

reads as if we'd done mkdir ./file0, opened it and then tried
to feed move_mount(2) "./file0" relative to that descriptor.
How the hell has that avoided an instant -ENOENT?  On the first
pair, that is - the second one (AT_FDCWD, "./file0") is fine...

Confused...  Incidentally, what the hell is
	mount(0x0, 0x0, 0x0, 0x0, 0x0)
about?  *IF* that really refers to mount(2) with
such arguments, all you'll get is -EFAULT.  Way before
it gets to actually doing anything - it won't get past
        /* ... and get the mountpoint */
        retval = user_path(dir_name, &path);
        if (retval)
                return retval;
in do_mount(2)...

  reply	other threads:[~2019-06-18 14:03 UTC|newest]

Thread overview: 22+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-06-18 10:47 syzbot
2019-06-18 14:02 ` Al Viro [this message]
2019-06-24  9:28   ` Dmitry Vyukov
2019-06-29 20:27     ` [PATCH] vfs: move_mount: reject moving kernel internal mounts Eric Biggers
2019-06-29 20:39       ` Al Viro
2019-07-01  1:08         ` Al Viro
2019-07-01 15:43           ` Eric Biggers
2019-07-01  7:38         ` David Howells
2019-07-01 11:19           ` Al Viro
2019-07-01 16:45       ` Eric Biggers
2019-07-01 18:22         ` Al Viro
2019-07-01 19:20           ` Al Viro
2019-07-02 18:22           ` Eric Biggers
2019-07-09 19:40             ` Eric Biggers
2019-07-09 20:54               ` Al Viro
2019-07-10  3:23                 ` 6 new syscalls without tests (was: [PATCH] vfs: move_mount: reject moving kernel internal mounts) Eric Biggers
2019-07-05  9:01           ` move_mount.2 David Howells
2019-06-29 20:39     ` general protection fault in do_move_mount (2) Eric Biggers
2019-07-01 14:59       ` Dmitry Vyukov
2019-07-01 15:18         ` Eric Biggers
2019-07-05 12:17           ` Dmitry Vyukov
2019-07-05 13:02           ` Dmitry Vyukov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190618140239.GA17978@ZenIV.linux.org.uk \
    --to=viro@zeniv.linux.org.uk \
    --cc=arnd@arndb.de \
    --cc=axboe@kernel.dk \
    --cc=bp@alien8.de \
    --cc=catalin.marinas@arm.com \
    --cc=christian@brauner.io \
    --cc=dhowells@redhat.com \
    --cc=geert@linux-m68k.org \
    --cc=hare@suse.com \
    --cc=heiko.carstens@de.ibm.com \
    --cc=hpa@zytor.com \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=luto@kernel.org \
    --cc=mingo@redhat.com \
    --cc=syzbot+6004acbaa1893ad013f0@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    --cc=tglx@linutronix.de \
    --cc=x86@kernel.org \
    --subject='Re: general protection fault in do_move_mount (2)' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).