From: Kees Cook <keescook@chromium.org>
To: ira.weiny@intel.com
Cc: syzbot+3250d9c8925ef29e975f@syzkaller.appspotmail.com,
"Fabio M. De Francesco" <fmdefrancesco@gmail.com>,
ebiederm@xmission.com, viro@zeniv.linux.org.uk,
sfr@canb.auug.org.au, syzkaller-bugs@googlegroups.com,
linux-mm@kvack.org, linux-fsdevel@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH] fs/exec: Test patch for syzkaller crash
Date: Fri, 12 Aug 2022 11:45:36 -0700 [thread overview]
Message-ID: <202208121144.E9E5EE9E@keescook> (raw)
In-Reply-To: <20220812000919.408614-1-ira.weiny@intel.com>
On Thu, Aug 11, 2022 at 05:09:19PM -0700, ira.weiny@intel.com wrote:
> From: Ira Weiny <ira.weiny@intel.com>
>
> Kees reported that it looked like the kmap_local_page() conversion in
> fs/exec.c was causing a crash with the syzkaller.[1]
>
> At first glance it appeared this was due to the lack of pagefaults not
> being disabled as was done by kmap_atomic().
>
> Unfortunately, after deeper investigation we don't see how this is a
> problem. The crash does not appear to be happening in the
> memcpy_to_page() call.[2]
>
> For testing, add back pagefault disable in copy_string_kernel() to see
> if it makes syzkaller happy. If so more investigation will need to be
> done to understand exactly what is happening.
>
> [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c6e8e36c6ae4b11bed5643317afb66b6c3cadba8
> [2] https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/fs/exec.c?id=40d43a7507e1547dd45cb02af2e40d897c591870#n616
>
> Cc: Kees Cook <keescook@chromium.org>
> Reported-by: syzbot+3250d9c8925ef29e975f@syzkaller.appspotmail.com
> Signed-off-by: Ira Weiny <ira.weiny@intel.com>
Thanks for spinning this. As noted in the other thread, I'm going to
wait and see if the crashes return. It looks like it may have been an
unrelated problem that got fix in -next (no crashes for a day now...)
But we'll have this in our back pocket if we need it. :)
-Kees
--
Kees Cook
prev parent reply other threads:[~2022-08-12 18:45 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-08-12 0:09 [PATCH] fs/exec: Test patch for syzkaller crash ira.weiny
2022-08-12 18:45 ` Kees Cook [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202208121144.E9E5EE9E@keescook \
--to=keescook@chromium.org \
--cc=ebiederm@xmission.com \
--cc=fmdefrancesco@gmail.com \
--cc=ira.weiny@intel.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=sfr@canb.auug.org.au \
--cc=syzbot+3250d9c8925ef29e975f@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).