lkml.org 
[lkml]   [2024]   [Apr]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [syzbot] [netfs?] divide error in netfs_submit_writethrough
    Hello, I reproduced this bug and comfired in the latest upstream with the same config with syzbot instance.

    If you fix this issue, please add the following tag to the commit:
    Reported-by: xingwei lee <xrivendell7@gmail.com>
    Reported-by: yue sun <samsun1006219@gmail.com>

    kernel version: upstream 39cd87c4eb2b893354f3b850f916353f2658ae6f
    kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=8c2c72b264636e25 with KASAN enabled
    compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

    BTW, I can only trigger this bug with repro.txt as follows:

    root@syzkaller:~/linux_amd64# ./syz-execprog -repeat 0 ../6c9-0.txt
    TITLE: divide error in netfs_submit_writethrough
    divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI
    CPU: 0 PID: 12946 Comm: syz-executor Not tainted 6.9.0-rc2-00413-gf2f80ac80987-dirty #25
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc38 04/01/2014
    RIP: 0010:netfs_submit_writethrough+0x20e/0x290 fs/netfs/output.c:427
    Code: fc ff df 48 89 fa 48 c1 ea 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 1a 8b 8b 0c 01 00 00 48 89 e8 31 d2 <48> ff
    RSP: 0018:ffffc9000f88f760 EFLAGS: 00010246
    RAX: 0000000000001000 RBX: ffff8880564c2c00 RCX: 0000000000000000
    RDX: 0000000000000000 RSI: ffffffff823ceef6 RDI: ffff8880564c2d0c
    RBP: 0000000000001000 R08: 0000000000000001 R09: 0000000000000000
    R10: 0000000000000000 R11: 0000000000000003 R12: 0000000000000000
    R13: ffff88806caa0008 R14: ffff8880564c2d20 R15: 0000000000000000
    FS: 00007f5d8dfa06c0(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000
    CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 000000002000f000 CR3: 0000000059e98000 CR4: 0000000000750ef0
    PKRU: 55555554
    Call Trace:
    <TASK>
    netfs_advance_writethrough+0x14a/0x180 fs/netfs/output.c:449
    netfs_perform_write+0x1c70/0x27e0 fs/netfs/buffered_write.c:385
    netfs_buffered_write_iter_locked+0x232/0x2f0 fs/netfs/buffered_write.c:454
    netfs_file_write_iter+0x1f3/0x480 fs/netfs/buffered_write.c:493
    v9fs_file_write_iter+0xa8/0x110 fs/9p/vfs_file.c:407
    call_write_iter include/linux/fs.h:2110 [inline]
    do_iter_readv_writev+0x53a/0x7c0 fs/read_write.c:741
    vfs_writev+0x386/0xe10 fs/read_write.c:971
    do_pwritev+0x1c1/0x280 fs/read_write.c:1072
    __do_sys_pwritev2 fs/read_write.c:1131 [inline]
    __se_sys_pwritev2 fs/read_write.c:1122 [inline]
    __x64_sys_pwritev2+0xf6/0x160 fs/read_write.c:1122
    do_syscall_x64 arch/x86/entry/common.c:52 [inline]
    do_syscall_64+0xd5/0x260 arch/x86/entry/common.c:83
    entry_SYSCALL_64_after_hwframe+0x72/0x7a
    RIP: 0033:0x7f5d8e4a5559
    Code: 08 89 e8 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 38
    RSP: 002b:00007f5d8df9fd58 EFLAGS: 00000246 ORIG_RAX: 0000000000000148
    RAX: ffffffffffffffda RBX: 00000000004bbf80 RCX: 00007f5d8e4a5559
    RDX: 0000000000000001 RSI: 0000000020000780 RDI: 0000000000000007
    RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000016
    R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004bbf8c
    R13: 000000000000000b R14: 00000000004bbf80 R15: 00007f5d8df80000
    </TASK>
    Modules linked in:
    ---[ end trace 0000000000000000 ]---
    RIP: 0010:netfs_submit_writethrough+0x20e/0x290 fs/netfs/output.c:427
    Code: fc ff df 48 89 fa 48 c1 ea 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 1a 8b 8b 0c 01 00 00 48 89 e8 31 d2 <48> ff
    RSP: 0018:ffffc9000f88f760 EFLAGS: 00010246
    RAX: 0000000000001000 RBX: ffff8880564c2c00 RCX: 0000000000000000
    RDX: 0000000000000000 RSI: ffffffff823ceef6 RDI: ffff8880564c2d0c
    RBP: 0000000000001000 R08: 0000000000000001 R09: 0000000000000000
    R10: 0000000000000000 R11: 0000000000000003 R12: 0000000000000000
    R13: ffff88806caa0008 R14: ffff8880564c2d20 R15: 0000000000000000
    FS: 00007f5d8dfa06c0(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000
    CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 000000002000f000 CR3: 0000000059e98000 CR4: 0000000000750ef0
    PKRU: 55555554
    ----------------
    Code disassembly (best guess), 2 bytes skipped:
    0: df 48 89 fisttps -0x77(%rax)
    3: fa cli
    4: 48 c1 ea 03 shr $0x3,%rdx
    8: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx
    c: 48 89 f8 mov %rdi,%rax
    f: 83 e0 07 and $0x7,%eax
    12: 83 c0 03 add $0x3,%eax
    15: 38 d0 cmp %dl,%al
    17: 7c 04 jl 0x1d
    19: 84 d2 test %dl,%dl
    1b: 75 1a jne 0x37
    1d: 8b 8b 0c 01 00 00 mov 0x10c(%rbx),%ecx
    23: 48 89 e8 mov %rbp,%rax
    26: 31 d2 xor %edx,%edx
    * 28: 48 rex.W <-- trapping instruction
    29: ff .byte 0xff
    TITLE: kernel panic: Fatal exception
    CORRUPTED: true (report format is marked as corrupted)
    MAINTAINERS (TO): []
    MAINTAINERS (CC): []
    CPU: 0 PID: 12946 Comm: syz-executor Not tainted 6.9.0-rc2-00413-gf2f80ac80987-dirty #25
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc38 04/01/2014
    RIP: 0010:netfs_submit_writethrough+0x20e/0x290 fs/netfs/output.c:427
    Code: fc ff df 48 89 fa 48 c1 ea 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 1a 8b 8b 0c 01 00 00 48 89 e8 31 d2 <48> ff
    RSP: 0018:ffffc9000f88f760 EFLAGS: 00010246
    RAX: 0000000000001000 RBX: ffff8880564c2c00 RCX: 0000000000000000
    RDX: 0000000000000000 RSI: ffffffff823ceef6 RDI: ffff8880564c2d0c
    RBP: 0000000000001000 R08: 0000000000000001 R09: 0000000000000000
    R10: 0000000000000000 R11: 0000000000000003 R12: 0000000000000000
    R13: ffff88806caa0008 R14: ffff8880564c2d20 R15: 0000000000000000
    FS: 00007f5d8dfa06c0(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000
    CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 000000002000f000 CR3: 0000000059e98000 CR4: 0000000000750ef0
    PKRU: 55555554
    Call Trace:
    <TASK>
    netfs_advance_writethrough+0x14a/0x180 fs/netfs/output.c:449
    netfs_perform_write+0x1c70/0x27e0 fs/netfs/buffered_write.c:385
    netfs_buffered_write_iter_locked+0x232/0x2f0 fs/netfs/buffered_write.c:454
    netfs_file_write_iter+0x1f3/0x480 fs/netfs/buffered_write.c:493
    v9fs_file_write_iter+0xa8/0x110 fs/9p/vfs_file.c:407
    call_write_iter include/linux/fs.h:2110 [inline]
    do_iter_readv_writev+0x53a/0x7c0 fs/read_write.c:741
    vfs_writev+0x386/0xe10 fs/read_write.c:971
    do_pwritev+0x1c1/0x280 fs/read_write.c:1072
    __do_sys_pwritev2 fs/read_write.c:1131 [inline]
    __se_sys_pwritev2 fs/read_write.c:1122 [inline]
    __x64_sys_pwritev2+0xf6/0x160 fs/read_write.c:1122
    do_syscall_x64 arch/x86/entry/common.c:52 [inline]
    do_syscall_64+0xd5/0x260 arch/x86/entry/common.c:83
    entry_SYSCALL_64_after_hwframe+0x72/0x7a
    RIP: 0033:0x7f5d8e4a5559
    Code: 08 89 e8 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 38
    RSP: 002b:00007f5d8df9fd58 EFLAGS: 00000246 ORIG_RAX: 0000000000000148
    RAX: ffffffffffffffda RBX: 00000000004bbf80 RCX: 00007f5d8e4a5559
    RDX: 0000000000000001 RSI: 0000000020000780 RDI: 0000000000000007
    RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000016
    R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004bbf8c
    R13: 000000000000000b R14: 00000000004bbf80 R15: 00007f5d8df80000
    </TASK>
    Modules linked in:
    ---[ end trace 0000000000000000 ]---
    RIP: 0010:netfs_submit_writethrough+0x20e/0x290 fs/netfs/output.c:427
    Code: fc ff df 48 89 fa 48 c1 ea 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 1a 8b 8b 0c 01 00 00 48 89 e8 31 d2 <48> ff
    RSP: 0018:ffffc9000f88f760 EFLAGS: 00010246
    RAX: 0000000000001000 RBX: ffff8880564c2c00 RCX: 0000000000000000
    RDX: 0000000000000000 RSI: ffffffff823ceef6 RDI: ffff8880564c2d0c
    RBP: 0000000000001000 R08: 0000000000000001 R09: 0000000000000000
    R10: 0000000000000000 R11: 0000000000000003 R12: 0000000000000000
    R13: ffff88806caa0008 R14: ffff8880564c2d20 R15: 0000000000000000
    FS: 00007f5d8dfa06c0(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000
    CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 000000002000f000 CR3: 0000000059e98000 CR4: 0000000000750ef0
    PKRU: 55555554
    Kernel panic - not syncing: Fatal exception
    Kernel Offset: disabled
    Rebooting in 86400 seconds..


    =* repro.c =*
    #define _GNU_SOURCE

    #include <endian.h>
    #include <stdint.h>
    #include <stdio.h>
    #include <stdlib.h>
    #include <string.h>
    #include <sys/syscall.h>
    #include <sys/types.h>
    #include <unistd.h>

    #ifndef __NR_pwritev2
    #define __NR_pwritev2 328
    #endif

    uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff,
    0xffffffffffffffff};

    int main(void) {
    syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
    /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
    syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul,
    /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
    syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
    /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
    intptr_t res = 0;
    memcpy((void*)0x20000240, "./file0\000", 8);
    syscall(__NR_creat, /*file=*/0x20000240ul, /*mode=*/0ul);
    res = syscall(__NR_pipe2, /*pipefd=*/0x20001900ul, /*flags=*/0ul);
    if (res != -1) {
    r[0] = *(uint32_t*)0x20001900;
    r[1] = *(uint32_t*)0x20001904;
    }
    memcpy((void*)0x20000480,
    "\x15\x00\x00\x00\x65\xff\xff\x01\x80\x00\x00\x08\x00\x39\x50\x32\x30"
    "\x30\x30",
    19);
    syscall(__NR_write, /*fd=*/r[1], /*data=*/0x20000480ul, /*size=*/0x15ul);
    res = syscall(__NR_dup, /*oldfd=*/r[1]);
    if (res != -1)
    r[2] = res;
    *(uint32_t*)0x20000100 = 0x18;
    *(uint32_t*)0x20000104 = 0;
    *(uint64_t*)0x20000108 = 0;
    *(uint64_t*)0x20000110 = 0;
    syscall(__NR_write, /*fd=*/r[2], /*arg=*/0x20000100ul, /*len=*/0x18ul);
    *(uint32_t*)0x200000c0 = 0x14c;
    *(uint32_t*)0x200000c4 = 5;
    *(uint64_t*)0x200000c8 = 0;
    *(uint64_t*)0x200000d0 = 0;
    *(uint64_t*)0x200000d8 = 0;
    *(uint64_t*)0x200000e0 = 0;
    *(uint32_t*)0x200000e8 = 0;
    *(uint32_t*)0x200000ec = 0;
    syscall(__NR_write, /*fd=*/r[2], /*arg=*/0x200000c0ul, /*len=*/0x137ul);
    memcpy((void*)0x20000080, "./file0\000", 8);
    memcpy((void*)0x20000040, "9p\000", 3);
    memcpy((void*)0x20000280, "trans=fd,", 9);
    memcpy((void*)0x20000289, "rfdno", 5);
    *(uint8_t*)0x2000028e = 0x3d;
    sprintf((char*)0x2000028f, "0x%016llx", (long long)r[0]);
    *(uint8_t*)0x200002a1 = 0x2c;
    memcpy((void*)0x200002a2, "wfdno", 5);
    *(uint8_t*)0x200002a7 = 0x3d;
    sprintf((char*)0x200002a8, "0x%016llx", (long long)r[2]);
    *(uint8_t*)0x200002ba = 0x2c;
    memcpy((void*)0x200002bb, "cache=mmap", 10);
    *(uint8_t*)0x200002c5 = 0x2c;
    *(uint8_t*)0x200002c6 = 0x6b;
    syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x20000080ul, /*type=*/0x20000040ul,
    /*flags=*/0ul, /*opts=*/0x20000280ul);
    memcpy((void*)0x20000140, "./file0\000", 8);
    syscall(__NR_chmod, /*file=*/0x20000140ul, /*mode=*/0ul);
    memcpy((void*)0x20000300, "./file0\000", 8);
    res = syscall(__NR_creat, /*file=*/0x20000300ul, /*mode=*/0ul);
    if (res != -1)
    r[3] = res;
    *(uint64_t*)0x20000780 = 0x20000180;
    memset((void*)0x20000180, 142, 1);
    *(uint64_t*)0x20000788 = 0xfdef;
    syscall(__NR_pwritev2, /*fd=*/r[3], /*vec=*/0x20000780ul, /*vlen=*/1ul,
    /*off_low=*/0, /*off_high=*/0, /*flags=*/0x16ul);
    return 0;
    }

    remember to run it syz-execprog -repeat 0 ./repro.txt

    =* repro.txt =*
    creat(&(0x7f0000000240)='./file0\x00', 0x0)
    pipe2$9p(&(0x7f0000001900)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
    write$P9_RVERSION(r1, &(0x7f0000000480)=ANY=[@ANYBLOB="1500000065ffff018000000800395032303030"], 0x15)
    r2 = dup(r1)
    write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18)
    write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137)
    mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@cache_mmap}], [], 0x6b}})
    chmod(&(0x7f0000000140)='./file0\x00', 0x0)
    r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0)
    pwritev2(r3, &(0x7f0000000780)=[{&(0x7f0000000180)="8e", 0xfdef}], 0x1, 0x0, 0x0, 0x16)

    and see also in https://gist.github.com/xrivendell7/8a65b0e5c5109d1ce87acfd56f713544

    I hope it helps.
    Best regards

    \
     
     \ /
      Last update: 2024-05-27 16:27    [W:4.718 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site