lkml.org 
[lkml]   [2016]   [Sep]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: fs: GPF in bd_mount
On Sun, Sep 04, 2016 at 12:43:28PM +0200, Dmitry Vyukov wrote:
> Hello,
>
> The following program triggers GPF in bd_mount:
>
>
> // autogenerated by syzkaller (http://github.com/google/syzkaller)
> #include <fcntl.h>
> #include <sys/stat.h>
> #include <sys/types.h>
> #include <unistd.h>
> #include <sched.h>
> #include <linux/sched.h>
>
> int main()
> {
> int fd;
>
> unshare(CLONE_NEWUSER);
> unshare(CLONE_NEWNS);
> mkdir("./bus", 0662515705056234013740);
> mount("./bus/bus", "./bus", "bdev", 0,
> "\xa9\x95\xbd\x88\x07\x6a\x39\xe8\xf4\xef\xf2\x6b\x88\x53\x1d\xdb"
> "\xd2\x83\xf9\x5f\x4f\x44\x71\xf2\x08\x84\x2b\xae\x94\x87\xb7\xa6"
> "\xf8\x9d\xc9\x96\xc7\x17\x2e\x22\xc4\xd2\xcc\xf9\x04\x0b\xd2\xaf"
> "\xf3\x0b\xec\xeb\x2b\x75\xf2\x93\xa2\xd4\x00\xd8\x69\x47\x48\xf5"
> "\xaf\x2b\xb8\x7c\x06\x04\x69\x8b\x46\x0d\x44\x79\x8c\x86\x68\xfd"
> "\xd3\xb4\x1c\x8e\x9e\x6c\x58\x0c\xa5\xdf\x55\x4d\x59\x65\xc9\x70"
> "\x7c\x8a\x44\x26\x7d\xba\xf0\x3d\x46\x9e\x3c\xbe\x22\xc3");
> return 0;
> }
>
>
> general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN
> Modules linked in:
> CPU: 2 PID: 4052 Comm: a.out Not tainted 4.8.0-rc3-next-20160825+ #11
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> task: ffff88006b37a380 task.stack: ffff880066dc0000
> RIP: 0010:[<ffffffff81927582>] [<ffffffff81927582>]
> bd_mount+0x52/0xa0 fs/block_dev.c:650
> RSP: 0018:ffff880066dc7ca0 EFLAGS: 00010207
> RAX: dffffc0000000000 RBX: ffffffffffffffff RCX: 0000000000000001
> RDX: 0000000000000018 RSI: ffffffff886fd6c0 RDI: 00000000000000c7
> RBP: ffff880066dc7cb0 R08: ffff88006b642cb8 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff8880d440
> R13: ffff88006a4ac1c0 R14: ffff88006b64b000 R15: 0000000000000000
> FS: 00000000012b2880(0000) GS:ffff88006d200000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00000000004b2160 CR3: 000000006cc72000 CR4: 00000000000006e0
> Stack:
> ffff880068e2c840 ffffffff8880d440 ffff880066dc7cf0 ffffffff8186e73b
> 0000000000000004 ffff88006659c600 ffffffff8880d440 ffff88006a4ac1c0
> 0000000000000000 ffff880068e2c840 ffff880066dc7d40 ffffffff818ce44a
> Call Trace:
> [<ffffffff8186e73b>] mount_fs+0x9b/0x2f0 fs/super.c:1177
> [<ffffffff818ce44a>] vfs_kern_mount+0x7a/0x3e0 fs/namespace.c:948
> [< inline >] do_new_mount fs/namespace.c:2393
> [<ffffffff818d6255>] do_mount+0x3d5/0x26b0 fs/namespace.c:2715
> [< inline >] SYSC_mount fs/namespace.c:2907
> [<ffffffff818d8f6b>] SyS_mount+0xab/0x120 fs/namespace.c:2884
> [<ffffffff810088ff>] do_syscall_64+0x1df/0x640 arch/x86/entry/common.c:288
> [<ffffffff86e10543>] entry_SYSCALL64_slow_path+0x25/0x25
> arch/x86/entry/entry_64.S:249
> Code: 87 e8 f3 ca fb ff 48 85 c0 48 89 c3 74 4c e8 a6 47 ca ff 48 8d
> bb c8 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80>
> 3c 02 00 75 36 4c 8b a3 c8 00 00 00 48 b8 00 00 00 00 00 fc
> RIP [<ffffffff81927582>] bd_mount+0x52/0xa0 fs/block_dev.c:650
> RSP <ffff880066dc7ca0>
> ---[ end trace 0e5d909159d79633 ]---
>
>
> On commit 0f98f121e1670eaa2a2fbb675e07d6ba7f0e146f of linux-next.
> --
> To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html


I think this is fixed with:
commit e9e5e3fae8da7e237049e00e0bfc9e32fd808fe8
Author: Vegard Nossum <vegard.nossum@oracle.com>
Date: Mon Aug 22 12:47:43 2016 +0200

bdev: fix NULL pointer dereference

in mainline. The commit is absent in linux-next.

--
Mateusz Guzik

\
 
 \ /
  Last update: 2016-09-17 09:58    [W:0.053 / U:0.672 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site