linux-ext4 - Re: [syzbot] [ext4?] general protection fault in ep_poll

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 21 Jul 2023 11:47:20 +0200
From:   Aleksandr Nogikh <nogikh@...gle.com>
To:     syzbot <syzbot+c2b68bdf76e442836443@...kaller.appspotmail.com>
Cc:     adilger.kernel@...ger.ca, brauner@...nel.org, bvanassche@....org,
        linux-ext4@...r.kernel.org, linux-fsdevel@...r.kernel.org,
        linux-kernel@...r.kernel.org, mingo@...nel.org,
        peterz@...radead.org, syzkaller-bugs@...glegroups.com,
        tytso@....edu, viro@...iv.linux.org.uk,
        Dmitry Vyukov <dvyukov@...gle.com>
Subject: Re: [syzbot] [ext4?] general protection fault in ep_poll_callback

On Fri, Jul 21, 2023 at 11:30 AM syzbot
<syzbot+c2b68bdf76e442836443@...kaller.appspotmail.com> wrote:
>
> syzbot has bisected this issue to:
>
> commit a0b0fd53e1e67639b303b15939b9c653dbe7a8c4
> Author: Bart Van Assche <bvanassche@....org>
> Date:   Thu Feb 14 23:00:46 2019 +0000
>
>     locking/lockdep: Free lock classes that are no longer in use

No, that doesn't seem like a real cause commit.

>
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=16c0c84ea80000

The reproducer actually causes a lot of different crashes, which
apparently confused the bisector.

run #0: crashed: general protection fault in ext4_finish_bio
run #1: crashed: general protection fault in ext4_finish_bio
run #2: crashed: KASAN: wild-memory-access Read in force_sig_info_to_task
run #3: crashed: KASAN: wild-memory-access Read in force_sig_info_to_task
run #4: crashed: BUG: unable to handle kernel paging request in __run_timers
run #5: crashed: BUG: unable to handle kernel paging request in __run_timers
run #6: crashed: general protection fault in mac80211_hwsim_netlink_notify
run #7: crashed: general protection fault in mac80211_hwsim_netlink_notify
run #8: crashed: general protection fault in __run_timers
run #9: crashed: general protection fault in __run_timers
run #10: crashed: KASAN: wild-memory-access Read in process_one_work
run #11: crashed: KASAN: wild-memory-access Read in process_one_work
run #12: crashed: general protection fault in timerqueue_del
run #13: crashed: general protection fault in timerqueue_del
run #14: crashed: kernel BUG in corrupted
run #15: crashed: kernel BUG in corrupted
run #16: crashed: general protection fault in mm_update_next_owner
run #17: crashed: general protection fault in mm_update_next_owner

Isn't it a sign of a severe memory corruption caused by the reproducer?


> start commit:   bfa3037d8280 Merge tag 'fuse-update-6.5' of git://git.kern..
> git tree:       upstream
> final oops:     https://syzkaller.appspot.com/x/report.txt?x=15c0c84ea80000
> console output: https://syzkaller.appspot.com/x/log.txt?x=11c0c84ea80000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=27e33fd2346a54b
> dashboard link: https://syzkaller.appspot.com/bug?extid=c2b68bdf76e442836443
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=111c904ea80000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=116b0faaa80000
>
> Reported-by: syzbot+c2b68bdf76e442836443@...kaller.appspotmail.com
> Fixes: a0b0fd53e1e6 ("locking/lockdep: Free lock classes that are no longer in use")
>
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection
>