linux-kernel - Re: BUG: corrupted list in __dentry

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180401200531.GA30522@ZenIV.linux.org.uk>
Date:   Sun, 1 Apr 2018 21:05:31 +0100
From:   Al Viro <viro@...IV.linux.org.uk>
To:     syzbot <syzbot+f3bd89a5ab3266b10540@...kaller.appspotmail.com>
Cc:     linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
        syzkaller-bugs@...glegroups.com
Subject: Re: BUG: corrupted list in __dentry_kill

On Sun, Apr 01, 2018 at 04:35:19AM +0100, Al Viro wrote:
> On Sat, Mar 31, 2018 at 04:01:02PM -0700, syzbot wrote:
> > Hello,
> > 
> > syzbot hit the following crash on bpf-next commit
> > 7828f20e3779e4e85e55371e0e43f5006a15fb41 (Sat Mar 31 00:17:57 2018 +0000)
> > Merge branch 'bpf-cgroup-bind-connect'
> > syzbot dashboard link:
> > https://syzkaller.appspot.com/bug?extid=f3bd89a5ab3266b10540
> > 
> > So far this crash happened 22 times on bpf-next, upstream.
> > C reproducer: https://syzkaller.appspot.com/x/repro.c?id=6290970458980352
> > syzkaller reproducer:
> > https://syzkaller.appspot.com/x/repro.syz?id=6577156880596992
> > Raw console output:
> > https://syzkaller.appspot.com/x/log.txt?id=5107570603720704
> > Kernel config:
> > https://syzkaller.appspot.com/x/.config?id=5909223872832634926
> > compiler: gcc (GCC) 7.1.1 20170620
> > 
> > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > Reported-by: syzbot+f3bd89a5ab3266b10540@...kaller.appspotmail.com
> > It will help syzbot understand when the bug is fixed. See footer for
> > details.
> > If you forward the report, please keep this part and the footer.
> > 
> > RBP: 00007ffd1bbb3ae0 R08: 0000000020000200 R09: 0000000300000000
> > R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
> > R13: 0000000000000003 R14: 0000000000001380 R15: 00007ffd1bbb3378
> > list_del corruption. prev->next should be 00000000a8104008, but was
> > 00000000081c6144
> 
> Lovely...  I'll look into that tomorrow morning.

Can't reproduce - it reproducer had been running for several hours, with
that kernel and that config (gcc 6.3, not 7.1, though), no oopsen...

If somebody can reproduce that thing, I'd appreciate having it bisected
a bit...