linux-kernel - Re: general protection fault in do_move

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190618140239.GA17978@ZenIV.linux.org.uk>
Date:   Tue, 18 Jun 2019 15:02:40 +0100
From:   Al Viro <viro@...iv.linux.org.uk>
To:     syzbot <syzbot+6004acbaa1893ad013f0@...kaller.appspotmail.com>
Cc:     arnd@...db.de, axboe@...nel.dk, bp@...en8.de,
        catalin.marinas@....com, christian@...uner.io, dhowells@...hat.com,
        geert@...ux-m68k.org, hare@...e.com, heiko.carstens@...ibm.com,
        hpa@...or.com, linux-fsdevel@...r.kernel.org,
        linux-kernel@...r.kernel.org, luto@...nel.org, mingo@...hat.com,
        syzkaller-bugs@...glegroups.com, tglx@...utronix.de, x86@...nel.org
Subject: Re: general protection fault in do_move_mount (2)

On Tue, Jun 18, 2019 at 03:47:10AM -0700, syzbot wrote:
> Hello,
> 
> syzbot found the following crash on:
> 
> HEAD commit:    9e0babf2 Linux 5.2-rc5
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=138b310aa00000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=d16883d6c7f0d717
> dashboard link: https://syzkaller.appspot.com/bug?extid=6004acbaa1893ad013f0
> compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=154e8c2aa00000

IDGI...

mkdir(&(0x7f0000632000)='./file0\x00', 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
r0 = open(&(0x7f0000032ff8)='./file0\x00', 0x0, 0x0)
r1 = memfd_create(&(0x7f00000001c0)='\xb3', 0x0)
write$FUSE_DIRENT(r1, &(0x7f0000000080)=ANY=[], 0x29)
move_mount(r0, &(0x7f0000000040)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x66)

reads as if we'd done mkdir ./file0, opened it and then tried
to feed move_mount(2) "./file0" relative to that descriptor.
How the hell has that avoided an instant -ENOENT?  On the first
pair, that is - the second one (AT_FDCWD, "./file0") is fine...

Confused...  Incidentally, what the hell is
	mount(0x0, 0x0, 0x0, 0x0, 0x0)
about?  *IF* that really refers to mount(2) with
such arguments, all you'll get is -EFAULT.  Way before
it gets to actually doing anything - it won't get past
        /* ... and get the mountpoint */
        retval = user_path(dir_name, &path);
        if (retval)
                return retval;
in do_mount(2)...