linux-kernel - Re: WARNING: bad unlock balance in ovl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAOQ4uxhTAR0-evX0DHdvF9BhHwgC8dU-532FyUiSCqcfujfiKA@mail.gmail.com>
Date:   Mon, 2 Mar 2020 15:24:01 +0200
From:   Amir Goldstein <amir73il@...il.com>
To:     Dmitry Vyukov <dvyukov@...gle.com>
Cc:     syzbot <syzbot+66a9752fa927f745385e@...kaller.appspotmail.com>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        overlayfs <linux-unionfs@...r.kernel.org>,
        Miklos Szeredi <miklos@...redi.hu>,
        Miklos Szeredi <mszeredi@...hat.com>,
        syzkaller-bugs <syzkaller-bugs@...glegroups.com>
Subject: Re: WARNING: bad unlock balance in ovl_llseek

On Mon, Mar 2, 2020 at 2:35 PM Dmitry Vyukov <dvyukov@...gle.com> wrote:
>
> On Mon, Mar 2, 2020 at 1:10 PM Amir Goldstein <amir73il@...il.com> wrote:
> > > > On Sun, Mar 1, 2020 at 9:13 PM syzbot
> > > > <syzbot+66a9752fa927f745385e@...kaller.appspotmail.com> wrote:
> > > > >
> > > > > Hello,
> > > > >
> > > > > syzbot found the following crash on:
> > > > >
> > > > > HEAD commit:    f8788d86 Linux 5.6-rc3
> > > > > git tree:       upstream
> > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=13c5f8f9e00000
> > > > > kernel config:  https://syzkaller.appspot.com/x/.config?x=5d2e033af114153f
> > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=66a9752fa927f745385e
> > > > > compiler:       clang version 10.0.0 (https://github.com/llvm/llvm-project/ c2443155a0fb245c8f17f2c1c72b6ea391e86e81)
> > > > > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=131d9a81e00000
> > > > > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=14117a81e00000
> > > > >
> > > >
> > > > Dmitry,
> > > >
> > > > There is something strange about the C repro.
> > > > It passes an invalid address for the first arg of mount syscall:
> > > >
> > > >     syscall(__NR_mount, 0x400000ul, 0x20000000ul, 0x20000080ul, 0ul,
> > > >             0x20000100ul);
> > > >
> > > > With this address mount syscall returns -EFAULT on my system.
> > > > I fixed this manually, but repro did not trigger the reported bug on my system.
> > >
> > > Hi Amir,
> > >
> > > This is not strange in the context of fuzzer, it's goal is to pass
> > > random data. Generally if it says 0x400000ul, that's what it is, don't
> > > fix it, or you are running a different program that may not reproduce
> > > the bug. If syzbot attaches a reproducer, the bug was triggered by
> > > precisely this program.
> > >
> >
> > What's strange it that a bug in overlay code cannot be triggered if overlay
> > isn't mounted and as it is the repro couldn't mount overlayfs at all, at
> > lease with my kernel config.
>
> Can it depend on kernel config? The bug was triggered by the program
> provided somehow.

I am not sure. I do not have CONFIG_HARDENED_USERCOPY set.

>
> Separate question: why is it failing? Isn't src unused for overlayfs?
> Where/how does vfs code look at src?
>

SYSCALL_DEFINE5(mount, ...
copy_mount_string(dev_name)
strndup_user()
memdup_user()
copy_from_user()

Not in overlayfs code.
Actually, the source (dev) is not used by overlayfs but is visible at
/proc/mounts.

Thanks,
Amir.