lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAJfpegtzQB09ind8tkYzaiu6ODJvhMKj3myxVS75vbjTcOxU8g@mail.gmail.com> Date: Fri, 30 Oct 2020 14:02:22 +0100 From: Miklos Szeredi <miklos@...redi.hu> To: Ondrej Mosnacek <omosnace@...hat.com> Cc: syzbot <syzbot+f07cc9be8d1d226947ed@...kaller.appspotmail.com>, andriin@...com, Alexei Starovoitov <ast@...nel.org>, bpf <bpf@...r.kernel.org>, Daniel Borkmann <daniel@...earbox.net>, James Morris <jmorris@...ei.org>, john.fastabend@...il.com, kafai@...com, KP Singh <kpsingh@...omium.org>, Linux kernel mailing list <linux-kernel@...r.kernel.org>, Linux Security Module list <linux-security-module@...r.kernel.org>, network dev <netdev@...r.kernel.org>, "Serge E. Hallyn" <serge@...lyn.com>, Song Liu <songliubraving@...com>, syzkaller-bugs <syzkaller-bugs@...glegroups.com>, yhs@...com, linux-fsdevel@...r.kernel.org, overlayfs <linux-unionfs@...r.kernel.org> Subject: Re: general protection fault in security_inode_getattr On Mon, Aug 24, 2020 at 11:00 PM Ondrej Mosnacek <omosnace@...hat.com> wrote: > > On Mon, Aug 24, 2020 at 9:37 PM syzbot > <syzbot+f07cc9be8d1d226947ed@...kaller.appspotmail.com> wrote: > > syzbot has found a reproducer for the following issue on: > > Looping in fsdevel and OverlayFS maintainers, as this seems to be > FS/OverlayFS related... Hmm, the oopsing code is always something like: All code ======== 0: 1b fe sbb %esi,%edi 2: 49 8d 5e 08 lea 0x8(%r14),%rbx 6: 48 89 d8 mov %rbx,%rax 9: 48 c1 e8 03 shr $0x3,%rax d: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) 12: 74 08 je 0x1c 14: 48 89 df mov %rbx,%rdi 17: e8 bc b4 5b fe callq 0xfffffffffe5bb4d8 1c: 48 8b 1b mov (%rbx),%rbx 1f: 48 83 c3 68 add $0x68,%rbx 23: 48 89 d8 mov %rbx,%rax 26: 48 c1 e8 03 shr $0x3,%rax 2a:* 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 48 89 df mov %rbx,%rdi 34: e8 9f b4 5b fe callq 0xfffffffffe5bb4d8 39: 48 8b 1b mov (%rbx),%rbx 3c: 48 83 c3 0c add $0xc,%rbx And that looks (to me) like the unrolled loop in call_int_hook(). I don't see how that could be related to overlayfs, though it's definitely interesting why it only triggers from overlay->vfs_getattr()->security_inode_getattr()... Thanks, Miklos
Powered by blists - more mailing lists