Message-ID: <CAGyP=7ddSXLc-CjE3TU=k0SGGg+LjgWdADXTnjNDdsM+06k-XQ@mail.gmail.com>
Date:   Wed, 16 Dec 2020 15:52:58 +0530
From:   Palash Oswal <oswalpalash@...il.com>
To:     linux-kernel@...r.kernel.org
Subject: BUG: unable to handle kernel paging request in squashfs_decompress

Syzkaller hit 'BUG: unable to handle kernel paging request in
squashfs_decompress' bug.

Head Commit : 841fca5a32cc tag: v5.10.1
git tree : stable

kernel config :  Attached config.txt

console output :
BUG: unable to handle page fault for address: ffffc9000014b000
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 3c00067 P4D 3c00067 PUD 3dce067 PMD 3dcf067 PTE 0
Oops: 0002 [#1] SMP PTI
CPU: 0 PID: 318 Comm: syz-executor186 Not tainted 5.10.1 #5
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1 04/01/2014
RIP: 0010:memcpy_erms+0x6/0x10 arch/x86/lib/memcpy_64.S:55
Code: cc cc cc cc eb 1e 0f 1f 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2
07 f3 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 <f3> a4
c3 0f 1f 80 00 00 00 00 48 89 f8 48 83 fa 20 72 7e 40 38 fe
RSP: 0018:ffffc9000089f840 EFLAGS: 00010246
RAX: ffffc9000014affe RBX: 0000000000001000 RCX: 0000000000000ffe
RDX: 0000000000001000 RSI: ffff888005a34002 RDI: ffffc9000014b000
RBP: ffffc9000089f8b8 R08: 0000000000007368 R09: ffff888005ca1240
R10: ffffffff8157e760 R11: 0000000000000000 R12: 0000000000000000
R13: ffffc9000014affe R14: 0000000000000000 R15: 000000000000236a
FS:  00000000019f7380(0000) GS:ffff88803ec00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc9000014b000 CR3: 0000000005ada006 CR4: 0000000000370ef0
Call Trace:
 squashfs_decompress+0x62/0x90 fs/squashfs/decompressor_single.c:70
 squashfs_read_data+0x111/0x710 fs/squashfs/block.c:214
 squashfs_cache_get+0x198/0x460 fs/squashfs/cache.c:110
 squashfs_read_metadata+0xeb/0x1b0 fs/squashfs/cache.c:344
 squashfs_xattr_lookup+0x76/0xd0 fs/squashfs/xattr_id.c:38
 squashfs_read_inode+0x63d/0xae0 fs/squashfs/inode.c:395
 squashfs_iget+0xa8/0xf0 fs/squashfs/inode.c:85
 squashfs_lookup+0x42d/0x500 fs/squashfs/namei.c:212
 lookup_open fs/namei.c:3083 [inline]
 open_last_lookups fs/namei.c:3178 [inline]
 path_openat+0x6ee/0x14a0 fs/namei.c:3366
 do_filp_open+0xa7/0x190 fs/namei.c:3396
 do_sys_openat2+0xcc/0x1e0 fs/open.c:1168
 do_sys_open fs/open.c:1184 [inline]
 __do_sys_openat fs/open.c:1200 [inline]
 __se_sys_openat fs/open.c:1195 [inline]
 __x64_sys_openat+0x80/0xe0 fs/open.c:1195
 do_syscall_64+0x38/0x90 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x4489fd
Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48
89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffea7e1498 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000400530 RCX: 00000000004489fd
RDX: 0000000000080000 RSI: 0000000020000040 RDI: 0000000000000005
RBP: 0000000000403e50 R08: 0000000000000000 R09: 0000000000400530
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000403ef0
R13: 0000000000000000 R14: 00000000004bf018 R15: 0000000000400530
Modules linked in:
Dumping ftrace buffer:
   (ftrace buffer empty)
CR2: ffffc9000014b000
---[ end trace ef664778b3add560 ]---
RIP: 0010:memcpy_erms+0x6/0x10 arch/x86/lib/memcpy_64.S:55
Code: cc cc cc cc eb 1e 0f 1f 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2
07 f3 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 <f3> a4
c3 0f 1f 80 00 00 00 00 48 89 f8 48 83 fa 20 72 7e 40 38 fe
RSP: 0018:ffffc9000089f840 EFLAGS: 00010246
RAX: ffffc9000014affe RBX: 0000000000001000 RCX: 0000000000000ffe
RDX: 0000000000001000 RSI: ffff888005a34002 RDI: ffffc9000014b000
RBP: ffffc9000089f8b8 R08: 0000000000007368 R09: ffff888005ca1240
R10: ffffffff8157e760 R11: 0000000000000000 R12: 0000000000000000
R13: ffffc9000014affe R14: 0000000000000000 R15: 000000000000236a
FS:  00000000019f7380(0000) GS:ffff88803ec00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc9000014b000 CR3: 0000000005ada006 CR4: 0000000000370ef0


c reproducer : Attached reproduer.c

syzkaller reproducer :
# {Threaded:false Collide:false Repeat:false RepeatTimes:0 Procs:1
Sandbox: Fault:false FaultCall:-1 FaultNth:0 Leak:false
NetInjection:false NetDevices:false NetReset:false Cgroups:false
BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false
VhciInjection:false Wifi:false Sysctl:false UseTmpDir:false
HandleSegv:false Repro:false Trace:false}
r0 = syz_mount_image$squashfs(&(0x7f0000000000)='squashfs\x00',
&(0x7f0000000100)='./file0\x00', 0x7fffffff, 0x1,
&(0x7f0000000200)=[{&(0x7f0000010000)="6873717307000000911d675f004000000100000003000e00e0000200040000001201000000000000f801000000000000ac01000000000000e0010000000000007f000000000000001f0100000000000076010000000000009a010000000000001a73797a6b616c6c6572203a200020438c01200000009820002838001100009e001d0200ed0100000100911d675f40012b0100644c002a7d00032d6e001a040f000300ff277c005901006d08264c00000e2f746d702f73797a2d696d61676567656e3431393737363339322f66696c6530b5000129750102c40b7d00294d00074d0009297d000529f5010a2da402e6177e04bc002add00065d0160de0328232cdc006d0dff410000291f000100c027ed0007dc04651f545d1a085c001100004800130100a100034d00204c00090200040066696c65304000015002b2013104d404f7050200088003032e636f6c647e590201f9069e4001ec080131d60005273100322a3100331100000b00136000a1001fdc0011000069010000000000001a001200c1007edd0020dd0040dd009edd00d6de001201bc001100007e0100000000000008805cf90100535f0100a2010000000000001b001e00000600786174747231060000c401274d0032274d00321100000d001200c100024d00244c00110000b40100000000000001",
0x1e9}], 0x0, &(0x7f0000010200)=ANY=[])
openat(r0, &(0x7f0000000040)='./file1\x00', 0x80000, 0x0)

I haven't seen this entry on the syzkaller dashboard yet; syzbot
tracker - https://groups.google.com/g/syzkaller-bugs/c/WrjySbEAF3s .

Palash

View attachment "CONFIG.txt" of type "text/plain" (250289 bytes)

View attachment "reproducer.c" of type "text/x-c-code" (7115 bytes)

Powered by blists - more mailing lists