linux-kernel - Re: We found a general protection fault in evict

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <224ae998-d264-c984-263d-a9a7cf6c7a00@redhat.com>
Date:   Thu, 27 Apr 2023 15:04:19 -0400
From:   Bob Peterson <rpeterso@...hat.com>
To:     yang lan <lanyang0908@...il.com>, agruenba@...hat.com,
        cluster-devel@...hat.com, linux-kernel@...r.kernel.org
Subject: Re: We found a general protection fault in evict

On 4/27/23 11:15 AM, yang lan wrote:
> Hi,
> 
> We use our modified Syzkaller to fuzz the latest Linux kernel and find a 
> bug in the gfs2 file system.
> 
> We have used the utility syz-execprog to reproduce this bug with 
> ./syz-execprog -executor=./syz-executor -repeat=100 -procs=6 -cover=1 poc.
> Now, this bug can be triggered with the following prog provided:
> 
> HEAD commit: f1b32fda06d2 tag: v5.10.179
> console log: https://pastebin.com/raw/3XhteWrX 
> <https://pastebin.com/raw/3XhteWrX>
> kernel config: https://pastebin.com/raw/BiggLxRg 
> <https://pastebin.com/raw/BiggLxRg>
> Syz reproducer: https://pastebin.com/raw/PwbMR8ag 
> <https://pastebin.com/raw/PwbMR8ag>
> C reproducer: 
> https://drive.google.com/file/d/1j4g8EUrFb1GGdaaRBNHE4ATXiqeg6-zI/view?usp=sharing <https://drive.google.com/file/d/1j4g8EUrFb1GGdaaRBNHE4ATXiqeg6-zI/view?usp=sharing>
> 
> gfs2: fsid=syz:syz.0: no resource groups found in the file system.

Hi,

The upstream kernel doesn't seem to GPF here. I get a non-fatal file 
system withdraw (which seems reasonable given what the resulting fs 
looks like):

[root@...-upstream9 /home/bob/xfstests-dev]# /home/bob/tools/c/poc_evict
[root@...-upstream9 /home/bob/xfstests-dev]# echo $?
0

[ 2530.707005] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", 
"syz:syz"
[ 2530.707576] gfs2: fsid=syz:syz: Now mounting FS (format 1801)...
[ 2530.708349] gfs2: fsid=syz:syz.0: fatal: filesystem consistency error
[ 2530.708349]   inode = 3 2076
[ 2530.708349]   function = gfs2_dinode_in, file = fs/gfs2/glops.c, line 
= 472
[ 2530.709534] gfs2: fsid=syz:syz.0: G:  s:SH n:2/81c f:qobnN t:SH 
d:EX/0 a:0 v:0 r:3 m:200 p:1
[ 2530.710165] gfs2: fsid=syz:syz.0:  H: s:SH f:H e:0 p:1825 [mount] 
gfs2_fill_super+0x8f0/0xef0 [gfs2]
[ 2530.710846] gfs2: fsid=syz:syz.0:  I: n:3/2076 t:4 f:0x00 
d:0x00000000 s:0 p:0
[ 2530.711387] gfs2: fsid=syz:syz.0: about to withdraw this file system
[ 2530.711857] gfs2: fsid=syz:syz.0: File system withdrawn
[ 2530.712256] CPU: 6 PID: 1825 Comm: mount Kdump: loaded Not tainted 
6.3.0-rc3+ #26
[ 2530.712803] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.1-1.el9 
04/01/2014
[ 2530.713324] Call Trace:
[ 2530.713513]  <TASK>
[ 2530.713678]  dump_stack_lvl+0x48/0x60
[ 2530.713959]  gfs2_withdraw+0x479/0x5c0 [gfs2]
[ 2530.714299]  gfs2_inode_refresh+0x267/0x2d0 [gfs2]
[ 2530.714667]  gfs2_instantiate+0x87/0xc0 [gfs2]
[ 2530.715013]  gfs2_glock_wait+0x8b/0xb0 [gfs2]
[ 2530.715356]  init_journal+0x302/0xaf0 [gfs2]
[ 2530.715693]  ? vsnprintf+0x2ba/0x560
[ 2530.715966]  ? gfs2_fill_super+0x8f0/0xef0 [gfs2]
[ 2530.716326]  ? snprintf+0x3d/0x50
[ 2530.716576]  gfs2_fill_super+0x8f0/0xef0 [gfs2]
[ 2530.716927]  ? gfs2_fill_super+0x7aa/0xef0 [gfs2]
[ 2530.717287]  ? mutex_lock+0x12/0x40
[ 2530.717552]  ? __pfx_gfs2_fill_super+0x10/0x10 [gfs2]
[ 2530.717938]  ? snprintf+0x3d/0x50
[ 2530.718190]  ? sget_fc+0x208/0x300
[ 2530.718453]  ? __pfx_gfs2_fill_super+0x10/0x10 [gfs2]
[ 2530.718837]  get_tree_bdev+0x171/0x270
[ 2530.719126]  gfs2_get_tree+0x22/0x90 [gfs2]
[ 2530.719446]  vfs_get_tree+0x26/0xd0
[ 2530.719711]  path_mount+0x464/0xa80
[ 2530.719981]  __x64_sys_mount+0xeb/0x120
[ 2530.720271]  do_syscall_64+0x5d/0x90
[ 2530.720544]  ? syscall_exit_to_user_mode+0x1b/0x40
[ 2530.720902]  ? do_syscall_64+0x6d/0x90
[ 2530.721185]  ? do_syscall_64+0x6d/0x90
[ 2530.721467]  ? syscall_exit_to_user_mode+0x1b/0x40
[ 2530.721823]  ? do_syscall_64+0x6d/0x90
[ 2530.722106]  ? do_syscall_64+0x6d/0x90
[ 2530.722386]  ? do_syscall_64+0x6d/0x90
[ 2530.722668]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2530.723046] RIP: 0033:0x7f7dcd83f7be
[ 2530.723316] Code: 48 8b 0d 65 a6 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 
66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 
05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 32 a6 1b 00 f7 d8 64 89 01 48
[ 2530.724659] RSP: 002b:00007fffe0f3d248 EFLAGS: 00000246 ORIG_RAX: 
00000000000000a5
[ 2530.725211] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 
00007f7dcd83f7be
[ 2530.725733] RDX: 000055b230c02e20 RSI: 000055b230c02e60 RDI: 
000055b230c02e40
[ 2530.726256] RBP: 000055b230c02bf0 R08: 0000000000000000 R09: 
00007fffe0f3bf70
[ 2530.726776] R10: 0000000000000000 R11: 0000000000000246 R12: 
0000000000000000
[ 2530.727298] R13: 000055b230c02e20 R14: 000055b230c02e40 R15: 
000055b230c02bf0
[ 2530.727819]  </TASK>
[ 2530.728005] gfs2: fsid=syz:syz.0: can't read journal index: -5

I'm guessing it's a problem we've already fixed in newer versions, but I 
don't have easy access to that kernel. Perhaps you can bisect it?
I could try older kernels but I've already spent a lot of time on this 
today, so I need to move on to other things.

Regards,

Bob Peterson