linux-kernel - Re: [PATCH] vfs: avoid spurious dentry ref/unref cycle on open

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGudoHFm07iqjhagt-SRFcWsnjqzOtVD4bQC86sKBFEFQRt3kA@mail.gmail.com>
Date: Wed, 7 Aug 2024 11:50:50 +0200
From: Mateusz Guzik <mjguzik@...il.com>
To: Al Viro <viro@...iv.linux.org.uk>
Cc: brauner@...nel.org, jack@...e.cz, linux-kernel@...r.kernel.org, 
	linux-fsdevel@...r.kernel.org
Subject: Re: [PATCH] vfs: avoid spurious dentry ref/unref cycle on open

This eventually broke:

[ 1297.949437] BUG: kernel NULL pointer dereference, address: 0000000000000028
[ 1297.951840] #PF: supervisor read access in kernel mode
[ 1297.953548] #PF: error_code(0x0000) - not-present page
[ 1297.954984] PGD 109590067 P4D 0
[ 1297.955533] Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI
[ 1297.956340] CPU: 18 UID: 0 PID: 1113 Comm: cron Not tainted
6.11.0-rc1-00003-g80efb96e5cd4 #291
[ 1297.958090] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009),
BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014
[ 1297.959926] RIP: 0010:vfs_tmpfile+0x162/0x230
[ 1297.960666] Code: b2 8b 55 48 83 e2 20 83 fa 01 19 ff 81 e7 00 f0
ff ff 81 c7 20 10 00 00 a9 00 40 00
04 75 90 48 8b 85 a0 00 00 00 4c 8b 48 30 <49> 8b 51 28 48 8b 92 b8 03
00 00 48 85 d2 0f 84 71 ff ff ff 48 8b
[ 1297.963682] RSP: 0018:ff38d126c19c3cc0 EFLAGS: 00010246
[ 1297.964549] RAX: ff2c2c8c89a3b980 RBX: 0000000000000000 RCX: 0000000000000002
[ 1297.965714] RDX: 0000000000000000 RSI: ff2c2c8c89a3ba30 RDI: 0000000000000020
[ 1297.966872] RBP: ff2c2c8c91917b00 R08: 0000000000000000 R09: 0000000000000000
[ 1297.968046] R10: 0000000000000000 R11: ff2c2c8c91cd23f0 R12: ffffffffb7b91e20
[ 1297.969202] R13: ff38d126c19c3d48 R14: ff2c2c8c89a3b980 R15: ff2c2c8c89a00a58
[ 1297.970364] FS:  00007ff81cb63840(0000) GS:ff2c2c91e7a80000(0000)
knlGS:0000000000000000
[ 1297.971694] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1297.972645] CR2: 0000000000000028 CR3: 000000010cf58001 CR4: 0000000000371ef0
[ 1297.973825] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1297.974996] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400
[ 1297.976175] Call Trace:
[ 1297.976609]  <TASK>
[ 1297.976978]  ? __die+0x23/0x70
[ 1297.977501]  ? page_fault_oops+0x15c/0x480
[ 1297.978191]  ? jbd2_journal_stop+0x13c/0x2d0
[ 1297.978903]  ? exc_page_fault+0x78/0x170
[ 1297.979564]  ? asm_exc_page_fault+0x26/0x30
[ 1297.980262]  ? vfs_tmpfile+0x162/0x230
[ 1297.980891]  path_openat+0xc70/0x12b0
[ 1297.981507]  ? __count_memcg_events+0x58/0xf0
[ 1297.982233]  ? handle_mm_fault+0xb9/0x260
[ 1297.982903]  ? do_user_addr_fault+0x2ed/0x6e0
[ 1297.983636]  do_filp_open+0xb0/0x150
[ 1297.984241]  do_sys_openat2+0x91/0xc0
[ 1297.984855]  __x64_sys_openat+0x57/0xa0
[ 1297.985504]  do_syscall_64+0x52/0x150
[ 1297.986128]  entry_SYSCALL_64_after_hwframe+0x76/0x7e

tripping ip:
vfs_tmpfile+0x162/0x230:
fsnotify_parent at include/linux/fsnotify.h:81
(inlined by) fsnotify_file at include/linux/fsnotify.h:131
(inlined by) fsnotify_open at include/linux/fsnotify.h:401
(inlined by) vfs_tmpfile at fs/namei.c:3781

-- 
Mateusz Guzik <mjguzik gmail.com>