linux-kernel - Re: [syzbot] [v9fs?] general protection fault in p9_client

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z9F6cakkpF26_KJu@codewreck.org>
Date: Wed, 12 Mar 2025 21:13:37 +0900
From: asmadeus@...ewreck.org
To: Christian Schoenebeck <linux_oss@...debyte.com>
Cc: ericvh@...nel.org, linux-kernel@...r.kernel.org, lucho@...kov.net,
	syzkaller-bugs@...glegroups.com, v9fs@...ts.linux.dev,
	syzbot <syzbot+5b667f9a1fee4ba3775a@...kaller.appspotmail.com>
Subject: Re: [syzbot] [v9fs?] general protection fault in p9_client_walk

Christian Schoenebeck wrote on Wed, Mar 12, 2025 at 10:36:15AM +0100:
> > RIP: 0010:p9_client_walk+0x9a/0x530 net/9p/client.c:1165
> >  clone_fid fs/9p/fid.h:23 [inline]
> >  v9fs_fid_xattr_set+0x119/0x2d0 fs/9p/xattr.c:121
> >  v9fs_set_acl+0xe6/0x150 fs/9p/acl.c:276
> >  v9fs_set_create_acl+0x4b/0x70 fs/9p/acl.c:306
> >  v9fs_vfs_mkdir_dotl+0x517/0x6e0 fs/9p/vfs_inode_dotl.c:411
> >  vfs_mkdir+0x57d/0x860 fs/namei.c:4313
> >  do_mkdirat+0x301/0x3a0 fs/namei.c:4336
> >  __do_sys_mkdir fs/namei.c:4356 [inline]
> >  __se_sys_mkdir fs/namei.c:4354 [inline]
> >  __x64_sys_mkdir+0xef/0x140 fs/namei.c:4354
> >  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> >  do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
> >  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> Just had a glimpse on it so far. IIUIC the trigger is in
> v9fs_vfs_mkdir_dotl() [fs/9p/vfs_inode_dotl.c:411] ?
> 
>     // NULLs out fid (since dafbe6897)
>     v9fs_fid_add(dentry, &fid);
>     // expects fid being non-NULL
>     v9fs_set_create_acl(inode, fid, dacl, pacl);

Sounds about right, inverting the two calls probably makes sense?

OTOH I don't get why all mkdirs don't hit that.. ah, it's only a problem
if the parent directory has some ACL and none of our tests hit that :/

Well, it shouldn't be too hard to trigger & fix anyway, since you've
done this much want to send the patch?

Thanks,
-- 
Dominique Martinet | Asmadeus