linux-kernel - Re: [syzbot] [v9fs?] general protection fault in p9_client

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2115265.hiCNZqmPJN@silver>
Date: Wed, 12 Mar 2025 15:25:27 +0100
From: Christian Schoenebeck <linux_oss@...debyte.com>
To: asmadeus@...ewreck.org
Cc: ericvh@...nel.org, linux-kernel@...r.kernel.org, lucho@...kov.net,
 syzkaller-bugs@...glegroups.com, v9fs@...ts.linux.dev,
 syzbot <syzbot+5b667f9a1fee4ba3775a@...kaller.appspotmail.com>
Subject: Re: [syzbot] [v9fs?] general protection fault in p9_client_walk

On Wednesday, March 12, 2025 1:13:37 PM CET asmadeus@...ewreck.org wrote:
> Christian Schoenebeck wrote on Wed, Mar 12, 2025 at 10:36:15AM +0100:
> > > RIP: 0010:p9_client_walk+0x9a/0x530 net/9p/client.c:1165
> > >  clone_fid fs/9p/fid.h:23 [inline]
> > >  v9fs_fid_xattr_set+0x119/0x2d0 fs/9p/xattr.c:121
> > >  v9fs_set_acl+0xe6/0x150 fs/9p/acl.c:276
> > >  v9fs_set_create_acl+0x4b/0x70 fs/9p/acl.c:306
> > >  v9fs_vfs_mkdir_dotl+0x517/0x6e0 fs/9p/vfs_inode_dotl.c:411
> > >  vfs_mkdir+0x57d/0x860 fs/namei.c:4313
> > >  do_mkdirat+0x301/0x3a0 fs/namei.c:4336
> > >  __do_sys_mkdir fs/namei.c:4356 [inline]
> > >  __se_sys_mkdir fs/namei.c:4354 [inline]
> > >  __x64_sys_mkdir+0xef/0x140 fs/namei.c:4354
> > >  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> > >  do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
> > >  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > 
> > Just had a glimpse on it so far. IIUIC the trigger is in
> > v9fs_vfs_mkdir_dotl() [fs/9p/vfs_inode_dotl.c:411] ?
> > 
> >     // NULLs out fid (since dafbe6897)
> >     v9fs_fid_add(dentry, &fid);
> >     // expects fid being non-NULL
> >     v9fs_set_create_acl(inode, fid, dacl, pacl);
> 
> Sounds about right, inverting the two calls probably makes sense?

Yeah, that was also my first though. Just didn't have time yet to check
whether that dentry was needed somewhere downwards that v9fs_set_create_acl()
call stack.

> OTOH I don't get why all mkdirs don't hit that.. ah, it's only a problem
> if the parent directory has some ACL and none of our tests hit that :/

There are test cases now?

> Well, it shouldn't be too hard to trigger & fix anyway, since you've
> done this much want to send the patch?

If it is not super urgent then I'll schedule some cycles. Not worried if
anyone is faster of course.

/Christian