linux-kernel - Re: [syzbot] [kernfs?] general protection fault in kernfs_dop

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CANp29Y5Ew-7FCrSmCXngSJ66SeWMMX=bgztUZP99i-tGX=jMbg@mail.gmail.com>
Date: Mon, 9 Jun 2025 09:02:59 +0200
From: Aleksandr Nogikh <nogikh@...gle.com>
To: Kent Overstreet <kent.overstreet@...ux.dev>
Cc: syzbot <syzbot+e37a1730d63d207fe403@...kaller.appspotmail.com>, 
	bfoster@...hat.com, gregkh@...uxfoundation.org, 
	linux-bcachefs@...r.kernel.org, linux-kernel@...r.kernel.org, 
	syzkaller-bugs@...glegroups.com, tj@...nel.org, 
	syzkaller <syzkaller@...glegroups.com>
Subject: Re: [syzbot] [kernfs?] general protection fault in kernfs_dop_revalidate

On Mon, Jun 9, 2025 at 5:19 AM Kent Overstreet
<kent.overstreet@...ux.dev> wrote:
>
> On Sun, Jun 08, 2025 at 08:11:02PM -0700, syzbot wrote:
> > syzbot has bisected this issue to:
> >
> > commit f7643bc9749f270d487c32dc35b578575bf1adb0
> > Author: Kent Overstreet <kent.overstreet@...ux.dev>
> > Date:   Wed Apr 17 05:26:02 2024 +0000
> >
> >     bcachefs: make btree read errors silent during scan
>
> syzbot bisections have been looking _very_ unreliable
>

In the bisection log[1], syzbot has run the reproducer (that mounts a
bcachefs image) on the original commit 20 times and it has got lots of
very different crash titles. One of those was actually the original
crash:

run #1: crashed: general protection fault in kernfs_dop_revalidate

but the others were in quite different subsystems (net, block,
bcachefs). They look like different manifestations of some memory
corruption caused by the mount of a corrupted bcachefs image.

I don't see where the bisection could have derailed later during the
process - on the tested commits, the kernel either crashed 100% of
repro runs or none of them. So the result very likely is reasonable
w.r.t. to some bcachefs bug, which has apparently been fixed since
then. The reproducer no longer works on syzbot and the last "general
protection fault in kernfs_dop_revalidate" crash was recorded almost
100 days ago.

[1] https://syzkaller.appspot.com/x/bisect.txt?x=17abb20c580000

-- 
Aleksandr