lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <4a3a6527-4a19-699a-d7a5-21249254522b@I-love.SAKURA.ne.jp> Date: Mon, 17 Oct 2022 23:29:01 +0900 From: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp> To: Paul Moore <paul@...l-moore.com>, miklos@...redi.hu, linux-unionfs@...r.kernel.org Cc: dvyukov@...gle.com, hdanton@...a.com, linux-fsdevel@...r.kernel.org, syzkaller-bugs@...glegroups.com, syzbot <syzbot+f07cc9be8d1d226947ed@...kaller.appspotmail.com>, yhs@...com, omosnace@...hat.com Subject: Re: [syzbot] general protection fault in security_inode_getattr On 2022/10/16 23:52, Paul Moore wrote: > It doesn't look like this is a problem with > security_inode_getattr()/d_backing_inode() as it appears that the > passed path struct pointer has a bogus/NULL path->dentry pointer and > to the best of my knowledge it would appear that vfs_getattr() (the > caller) requires a valid path->dentry value. > > Looking quickly at the code, I wonder if there is something wonky > going on in the overlayfs code, specifically ovl_copy_up_flags() and > ovl_copy_up_one() as they have to play a number of tricks to handle > the transparent overlays and copy up operations. I'm not an overlayfs > expert, but that seems like a good place to start digging further into > this. Right. This is a bug in overlayfs code. Probably due to some race condition, ovl_copy_up_flags() is calling ovl_copy_up_one() with "next" dentry with "struct ovl_entry"->numlower == 0. As a result, ovl_path_lower() from ovl_copy_up_one() fills ctx.lowerpath with NULLs, and vfs_getattr() gets surprised by ctx.lowerpath.dentry == NULL. If we can't avoid selecting a dentry with "struct ovl_entry"->numlower == 0 using some lock, I guess that we would need to use a workaround suggested by Hillf Danton at https://groups.google.com/g/syzkaller-bugs/c/xDcxFKSppfE/m/b38Tv7LoAAAJ .
Powered by blists - more mailing lists