Hello,
syzbot found the following issue on:
HEAD commit: 7ac3a1c1 Merge tag 'mtd/fixes-for-5.13-rc4' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15b43813d00000
kernel config: https://syzkaller.appspot.com/x/.config?x=266cda122a0b56c
dashboard link: https://syzkaller.appspot.com/bug?extid=6fb8ff5211d3e821398f
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]
output_len: 0x000000000e7f5b68
kernel_total_size: 0x000000000fc26000
needed_size: 0x000000000fe00000
trampoline_32bit: 0x000000000009d000
Decompressing Linux... Parsing ELF... done.
Booting the kernel.
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at [email protected].
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot has found a reproducer for the following issue on:
HEAD commit: 7ac3a1c1 Merge tag 'mtd/fixes-for-5.13-rc4' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=174ba76fd00000
kernel config: https://syzkaller.appspot.com/x/.config?x=266cda122a0b56c
dashboard link: https://syzkaller.appspot.com/bug?extid=6fb8ff5211d3e821398f
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10772527d00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1072f98dd00000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]
output_len: 0x000000000e7f5b68
kernel_total_size: 0x000000000fc26000
needed_size: 0x000000000fe00000
trampoline_32bit: 0x000000000009d000
Decompressing Linux... Parsing ELF... done.
Booting the kernel.
On Thu, May 27, 2021 at 4:08 AM syzbot
<[email protected]> wrote:
>
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 7ac3a1c1 Merge tag 'mtd/fixes-for-5.13-rc4' of git://git.k..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=174ba76fd00000
> kernel config: https://syzkaller.appspot.com/x/.config?x=266cda122a0b56c
> dashboard link: https://syzkaller.appspot.com/bug?extid=6fb8ff5211d3e821398f
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10772527d00000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1072f98dd00000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: [email protected]
>
> output_len: 0x000000000e7f5b68
> kernel_total_size: 0x000000000fc26000
> needed_size: 0x000000000fe00000
> trampoline_32bit: 0x000000000009d000
> Decompressing Linux... Parsing ELF... done.
> Booting the kernel.
The reproducer writes into /sys/power/state. I assume this is an
intentional way to reboot a machine and we can't let the fuzzer mess
with all sysfs files with:
openat$sysfs(fd const[AT_FDCWD], dir ptr[in, glob["/sys/**/*"]], flags
flags[open_flags], mode flags[open_mode]) fd
+Joey, how do you deal with this?
On 2021/05/27 15:40, Dmitry Vyukov wrote:
> The reproducer writes into /sys/power/state. I assume this is an
> intentional way to reboot a machine and we can't let the fuzzer mess
> with all sysfs files with:
>
> openat$sysfs(fd const[AT_FDCWD], dir ptr[in, glob["/sys/**/*"]], flags
> flags[open_flags], mode flags[open_mode]) fd
>
> +Joey, how do you deal with this?
>
I have CaitSith LSM module ( https://caitsith.osdn.jp/#5.2 ).
Maybe we could invent a simple LSM module for excluding access to specific pseudo files?
On 2021/05/27 21:15, joey.jiaojg wrote:
> I tested on qemu and Android device, not found the reboot.
> Any kernel version different?
Kernel version needs to be v5.11-rc5+ because this reproducer
depends on commit f2d6c2708bd8 ("kernfs: wire up ->splice_read
and ->splice_write"). Also, this reproducer depends on contents
of /sys/power/state file.
----------
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/sendfile.h>
int main(int argc, char *argv[])
{
const int fd = open("/sys/power/state", O_RDWR);
off_t offset = 7;
/* Assumes that 3 bytes from offset 7 in /sys/power/state are "mem". */
sendfile(fd, fd, &offset, 3);
return 0;
}
----------
On 2021/05/27 21:19, joey.jiaojg wrote:
> Or we can add glob code like
> /sys/**/*:-/sys/power/state to exclude.
Well, since /sys/ includes mount points for other filesystems such as
securityfs ( /sys/kernel/security/ ), debugfs ( /sys/kernel/debug/ )
and cgroup ( /sys/fs/cgroup/ ), just excluding this specific file is not
sufficient. I think we have to start from removing glob["/sys/**/*"] .
syzbot has bisected this issue to:
commit f2d6c2708bd84ca953fa6b6ca5717e79eb0140c7
Author: Christoph Hellwig <[email protected]>
Date: Wed Jan 20 20:46:31 2021 +0000
kernfs: wire up ->splice_read and ->splice_write
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=144ee113d00000
start commit: 7ac3a1c1 Merge tag 'mtd/fixes-for-5.13-rc4' of git://git.k..
git tree: upstream
final oops: https://syzkaller.appspot.com/x/report.txt?x=164ee113d00000
console output: https://syzkaller.appspot.com/x/log.txt?x=124ee113d00000
kernel config: https://syzkaller.appspot.com/x/.config?x=266cda122a0b56c
dashboard link: https://syzkaller.appspot.com/bug?extid=6fb8ff5211d3e821398f
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=154e8703d00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=171382d3d00000
Reported-by: [email protected]
Fixes: f2d6c2708bd8 ("kernfs: wire up ->splice_read and ->splice_write")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
On Thu, May 27, 2021 at 3:17 PM Tetsuo Handa
<[email protected]> wrote:
>
> On 2021/05/27 21:15, joey.jiaojg wrote:
> > I tested on qemu and Android device, not found the reboot.
> > Any kernel version different?
>
> Kernel version needs to be v5.11-rc5+ because this reproducer
> depends on commit f2d6c2708bd8 ("kernfs: wire up ->splice_read
> and ->splice_write"). Also, this reproducer depends on contents
> of /sys/power/state file.
>
> ----------
> #include <sys/types.h>
> #include <sys/stat.h>
> #include <fcntl.h>
> #include <sys/sendfile.h>
>
> int main(int argc, char *argv[])
> {
> const int fd = open("/sys/power/state", O_RDWR);
> off_t offset = 7;
>
> /* Assumes that 3 bytes from offset 7 in /sys/power/state are "mem". */
> sendfile(fd, fd, &offset, 3);
> return 0;
> }
> ----------
>
> On 2021/05/27 21:19, joey.jiaojg wrote:
> > Or we can add glob code like
> > /sys/**/*:-/sys/power/state to exclude.
>
> Well, since /sys/ includes mount points for other filesystems such as
> securityfs ( /sys/kernel/security/ ), debugfs ( /sys/kernel/debug/ )
> and cgroup ( /sys/fs/cgroup/ ), just excluding this specific file is not
> sufficient. I think we have to start from removing glob["/sys/**/*"] .
FTR, Joey is working on support for excluding specific patterns from globs:
https://github.com/google/syzkaller/pull/2602
I agree /sys/**/* may be too broad. On my machine /sys contains 82501
files. But it's also hard for me to tell what exactly should be
included/excluded. Do we know any definitely bad files/dirs?
Or alternatively, we can just wait for more reports from syzbot when
it opens something we don't want it to open. The benefit of working on
testing :)