Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <000000000000b808c705c345b35d@google.com> <0000000000009dfd7c05c3463b32@google.com>
In-Reply-To: <0000000000009dfd7c05c3463b32@google.com>
From:   Dmitry Vyukov <dvyukov@google.com>
Date:   Thu, 27 May 2021 08:40:06 +0200
Message-ID: <CACT4Y+ZkGw8GDs9vYzs5t7iBba+5ZRKmTnp3zXAnkOsmyWp6Rw@mail.gmail.com>
Subject: Re: [syzbot] unexpected kernel reboot (5)
To:     syzbot <syzbot+6fb8ff5211d3e821398f@syzkaller.appspotmail.com>,
        Joey Jiao <joey.jiaojg@gmail.com>,
        Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Cc:     LKML <linux-kernel@vger.kernel.org>,
        syzkaller-bugs <syzkaller-bugs@googlegroups.com>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Thu, May 27, 2021 at 4:08 AM syzbot
<syzbot+6fb8ff5211d3e821398f@syzkaller.appspotmail.com> wrote:
>
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit:    7ac3a1c1 Merge tag 'mtd/fixes-for-5.13-rc4' of git://git.k..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=174ba76fd00000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=266cda122a0b56c
> dashboard link: https://syzkaller.appspot.com/bug?extid=6fb8ff5211d3e821398f
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10772527d00000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1072f98dd00000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+6fb8ff5211d3e821398f@syzkaller.appspotmail.com
>
> output_len: 0x000000000e7f5b68
> kernel_total_size: 0x000000000fc26000
> needed_size: 0x000000000fe00000
> trampoline_32bit: 0x000000000009d000
> Decompressing Linux... Parsing ELF... done.
> Booting the kernel.


The reproducer writes into /sys/power/state. I assume this is an
intentional way to reboot a machine and we can't let the fuzzer mess
with all sysfs files with:

openat$sysfs(fd const[AT_FDCWD], dir ptr[in, glob["/sys/**/*"]], flags
flags[open_flags], mode flags[open_mode]) fd

+Joey, how do you deal with this?