Received-SPF: pass (google.com: domain of linux-kernel+bounces-102505-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Precedence: bulk
MIME-Version: 1.0
References: <00000000000043c5e70613882ad1@google.com>
In-Reply-To: <00000000000043c5e70613882ad1@google.com>
From: Amir Goldstein <amir73il@gmail.com>
Date: Wed, 13 Mar 2024 22:55:06 +0200
Message-ID: <CAOQ4uxjtkRns4_EiradMnRUd6xAkqevTiYZZ61oVh7yDzBn_-g@mail.gmail.com>
Subject: Re: [syzbot] [overlayfs?] WARNING in ovl_copy_up_file
To: miklos@szeredi.hu
Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, 
	linux-unionfs@vger.kernel.org, syzkaller-bugs@googlegroups.com, 
	syzbot <syzbot+3abd99031b42acf367ef@syzkaller.appspotmail.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Wed, Mar 13, 2024 at 12:23=E2=80=AFPM syzbot
<syzbot+3abd99031b42acf367ef@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit:    707081b61156 Merge branch 'for-next/core', remote-trackin=
g..
> git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux=
git for-kernelci
> console output: https://syzkaller.appspot.com/x/log.txt?x=3D1785a85918000=
0
> kernel config:  https://syzkaller.appspot.com/x/.config?x=3Dcaeac3f3565b0=
57a
> dashboard link: https://syzkaller.appspot.com/bug?extid=3D3abd99031b42acf=
367ef
> compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Deb=
ian) 2.40
> userspace arch: arm64
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=3D1115ada6180=
000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=3D1626870a18000=
0
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/6cad68bf7532/dis=
k-707081b6.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/1a27e5400778/vmlinu=
x-707081b6.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/67dfc53755d0/I=
mage-707081b6.gz.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the comm=
it:
> Reported-by: syzbot+3abd99031b42acf367ef@syzkaller.appspotmail.com
>
> evm: overlay not supported
> ------------[ cut here ]------------
> WARNING: CPU: 0 PID: 6187 at fs/overlayfs/copy_up.c:239 ovl_copy_up_file+=
0x624/0x674 fs/overlayfs/copy_up.c:330

Miklos,

The WARN_ON that I put in ovl_verify_area() may be too harsh.
I think they can happen if lower file is changed (i_size) while file is bei=
ng
copied up after reading i_size into the copy length and this could be
the case with this syzbot reproducer that keeps mounting overlayfs
instances over same path.

Should probably demote those WARN_ON to just returning EIO?

Thanks,
Amir.