Test patch for kernel BUG in ntfs_lookup_inode_by_name
17 views
Skip to first unread message
Soumya Negi
Jul 24, 2022, 7:03:04 AM7/24/22
to syzbot+30b7f8...@syzkaller.appspotmail.com, syzkall...@googlegroups.com
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master
Subject: [PATCH] ntfs: Ensure $Extend is a directory
Fixes Syzbot bug: kernel BUG in ntfs_lookup_inode_by_name
https://syzkaller.appspot.com/bug?id=32cf53b48c1846ffc25a185a2e92e170d1a95d71
Check whether $Extend is a directory or not( for NTFS3.0+) while loading
system files. If it isn't(as in the case of this bug where the mft record for
$Extend contains a regular file), load_system_files() returns false.
Reported-by: syzbot+30b7f8...@syzkaller.appspotmail.com
Signed-off-by: Soumya Negi <soumya...@gmail.com>
---
fs/ntfs/super.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index 5ae8de09b271..18e2902531f9 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -2092,10 +2092,15 @@ static bool load_system_files(ntfs_volume *vol)
// TODO: Initialize security.
/* Get the extended system files' directory inode. */
vol->extend_ino = ntfs_iget(sb, FILE_Extend);
- if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino)) {
+ if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino) ||
+ !S_ISDIR(vol->extend_ino->i_mode)) {
+ static const char *es1 = "$Extend is not a directory";
+ static const char *es2 = "Failed to load $Extend";
+ const char *es = !S_ISDIR(vol->extend_ino->i_mode) ? es1 : es2;
+
if (!IS_ERR(vol->extend_ino))
iput(vol->extend_ino);
- ntfs_error(sb, "Failed to load $Extend.");
+ ntfs_error(sb, "%s.", es);
goto iput_sec_err_out;
}
#ifdef NTFS_RW
--
2.17.1
master
Subject: [PATCH] ntfs: Ensure $Extend is a directory
Fixes Syzbot bug: kernel BUG in ntfs_lookup_inode_by_name
https://syzkaller.appspot.com/bug?id=32cf53b48c1846ffc25a185a2e92e170d1a95d71
Check whether $Extend is a directory or not( for NTFS3.0+) while loading
system files. If it isn't(as in the case of this bug where the mft record for
$Extend contains a regular file), load_system_files() returns false.
Reported-by: syzbot+30b7f8...@syzkaller.appspotmail.com
Signed-off-by: Soumya Negi <soumya...@gmail.com>
---
fs/ntfs/super.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index 5ae8de09b271..18e2902531f9 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -2092,10 +2092,15 @@ static bool load_system_files(ntfs_volume *vol)
// TODO: Initialize security.
/* Get the extended system files' directory inode. */
vol->extend_ino = ntfs_iget(sb, FILE_Extend);
- if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino)) {
+ if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino) ||
+ !S_ISDIR(vol->extend_ino->i_mode)) {
+ static const char *es1 = "$Extend is not a directory";
+ static const char *es2 = "Failed to load $Extend";
+ const char *es = !S_ISDIR(vol->extend_ino->i_mode) ? es1 : es2;
+
if (!IS_ERR(vol->extend_ino))
iput(vol->extend_ino);
- ntfs_error(sb, "Failed to load $Extend.");
+ ntfs_error(sb, "%s.", es);
goto iput_sec_err_out;
}
#ifdef NTFS_RW
--
2.17.1
syzbot
Jul 24, 2022, 7:25:25 AM7/24/22
to soumya...@gmail.com, syzkall...@googlegroups.com, syzkaller...@googlegroups.com
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
of Tasks RCU enabled.
[ 1.397264] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[ 1.399035] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
[ 1.434964] NR_IRQS: 4352, nr_irqs: 440, preallocated irqs: 16
[ 1.437125] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[ 1.443167] Console: colour VGA+ 80x25
[ 1.444206] printk: console [ttyS0] enabled
[ 1.444206] printk: console [ttyS0] enabled
[ 1.446847] printk: bootconsole [earlyser0] disabled
[ 1.446847] printk: bootconsole [earlyser0] disabled
[ 1.450496] Lock dependency validator: Copyright (c) 2006 Red Hat, Inc., Ingo Molnar
[ 1.452250] ... MAX_LOCKDEP_SUBCLASSES: 8
[ 1.455850] ... MAX_LOCK_DEPTH: 48
[ 1.457643] ... MAX_LOCKDEP_KEYS: 8192
[ 1.458655] ... CLASSHASH_SIZE: 4096
[ 1.459458] ... MAX_LOCKDEP_ENTRIES: 32768
[ 1.460555] ... MAX_LOCKDEP_CHAINS: 65536
[ 1.461818] ... CHAINHASH_SIZE: 32768
[ 1.464821] memory used by lock dependency info: 6365 kB
[ 1.467745] memory used for stack traces: 4224 kB
[ 1.470084] per task-struct memory footprint: 1920 bytes
[ 1.471744] mempolicy: Enabling automatic NUMA balancing. Configure with numa_balancing= or the kernel.numa_balancing sysctl
[ 1.476505] ACPI: Core revision 20220331
[ 1.478579] APIC: Switch to symmetric I/O mode setup
[ 1.485022] ..TIMER: vector=0x30 apic1=0 pin1=0 apic2=-1 pin2=-1
[ 1.486788] clocksource: tsc-early: mask: 0xffffffffffffffff max_cycles: 0x1fb63109b96, max_idle_ns: 440795265316 ns
[ 1.490238] Calibrating delay loop (skipped) preset value.. 4399.99 BogoMIPS (lpj=21999980)
[ 1.491824] pid_max: default: 32768 minimum: 301
[ 1.493474] LSM: Security Framework initializing
[ 1.494402] Yama: becoming mindful.
[ 1.495625] AppArmor: AppArmor initialized
[ 1.496629] TOMOYO Linux initialized
[ 1.501397] Dentry cache hash table entries: 1048576 (order: 11, 8388608 bytes, vmalloc hugepage)
[ 1.505770] Inode-cache hash table entries: 524288 (order: 10, 4194304 bytes, vmalloc hugepage)
[ 1.508894] Mount-cache hash table entries: 16384 (order: 5, 131072 bytes, vmalloc)
[ 1.510305] Mountpoint-cache hash table entries: 16384 (order: 5, 131072 bytes, vmalloc)
[ 1.516143] Last level iTLB entries: 4KB 64, 2MB 8, 4MB 8
[ 1.517506] Last level dTLB entries: 4KB 64, 2MB 0, 4MB 0, 1GB 4
[ 1.519510] Spectre V1 : Mitigation: usercopy/swapgs barriers and __user pointer sanitization
[ 1.520286] Spectre V2 : Mitigation: IBRS
[ 1.520886] Spectre V2 : Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch
[ 1.522565] RETBleed: Mitigation: IBRS
[ 1.523304] Spectre V2 : mitigation: Enabling conditional Indirect Branch Prediction Barrier
[ 1.525937] Speculative Store Bypass: Mitigation: Speculative Store Bypass disabled via prctl
[ 1.528060] MDS: Mitigation: Clear CPU buffers
[ 1.530234] TAA: Mitigation: Clear CPU buffers
[ 1.531081] MMIO Stale Data: Vulnerable: Clear CPU buffers attempted, no microcode
[ 1.534524] Freeing SMP alternatives memory: 104K
[ 1.657486] smpboot: CPU0: Intel(R) Xeon(R) CPU @ 2.20GHz (family: 0x6, model: 0x4f, stepping: 0x0)
[ 1.660223] cblist_init_generic: Setting adjustable number of callback queues.
[ 1.660223] cblist_init_generic: Setting shift to 1 and lim to 1.
[ 1.660223] cblist_init_generic: Setting shift to 1 and lim to 1.
[ 1.660223] Running RCU-tasks wait API self tests
[ 1.760498] Performance Events: unsupported p6 CPU model 79 no PMU driver, software events only.
[ 1.763536] rcu: Hierarchical SRCU implementation.
[ 1.764903] rcu: Max phase no-delay instances is 1000.
[ 1.770577] NMI watchdog: Perf NMI watchdog permanently disabled
[ 1.772816] smp: Bringing up secondary CPUs ...
[ 1.777963] x86: Booting SMP configuration:
[ 1.779002] .... node #0, CPUs: #1
[ 1.781632] MDS CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html for more details.
[ 1.784877] TAA CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/tsx_async_abort.html for more details.
[ 1.790251] MMIO Stale Data CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html for more details.
[ 1.794197] smp: Brought up 2 nodes, 2 CPUs
[ 1.795621] smpboot: Max logical packages: 1
[ 1.796395] smpboot: Total of 2 processors activated (8799.99 BogoMIPS)
[ 1.800294] Callback from call_rcu_tasks_trace() invoked.
[ 1.808345] devtmpfs: initialized
[ 1.808345] x86/mm: Memory block size: 128MB
[ 1.842095] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 1.843507] futex hash table entries: 512 (order: 4, 65536 bytes, vmalloc)
[ 1.847947] PM: RTC time: 11:16:07, date: 2022-07-24
[ 1.857619] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[ 1.863936] audit: initializing netlink subsys (disabled)
[ 1.870558] audit: type=2000 audit(1658661367.267:1): state=initialized audit_enabled=0 res=1
[ 1.870500] thermal_sys: Registered thermal governor 'step_wise'
[ 1.870500] thermal_sys: Registered thermal governor 'user_space'
[ 1.871837] cpuidle: using governor menu
[ 1.877938] HugeTLB: can optimize 4095 vmemmap pages for hugepages-1048576kB
[ 1.881505] PCI: Using configuration type 1 for base access
[ 2.055451] WARNING: workqueue cpumask: online intersect > possible intersect
[ 2.061972] HugeTLB: can optimize 7 vmemmap pages for hugepages-2048kB
[ 2.063777] HugeTLB registered 1.00 GiB page size, pre-allocated 0 pages
[ 2.065703] HugeTLB registered 2.00 MiB page size, pre-allocated 0 pages
[ 2.074739] cryptd: max_cpu_qlen set to 1000
[ 2.240342] Callback from call_rcu_tasks() invoked.
[ 2.242432] raid6: avx2x4 gen() 4667 MB/s
[ 2.410243] raid6: avx2x2 gen() 3216 MB/s
[ 2.580316] raid6: avx2x1 gen() 1982 MB/s
[ 2.581960] raid6: using algorithm avx2x4 gen() 4667 MB/s
[ 2.750493] raid6: .... xor() 2384 MB/s, rmw enabled
[ 2.752078] raid6: using avx2x2 recovery algorithm
[ 2.754551] ACPI: Added _OSI(Module Device)
[ 2.757016] ACPI: Added _OSI(Processor Device)
[ 2.759410] ACPI: Added _OSI(3.0 _SCP Extensions)
[ 2.760245] ACPI: Added _OSI(Processor Aggregator Device)
[ 2.761773] ACPI: Added _OSI(Linux-Dell-Video)
[ 2.762786] ACPI: Added _OSI(Linux-Lenovo-NV-HDMI-Audio)
[ 2.764121] ACPI: Added _OSI(Linux-HPI-Hybrid-Graphics)
[ 2.854218] ACPI: 2 ACPI AML tables successfully acquired and loaded
[ 2.907980] ACPI: Interpreter enabled
[ 2.909168] ACPI: PM: (supports S0 S3 S4 S5)
[ 2.910278] ACPI: Using IOAPIC for interrupt routing
[ 2.911385] PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug
[ 2.913146] PCI: Using E820 reservations for host bridge windows
[ 2.917537] ACPI: Enabled 16 GPEs in block 00 to 0F
[ 3.036642] ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-ff])
[ 3.039059] acpi PNP0A03:00: _OSC: OS supports [ASPM ClockPM Segments MSI HPX-Type3]
[ 3.040258] acpi PNP0A03:00: _OSC: not requesting OS control; OS requires [ExtendedConfig ASPM ClockPM MSI]
[ 3.043492] acpi PNP0A03:00: fail to add MMCONFIG information, can't access extended PCI configuration space under this bridge.
[ 3.055664] PCI host bridge to bus 0000:00
[ 3.056894] pci_bus 0000:00: Unknown NUMA node; performance will be reduced
[ 3.058646] pci_bus 0000:00: root bus resource [io 0x0000-0x0cf7 window]
[ 3.060278] pci_bus 0000:00: root bus resource [io 0x0d00-0xffff window]
[ 3.063145] pci_bus 0000:00: root bus resource [mem 0x000a0000-0x000bffff window]
[ 3.066608] pci_bus 0000:00: root bus resource [mem 0xc0000000-0xfebfefff window]
[ 3.070276] pci_bus 0000:00: root bus resource [bus 00-ff]
[ 3.072031] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000
[ 3.081716] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100
[ 3.117430] pci 0000:00:01.3: [8086:7113] type 00 class 0x068000
[ 3.147618] pci 0000:00:01.3: quirk: [io 0xb000-0xb03f] claimed by PIIX4 ACPI
[ 3.153098] pci 0000:00:03.0: [1af4:1004] type 00 class 0x000000
[ 3.166614] pci 0000:00:03.0: reg 0x10: [io 0xc000-0xc03f]
[ 3.175472] pci 0000:00:03.0: reg 0x14: [mem 0xfe800000-0xfe80007f]
[ 3.199267] pci 0000:00:04.0: [1af4:1000] type 00 class 0x020000
[ 3.209454] pci 0000:00:04.0: reg 0x10: [io 0xc040-0xc07f]
[ 3.217256] pci 0000:00:04.0: reg 0x14: [mem 0xfe801000-0xfe80107f]
[ 3.248347] pci 0000:00:05.0: [1ae0:a002] type 00 class 0x030000
[ 3.265055] pci 0000:00:05.0: reg 0x10: [mem 0xfe000000-0xfe7fffff]
[ 3.304937] pci 0000:00:05.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff]
[ 3.310008] pci 0000:00:06.0: [1af4:1002] type 00 class 0x00ff00
[ 3.323573] pci 0000:00:06.0: reg 0x10: [io 0xc080-0xc09f]
[ 3.332447] pci 0000:00:06.0: reg 0x14: [mem 0xfe802000-0xfe80207f]
[ 3.363189] pci 0000:00:07.0: [1af4:1005] type 00 class 0x00ff00
[ 3.376945] pci 0000:00:07.0: reg 0x10: [io 0xc0a0-0xc0bf]
[ 3.384357] pci 0000:00:07.0: reg 0x14: [mem 0xfe803000-0xfe80303f]
[ 3.427052] ACPI: PCI: Interrupt link LNKA configured for IRQ 10
[ 3.433371] ACPI: PCI: Interrupt link LNKB configured for IRQ 10
[ 3.440872] ACPI: PCI: Interrupt link LNKC configured for IRQ 11
[ 3.448355] ACPI: PCI: Interrupt link LNKD configured for IRQ 11
[ 3.454315] ACPI: PCI: Interrupt link LNKS configured for IRQ 9
[ 3.469538] iommu: Default domain type: Translated
[ 3.470252] iommu: DMA domain TLB invalidation policy: lazy mode
[ 3.478089] SCSI subsystem initialized
[ 3.482029] ACPI: bus type USB registered
[ 3.483981] usbcore: registered new interface driver usbfs
[ 3.486205] usbcore: registered new interface driver hub
[ 3.488501] usbcore: registered new device driver usb
[ 3.491937] mc: Linux media interface: v0.10
[ 3.493896] videodev: Linux video capture interface: v2.00
[ 3.497060] pps_core: LinuxPPS API ver. 1 registered
[ 3.498669] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giom...@linux.it>
[ 3.500365] PTP clock support registered
[ 3.502971] EDAC MC: Ver: 3.0.0
[ 3.506913] Advanced Linux Sound Architecture Driver Initialized.
[ 3.514020] Bluetooth: Core ver 2.22
[ 3.515199] NET: Registered PF_BLUETOOTH protocol family
[ 3.517229] Bluetooth: HCI device and connection manager initialized
[ 3.520290] Bluetooth: HCI socket layer initialized
[ 3.521715] Bluetooth: L2CAP socket layer initialized
[ 3.523389] Bluetooth: SCO socket layer initialized
[ 3.524956] NET: Registered PF_ATMPVC protocol family
[ 3.526872] NET: Registered PF_ATMSVC protocol family
[ 3.528682] NetLabel: Initializing
[ 3.530250] NetLabel: domain hash size = 128
[ 3.531525] NetLabel: protocols = UNLABELED CIPSOv4 CALIPSO
[ 3.534397] NetLabel: unlabeled traffic allowed by default
[ 3.538638] nfc: nfc_init: NFC Core ver 0.1
[ 3.540686] NET: Registered PF_NFC protocol family
[ 3.542817] PCI: Using ACPI for IRQ routing
[ 3.546222] pci 0000:00:05.0: vgaarb: setting as boot VGA device
[ 3.548730] pci 0000:00:05.0: vgaarb: bridge control possible
[ 3.550200] pci 0000:00:05.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none
[ 3.550241] vgaarb: loaded
[ 3.560633] clocksource: Switched to clocksource kvm-clock
[ 3.564690] VFS: Disk quotas dquot_6.6.0
[ 3.565898] VFS: Dquot-cache hash table entries: 512 (order 0, 4096 bytes)
[ 3.568880] FS-Cache: Loaded
[ 3.581032] CacheFiles: Loaded
[ 3.582218] TOMOYO: 2.6.0
[ 3.582876] Profile 0 (used by '<kernel>') is not defined.
[ 3.584286] Userland tools for TOMOYO 2.6 must be installed and policy must be initialized.
[ 3.587878] Please see https://tomoyo.osdn.jp/2.6/ for more information.
[ 3.589277] Kernel panic - not syncing: STOP!
[ 3.590247] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-rc7-syzkaller #0
[ 3.590247] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[ 3.590247] Call Trace:
[ 3.590247] <TASK>
[ 3.590247] dump_stack_lvl+0x8b/0xb3
[ 3.590247] panic+0x29c/0x5fb
[ 3.590247] ? panic_print_sys_info.part.0+0x10b/0x10b
[ 3.590247] ? lock_release+0x3bb/0x770
[ 3.590247] ? tomoyo_load_builtin_policy+0x24d/0x2c4
[ 3.590247] ? lock_downgrade+0x6d0/0x6d0
[ 3.590247] ? vprintk+0x88/0x90
[ 3.590247] tomoyo_check_profile.cold+0xbb/0xc8
[ 3.590247] tomoyo_load_builtin_policy+0x279/0x2c4
[ 3.590247] ? smack_nf_ip_init+0x7c/0x7c
[ 3.590247] ? mark_lock.part.0+0xee/0x17c0
[ 3.590247] ? tomoyo_write_domain2+0x1a0/0x1a0
[ 3.590247] ? up_write+0x148/0x470
[ 3.590247] ? securityfs_create_dentry+0x178/0x5a0
[ 3.590247] ? tomoyo_mm_init+0x26e/0x26e
[ 3.590247] tomoyo_initerface_init+0x1c0/0x1ca
[ 3.590247] do_one_initcall+0x103/0x650
[ 3.590247] ? trace_event_raw_event_initcall_level+0x1f0/0x1f0
[ 3.590247] ? parameq+0x100/0x170
[ 3.590247] ? lock_is_held_type+0xd7/0x130
[ 3.590247] kernel_init_freeable+0x604/0x68d
[ 3.590247] ? rest_init+0x250/0x250
[ 3.590247] kernel_init+0x1a/0x1d0
[ 3.590247] ? rest_init+0x250/0x250
[ 3.590247] ret_from_fork+0x1f/0x30
[ 3.590247] </TASK>
[ 3.590247] Rebooting in 86400 seconds..
syzkaller build log:
go env (err=<nil>)
GO111MODULE="auto"
GOARCH="amd64"
GOBIN=""
GOCACHE="/syzkaller/.cache/go-build"
GOENV="/syzkaller/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/syzkaller/jobs/linux/gopath/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/syzkaller/jobs/linux/gopath"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.17"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build368488466=/tmp/go-build -gno-record-gcc-switches"
git status (err=<nil>)
HEAD detached at c88578925
nothing to commit, working tree clean
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=c885789257c76ea4479ea36282f5e0a2c7861e26 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220603-183609'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=c885789257c76ea4479ea36282f5e0a2c7861e26 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220603-183609'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=c885789257c76ea4479ea36282f5e0a2c7861e26 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220603-183609'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-stress github.com/google/syzkaller/tools/syz-stress
mkdir -p ./bin/linux_amd64
gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"c885789257c76ea4479ea36282f5e0a2c7861e26\"
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=12192ace080000
Tested on:
commit: 515f7141 Merge tag 'for-linus' of git://git.kernel.org..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
kernel config: https://syzkaller.appspot.com/x/.config?x=b5af4302509ca4c9
dashboard link: https://syzkaller.appspot.com/bug?extid=30b7f850c6d98ea461d2
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=16db0f5e080000
syzbot tried to test the proposed patch but the build/boot failed:
of Tasks RCU enabled.
[ 1.397264] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[ 1.399035] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
[ 1.434964] NR_IRQS: 4352, nr_irqs: 440, preallocated irqs: 16
[ 1.437125] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[ 1.443167] Console: colour VGA+ 80x25
[ 1.444206] printk: console [ttyS0] enabled
[ 1.444206] printk: console [ttyS0] enabled
[ 1.446847] printk: bootconsole [earlyser0] disabled
[ 1.446847] printk: bootconsole [earlyser0] disabled
[ 1.450496] Lock dependency validator: Copyright (c) 2006 Red Hat, Inc., Ingo Molnar
[ 1.452250] ... MAX_LOCKDEP_SUBCLASSES: 8
[ 1.455850] ... MAX_LOCK_DEPTH: 48
[ 1.457643] ... MAX_LOCKDEP_KEYS: 8192
[ 1.458655] ... CLASSHASH_SIZE: 4096
[ 1.459458] ... MAX_LOCKDEP_ENTRIES: 32768
[ 1.460555] ... MAX_LOCKDEP_CHAINS: 65536
[ 1.461818] ... CHAINHASH_SIZE: 32768
[ 1.464821] memory used by lock dependency info: 6365 kB
[ 1.467745] memory used for stack traces: 4224 kB
[ 1.470084] per task-struct memory footprint: 1920 bytes
[ 1.471744] mempolicy: Enabling automatic NUMA balancing. Configure with numa_balancing= or the kernel.numa_balancing sysctl
[ 1.476505] ACPI: Core revision 20220331
[ 1.478579] APIC: Switch to symmetric I/O mode setup
[ 1.485022] ..TIMER: vector=0x30 apic1=0 pin1=0 apic2=-1 pin2=-1
[ 1.486788] clocksource: tsc-early: mask: 0xffffffffffffffff max_cycles: 0x1fb63109b96, max_idle_ns: 440795265316 ns
[ 1.490238] Calibrating delay loop (skipped) preset value.. 4399.99 BogoMIPS (lpj=21999980)
[ 1.491824] pid_max: default: 32768 minimum: 301
[ 1.493474] LSM: Security Framework initializing
[ 1.494402] Yama: becoming mindful.
[ 1.495625] AppArmor: AppArmor initialized
[ 1.496629] TOMOYO Linux initialized
[ 1.501397] Dentry cache hash table entries: 1048576 (order: 11, 8388608 bytes, vmalloc hugepage)
[ 1.505770] Inode-cache hash table entries: 524288 (order: 10, 4194304 bytes, vmalloc hugepage)
[ 1.508894] Mount-cache hash table entries: 16384 (order: 5, 131072 bytes, vmalloc)
[ 1.510305] Mountpoint-cache hash table entries: 16384 (order: 5, 131072 bytes, vmalloc)
[ 1.516143] Last level iTLB entries: 4KB 64, 2MB 8, 4MB 8
[ 1.517506] Last level dTLB entries: 4KB 64, 2MB 0, 4MB 0, 1GB 4
[ 1.519510] Spectre V1 : Mitigation: usercopy/swapgs barriers and __user pointer sanitization
[ 1.520286] Spectre V2 : Mitigation: IBRS
[ 1.520886] Spectre V2 : Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch
[ 1.522565] RETBleed: Mitigation: IBRS
[ 1.523304] Spectre V2 : mitigation: Enabling conditional Indirect Branch Prediction Barrier
[ 1.525937] Speculative Store Bypass: Mitigation: Speculative Store Bypass disabled via prctl
[ 1.528060] MDS: Mitigation: Clear CPU buffers
[ 1.530234] TAA: Mitigation: Clear CPU buffers
[ 1.531081] MMIO Stale Data: Vulnerable: Clear CPU buffers attempted, no microcode
[ 1.534524] Freeing SMP alternatives memory: 104K
[ 1.657486] smpboot: CPU0: Intel(R) Xeon(R) CPU @ 2.20GHz (family: 0x6, model: 0x4f, stepping: 0x0)
[ 1.660223] cblist_init_generic: Setting adjustable number of callback queues.
[ 1.660223] cblist_init_generic: Setting shift to 1 and lim to 1.
[ 1.660223] cblist_init_generic: Setting shift to 1 and lim to 1.
[ 1.660223] Running RCU-tasks wait API self tests
[ 1.760498] Performance Events: unsupported p6 CPU model 79 no PMU driver, software events only.
[ 1.763536] rcu: Hierarchical SRCU implementation.
[ 1.764903] rcu: Max phase no-delay instances is 1000.
[ 1.770577] NMI watchdog: Perf NMI watchdog permanently disabled
[ 1.772816] smp: Bringing up secondary CPUs ...
[ 1.777963] x86: Booting SMP configuration:
[ 1.779002] .... node #0, CPUs: #1
[ 1.781632] MDS CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html for more details.
[ 1.784877] TAA CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/tsx_async_abort.html for more details.
[ 1.790251] MMIO Stale Data CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html for more details.
[ 1.794197] smp: Brought up 2 nodes, 2 CPUs
[ 1.795621] smpboot: Max logical packages: 1
[ 1.796395] smpboot: Total of 2 processors activated (8799.99 BogoMIPS)
[ 1.800294] Callback from call_rcu_tasks_trace() invoked.
[ 1.808345] devtmpfs: initialized
[ 1.808345] x86/mm: Memory block size: 128MB
[ 1.842095] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 1.843507] futex hash table entries: 512 (order: 4, 65536 bytes, vmalloc)
[ 1.847947] PM: RTC time: 11:16:07, date: 2022-07-24
[ 1.857619] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[ 1.863936] audit: initializing netlink subsys (disabled)
[ 1.870558] audit: type=2000 audit(1658661367.267:1): state=initialized audit_enabled=0 res=1
[ 1.870500] thermal_sys: Registered thermal governor 'step_wise'
[ 1.870500] thermal_sys: Registered thermal governor 'user_space'
[ 1.871837] cpuidle: using governor menu
[ 1.877938] HugeTLB: can optimize 4095 vmemmap pages for hugepages-1048576kB
[ 1.881505] PCI: Using configuration type 1 for base access
[ 2.055451] WARNING: workqueue cpumask: online intersect > possible intersect
[ 2.061972] HugeTLB: can optimize 7 vmemmap pages for hugepages-2048kB
[ 2.063777] HugeTLB registered 1.00 GiB page size, pre-allocated 0 pages
[ 2.065703] HugeTLB registered 2.00 MiB page size, pre-allocated 0 pages
[ 2.074739] cryptd: max_cpu_qlen set to 1000
[ 2.240342] Callback from call_rcu_tasks() invoked.
[ 2.242432] raid6: avx2x4 gen() 4667 MB/s
[ 2.410243] raid6: avx2x2 gen() 3216 MB/s
[ 2.580316] raid6: avx2x1 gen() 1982 MB/s
[ 2.581960] raid6: using algorithm avx2x4 gen() 4667 MB/s
[ 2.750493] raid6: .... xor() 2384 MB/s, rmw enabled
[ 2.752078] raid6: using avx2x2 recovery algorithm
[ 2.754551] ACPI: Added _OSI(Module Device)
[ 2.757016] ACPI: Added _OSI(Processor Device)
[ 2.759410] ACPI: Added _OSI(3.0 _SCP Extensions)
[ 2.760245] ACPI: Added _OSI(Processor Aggregator Device)
[ 2.761773] ACPI: Added _OSI(Linux-Dell-Video)
[ 2.762786] ACPI: Added _OSI(Linux-Lenovo-NV-HDMI-Audio)
[ 2.764121] ACPI: Added _OSI(Linux-HPI-Hybrid-Graphics)
[ 2.854218] ACPI: 2 ACPI AML tables successfully acquired and loaded
[ 2.907980] ACPI: Interpreter enabled
[ 2.909168] ACPI: PM: (supports S0 S3 S4 S5)
[ 2.910278] ACPI: Using IOAPIC for interrupt routing
[ 2.911385] PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug
[ 2.913146] PCI: Using E820 reservations for host bridge windows
[ 2.917537] ACPI: Enabled 16 GPEs in block 00 to 0F
[ 3.036642] ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-ff])
[ 3.039059] acpi PNP0A03:00: _OSC: OS supports [ASPM ClockPM Segments MSI HPX-Type3]
[ 3.040258] acpi PNP0A03:00: _OSC: not requesting OS control; OS requires [ExtendedConfig ASPM ClockPM MSI]
[ 3.043492] acpi PNP0A03:00: fail to add MMCONFIG information, can't access extended PCI configuration space under this bridge.
[ 3.055664] PCI host bridge to bus 0000:00
[ 3.056894] pci_bus 0000:00: Unknown NUMA node; performance will be reduced
[ 3.058646] pci_bus 0000:00: root bus resource [io 0x0000-0x0cf7 window]
[ 3.060278] pci_bus 0000:00: root bus resource [io 0x0d00-0xffff window]
[ 3.063145] pci_bus 0000:00: root bus resource [mem 0x000a0000-0x000bffff window]
[ 3.066608] pci_bus 0000:00: root bus resource [mem 0xc0000000-0xfebfefff window]
[ 3.070276] pci_bus 0000:00: root bus resource [bus 00-ff]
[ 3.072031] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000
[ 3.081716] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100
[ 3.117430] pci 0000:00:01.3: [8086:7113] type 00 class 0x068000
[ 3.147618] pci 0000:00:01.3: quirk: [io 0xb000-0xb03f] claimed by PIIX4 ACPI
[ 3.153098] pci 0000:00:03.0: [1af4:1004] type 00 class 0x000000
[ 3.166614] pci 0000:00:03.0: reg 0x10: [io 0xc000-0xc03f]
[ 3.175472] pci 0000:00:03.0: reg 0x14: [mem 0xfe800000-0xfe80007f]
[ 3.199267] pci 0000:00:04.0: [1af4:1000] type 00 class 0x020000
[ 3.209454] pci 0000:00:04.0: reg 0x10: [io 0xc040-0xc07f]
[ 3.217256] pci 0000:00:04.0: reg 0x14: [mem 0xfe801000-0xfe80107f]
[ 3.248347] pci 0000:00:05.0: [1ae0:a002] type 00 class 0x030000
[ 3.265055] pci 0000:00:05.0: reg 0x10: [mem 0xfe000000-0xfe7fffff]
[ 3.304937] pci 0000:00:05.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff]
[ 3.310008] pci 0000:00:06.0: [1af4:1002] type 00 class 0x00ff00
[ 3.323573] pci 0000:00:06.0: reg 0x10: [io 0xc080-0xc09f]
[ 3.332447] pci 0000:00:06.0: reg 0x14: [mem 0xfe802000-0xfe80207f]
[ 3.363189] pci 0000:00:07.0: [1af4:1005] type 00 class 0x00ff00
[ 3.376945] pci 0000:00:07.0: reg 0x10: [io 0xc0a0-0xc0bf]
[ 3.384357] pci 0000:00:07.0: reg 0x14: [mem 0xfe803000-0xfe80303f]
[ 3.427052] ACPI: PCI: Interrupt link LNKA configured for IRQ 10
[ 3.433371] ACPI: PCI: Interrupt link LNKB configured for IRQ 10
[ 3.440872] ACPI: PCI: Interrupt link LNKC configured for IRQ 11
[ 3.448355] ACPI: PCI: Interrupt link LNKD configured for IRQ 11
[ 3.454315] ACPI: PCI: Interrupt link LNKS configured for IRQ 9
[ 3.469538] iommu: Default domain type: Translated
[ 3.470252] iommu: DMA domain TLB invalidation policy: lazy mode
[ 3.478089] SCSI subsystem initialized
[ 3.482029] ACPI: bus type USB registered
[ 3.483981] usbcore: registered new interface driver usbfs
[ 3.486205] usbcore: registered new interface driver hub
[ 3.488501] usbcore: registered new device driver usb
[ 3.491937] mc: Linux media interface: v0.10
[ 3.493896] videodev: Linux video capture interface: v2.00
[ 3.497060] pps_core: LinuxPPS API ver. 1 registered
[ 3.498669] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giom...@linux.it>
[ 3.500365] PTP clock support registered
[ 3.502971] EDAC MC: Ver: 3.0.0
[ 3.506913] Advanced Linux Sound Architecture Driver Initialized.
[ 3.514020] Bluetooth: Core ver 2.22
[ 3.515199] NET: Registered PF_BLUETOOTH protocol family
[ 3.517229] Bluetooth: HCI device and connection manager initialized
[ 3.520290] Bluetooth: HCI socket layer initialized
[ 3.521715] Bluetooth: L2CAP socket layer initialized
[ 3.523389] Bluetooth: SCO socket layer initialized
[ 3.524956] NET: Registered PF_ATMPVC protocol family
[ 3.526872] NET: Registered PF_ATMSVC protocol family
[ 3.528682] NetLabel: Initializing
[ 3.530250] NetLabel: domain hash size = 128
[ 3.531525] NetLabel: protocols = UNLABELED CIPSOv4 CALIPSO
[ 3.534397] NetLabel: unlabeled traffic allowed by default
[ 3.538638] nfc: nfc_init: NFC Core ver 0.1
[ 3.540686] NET: Registered PF_NFC protocol family
[ 3.542817] PCI: Using ACPI for IRQ routing
[ 3.546222] pci 0000:00:05.0: vgaarb: setting as boot VGA device
[ 3.548730] pci 0000:00:05.0: vgaarb: bridge control possible
[ 3.550200] pci 0000:00:05.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none
[ 3.550241] vgaarb: loaded
[ 3.560633] clocksource: Switched to clocksource kvm-clock
[ 3.564690] VFS: Disk quotas dquot_6.6.0
[ 3.565898] VFS: Dquot-cache hash table entries: 512 (order 0, 4096 bytes)
[ 3.568880] FS-Cache: Loaded
[ 3.581032] CacheFiles: Loaded
[ 3.582218] TOMOYO: 2.6.0
[ 3.582876] Profile 0 (used by '<kernel>') is not defined.
[ 3.584286] Userland tools for TOMOYO 2.6 must be installed and policy must be initialized.
[ 3.587878] Please see https://tomoyo.osdn.jp/2.6/ for more information.
[ 3.589277] Kernel panic - not syncing: STOP!
[ 3.590247] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-rc7-syzkaller #0
[ 3.590247] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[ 3.590247] Call Trace:
[ 3.590247] <TASK>
[ 3.590247] dump_stack_lvl+0x8b/0xb3
[ 3.590247] panic+0x29c/0x5fb
[ 3.590247] ? panic_print_sys_info.part.0+0x10b/0x10b
[ 3.590247] ? lock_release+0x3bb/0x770
[ 3.590247] ? tomoyo_load_builtin_policy+0x24d/0x2c4
[ 3.590247] ? lock_downgrade+0x6d0/0x6d0
[ 3.590247] ? vprintk+0x88/0x90
[ 3.590247] tomoyo_check_profile.cold+0xbb/0xc8
[ 3.590247] tomoyo_load_builtin_policy+0x279/0x2c4
[ 3.590247] ? smack_nf_ip_init+0x7c/0x7c
[ 3.590247] ? mark_lock.part.0+0xee/0x17c0
[ 3.590247] ? tomoyo_write_domain2+0x1a0/0x1a0
[ 3.590247] ? up_write+0x148/0x470
[ 3.590247] ? securityfs_create_dentry+0x178/0x5a0
[ 3.590247] ? tomoyo_mm_init+0x26e/0x26e
[ 3.590247] tomoyo_initerface_init+0x1c0/0x1ca
[ 3.590247] do_one_initcall+0x103/0x650
[ 3.590247] ? trace_event_raw_event_initcall_level+0x1f0/0x1f0
[ 3.590247] ? parameq+0x100/0x170
[ 3.590247] ? lock_is_held_type+0xd7/0x130
[ 3.590247] kernel_init_freeable+0x604/0x68d
[ 3.590247] ? rest_init+0x250/0x250
[ 3.590247] kernel_init+0x1a/0x1d0
[ 3.590247] ? rest_init+0x250/0x250
[ 3.590247] ret_from_fork+0x1f/0x30
[ 3.590247] </TASK>
[ 3.590247] Rebooting in 86400 seconds..
syzkaller build log:
go env (err=<nil>)
GO111MODULE="auto"
GOARCH="amd64"
GOBIN=""
GOCACHE="/syzkaller/.cache/go-build"
GOENV="/syzkaller/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/syzkaller/jobs/linux/gopath/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/syzkaller/jobs/linux/gopath"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.17"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build368488466=/tmp/go-build -gno-record-gcc-switches"
git status (err=<nil>)
HEAD detached at c88578925
nothing to commit, working tree clean
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=c885789257c76ea4479ea36282f5e0a2c7861e26 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220603-183609'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=c885789257c76ea4479ea36282f5e0a2c7861e26 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220603-183609'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=c885789257c76ea4479ea36282f5e0a2c7861e26 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220603-183609'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-stress github.com/google/syzkaller/tools/syz-stress
mkdir -p ./bin/linux_amd64
gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"c885789257c76ea4479ea36282f5e0a2c7861e26\"
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=12192ace080000
Tested on:
commit: 515f7141 Merge tag 'for-linus' of git://git.kernel.org..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
kernel config: https://syzkaller.appspot.com/x/.config?x=b5af4302509ca4c9
dashboard link: https://syzkaller.appspot.com/bug?extid=30b7f850c6d98ea461d2
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=16db0f5e080000
Reply all
Reply to author
Forward
0 new messages