fs: NULL deref in atime_needs_update
From: Dmitry Vyukov
Date: Fri Feb 05 2016 - 16:11:48 EST
Hello,
I've hit the following GPF while running syzkaller fuzzer:
general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN
Modules linked in:
CPU: 1 PID: 5178 Comm: syz-executor Not tainted 4.5.0-rc2+ #65
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff880064768000 ti: ffff8800622c0000 task.ti: ffff8800622c0000
RIP: 0010:[<ffffffff8181aa5d>] [<ffffffff8181aa5d>]
atime_needs_update+0x2d/0x460
RSP: 0018:ffff8800622c7a30 EFLAGS: 00010203
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: dffffc0000000000
RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000000000000000c
RBP: ffff8800622c7a58 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff8800622c7c08
R13: ffff8800622c7c08 R14: ffff8800301ca322 R15: ffff8800622c7bb0
FS: 00007fd1c9f8b700(0000) GS:ffff88003ed00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000020f31000 CR3: 0000000062274000 CR4: 00000000000006e0
Stack:
ffff8800622c7bf4 0000000000000000 ffff8800622c7c08 ffff8800301ca322
ffff8800622c7bb0 ffff8800622c7b38 ffffffff817ecd91 ffff880030bf5200
ffff8800622c7bb8 1ffff1000c458f56 ffff8800622c7c00 ffff8800622c7be0
Call Trace:
[< inline >] get_link fs/namei.c:1006
[<ffffffff817ecd91>] link_path_walk+0xaf1/0x1030 fs/namei.c:1968
[<ffffffff817ed311>] path_parentat+0x41/0x150 fs/namei.c:2176
[<ffffffff817f4c5c>] filename_parentat+0x17c/0x3c0 fs/namei.c:2198
[< inline >] user_path_parent fs/namei.c:2412
[< inline >] SYSC_renameat2 fs/namei.c:4411
[< inline >] SyS_renameat2 fs/namei.c:4375
[< inline >] SYSC_renameat fs/namei.c:4521
[<ffffffff817f9a72>] SyS_renameat+0x192/0x820 fs/namei.c:4518
[<ffffffff8669e0b6>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
Code: 89 e5 41 57 41 56 41 55 41 54 49 89 fc 53 48 89 f3 e8 08 25 d5
ff 48 8d 7b 0c 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f>
b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85
RIP [<ffffffff8181aa5d>] atime_needs_update+0x2d/0x460 fs/inode.c:1611
RSP <ffff8800622c7a30>
---[ end trace 1a4c9bda4680ce46 ]---
On commit df48ab3c2f5ffca88b7803ffbadd074bd5a0a2ef.
Objdump shows that inode is NULL in atime_needs_update.
Unfortunately reproduction of this crash is very hard. The program
executes something along the lines of:
mmap(0x20000000, 15945728, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mkdir("./bus", 0662515705056234013740) = 0
openat(AT_FDCWD, "./bus", O_RDONLY|O_EXCL) = 3
symlinkat("../bus", 3, "./bus") = 0
renameat(3, "./bus", 3, "./bus/file0") = 0
mmap(0x20f35000, 4096, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20f35000
mount("./bus", "./bus", 0x20f2aee4,
MS_RDONLY|MS_NODEV|MS_RELATIME|MS_NODIRATIME|MS_BIND|MS_MOVE|MS_REC|MS_UNBINDABLE|MS_SLAVE|MS_SHARED|0xc000380,
0x20093f5f) = 0
open("./bus/file0", O_RDWR|O_EXCL) = -1 EISDIR (Is a directory)
exit_group(0) = ?
But in multiple threads so that some calls can be doubled and/or
overlapped. And all this happens on a tmpfs mount.
But I was able to reproduce it 8 or so times, so I am sure that it is real.
For future reference, I was running these programs:
https://gist.githubusercontent.com/dvyukov/124c457d308fa724d88a/raw/fec2d86e125a7fd2fa2916791d65d7daead7cbbb/gistfile1.txt
Following these instructions:
https://github.com/google/syzkaller/wiki/How-to-execute-syzkaller-programs