* Re: [syzbot] Re: [syzbot] [overlayfs?] WARNING in ovl_listxattr
2025-05-17 9:38 [syzbot] [overlayfs?] WARNING in ovl_listxattr syzbot
@ 2025-06-12 7:14 ` syzbot
2025-06-12 11:32 ` Edward Adam Davis
` (4 subsequent siblings)
5 siblings, 0 replies; 12+ messages in thread
From: syzbot @ 2025-06-12 7:14 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: Re: [syzbot] [overlayfs?] WARNING in ovl_listxattr
Author: lizhi.xu@windriver.com
#syz test
diff --git a/fs/overlayfs/xattrs.c b/fs/overlayfs/xattrs.c
index 88055deca936..69e17db853f5 100644
--- a/fs/overlayfs/xattrs.c
+++ b/fs/overlayfs/xattrs.c
@@ -122,6 +122,7 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
old_cred = ovl_override_creds(dentry->d_sb);
res = vfs_listxattr(realdentry, list, size);
ovl_revert_creds(old_cred);
+ printk("buf: %s, size: %lu, res: %ld, %s\n", list, size, res, __func__);
if (res <= 0 || size == 0)
return res;
@@ -131,6 +132,7 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
/* filter out private xattrs */
for (s = list, len = res; len;) {
size_t slen = strnlen(s, len) + 1;
+ printk("s: %s, len: %lu, slen: %lu, %s\n", s, len, slen, __func__);
/* underlying fs providing us with an broken xattr list? */
if (WARN_ON(slen > len))
^ permalink raw reply related [flat|nested] 12+ messages in thread* Re: [syzbot] [overlayfs?] WARNING in ovl_listxattr
2025-05-17 9:38 [syzbot] [overlayfs?] WARNING in ovl_listxattr syzbot
2025-06-12 7:14 ` [syzbot] " syzbot
@ 2025-06-12 11:32 ` Edward Adam Davis
2025-06-12 13:19 ` syzbot
2025-06-12 13:34 ` Edward Adam Davis
` (3 subsequent siblings)
5 siblings, 1 reply; 12+ messages in thread
From: Edward Adam Davis @ 2025-06-12 11:32 UTC (permalink / raw)
To: syzbot+4125590f2a9f5b3cdf43; +Cc: linux-kernel, syzkaller-bugs
#syz test
diff --git a/fs/xattr.c b/fs/xattr.c
index 8ec5b0204bfd..1f55b98ae275 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -491,6 +491,7 @@ vfs_listxattr(struct dentry *dentry, char *list, size_t size)
if (inode->i_op->listxattr) {
error = inode->i_op->listxattr(dentry, list, size);
+ printk("buf: %s, size: %lu, res: %ld, sb: %s, %s\n", list, size, error, inode->i_sb->s_type->name, __func__);
} else {
error = security_inode_listsecurity(inode, list, size);
if (size && error > size)
@@ -1466,12 +1467,14 @@ ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs,
int err = 0;
err = posix_acl_listxattr(inode, &buffer, &remaining_size);
+ printk("inode: %p, buf: %s, size: %lu, res: %d, %s\n", inode, buffer, size, err, __func__);
if (err)
- return err;
+ goto out;
err = security_inode_listsecurity(inode, buffer, remaining_size);
+ printk("2inode: %p, buf: %s, size: %lu, res: %d, %s\n", inode, buffer, size, err, __func__);
if (err < 0)
- return err;
+ goto out;
if (buffer) {
if (remaining_size < err)
@@ -1498,7 +1501,12 @@ ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs,
}
read_unlock(&xattrs->lock);
- return err ? err : size - remaining_size;
+ printk("3inode: %p, buf: %s, size: %lu, res: %d, remaining_size: %ld, %s\n", inode, buffer, size, err, remaining_size, __func__);
+ err = err ? err : size - remaining_size;
+ if (err > 0 && err < 24)
+ err = -ERANGE;
+out:
+ return err;
}
/**
^ permalink raw reply related [flat|nested] 12+ messages in thread* Re: [syzbot] [overlayfs?] WARNING in ovl_listxattr
2025-05-17 9:38 [syzbot] [overlayfs?] WARNING in ovl_listxattr syzbot
2025-06-12 7:14 ` [syzbot] " syzbot
2025-06-12 11:32 ` Edward Adam Davis
@ 2025-06-12 13:34 ` Edward Adam Davis
2025-06-12 14:02 ` syzbot
2025-06-12 14:29 ` Edward Adam Davis
` (2 subsequent siblings)
5 siblings, 1 reply; 12+ messages in thread
From: Edward Adam Davis @ 2025-06-12 13:34 UTC (permalink / raw)
To: syzbot+4125590f2a9f5b3cdf43; +Cc: linux-kernel, syzkaller-bugs
#syz test
diff --git a/fs/xattr.c b/fs/xattr.c
index 8ec5b0204bfd..49bbce356e27 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -491,6 +491,7 @@ vfs_listxattr(struct dentry *dentry, char *list, size_t size)
if (inode->i_op->listxattr) {
error = inode->i_op->listxattr(dentry, list, size);
+ printk("buf: %s, size: %lu, res: %ld, sb: %s, %s\n", list, size, error, inode->i_sb->s_type->name, __func__);
} else {
error = security_inode_listsecurity(inode, list, size);
if (size && error > size)
@@ -1466,12 +1467,14 @@ ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs,
int err = 0;
err = posix_acl_listxattr(inode, &buffer, &remaining_size);
+ printk("inode: %p, buf: %s, size: %lu, res: %d, %s\n", inode, buffer, size, err, __func__);
if (err)
- return err;
+ goto out;
err = security_inode_listsecurity(inode, buffer, remaining_size);
+ printk("2inode: %p, buf: %s, size: %lu, res: %d, %s\n", inode, buffer, size, err, __func__);
if (err < 0)
- return err;
+ goto out;
if (buffer) {
if (remaining_size < err)
@@ -1498,7 +1501,13 @@ ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs,
}
read_unlock(&xattrs->lock);
- return err ? err : size - remaining_size;
+ printk("3inode: %p, buf: %s, size: %lu, res: %d, remaining_size: %ld, %s\n", inode, buffer, size, err, remaining_size, __func__);
+ if (IS_POSIXACL(inode) && !err && size - remaining_size < 24)
+ ;//err = -ERANGE;
+ else
+ err = err ? err : size - remaining_size;
+out:
+ return err;
}
/**
^ permalink raw reply related [flat|nested] 12+ messages in thread* Re: [syzbot] [overlayfs?] WARNING in ovl_listxattr
2025-06-12 13:34 ` Edward Adam Davis
@ 2025-06-12 14:02 ` syzbot
0 siblings, 0 replies; 12+ messages in thread
From: syzbot @ 2025-06-12 14:02 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in ovl_listxattr
3inode: ffff888078108508, buf: , size: 182, res: 17, remaining_size: 116, simple_xattr_list
buf: system.posix_acl_access, size: 182, res: 17, sb: sysfs, vfs_listxattr
------------[ cut here ]------------
WARNING: CPU: 0 PID: 6609 at fs/overlayfs/xattrs.c:136 ovl_listxattr+0x3a3/0x400 fs/overlayfs/xattrs.c:136
Modules linked in:
CPU: 0 UID: 0 PID: 6609 Comm: syz.0.16 Not tainted 6.16.0-rc1-syzkaller-g2c4a1f3fe03e-dirty #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:ovl_listxattr+0x3a3/0x400 fs/overlayfs/xattrs.c:136
Code: 08 f2 fe e9 47 ff ff ff e8 2a bc 90 fe 4c 89 f8 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f 5d e9 84 17 32 08 cc e8 0e bc 90 fe 90 <0f> 0b 90 49 c7 c7 fb ff ff ff eb d7 e8 fc bb 90 fe 90 0f 0b 90 e9
RSP: 0018:ffffc90002f67d98 EFLAGS: 00010293
RAX: ffffffff832fa1e2 RBX: ffff888029d53400 RCX: ffff888025afda00
RDX: 0000000000000000 RSI: 0000000000000011 RDI: 0000000000000012
RBP: ffff888030fa9001 R08: ffffc90002f67a87 R09: 1ffff920005ecf50
R10: dffffc0000000000 R11: fffff520005ecf51 R12: ffffffffffffffff
R13: 0000000000000012 R14: ffff88807afcfc88 R15: 0000000000000011
FS: 00007fe253dad6c0(0000) GS:ffff888125c86000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000001000 CR3: 00000000748d2000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
vfs_listxattr fs/xattr.c:493 [inline]
listxattr+0x26d/0x320 fs/xattr.c:925
filename_listxattr fs/xattr.c:959 [inline]
path_listxattrat+0x179/0x3a0 fs/xattr.c:989
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe252f8e969
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe253dad038 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3
RAX: ffffffffffffffda RBX: 00007fe2531b5fa0 RCX: 00007fe252f8e969
RDX: 00000000000000b6 RSI: 0000200000000200 RDI: 00002000000001c0
RBP: 00007fe253010ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fe2531b5fa0 R15: 00007ffedfdb19e8
</TASK>
Tested on:
commit: 2c4a1f3f Merge tag 'bpf-fixes' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=112be60c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=162faeb2d1eaefb4
dashboard link: https://syzkaller.appspot.com/bug?extid=4125590f2a9f5b3cdf43
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
patch: https://syzkaller.appspot.com/x/patch.diff?x=14a2d9d4580000
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] [overlayfs?] WARNING in ovl_listxattr
2025-05-17 9:38 [syzbot] [overlayfs?] WARNING in ovl_listxattr syzbot
` (2 preceding siblings ...)
2025-06-12 13:34 ` Edward Adam Davis
@ 2025-06-12 14:29 ` Edward Adam Davis
2025-06-12 14:59 ` syzbot
2025-06-12 15:01 ` [PATCH] fs/xattr: reset err to 0 after get security.* xattrs Edward Adam Davis
2025-07-17 7:47 ` [syzbot] [overlayfs?] WARNING in ovl_listxattr syzbot
5 siblings, 1 reply; 12+ messages in thread
From: Edward Adam Davis @ 2025-06-12 14:29 UTC (permalink / raw)
To: syzbot+4125590f2a9f5b3cdf43; +Cc: linux-kernel, syzkaller-bugs
#syz test
diff --git a/fs/xattr.c b/fs/xattr.c
index 8ec5b0204bfd..3751c9306274 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -491,6 +491,7 @@ vfs_listxattr(struct dentry *dentry, char *list, size_t size)
if (inode->i_op->listxattr) {
error = inode->i_op->listxattr(dentry, list, size);
+ printk("buf: %s, size: %lu, res: %ld, sb: %s, %s\n", list, size, error, inode->i_sb->s_type->name, __func__);
} else {
error = security_inode_listsecurity(inode, list, size);
if (size && error > size)
@@ -1466,12 +1467,14 @@ ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs,
int err = 0;
err = posix_acl_listxattr(inode, &buffer, &remaining_size);
+ printk("inode: %p, buf: %s, size: %lu, res: %d, remaining_size: %ld, %s\n", inode, buffer, size, err, remaining_size, __func__);
if (err)
- return err;
+ goto out;
err = security_inode_listsecurity(inode, buffer, remaining_size);
+ printk("2inode: %p, buf: %s, size: %lu, res: %d, remaining_size: %ld, %s\n", inode, buffer, size, err, remaining_size, __func__);
if (err < 0)
- return err;
+ goto out;
if (buffer) {
if (remaining_size < err)
@@ -1479,6 +1482,7 @@ ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs,
buffer += err;
}
remaining_size -= err;
+ err = 0;
read_lock(&xattrs->lock);
for (rbp = rb_first(&xattrs->rb_root); rbp; rbp = rb_next(rbp)) {
@@ -1498,6 +1502,8 @@ ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs,
}
read_unlock(&xattrs->lock);
+ printk("3inode: %p, buf: %s, size: %lu, res: %d, remaining_size: %ld, %s\n", inode, buffer, size, err, remaining_size, __func__);
+out:
return err ? err : size - remaining_size;
}
^ permalink raw reply related [flat|nested] 12+ messages in thread* [PATCH] fs/xattr: reset err to 0 after get security.* xattrs
2025-05-17 9:38 [syzbot] [overlayfs?] WARNING in ovl_listxattr syzbot
` (3 preceding siblings ...)
2025-06-12 14:29 ` Edward Adam Davis
@ 2025-06-12 15:01 ` Edward Adam Davis
2025-06-12 15:09 ` Stephen Smalley
2025-07-17 7:47 ` [syzbot] [overlayfs?] WARNING in ovl_listxattr syzbot
5 siblings, 1 reply; 12+ messages in thread
From: Edward Adam Davis @ 2025-06-12 15:01 UTC (permalink / raw)
To: syzbot+4125590f2a9f5b3cdf43
Cc: amir73il, linux-kernel, linux-unionfs, miklos,
stephen.smalley.work, syzkaller-bugs
After successfully getting "security.SMACK64", err is not reset to 0, which
causes simple_xattr_list() to return 17, which is much smaller than the
actual buffer size..
After updating err to remaining_size, reset err to 0 to avoid returning an
inappropriate buffer size.
Fixes: 8b0ba61df5a1 ("fs/xattr.c: fix simple_xattr_list to always include security.* xattrs")
Reported-by: syzbot+4125590f2a9f5b3cdf43@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4125590f2a9f5b3cdf43
Tested-by: syzbot+4125590f2a9f5b3cdf43@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
fs/xattr.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/xattr.c b/fs/xattr.c
index 8ec5b0204bfd..600ae97969cf 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -1479,6 +1479,7 @@ ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs,
buffer += err;
}
remaining_size -= err;
+ err = 0;
read_lock(&xattrs->lock);
for (rbp = rb_first(&xattrs->rb_root); rbp; rbp = rb_next(rbp)) {
--
2.43.0
^ permalink raw reply related [flat|nested] 12+ messages in thread* Re: [PATCH] fs/xattr: reset err to 0 after get security.* xattrs
2025-06-12 15:01 ` [PATCH] fs/xattr: reset err to 0 after get security.* xattrs Edward Adam Davis
@ 2025-06-12 15:09 ` Stephen Smalley
0 siblings, 0 replies; 12+ messages in thread
From: Stephen Smalley @ 2025-06-12 15:09 UTC (permalink / raw)
To: Edward Adam Davis
Cc: syzbot+4125590f2a9f5b3cdf43, amir73il, linux-kernel,
linux-unionfs, miklos, syzkaller-bugs
On Thu, Jun 12, 2025 at 11:01 AM Edward Adam Davis <eadavis@qq.com> wrote:
>
> After successfully getting "security.SMACK64", err is not reset to 0, which
> causes simple_xattr_list() to return 17, which is much smaller than the
> actual buffer size..
>
> After updating err to remaining_size, reset err to 0 to avoid returning an
> inappropriate buffer size.
>
> Fixes: 8b0ba61df5a1 ("fs/xattr.c: fix simple_xattr_list to always include security.* xattrs")
> Reported-by: syzbot+4125590f2a9f5b3cdf43@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=4125590f2a9f5b3cdf43
> Tested-by: syzbot+4125590f2a9f5b3cdf43@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Already fixed on vfs/vfs.fixes, see:
https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git/commit/?h=vfs.fixes&id=800d0b9b6a8b1b354637b4194cc167ad1ce2bdd3
> ---
> fs/xattr.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/fs/xattr.c b/fs/xattr.c
> index 8ec5b0204bfd..600ae97969cf 100644
> --- a/fs/xattr.c
> +++ b/fs/xattr.c
> @@ -1479,6 +1479,7 @@ ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs,
> buffer += err;
> }
> remaining_size -= err;
> + err = 0;
>
> read_lock(&xattrs->lock);
> for (rbp = rb_first(&xattrs->rb_root); rbp; rbp = rb_next(rbp)) {
> --
> 2.43.0
>
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] [overlayfs?] WARNING in ovl_listxattr
2025-05-17 9:38 [syzbot] [overlayfs?] WARNING in ovl_listxattr syzbot
` (4 preceding siblings ...)
2025-06-12 15:01 ` [PATCH] fs/xattr: reset err to 0 after get security.* xattrs Edward Adam Davis
@ 2025-07-17 7:47 ` syzbot
5 siblings, 0 replies; 12+ messages in thread
From: syzbot @ 2025-07-17 7:47 UTC (permalink / raw)
To: amir73il, brauner, eadavis, jack, linux-fsdevel, linux-kernel,
linux-unionfs, lizhi.xu, miklos, stephen.smalley.work,
syzkaller-bugs, viro
syzbot suspects this issue was fixed by commit:
commit 800d0b9b6a8b1b354637b4194cc167ad1ce2bdd3
Author: Stephen Smalley <stephen.smalley.work@gmail.com>
Date: Thu Jun 5 16:51:16 2025 +0000
fs/xattr.c: fix simple_xattr_list()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=173de382580000
start commit: e9565e23cd89 Merge tag 'sched_ext-for-6.15-rc6-fixes' of g..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=5929ac65be9baf3c
dashboard link: https://syzkaller.appspot.com/bug?extid=4125590f2a9f5b3cdf43
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12cb6af4580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1301f670580000
If the result looks correct, please mark the issue as fixed by replying with:
#syz fix: fs/xattr.c: fix simple_xattr_list()
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
^ permalink raw reply [flat|nested] 12+ messages in thread