[Cluster-devel] We found a general protection fault in evict

[Cluster-devel] We found a general protection fault in evict

[yang lan]

Hi,

We use our modified Syzkaller to fuzz the latest Linux kernel and find a
bug in the gfs2 file system.

We have used the utility syz-execprog to reproduce this bug with
./syz-execprog -executor=./syz-executor -repeat=100 -procs=6 -cover=1 poc.
Now, this bug can be triggered with the following prog provided:

HEAD commit: f1b32fda06d2 tag: v5.10.179
console log: https://pastebin.com/raw/3XhteWrX
kernel config: https://pastebin.com/raw/BiggLxRg
Syz reproducer: https://pastebin.com/raw/PwbMR8ag
C reproducer:
https://drive.google.com/file/d/1j4g8EUrFb1GGdaaRBNHE4ATXiqeg6-zI/view?usp=sharing

gfs2: fsid=syz:syz.0: no resource groups found in the file system.
general protection fault, probably for non-canonical address
0xdffffc0000000010: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000080-0x0000000000000087]
CPU: 0 PID: 9001 Comm: syz-executor.0 Not tainted 5.10.179 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1
04/01/2014
RIP: 0010:gfs2_evict_inode+0xaed/0x17b0
Code: 80 3c 02 00 0f 85 a4 0b 00 00 49 8b 9c 24 08 09 00 00 48 b8 00 00 00
00 00 fc ff df 48 8d bb 84 00 00 00 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48
89 f8 83 e0 07 83 c0 03 38 d0 7c 09 84 d2 74 05 e8
RSP: 0018:ffff88802967f640 EFLAGS: 00010203
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc90007f25000
RDX: 0000000000000010 RSI: ffffffff83480d2a RDI: 0000000000000084
RBP: ffff88802967f7b8 R08: ffff8880416d8000 R09: ffffed1005400154
R10: ffff88802a000a9b R11: ffffed1005400153 R12: ffff888029a40000
R13: ffff88802a000c10 R14: ffff888029ce9100 R15: ffff888029ce8ce0
FS:  00007fd8a9e7c700(0000) GS:ffff88802d000000(0000) knlGS:0000000000000000
wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
CR2: 00007fffb6ae1f70 CR3: 00000000282bf000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 ? quarantine_put+0xcc/0x160
 ? evict_unlinked_inode+0x890/0x890
 ? evict+0x2b2/0x630
 ? lock_downgrade+0x6a0/0x6a0
 ? var_wake_function+0x150/0x150
 ? gfs2_evict_inode+0x87b/0x17b0
 ? evict_unlinked_inode+0x890/0x890
 evict+0x2e8/0x630
 ? gfs2_glock_put_eventually+0x90/0x90
 iput+0x48c/0x780
 init_inodes+0x1ed/0x26d0
 ? end_bio_io_page+0x100/0x100
 ? vsnprintf+0x1bd/0x15c0
 ? pointer+0x790/0x790
 ? init_sb+0x9bf/0xd00
 ? snprintf+0xae/0xe0
 ? gfs2_fill_super+0x1a3b/0x2760
 gfs2_fill_super+0x1a3b/0x2760
 ? gfs2_reconfigure+0x1120/0x1120
 ? gfs2_glock_nq_num+0xf6/0x1e0
 ? __down_interruptible+0x3c0/0x3c0
 ? snprintf+0xae/0xe0
 ? vsprintf+0x30/0x30
 ? wait_for_completion+0x250/0x250
 ? set_blocksize+0x2a0/0x330
 get_tree_bdev+0x484/0x720
 ? gfs2_reconfigure+0x1120/0x1120
 gfs2_get_tree+0x4a/0x270
 vfs_get_tree+0x86/0x2f0
 path_mount+0x6d3/0x1c90
 ? strncpy_from_user+0x2e4/0x460
 ? finish_automount+0x910/0x910
 ? getname_flags+0x268/0x5a0
 do_mount+0xf1/0x110
 ? path_mount+0x1c90/0x1c90
 __x64_sys_mount+0x1d5/0x220
 do_syscall_64+0x2d/0x70
 entry_SYSCALL_64_after_hwframe+0x61/0xc6
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/cluster-devel/attachments/20230427/5ce5de55/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: log
Type: application/octet-stream
Size: 17478 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/cluster-devel/attachments/20230427/5ce5de55/attachment-0004.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: syz_poc
Type: application/octet-stream
Size: 459390 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/cluster-devel/attachments/20230427/5ce5de55/attachment-0005.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: kernel_config
Type: application/octet-stream
Size: 225672 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/cluster-devel/attachments/20230427/5ce5de55/attachment-0006.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: c_poc
Type: application/octet-stream
Size: 1166243 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/cluster-devel/attachments/20230427/5ce5de55/attachment-0007.obj>

[Cluster-devel] We found a general protection fault in evict

[Bob Peterson]

On 4/27/23 11:15 AM, yang lan wrote:
> Hi,
> 
> We use our modified Syzkaller to fuzz the latest Linux kernel and find a 
> bug in the gfs2 file system.
> 
> We have used the utility syz-execprog to reproduce this bug with 
> ./syz-execprog -executor=./syz-executor -repeat=100 -procs=6 -cover=1 poc.
> Now, this bug can be triggered with the following prog provided:
> 
> HEAD commit: f1b32fda06d2 tag: v5.10.179
> console log: https://pastebin.com/raw/3XhteWrX 
> <https://pastebin.com/raw/3XhteWrX>
> kernel config: https://pastebin.com/raw/BiggLxRg 
> <https://pastebin.com/raw/BiggLxRg>
> Syz reproducer: https://pastebin.com/raw/PwbMR8ag 
> <https://pastebin.com/raw/PwbMR8ag>
> C reproducer: 
> https://drive.google.com/file/d/1j4g8EUrFb1GGdaaRBNHE4ATXiqeg6-zI/view?usp=sharing <https://drive.google.com/file/d/1j4g8EUrFb1GGdaaRBNHE4ATXiqeg6-zI/view?usp=sharing>
> 
> gfs2: fsid=syz:syz.0: no resource groups found in the file system.

Hi,

The upstream kernel doesn't seem to GPF here. I get a non-fatal file 
system withdraw (which seems reasonable given what the resulting fs 
looks like):

[root at bob-upstream9 /home/bob/xfstests-dev]# /home/bob/tools/c/poc_evict
[root at bob-upstream9 /home/bob/xfstests-dev]# echo $?
0

[ 2530.707005] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", 
"syz:syz"
[ 2530.707576] gfs2: fsid=syz:syz: Now mounting FS (format 1801)...
[ 2530.708349] gfs2: fsid=syz:syz.0: fatal: filesystem consistency error
[ 2530.708349]   inode = 3 2076
[ 2530.708349]   function = gfs2_dinode_in, file = fs/gfs2/glops.c, line 
= 472
[ 2530.709534] gfs2: fsid=syz:syz.0: G:  s:SH n:2/81c f:qobnN t:SH 
d:EX/0 a:0 v:0 r:3 m:200 p:1
[ 2530.710165] gfs2: fsid=syz:syz.0:  H: s:SH f:H e:0 p:1825 [mount] 
gfs2_fill_super+0x8f0/0xef0 [gfs2]
[ 2530.710846] gfs2: fsid=syz:syz.0:  I: n:3/2076 t:4 f:0x00 
d:0x00000000 s:0 p:0
[ 2530.711387] gfs2: fsid=syz:syz.0: about to withdraw this file system
[ 2530.711857] gfs2: fsid=syz:syz.0: File system withdrawn
[ 2530.712256] CPU: 6 PID: 1825 Comm: mount Kdump: loaded Not tainted 
6.3.0-rc3+ #26
[ 2530.712803] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.1-1.el9 
04/01/2014
[ 2530.713324] Call Trace:
[ 2530.713513]  <TASK>
[ 2530.713678]  dump_stack_lvl+0x48/0x60
[ 2530.713959]  gfs2_withdraw+0x479/0x5c0 [gfs2]
[ 2530.714299]  gfs2_inode_refresh+0x267/0x2d0 [gfs2]
[ 2530.714667]  gfs2_instantiate+0x87/0xc0 [gfs2]
[ 2530.715013]  gfs2_glock_wait+0x8b/0xb0 [gfs2]
[ 2530.715356]  init_journal+0x302/0xaf0 [gfs2]
[ 2530.715693]  ? vsnprintf+0x2ba/0x560
[ 2530.715966]  ? gfs2_fill_super+0x8f0/0xef0 [gfs2]
[ 2530.716326]  ? snprintf+0x3d/0x50
[ 2530.716576]  gfs2_fill_super+0x8f0/0xef0 [gfs2]
[ 2530.716927]  ? gfs2_fill_super+0x7aa/0xef0 [gfs2]
[ 2530.717287]  ? mutex_lock+0x12/0x40
[ 2530.717552]  ? __pfx_gfs2_fill_super+0x10/0x10 [gfs2]
[ 2530.717938]  ? snprintf+0x3d/0x50
[ 2530.718190]  ? sget_fc+0x208/0x300
[ 2530.718453]  ? __pfx_gfs2_fill_super+0x10/0x10 [gfs2]
[ 2530.718837]  get_tree_bdev+0x171/0x270
[ 2530.719126]  gfs2_get_tree+0x22/0x90 [gfs2]
[ 2530.719446]  vfs_get_tree+0x26/0xd0
[ 2530.719711]  path_mount+0x464/0xa80
[ 2530.719981]  __x64_sys_mount+0xeb/0x120
[ 2530.720271]  do_syscall_64+0x5d/0x90
[ 2530.720544]  ? syscall_exit_to_user_mode+0x1b/0x40
[ 2530.720902]  ? do_syscall_64+0x6d/0x90
[ 2530.721185]  ? do_syscall_64+0x6d/0x90
[ 2530.721467]  ? syscall_exit_to_user_mode+0x1b/0x40
[ 2530.721823]  ? do_syscall_64+0x6d/0x90
[ 2530.722106]  ? do_syscall_64+0x6d/0x90
[ 2530.722386]  ? do_syscall_64+0x6d/0x90
[ 2530.722668]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2530.723046] RIP: 0033:0x7f7dcd83f7be
[ 2530.723316] Code: 48 8b 0d 65 a6 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 
66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 
05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 32 a6 1b 00 f7 d8 64 89 01 48
[ 2530.724659] RSP: 002b:00007fffe0f3d248 EFLAGS: 00000246 ORIG_RAX: 
00000000000000a5
[ 2530.725211] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 
00007f7dcd83f7be
[ 2530.725733] RDX: 000055b230c02e20 RSI: 000055b230c02e60 RDI: 
000055b230c02e40
[ 2530.726256] RBP: 000055b230c02bf0 R08: 0000000000000000 R09: 
00007fffe0f3bf70
[ 2530.726776] R10: 0000000000000000 R11: 0000000000000246 R12: 
0000000000000000
[ 2530.727298] R13: 000055b230c02e20 R14: 000055b230c02e40 R15: 
000055b230c02bf0
[ 2530.727819]  </TASK>
[ 2530.728005] gfs2: fsid=syz:syz.0: can't read journal index: -5

I'm guessing it's a problem we've already fixed in newer versions, but I 
don't have easy access to that kernel. Perhaps you can bisect it?
I could try older kernels but I've already spent a lot of time on this 
today, so I need to move on to other things.

Regards,

Bob Peterson