[PATCH] fs/exec: Test patch for syzkaller crash

[PATCH] fs/exec: Test patch for syzkaller crash

[ira.weiny]

From: Ira Weiny <ira.weiny@intel.com>

Kees reported that it looked like the kmap_local_page() conversion in
fs/exec.c was causing a crash with the syzkaller.[1]

At first glance it appeared this was due to the lack of pagefaults not
being disabled as was done by kmap_atomic().

Unfortunately, after deeper investigation we don't see how this is a
problem.  The crash does not appear to be happening in the
memcpy_to_page() call.[2]

For testing, add back pagefault disable in copy_string_kernel() to see
if it makes syzkaller happy.  If so more investigation will need to be
done to understand exactly what is happening.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c6e8e36c6ae4b11bed5643317afb66b6c3cadba8
[2] https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/fs/exec.c?id=40d43a7507e1547dd45cb02af2e40d897c591870#n616

Cc: Kees Cook <keescook@chromium.org>
Reported-by: syzbot+3250d9c8925ef29e975f@syzkaller.appspotmail.com
Signed-off-by: Ira Weiny <ira.weiny@intel.com>
---
 fs/exec.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/exec.c b/fs/exec.c
index b51dd14e7388..e076b228123a 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -640,7 +640,9 @@ int copy_string_kernel(const char *arg, struct linux_binprm *bprm)
 		if (!page)
 			return -E2BIG;
 		flush_arg_page(bprm, pos & PAGE_MASK, page);
+		pagefault_disable();
 		memcpy_to_page(page, offset_in_page(pos), arg, bytes_to_copy);
+		pagefault_enable();
 		put_arg_page(page);
 	}
 
-- 
2.35.3

Re: [PATCH] fs/exec: Test patch for syzkaller crash

[Kees Cook]

On Thu, Aug 11, 2022 at 05:09:19PM -0700, ira.weiny@intel.com wrote:
> From: Ira Weiny <ira.weiny@intel.com>
> 
> Kees reported that it looked like the kmap_local_page() conversion in
> fs/exec.c was causing a crash with the syzkaller.[1]
> 
> At first glance it appeared this was due to the lack of pagefaults not
> being disabled as was done by kmap_atomic().
> 
> Unfortunately, after deeper investigation we don't see how this is a
> problem.  The crash does not appear to be happening in the
> memcpy_to_page() call.[2]
> 
> For testing, add back pagefault disable in copy_string_kernel() to see
> if it makes syzkaller happy.  If so more investigation will need to be
> done to understand exactly what is happening.
> 
> [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c6e8e36c6ae4b11bed5643317afb66b6c3cadba8
> [2] https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/fs/exec.c?id=40d43a7507e1547dd45cb02af2e40d897c591870#n616
> 
> Cc: Kees Cook <keescook@chromium.org>
> Reported-by: syzbot+3250d9c8925ef29e975f@syzkaller.appspotmail.com
> Signed-off-by: Ira Weiny <ira.weiny@intel.com>

Thanks for spinning this. As noted in the other thread, I'm going to
wait and see if the crashes return. It looks like it may have been an
unrelated problem that got fix in -next (no crashes for a day now...)

But we'll have this in our back pocket if we need it. :)

-Kees

-- 
Kees Cook