From: Al Viro <viro@zeniv.linux.org.uk>
To: reveliofuzzing <reveliofuzzing@gmail.com>
Cc: brauner@kernel.org, linux-fsdevel@vger.kernel.org
Subject: Re: Report "WARNING in putname"
Date: Wed, 25 Sep 2024 18:51:18 +0100 [thread overview]
Message-ID: <20240925175118.GJ3550746@ZenIV> (raw)
In-Reply-To: <CA+-ZZ_gDJ02P46ee08sFcFGUWCyS37nbybcRALnBkGhSPkB-fQ@mail.gmail.com>
On Wed, Sep 25, 2024 at 11:50:17AM -0400, reveliofuzzing wrote:
> Hello,
>
> We found the following error when fuzzing^1 the Linux kernel 6.10 and
> we are able
> to reproduce it.
Must be nice, seeing that the rest of us are only given something
that needs syzbot (presumably with your modifications) to translate
into usable C.
[snip "dangling struct filename on return from mkdir()"]
> - reproducer
> syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff)
> syz_open_dev$usbmon(&(0x7f00000004c0), 0x0, 0x0)
> setxattr$trusted_overlay_opaque(0x0, 0x0, 0x0, 0x0, 0x0)
> socket$nl_generic(0x10, 0x3, 0x10)
> openat$null(0xffffffffffffff9c, &(0x7f0000001180), 0x0, 0x0)
> r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
> read(r0, &(0x7f0000000000), 0x2000)
> shutdown(0xffffffffffffffff, 0x0)
> r1 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0)
Seeing that nothing in that, as far as I can parse the damn language,
should go anywhere near mkdir(), I suspect that you are seeing
a memory corruption from something that reproducer is actually
doing. And IIRC there had been a bunch of reports from you lately,
all with similar reproducers and with rather varied symptoms, which
makes memory corruptor triggering crap in whatever code that might
step on the buggered data structures afterwards.
Hard to tell anything beyond that without something one could
actually run...
prev parent reply other threads:[~2024-09-25 17:51 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-09-25 15:50 Report "WARNING in putname" reveliofuzzing
2024-09-25 17:51 ` Al Viro [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240925175118.GJ3550746@ZenIV \
--to=viro@zeniv.linux.org.uk \
--cc=brauner@kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=reveliofuzzing@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox