Re: general protection fault in do_move_mount (2)

Al Viro
2019-06-18T14:03:27Z

On Tue, Jun 18, 2019 at 03:47:10AM -0700, syzbot wrote:
> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit: 9e0babf2 Linux 5.2-rc5
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=138b310aa00000
> kernel config: https://syzkaller.appspot.com/x/.config?x=d16883d6c7f0d717
> dashboard link: https://syzkaller.appspot.com/bug?extid=6004acbaa1893ad013f0
> compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=154e8c2aa00000

IDGI...

mkdir(&(0x7f0000632000)='./file0\x00', 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
r0 = open(&(0x7f0000032ff8)='./file0\x00', 0x0, 0x0)
r1 = memfd_create(&(0x7f00000001c0)='\xb3', 0x0)
write$FUSE_DIRENT(r1, &(0x7f0000000080)=ANY=[], 0x29)
move_mount(r0, &(0x7f0000000040)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x66)

reads as if we'd done mkdir ./file0, opened it and then tried
to feed move_mount(2) "./file0" relative to that descriptor.
How the hell has that avoided an instant -ENOENT? On the first
pair, that is - the second one (AT_FDCWD, "./file0") is fine...

Confused... Incidentally, what the hell is
mount(0x0, 0x0, 0x0, 0x0, 0x0)
about? *IF* that really refers to mount(2) with
such arguments, all you'll get is -EFAULT. Way before
it gets to actually doing anything - it won't get past
/* ... and get the mountpoint */
retval = user_path(dir_name, &path);
if (retval)
return retval;
in do_mount(2)...