syzbot


general protection fault in nfs_idmap_legacy_upcall

Status: fixed on 2018/02/01 10:32
Subsystems: nfs
[Documentation on labels]
Reported-by: syzbot+5dfdbcf7b3eb5912abbb@syzkaller.appspotmail.com
Fix commit: 49686cbbb3eb NFS: reject request for id_legacy key without auxdata
First crash: 2283d, last: 2283d
Discussions (7)
Title Replies (including bot) Last reply
[PATCH 3.16 000/410] 3.16.57-rc1 review 426 (426) 2018/11/12 17:42
[PATCH 4.4 000/108] 4.4.116-stable review 133 (133) 2018/03/22 20:25
[PATCH 4.9 00/88] 4.9.82-stable review 98 (98) 2018/02/16 20:44
[PATCH 4.14 000/195] 4.14.20-stable review 200 (200) 2018/02/16 19:20
[PATCH 4.15 000/202] 4.15.4-stable review 209 (209) 2018/02/16 19:08
[PATCH] NFS: reject request for id_legacy key without auxdata 1 (1) 2018/01/19 23:15
general protection fault in nfs_idmap_legacy_upcall 0 (1) 2018/01/19 21:58

Sample crash report:
audit: type=1400 audit(1516307868.273:7): avc:  denied  { map } for  pid=3665 comm="syzkaller312387" path="/root/syzkaller312387249" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 3665 Comm: syzkaller312387 Not tainted 4.15.0-rc8+ #268
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:nfs_idmap_prepare_pipe_upcall fs/nfs/nfs4idmap.c:537 [inline]
RIP: 0010:nfs_idmap_legacy_upcall+0x290/0x4f0 fs/nfs/nfs4idmap.c:588
RSP: 0018:ffff8801d952fbd0 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 1ffff1003b2a5f7c RCX: ffffffff82083117
RDX: 0000000000000005 RSI: 1ffff1003b2f0953 RDI: 0000000000000028
RBP: ffff8801d952fc68 R08: 1ffff1003b2a5f29 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff8801d964cd00 R14: 1ffff1003b2a5f80 R15: ffff8801d97311c0
FS:  0000000002467880(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020006000 CR3: 00000001d97c4001 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 construct_key security/keys/request_key.c:235 [inline]
 construct_key_and_link security/keys/request_key.c:484 [inline]
 request_key_and_link+0x10fd/0x16c0 security/keys/request_key.c:593
 SYSC_request_key security/keys/keyctl.c:213 [inline]
 SyS_request_key+0x18c/0x2d0 security/keys/keyctl.c:158
 entry_SYSCALL_64_fastpath+0x29/0xa0
RIP: 0033:0x43fce9
RSP: 002b:00007ffc405e62e8 EFLAGS: 00000217 ORIG_RAX: 00000000000000f9
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fce9
RDX: 0000000020000000 RSI: 0000000020000000 RDI: 0000000020005ff6
RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000fffffffe R11: 0000000000000217 R12: 0000000000401610
R13: 00000000004016a0 R14: 0000000000000000 R15: 0000000000000000
Code: 89 85 68 ff ff ff 66 41 89 14 06 78 47 e8 79 f9 67 ff 48 8b 85 70 ff ff ff 48 8d 78 28 48 8b 85 68 ff ff ff 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 39 02 00 00 48 8b 85 70 ff ff ff 48 83 78 28 
RIP: nfs_idmap_prepare_pipe_upcall fs/nfs/nfs4idmap.c:537 [inline] RSP: ffff8801d952fbd0
RIP: nfs_idmap_legacy_upcall+0x290/0x4f0 fs/nfs/nfs4idmap.c:588 RSP: ffff8801d952fbd0
---[ end trace 4ab6ef81564187ba ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/01/18 20:39 upstream dda3e15231b3 161c1d64 .config console log report syz C ci-upstream-kasan-gce
2018/01/18 20:59 upstream dda3e15231b3 161c1d64 .config console log report syz C ci-upstream-kasan-gce-386
2018/01/18 20:26 linux-next a362f6d2cdbd 161c1d64 .config console log report syz C ci-upstream-next-kasan-gce
2018/01/18 20:04 mmots ce3c209f6733 161c1d64 .config console log report syz C ci-upstream-mmots-kasan-gce
* Struck through repros no longer work on HEAD.