general protection fault in path

general protection fault in path_openat
Status: fixed on 2020/03/06 21:15
Reported-by: syzbot+c486b6e32d3d23beb4c3@syzkaller.appspotmail.com
Fix commit: 40642747dd9f vfs: fix do_last() regression
First crash: 722d, last: 716d

Fix bisection: fixed by (bisect log) :
commit 40642747dd9feab4912157882166c05722cec7b0
Author: Al Viro <viro@zeniv.linux.org.uk>
Date: Sat Feb 1 16:26:45 2020 +0000

vfs: fix do_last() regression

similar bugs (3):
Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
linux-4.19	general protection fault in path_openat	C		done	13	716d	722d	1/1	fixed on 2020/03/06 08:34
upstream	general protection fault in path_openat	C	done		7	720d	720d	16/22	fixed on 2020/02/18 14:31
android-54	general protection fault in path_openat	syz			26	715d	722d	1/1	fixed on 2021/10/12 13:38

Sample crash report:

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 8606 Comm: udevd Not tainted 4.14.169-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff88809729a1c0 task.stack: ffff888096388000
RIP: 0010:do_last fs/namei.c:3269 [inline]
RIP: 0010:path_openat+0x20b/0x3db0 fs/namei.c:3569
RSP: 0018:ffff88809638f868 EFLAGS: 00010247
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0001020304050608
RDX: 0000000000000000 RSI: 1ffff11012c71efe RDI: 0000000000000004
RBP: ffff88809638f9c0 R08: ffff88809729a1c0 R09: 0000000000000002
R10: 0000000000000000 R11: 0000000000000003 R12: ffff88809638fa00
R13: ffff88809638fa00 R14: ffff888084c7ab40 R15: 0000000000000000
FS:  00007faee11bf7a0(0000) GS:ffff8880aed00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000625208 CR3: 0000000096a3d000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 do_filp_open+0x18e/0x250 fs/namei.c:3603
 do_open_execat+0xe7/0x4a0 fs/exec.c:849
 open_exec+0x37/0x70 fs/exec.c:881
 load_elf_binary+0x77c/0x4d60 fs/binfmt_elf.c:767
 search_binary_handler fs/exec.c:1638 [inline]
 search_binary_handler+0x149/0x6f0 fs/exec.c:1616
 exec_binprm fs/exec.c:1680 [inline]
 do_execveat_common.isra.0+0x1000/0x1dd0 fs/exec.c:1802
 do_execve fs/exec.c:1847 [inline]
 SYSC_execve fs/exec.c:1928 [inline]
 SyS_execve+0x39/0x50 fs/exec.c:1923
 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7faee08a3207
RSP: 002b:00007ffd29d6a178 EFLAGS: 00000206 ORIG_RAX: 000000000000003b
RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007faee08a3207
RDX: 0000000001c16e80 RSI: 00007ffd29d6a270 RDI: 00007ffd29d6b280
RBP: 0000000000625500 R08: 0000000000001c7e R09: 0000000000001c7e
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000001c16e80
R13: 0000000000000007 R14: 0000000001bc7030 R15: 0000000000000005
Code: 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 03 30 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 5e 58 48 8d 7b 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 
RIP: do_last fs/namei.c:3269 [inline] RSP: ffff88809638f868
RIP: path_openat+0x20b/0x3db0 fs/namei.c:3569 RSP: ffff88809638f868
---[ end trace 2ddd1381135f8f62 ]---

Crashes (40):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro
ci2-linux-4-14	2020/02/02 19:34	linux-4.14.y	9fa690a2a016	93e5e335	.config	log	report	syz	C
ci2-linux-4-14	2020/02/02 10:54	linux-4.14.y	9fa690a2a016	2274ad39	.config	log	report	syz	C
ci2-linux-4-14	2020/01/31 09:07	linux-4.14.y	9fa690a2a016	5ed23f9a	.config	log	report	syz	C
ci2-linux-4-14	2020/01/30 22:08	linux-4.14.y	9fa690a2a016	5ed23f9a	.config	log	report	syz	C
ci2-linux-4-14	2020/02/02 17:56	linux-4.14.y	9fa690a2a016	93e5e335	.config	log	report	syz
ci2-linux-4-14	2020/02/02 06:07	linux-4.14.y	9fa690a2a016	2274ad39	.config	log	report	syz
ci2-linux-4-14	2020/01/30 06:55	linux-4.14.y	9fa690a2a016	5ed23f9a	.config	log	report	syz
ci2-linux-4-14	2020/02/05 09:45	linux-4.14.y	9fa690a2a016	93e5e335	.config	log	report
ci2-linux-4-14	2020/02/05 04:31	linux-4.14.y	9fa690a2a016	93e5e335	.config	log	report
ci2-linux-4-14	2020/02/04 23:57	linux-4.14.y	9fa690a2a016	93e5e335	.config	log	report
ci2-linux-4-14	2020/02/04 22:26	linux-4.14.y	9fa690a2a016	93e5e335	.config	log	report
ci2-linux-4-14	2020/02/03 22:54	linux-4.14.y	9fa690a2a016	93e5e335	.config	log	report
ci2-linux-4-14	2020/02/03 21:47	linux-4.14.y	9fa690a2a016	93e5e335	.config	log	report
ci2-linux-4-14	2020/02/03 21:15	linux-4.14.y	9fa690a2a016	93e5e335	.config	log	report
ci2-linux-4-14	2020/02/03 19:34	linux-4.14.y	9fa690a2a016	93e5e335	.config	log	report
ci2-linux-4-14	2020/02/03 15:40	linux-4.14.y	9fa690a2a016	93e5e335	.config	log	report
ci2-linux-4-14	2020/02/03 11:04	linux-4.14.y	9fa690a2a016	93e5e335	.config	log	report
ci2-linux-4-14	2020/02/03 05:16	linux-4.14.y	9fa690a2a016	93e5e335	.config	log	report
ci2-linux-4-14	2020/02/03 01:58	linux-4.14.y	9fa690a2a016	93e5e335	.config	log	report
ci2-linux-4-14	2020/02/02 18:02	linux-4.14.y	9fa690a2a016	93e5e335	.config	log	report
ci2-linux-4-14	2020/02/02 07:33	linux-4.14.y	9fa690a2a016	2274ad39	.config	log	report
ci2-linux-4-14	2020/02/01 23:42	linux-4.14.y	9fa690a2a016	2274ad39	.config	log	report
ci2-linux-4-14	2020/02/01 23:30	linux-4.14.y	9fa690a2a016	2274ad39	.config	log	report
ci2-linux-4-14	2020/02/01 21:09	linux-4.14.y	9fa690a2a016	326d4c78	.config	log	report
ci2-linux-4-14	2020/02/01 15:16	linux-4.14.y	9fa690a2a016	326d4c78	.config	log	report
ci2-linux-4-14	2020/02/01 14:45	linux-4.14.y	9fa690a2a016	326d4c78	.config	log	report
ci2-linux-4-14	2020/02/01 12:43	linux-4.14.y	9fa690a2a016	326d4c78	.config	log	report
ci2-linux-4-14	2020/01/31 21:36	linux-4.14.y	9fa690a2a016	0eb59c27	.config	log	report
ci2-linux-4-14	2020/01/31 21:27	linux-4.14.y	9fa690a2a016	0eb59c27	.config	log	report
ci2-linux-4-14	2020/01/31 17:53	linux-4.14.y	9fa690a2a016	5ed23f9a	.config	log	report
ci2-linux-4-14	2020/01/31 15:06	linux-4.14.y	9fa690a2a016	5ed23f9a	.config	log	report
ci2-linux-4-14	2020/01/31 14:19	linux-4.14.y	9fa690a2a016	5ed23f9a	.config	log	report
ci2-linux-4-14	2020/01/31 11:04	linux-4.14.y	9fa690a2a016	5ed23f9a	.config	log	report
ci2-linux-4-14	2020/01/31 04:26	linux-4.14.y	9fa690a2a016	5ed23f9a	.config	log	report
ci2-linux-4-14	2020/01/30 21:23	linux-4.14.y	9fa690a2a016	5ed23f9a	.config	log	report
ci2-linux-4-14	2020/01/30 19:43	linux-4.14.y	9fa690a2a016	5ed23f9a	.config	log	report
ci2-linux-4-14	2020/01/30 05:28	linux-4.14.y	9fa690a2a016	5ed23f9a	.config	log	report
ci2-linux-4-14	2020/01/30 05:20	linux-4.14.y	9fa690a2a016	5ed23f9a	.config	log	report
ci2-linux-4-14	2020/01/30 04:26	linux-4.14.y	9fa690a2a016	5ed23f9a	.config	log	report
ci2-linux-4-14	2020/01/29 23:13	linux-4.14.y	9fa690a2a016	5ed23f9a	.config	log	report