Re: keys: GPF in request_key

From: Dmitry Vyukov
Date: Wed Feb 01 2017 - 09:07:36 EST


On Wed, Feb 1, 2017 at 2:48 PM, David Howells <dhowells@xxxxxxxxxx> wrote:
> Dmitry Vyukov <dvyukov@xxxxxxxxxx> wrote:
>
>> request_key_and_link+0x2d8/0x1150 security/keys/request_key.c:549
>
> Can you disassemble this function for me? There are several possible paths
> and without the argument to the syscall and whether there's a key that was
> matched, it's hard to say which path is being taken - but this might help
> determine that.

Here it is:
https://gist.githubusercontent.com/dvyukov/65efc41d00ef0033f9374853b9265c71/raw/9d8540dfb199b81f3d3534ec4cc6da378d07f5b2/gistfile1.txt

I actually know what were the arguments to the syscall. Since it
happened in a user process context, I know what syzkaller program it
was running at the time of the crash. It's just they are not
reproducible. Here are the 3 programs, and they are almost equivalent
as far as I can see. It's in syzkaller format, but I hope you can
decipher it, it's just syscall names, address and data in hex:
https://gist.githubusercontent.com/dvyukov/19bd59ffa286a74b49ca2371b69d4c5c/raw/004eaaa58a4ca775c008591fbb94eae78f92ef86/gistfile1.txt