Re: [syzbot] [usb?] general protection fault in wcove_typec_probe

[Aleksandr Nogikh]

On Wed, Aug 26, 2026 at 5:23 PM Greg KH <gregkh@xxxxxxxxxxxxxxxxxxx> wrote:
>
> On Wed, Aug 26, 2026 at 04:32:28PM +0200, Aleksandr Nogikh wrote:
> > On Wed, Aug 26, 2026 at 4:11 PM Greg KH <gregkh@xxxxxxxxxxxxxxxxxxx> wrote:
> > >
> > > On Wed, Aug 26, 2026 at 03:26:23PM +0200, Aleksandr Nogikh wrote:
< ... >
> > > >
> > > > Thanks for clarifying!
> > > >
> > > > Some context from the syzkaller side:
> > > > Restricting the fuzzer is always tricky, especially when the
> > > > problematic operation is just opening a file and writing to it.
> > > >
> > > > We normally constrain openat to:
> > > > 1) An allowlist of safe absolute paths (so it won't open /dev/mem,
> > > > etc.), blocking any other path starting with '/'.
> > > > 2) Relative paths under CWD (so we can still fuzz normal file operations).
> > > >
> > > > Here the problem is that one can mount sysfs under CWD, which leaves
> > > > syzkaller full access to everything inside it.
> > > >
> > > > Tightening the access to /bind, /unbind, /driver_override sounds
> > > > reasonable, but trying to catch all workarounds purely in userspace
> > > > (e.g., creating symlinks to these paths before opening them) will
> > > > easily turn into a whack-a-mole.
> > > >
> > > > Would you be open to adding some kernel config option or a boot
> > > > parameter to disable manual sysfs driver bind/unbind and
> > > > driver_override? We had a similar problem with writing to a block
> > > > device while a filesystem was being mounted, which was perfectly
> > > > solved by CONFIG_BLK_DEV_WRITE_MOUNTED.
> > >
> > > I've submitted a patch to taint the kernel if these files are written
> > > to, so that should "catch" syzbot and let you know to ignore these
> > > reports if it runs into them:
> > >         https://lore.kernel.org/r/20260826-bind_taint-v1-0-52b05f4a965c@xxxxxxxxxxxxxxxxxxx
> > >
> > > Is that sufficient?
> >
> > Hmm, if we set `panic_on_taint=` with TAINT_FORCED_BIND and ignore
> > such crashes, I think it could work, yes.
>
> Great, thanks for confirming.  I'll add that to the changelog just to
> highlight how this can be used.

Thanks!

FYI, I've just merged a mitigation into syzkaller:
https://github.com/google/syzkaller/commit/c53a1b9ca227. It should
prevent syzkaller from touching /bind, /unbind, etc., at least until
it finds a workaround.

Some more such bug reports are already in the reporting pipeline and
may still reach LKML, but new ones should stop appearing.

-- 
Aleksandr

>
> greg k-h