Re: general protection fault in security_inode_getattr

From: Miklos Szeredi
Date: Fri Oct 30 2020 - 09:02:40 EST


On Mon, Aug 24, 2020 at 11:00 PM Ondrej Mosnacek <omosnace@xxxxxxxxxx> wrote:
>
> On Mon, Aug 24, 2020 at 9:37 PM syzbot
> <syzbot+f07cc9be8d1d226947ed@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
> > syzbot has found a reproducer for the following issue on:
>
> Looping in fsdevel and OverlayFS maintainers, as this seems to be
> FS/OverlayFS related...

Hmm, the oopsing code is always something like:

All code
========
0: 1b fe sbb %esi,%edi
2: 49 8d 5e 08 lea 0x8(%r14),%rbx
6: 48 89 d8 mov %rbx,%rax
9: 48 c1 e8 03 shr $0x3,%rax
d: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1)
12: 74 08 je 0x1c
14: 48 89 df mov %rbx,%rdi
17: e8 bc b4 5b fe callq 0xfffffffffe5bb4d8
1c: 48 8b 1b mov (%rbx),%rbx
1f: 48 83 c3 68 add $0x68,%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
2a:* 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 48 89 df mov %rbx,%rdi
34: e8 9f b4 5b fe callq 0xfffffffffe5bb4d8
39: 48 8b 1b mov (%rbx),%rbx
3c: 48 83 c3 0c add $0xc,%rbx


And that looks (to me) like the unrolled loop in call_int_hook(). I
don't see how that could be related to overlayfs, though it's
definitely interesting why it only triggers from
overlay->vfs_getattr()->security_inode_getattr()...

Thanks,
Miklos