Re: [syzbot] Monthly lsm report (Sep 2024)

[Kent Overstreet]

On Sat, Sep 28, 2024 at 06:23:53PM GMT, Tetsuo Handa wrote:
> On 2024/09/28 17:57, Kent Overstreet wrote:
> > On Sat, Sep 28, 2024 at 03:49:27PM GMT, Tetsuo Handa wrote:
> >> On 2024/09/28 10:25, Kent Overstreet wrote:
> >>> And looking further, I don't see anyhting in the console log from when
> >>> bcachefs actually mounted (???), which means I don't think I have enough
> >>> to go on. It's clearly an upgrade path issue - we didn't run
> >>> check_allocations as is required when upgrading to 1.11 - but it's not
> >>> reproducing for me when I run tests with old tools.
> >>>
> >>> Can we get some more information about the syzbot reproducer? Exact
> >>> tools version, format command and mount command.
> >>
> >> Reproducer for this bug is not yet found. But syzbot does not use userspace
> >> tools. That is, testing with old (or new) tools will not help. Please note
> >> that syzbot uses crafted (intentionally corrupted) filesystem images. If the
> >> kernel side depends on sanity checks / validations done by the userspace
> >> side, syzbot will find oversights on the kernel side. Please don't make any
> >> assumptions made by the userspace tools.
> >>
> > 
> > You seem to be confused; how do you expect sysbot to test a filesystem
> > without the format comand?
> 
> Please find syz_mount_image$bcachefs from e.g.
> https://syzkaller.appspot.com/text?tag=CrashLog&x=17441e80580000 .
> 
> syzbot creates in-memory filesystem image using memfd and mount it
> using loopback devices. For example,
> https://syzkaller.appspot.com/text?tag=ReproC&x=102e0907980000 is
> a C reproducer for an ext4 bug; check how setup_loop_device() and
> syz_mount_image() are used for mounting filesystems.
> 
> Again, syzbot does not use userspace tools for managing filesystems.

Well, they must have started with /something/, I very much doubt they
wrote their own code for writing a bcachefs superblock.

And if they were using the standard format command I would've gotten the
full contents of the superblock in a nice text format, so I could piece
together what happened.

Since I don't have that, and the part of the dmesg log where bcachefs
mounted doesn't even seem to be there, I don't have anything to go on.