general protection fault in kernfs_dop_revalidate

From: cheung wall
Date: Fri Mar 15 2024 - 23:16:35 EST

Hello,

when using Healer to fuzz the latest Linux Kernel, the following crash

was triggered on:


HEAD commit: 90d35da658da8cff0d4ecbb5113f5fac9d00eb72 (tag: v6.8-rc7)

git tree: upstream

console output: https://pastebin.com/raw/Hjn0vNFh

kernel config: https://pastebin.com/raw/EjhKA6ij

C reproducer: https://pastebin.com/raw/5nL8yLmu

Syzlang reproducer: https://pastebin.com/raw/Gkqa66xp

If you fix this issue, please add the following tag to the commit:

Reported-by: Qiang Zhang <zzqq0103.hey@xxxxxxxxx>

----------------------------------------------------------


BUG: unable to handle page fault for address: ffff888104849cf0
RIP: 0010:kernfs_root fs/kernfs/kernfs-internal.h:70 [inline]
RIP: 0010:kernfs_dop_revalidate+0xc7/0x580 fs/kernfs/dir.c:1149
#PF: supervisor read access in kernel mode
Code: 00 04 00 00 4c 8b 65 08 4d 85 e4 4c 0f 44 e5 e8 0f 28 b3 ff 48
b8 00 00 00 00 00 fc ff df 49 8d 7c 24 50 48 89 fa 48 c1 ea 03 <80> 3c
02 00 0f 85 e7 03 00 00 4d 8b 64 24 50 4c 8d 6d 04 49 83 c4
#PF: error_code(0x0009) - reserved bit violation
RSP: 0018:ffff888112557990 EFLAGS: 00010217
PGD 1d0201067 P4D 1d0201067

RAX: dffffc0000000000 RBX: ffff888108fbb000 RCX: ffffffffa42bb871
PUD 100915063
RDX: 0012476b20000009 RSI: 0000000000000000 RDI: 00923b590000004f
PMD 10464f063
RBP: ffff8881045dbc00 R08: 0000000000000000 R09: ffffed10211f7607
PTE 484b16380000001
R10: ffff888108fbb038 R11: 0000000000000000 R12: 00923b58ffffffff

Oops: 0009 [#4] PREEMPT SMP KASAN NOPTI
R13: ffff888108c1b800 R14: ffff8881045dbc08 R15: ffff888115091120
CPU: 1 PID: 0 Comm: swapper/1 Tainted: G D 6.8.0-rc7 #1
FS: 00007ffa91fbc640(0000) GS:ffff8881f7180000(0000) knlGS:0000000000000000
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
RIP: 0010:find_stack lib/stackdepot.c:594 [inline]
RIP: 0010:stack_depot_save_flags+0x136/0x710 lib/stackdepot.c:659
CR2: ffff888104800000 CR3: 0000000105898003 CR4: 0000000000770ef0
Code: 0d d7 84 75 04 65 ff 05 f0 90 63 5b 4d 8b 31 89 d6 83 e6 02 4d
39 f1 75 11 e9 c9 01 00 00 4d 8b 36 4d 39 f1 0f 84 bd 01 00 00 <41> 39
5e 10 75 ee 41 3b 6e 14 75 e8 31 c0 49 8b 7c c6 20 49 39 7c
PKRU: 55555554
RSP: 0018:ffff88810036f9b8 EFLAGS: 00010202
note: syz-executor207[342] exited with irqs disabled

RAX: 000000004b42e799 RBX: 000000001d41ecbb RCX: 00000000dbd2612a
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: 000000000000000b R08: ffff88810036f918 R09: ffff8881f55ecbb0
R10: ffff888112c3f083 R11: ffff8881f70b8a20 R12: 0000000000000000
R13: ffff88810036fa18 R14: ffff888104849ce0 R15: 000000000000000b
FS: 0000000000000000(0000) GS:ffff8881f7080000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff888104849cf0 CR3: 0000000105898003 CR4: 0000000000770ef0
PKRU: 55555554
Call Trace:
<TASK>
kasan_save_stack+0x34/0x50 mm/kasan/common.c:48
__kasan_record_aux_stack+0x8e/0xa0 mm/kasan/generic.c:551
__call_rcu_common.constprop.0+0x6a/0xab0 kernel/rcu/tree.c:2715
put_task_struct_rcu_user+0x69/0xb0 kernel/exit.c:235
finish_task_switch.isra.0+0x5f6/0x7d0 kernel/sched/core.c:5309
context_switch kernel/sched/core.c:5403 [inline]
__schedule+0xc26/0x22d0 kernel/sched/core.c:6727
schedule_idle+0x65/0xa0 kernel/sched/core.c:6843
do_idle+0x295/0x430 kernel/sched/idle.c:340
cpu_startup_entry+0x5a/0x70 kernel/sched/idle.c:410
start_secondary+0x1ba/0x210 arch/x86/kernel/smpboot.c:336
secondary_startup_64_no_verify+0x16d/0x17b
</TASK>
Modules linked in:
CR2: ffff888104849cf0
---[ end trace 0000000000000000 ]---
BUG: unable to handle page fault for address: ffff888104849cf0
RIP: 0010:kernfs_root fs/kernfs/kernfs-internal.h:70 [inline]
RIP: 0010:kernfs_dop_revalidate+0xc7/0x580 fs/kernfs/dir.c:1149
#PF: supervisor read access in kernel mode
Code: 00 04 00 00 4c 8b 65 08 4d 85 e4 4c 0f 44 e5 e8 0f 28 b3 ff 48
b8 00 00 00 00 00 fc ff df 49 8d 7c 24 50 48 89 fa 48 c1 ea 03 <80> 3c
02 00 0f 85 e7 03 00 00 4d 8b 64 24 50 4c 8d 6d 04 49 83 c4
#PF: error_code(0x0009) - reserved bit violation
RSP: 0018:ffff888112557990 EFLAGS: 00010217
PGD 1d0201067 P4D 1d0201067
RAX: dffffc0000000000 RBX: ffff888108fbb000 RCX: ffffffffa42bb871
PUD 100915063
RDX: 0012476b20000009 RSI: 0000000000000000 RDI: 00923b590000004f
PMD 10464f063
RBP: ffff8881045dbc00 R08: 0000000000000000 R09: ffffed10211f7607
PTE 484b16380000001
R10: ffff888108fbb038 R11: 0000000000000000 R12: 00923b58ffffffff

R13: ffff888108c1b800 R14: ffff8881045dbc08 R15: ffff888115091120
Oops: 0009 [#5] PREEMPT SMP KASAN NOPTI
FS: 0000000000000000(0000) GS:ffff8881f7080000(0000) knlGS:0000000000000000
CPU: 3 PID: 0 Comm: swapper/3 Tainted: G D 6.8.0-rc7 #1
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
CR2: ffff888104849cf0 CR3: 0000000105898003 CR4: 0000000000770ef0
RIP: 0010:find_stack lib/stackdepot.c:594 [inline]
RIP: 0010:stack_depot_save_flags+0x136/0x710 lib/stackdepot.c:659
PKRU: 55555554
Code: 0d d7 84 75 04 65 ff 05 f0 90 63 5b 4d 8b 31 89 d6 83 e6 02 4d
39 f1 75 11 e9 c9 01 00 00 4d 8b 36 4d 39 f1 0f 84 bd 01 00 00 <41> 39
5e 10 75 ee 41 3b 6e 14 75 e8 31 c0 49 8b 7c c6 20 49 39 7c
----------------
Code disassembly (best guess):
0: 00 04 00 add %al,(%rax,%rax,1)
3: 00 4c 8b 65 add %cl,0x65(%rbx,%rcx,4)
7: 08 4d 85 or %cl,-0x7b(%rbp)
a: e4 4c in $0x4c,%al
c: 0f 44 e5 cmove %ebp,%esp
f: e8 0f 28 b3 ff call 0xffb32823
14: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
1b: fc ff df
1e: 49 8d 7c 24 50 lea 0x50(%r12),%rdi
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2e: 0f 85 e7 03 00 00 jne 0x41b
34: 4d 8b 64 24 50 mov 0x50(%r12),%r12
39: 4c 8d 6d 04 lea 0x4(%rbp),%r13
3d: 49 rex.WB
3e: 83 .byte 0x83
3f: c4 .byte 0xc4