Re: [syzbot] general protection fault in security_inode_getattr
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Date: 2022-10-17 14:30:16
Also in:
bpf, linux-fsdevel, linux-unionfs, lkml, netdev
On 2022/10/16 23:52, Paul Moore wrote:
It doesn't look like this is a problem with security_inode_getattr()/d_backing_inode() as it appears that the passed path struct pointer has a bogus/NULL path->dentry pointer and to the best of my knowledge it would appear that vfs_getattr() (the caller) requires a valid path->dentry value. Looking quickly at the code, I wonder if there is something wonky going on in the overlayfs code, specifically ovl_copy_up_flags() and ovl_copy_up_one() as they have to play a number of tricks to handle the transparent overlays and copy up operations. I'm not an overlayfs expert, but that seems like a good place to start digging further into this.
Right. This is a bug in overlayfs code. Probably due to some race condition, ovl_copy_up_flags() is calling ovl_copy_up_one() with "next" dentry with "struct ovl_entry"->numlower == 0. As a result, ovl_path_lower() from ovl_copy_up_one() fills ctx.lowerpath with NULLs, and vfs_getattr() gets surprised by ctx.lowerpath.dentry == NULL. If we can't avoid selecting a dentry with "struct ovl_entry"->numlower == 0 using some lock, I guess that we would need to use a workaround suggested by Hillf Danton at https://groups.google.com/g/syzkaller-bugs/c/xDcxFKSppfE/m/b38Tv7LoAAAJ .