204461 – general protection fault in selinux_inode_free_security

Bug 204461 - general protection fault in selinux_inode_free_security

Summary: general protection fault in selinux_inode_free_security

Status:	NEW

Alias:	None

Product:	File System
Classification:	Unclassified
Component:	Other (show other bugs)
Hardware:	All Linux

Importance:	P1 normal
Assignee:	fs_other

URL:
Keywords:

Depends on:
Blocks:

Reported:	2019-08-04 04:37 UTC by icytxw
Modified:	2019-08-04 04:37 UTC (History)
CC List:	0 users

See Also:
Kernel Version:	v5.2-rc6
Subsystem:
Regression:	No
Bisected commit-id:

Attachments
Re-modern code (4.72 KB, text/x-csrc) 2019-08-04 04:37 UTC, icytxw	Details
Add an attachment (proposed patch, testcase, etc.)

Description icytxw 2019-08-04 04:37:02 UTC

Created attachment 284151 [details]
Re-modern code

Dear All
This bug was found in Linux Kernel v5.2-rc6

Syzkaller hit 'general protection fault in selinux_inode_free_security' bug.

ata1.00: configured for MWDMA2
ata1.00: device reported invalid CHS sector 0
ata1: EH complete
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN PTI
CPU: 1 PID: 1520 Comm: syz-executor947 Not tainted 5.2.0-rc6+ #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
RIP: 0010:__list_del include/linux/list.h:105 [inline]
RIP: 0010:__list_del_entry include/linux/list.h:120 [inline]
RIP: 0010:list_del_init include/linux/list.h:176 [inline]
RIP: 0010:inode_free_security security/selinux/hooks.c:350 [inline]
RIP: 0010:selinux_inode_free_security+0x14d/0x300 security/selinux/hooks.c:2854
Code: fc ff df 48 c1 e9 03 80 3c 11 00 0f 85 24 01 00 00 48 8d 78 08 4c 8b 73 10 48 ba 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 <80> 3c 11 00 0f 85 2f 01 00 00 4c 89 f1 4c 89 70 08 48 ba 00 00 00
RSP: 0018:ffff888066c2f550 EFLAGS: 00010202
RAX: 0000000000000000 RBX: ffff888067e51d20 RCX: 0000000000000001
RDX: dffffc0000000000 RSI: 0000000000000004 RDI: 0000000000000008
RBP: ffff888066c2f588 R08: ffff888067e51d30 R09: ffffed100cd85e9f
R10: ffffed100cd85e9e R11: 0000000000000003 R12: ffff888067e51d28
R13: ffff88806cfda6c8 R14: 0000000000000000 R15: ffff88806cfda680
FS:  0000555555f77880(0000) GS:ffff88806d300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffff600400 CR3: 0000000067c9a005 CR4: 00000000003606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 security_inode_free+0x4f/0xd0 security/security.c:893
 __destroy_inode+0x3d/0x2d0 fs/inode.c:252
 destroy_inode+0x98/0x1c0 fs/inode.c:275
 evict+0x447/0x6b0 fs/inode.c:588
 iput_final fs/inode.c:1560 [inline]
 iput+0x5c2/0x810 fs/inode.c:1586
 dentry_unlink_inode+0x325/0x460 fs/dcache.c:374
 __dentry_kill+0x382/0x690 fs/dcache.c:579
 shrink_dentry_list+0x1c8/0x690 fs/dcache.c:1092
 shrink_dcache_parent+0xde/0x130 fs/dcache.c:1499
 d_invalidate fs/dcache.c:1590 [inline]
 d_invalidate+0x11d/0x290 fs/dcache.c:1575
 proc_flush_task_mnt fs/proc/base.c:3111 [inline]
 proc_flush_task+0x274/0x4b0 fs/proc/base.c:3181
 release_task+0x96/0x1330 kernel/exit.c:197
 wait_task_zombie kernel/exit.c:1166 [inline]
 wait_consider_task+0x29e6/0x3770 kernel/exit.c:1393
 do_wait_thread kernel/exit.c:1456 [inline]
 do_wait+0x38f/0x7e0 kernel/exit.c:1527
 kernel_wait4+0x171/0x270 kernel/exit.c:1669
 __do_sys_wait4+0x147/0x160 kernel/exit.c:1681
 __se_sys_wait4 kernel/exit.c:1677 [inline]
 __x64_sys_wait4+0x97/0xf0 kernel/exit.c:1677
 do_syscall_64+0xbd/0x3a0 arch/x86/entry/common.c:301
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x40111a
Code: c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 8b 05 be 65 2d 00 85 c0 75 36 45 31 d2 48 63 d2 48 63 ff b8 3d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 d0 ff ff ff f7
RSP: 002b:00007ffffa2739e8 EFLAGS: 00000246 ORIG_RAX: 000000000000003d
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000040111a
RDX: 0000000040000000 RSI: 00007ffffa273b64 RDI: ffffffffffffffff
RBP: 00000000000005f5 R08: 0000000000000000 R09: 0000555555f77880
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffffa273b64
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
Dumping ftrace buffer:
   (ftrace buffer empty)
---[ end trace d8b4c97d2c148e9a ]---
kasan: CONFIG_KASAN_INLINE enabled
RIP: 0010:__list_del include/linux/list.h:105 [inline]
RIP: 0010:__list_del_entry include/linux/list.h:120 [inline]
RIP: 0010:list_del_init include/linux/list.h:176 [inline]
RIP: 0010:inode_free_security security/selinux/hooks.c:350 [inline]
RIP: 0010:selinux_inode_free_security+0x14d/0x300 security/selinux/hooks.c:2854
Code: fc ff df 48 c1 e9 03 80 3c 11 00 0f 85 24 01 00 00 48 8d 78 08 4c 8b 73 10 48 ba 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 <80> 3c 11 00 0f 85 2f 01 00 00 4c 89 f1 4c 89 70 08 48 ba 00 00 00
kasan: GPF could be caused by NULL-ptr deref or user memory access
RSP: 0018:ffff888066c2f550 EFLAGS: 00010202
general protection fault: 0000 [#2] SMP KASAN PTI
RAX: 0000000000000000 RBX: ffff888067e51d20 RCX: 0000000000000001
CPU: 0 PID: 1517 Comm: sshd Tainted: G      D           5.2.0-rc6+ #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
RIP: 0010:unlink_anon_vmas+0x135/0x7b0 mm/rmap.c:388
Code: 49 89 c6 e8 0d a9 e1 ff 49 8d 7c 24 08 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 9d 04 00 00 4d 8b 6c 24 08 4c 89 e8 48 c1 e8 03 <80> 3c 18 00 0f 85 7a 04 00 00 4d 8b 7d 00 4c 3b 7d d0 74 1e e8 d2
RSP: 0000:ffff888067a678d8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffffffffb8f798c3
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888067e59188
RBP: ffff888067a67928 R08: ffff888067cbba00 R09: ffffed100d3b6b39
R10: ffffed100d3b6b38 R11: ffff888069db59c7 R12: ffff888067e59180
R13: 0000000000000000 R14: fffffffffffffff0 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88806d200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc4d0068c0 CR3: 000000005d20e006 CR4: 00000000003606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
RDX: dffffc0000000000 RSI: 0000000000000004 RDI: 0000000000000008
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 free_pgtables+0x1af/0x2f0 mm/memory.c:395
 exit_mmap+0x28a/0x4c0 mm/mmap.c:3146
 __mmput kernel/fork.c:1063 [inline]
 mmput+0x74/0x340 kernel/fork.c:1084
 exit_mm kernel/exit.c:547 [inline]
 do_exit+0x753/0x2c30 kernel/exit.c:864
RBP: ffff888066c2f588 R08: ffff888067e51d30 R09: ffffed100cd85e9f
 do_group_exit+0x123/0x380 kernel/exit.c:981
 get_signal+0x43b/0x1e30 kernel/signal.c:2640
 do_signal+0x8e/0x17c0 arch/x86/kernel/signal.c:815
 exit_to_usermode_loop+0x192/0x1e0 arch/x86/entry/common.c:164
R10: ffffed100cd85e9e R11: 0000000000000003 R12: ffff888067e51d28
 prepare_exit_to_usermode+0x199/0x210 arch/x86/entry/common.c:199
 retint_user+0x8/0x8
RIP: 0033:0x55c1b428dfdd
Code: Bad RIP value.
RSP: 002b:00007ffc4d0068b0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f389bf29310
RDX: 00007ffc4d007128 RSI: 000055c1b42a938b RDI: 0000000000000004
RBP: 000055c1b44cbc88 R08: 0000000000000000 R09: 0101010101010101
R10: 0000000000000008 R11: 0000000000000246 R12: 000055c1b59a4d30
R13: 000055c1b44c9fb4 R14: 0000000000000028 R15: 00007ffc4d007128
Modules linked in:
Dumping ftrace buffer:
   (ftrace buffer empty)
---[ end trace d8b4c97d2c148e9b ]---
R13: ffff88806cfda6c8 R14: 0000000000000000 R15: ffff88806cfda680
FS:  0000555555f77880(0000) GS:ffff88806d300000(0000) knlGS:0000000000000000
RIP: 0010:__list_del include/linux/list.h:105 [inline]
RIP: 0010:__list_del_entry include/linux/list.h:120 [inline]
RIP: 0010:list_del_init include/linux/list.h:176 [inline]
RIP: 0010:inode_free_security security/selinux/hooks.c:350 [inline]
RIP: 0010:selinux_inode_free_security+0x14d/0x300 security/selinux/hooks.c:2854
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffff600400 CR3: 0000000067c9a005 CR4: 00000000003606e0
Code: fc ff df 48 c1 e9 03 80 3c 11 00 0f 85 24 01 00 00 48 8d 78 08 4c 8b 73 10 48 ba 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 <80> 3c 11 00 0f 85 2f 01 00 00 4c 89 f1 4c 89 70 08 48 ba 00 00 00
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
RSP: 0018:ffff888066c2f550 EFLAGS: 00010202
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


Syzkaller reproducer:
# {Threaded:false Collide:false Repeat:true RepeatTimes:0 Procs:1 Sandbox: Fault:false FaultCall:-1 FaultNth:0 Leak:false EnableTun:false EnableNetDev:false EnableNetReset:false EnableCgroups:false EnableBinfmtMisc:false EnableCloseFds:false UseTmpDir:false HandleSegv:false Repro:false Trace:false}
r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x100000000002000)
ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000240)=ANY=[@ANYBLOB="01000000000000000800003fbe32fa7707521917d3323b308e2def91c1c40c22908ca34fd88fde4b37d6519d5e62e1c7c63ddb5f1fefd3711ec5b9c9b578495e74c1601a37b157d038c7a137e1e1ac470c7cce949084d289419c9ba30ecd77433776545f1eaa0595137213555e392c78247661ea5dca3733d9c49526639370870043f0fceb52922b58530edac373ce674abc93239d2e878d6b7c2bbedba1e46b979c5c9a9ea320cea8ab7754a6cf773afc7484342879aedee882b7acea31ab5308400f63dc3670895b3fede18588308f04b4db2b429f4b0fa76ad8dcbc64e10965062cffdc996652745c44c218d27cf78dc9a2358b1af18b3a00471e3d1d6a19799f91406255838c8ebbcd94a54ffb56ab22d93ec03a563a8041810a84c7cfe1a44b65b16e63ae386f114064ff6eb4968aae269e2034c762a7cd46c7c369f50e65c327901d2938914e7d3362e688d31e885dbf8d9f21f59cac0b710506f2fe8ec5b108d1"])



You can run QEMU through this 
qemu-system-x86_64 -m 2048 -smp 2 -net nic,model=e1000 -net user,host=10.0.2.10,hostfwd=tcp::1111-:22 -display none -serial stdio -no-reboot -enable-kvm -cpu host,migratable=off -hda /home/icy/gopath/src/github.com/google/syzkaller/image/wheezy.img -snapshot -kernel /home/icy/gopath/src/github.com/google/syzkaller/linux/arch/x86/boot/bzImage -append "earlyprintk=serial oops=panic nmi_watchdog=panic panic_on_warn=1 panic=1 ftrace_dump_on_oops=orig_cpu rodata=n vsyscall=native net.ifnames=0 biosdevname=0 root=/dev/sda console=ttyS0 kvm-intel.nested=1 kvm-intel.unrestricted_guest=1 kvm-intel.vmm_exclusive=1 kvm-intel.fasteoi=1 kvm-intel.ept=1 kvm-intel.flexpriority=1 kvm-intel.vpid=1 kvm-intel.emulate_invalid_guest_state=1 kvm-intel.eptad=1 kvm-intel.enable_shadow_vmcs=1 kvm-intel.pml=1 kvm-intel.enable_apicv=1 "


You can get wheezy.img by this 
wget https://storage.googleapis.com/syzkaller/wheezy.img

From this url:192.168.44.128

Note You need to log in before you can comment on or make changes to this bug.