Created attachment 284151 [details] Re-modern code Dear All This bug was found in Linux Kernel v5.2-rc6 Syzkaller hit 'general protection fault in selinux_inode_free_security' bug. ata1.00: configured for MWDMA2 ata1.00: device reported invalid CHS sector 0 ata1: EH complete kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] SMP KASAN PTI CPU: 1 PID: 1520 Comm: syz-executor947 Not tainted 5.2.0-rc6+ #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 RIP: 0010:__list_del include/linux/list.h:105 [inline] RIP: 0010:__list_del_entry include/linux/list.h:120 [inline] RIP: 0010:list_del_init include/linux/list.h:176 [inline] RIP: 0010:inode_free_security security/selinux/hooks.c:350 [inline] RIP: 0010:selinux_inode_free_security+0x14d/0x300 security/selinux/hooks.c:2854 Code: fc ff df 48 c1 e9 03 80 3c 11 00 0f 85 24 01 00 00 48 8d 78 08 4c 8b 73 10 48 ba 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 <80> 3c 11 00 0f 85 2f 01 00 00 4c 89 f1 4c 89 70 08 48 ba 00 00 00 RSP: 0018:ffff888066c2f550 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffff888067e51d20 RCX: 0000000000000001 RDX: dffffc0000000000 RSI: 0000000000000004 RDI: 0000000000000008 RBP: ffff888066c2f588 R08: ffff888067e51d30 R09: ffffed100cd85e9f R10: ffffed100cd85e9e R11: 0000000000000003 R12: ffff888067e51d28 R13: ffff88806cfda6c8 R14: 0000000000000000 R15: ffff88806cfda680 FS: 0000555555f77880(0000) GS:ffff88806d300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffff600400 CR3: 0000000067c9a005 CR4: 00000000003606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: security_inode_free+0x4f/0xd0 security/security.c:893 __destroy_inode+0x3d/0x2d0 fs/inode.c:252 destroy_inode+0x98/0x1c0 fs/inode.c:275 evict+0x447/0x6b0 fs/inode.c:588 iput_final fs/inode.c:1560 [inline] iput+0x5c2/0x810 fs/inode.c:1586 dentry_unlink_inode+0x325/0x460 fs/dcache.c:374 __dentry_kill+0x382/0x690 fs/dcache.c:579 shrink_dentry_list+0x1c8/0x690 fs/dcache.c:1092 shrink_dcache_parent+0xde/0x130 fs/dcache.c:1499 d_invalidate fs/dcache.c:1590 [inline] d_invalidate+0x11d/0x290 fs/dcache.c:1575 proc_flush_task_mnt fs/proc/base.c:3111 [inline] proc_flush_task+0x274/0x4b0 fs/proc/base.c:3181 release_task+0x96/0x1330 kernel/exit.c:197 wait_task_zombie kernel/exit.c:1166 [inline] wait_consider_task+0x29e6/0x3770 kernel/exit.c:1393 do_wait_thread kernel/exit.c:1456 [inline] do_wait+0x38f/0x7e0 kernel/exit.c:1527 kernel_wait4+0x171/0x270 kernel/exit.c:1669 __do_sys_wait4+0x147/0x160 kernel/exit.c:1681 __se_sys_wait4 kernel/exit.c:1677 [inline] __x64_sys_wait4+0x97/0xf0 kernel/exit.c:1677 do_syscall_64+0xbd/0x3a0 arch/x86/entry/common.c:301 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x40111a Code: c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 8b 05 be 65 2d 00 85 c0 75 36 45 31 d2 48 63 d2 48 63 ff b8 3d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 d0 ff ff ff f7 RSP: 002b:00007ffffa2739e8 EFLAGS: 00000246 ORIG_RAX: 000000000000003d RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000040111a RDX: 0000000040000000 RSI: 00007ffffa273b64 RDI: ffffffffffffffff RBP: 00000000000005f5 R08: 0000000000000000 R09: 0000555555f77880 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffffa273b64 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Modules linked in: Dumping ftrace buffer: (ftrace buffer empty) ---[ end trace d8b4c97d2c148e9a ]--- kasan: CONFIG_KASAN_INLINE enabled RIP: 0010:__list_del include/linux/list.h:105 [inline] RIP: 0010:__list_del_entry include/linux/list.h:120 [inline] RIP: 0010:list_del_init include/linux/list.h:176 [inline] RIP: 0010:inode_free_security security/selinux/hooks.c:350 [inline] RIP: 0010:selinux_inode_free_security+0x14d/0x300 security/selinux/hooks.c:2854 Code: fc ff df 48 c1 e9 03 80 3c 11 00 0f 85 24 01 00 00 48 8d 78 08 4c 8b 73 10 48 ba 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 <80> 3c 11 00 0f 85 2f 01 00 00 4c 89 f1 4c 89 70 08 48 ba 00 00 00 kasan: GPF could be caused by NULL-ptr deref or user memory access RSP: 0018:ffff888066c2f550 EFLAGS: 00010202 general protection fault: 0000 [#2] SMP KASAN PTI RAX: 0000000000000000 RBX: ffff888067e51d20 RCX: 0000000000000001 CPU: 0 PID: 1517 Comm: sshd Tainted: G D 5.2.0-rc6+ #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 RIP: 0010:unlink_anon_vmas+0x135/0x7b0 mm/rmap.c:388 Code: 49 89 c6 e8 0d a9 e1 ff 49 8d 7c 24 08 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 9d 04 00 00 4d 8b 6c 24 08 4c 89 e8 48 c1 e8 03 <80> 3c 18 00 0f 85 7a 04 00 00 4d 8b 7d 00 4c 3b 7d d0 74 1e e8 d2 RSP: 0000:ffff888067a678d8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffffffffb8f798c3 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888067e59188 RBP: ffff888067a67928 R08: ffff888067cbba00 R09: ffffed100d3b6b39 R10: ffffed100d3b6b38 R11: ffff888069db59c7 R12: ffff888067e59180 R13: 0000000000000000 R14: fffffffffffffff0 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88806d200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc4d0068c0 CR3: 000000005d20e006 CR4: 00000000003606f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 RDX: dffffc0000000000 RSI: 0000000000000004 RDI: 0000000000000008 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: free_pgtables+0x1af/0x2f0 mm/memory.c:395 exit_mmap+0x28a/0x4c0 mm/mmap.c:3146 __mmput kernel/fork.c:1063 [inline] mmput+0x74/0x340 kernel/fork.c:1084 exit_mm kernel/exit.c:547 [inline] do_exit+0x753/0x2c30 kernel/exit.c:864 RBP: ffff888066c2f588 R08: ffff888067e51d30 R09: ffffed100cd85e9f do_group_exit+0x123/0x380 kernel/exit.c:981 get_signal+0x43b/0x1e30 kernel/signal.c:2640 do_signal+0x8e/0x17c0 arch/x86/kernel/signal.c:815 exit_to_usermode_loop+0x192/0x1e0 arch/x86/entry/common.c:164 R10: ffffed100cd85e9e R11: 0000000000000003 R12: ffff888067e51d28 prepare_exit_to_usermode+0x199/0x210 arch/x86/entry/common.c:199 retint_user+0x8/0x8 RIP: 0033:0x55c1b428dfdd Code: Bad RIP value. RSP: 002b:00007ffc4d0068b0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f389bf29310 RDX: 00007ffc4d007128 RSI: 000055c1b42a938b RDI: 0000000000000004 RBP: 000055c1b44cbc88 R08: 0000000000000000 R09: 0101010101010101 R10: 0000000000000008 R11: 0000000000000246 R12: 000055c1b59a4d30 R13: 000055c1b44c9fb4 R14: 0000000000000028 R15: 00007ffc4d007128 Modules linked in: Dumping ftrace buffer: (ftrace buffer empty) ---[ end trace d8b4c97d2c148e9b ]--- R13: ffff88806cfda6c8 R14: 0000000000000000 R15: ffff88806cfda680 FS: 0000555555f77880(0000) GS:ffff88806d300000(0000) knlGS:0000000000000000 RIP: 0010:__list_del include/linux/list.h:105 [inline] RIP: 0010:__list_del_entry include/linux/list.h:120 [inline] RIP: 0010:list_del_init include/linux/list.h:176 [inline] RIP: 0010:inode_free_security security/selinux/hooks.c:350 [inline] RIP: 0010:selinux_inode_free_security+0x14d/0x300 security/selinux/hooks.c:2854 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffff600400 CR3: 0000000067c9a005 CR4: 00000000003606e0 Code: fc ff df 48 c1 e9 03 80 3c 11 00 0f 85 24 01 00 00 48 8d 78 08 4c 8b 73 10 48 ba 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 <80> 3c 11 00 0f 85 2f 01 00 00 4c 89 f1 4c 89 70 08 48 ba 00 00 00 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 RSP: 0018:ffff888066c2f550 EFLAGS: 00010202 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Syzkaller reproducer: # {Threaded:false Collide:false Repeat:true RepeatTimes:0 Procs:1 Sandbox: Fault:false FaultCall:-1 FaultNth:0 Leak:false EnableTun:false EnableNetDev:false EnableNetReset:false EnableCgroups:false EnableBinfmtMisc:false EnableCloseFds:false UseTmpDir:false HandleSegv:false Repro:false Trace:false} r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x100000000002000) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000240)=ANY=[@ANYBLOB="01000000000000000800003fbe32fa7707521917d3323b308e2def91c1c40c22908ca34fd88fde4b37d6519d5e62e1c7c63ddb5f1fefd3711ec5b9c9b578495e74c1601a37b157d038c7a137e1e1ac470c7cce949084d289419c9ba30ecd77433776545f1eaa0595137213555e392c78247661ea5dca3733d9c49526639370870043f0fceb52922b58530edac373ce674abc93239d2e878d6b7c2bbedba1e46b979c5c9a9ea320cea8ab7754a6cf773afc7484342879aedee882b7acea31ab5308400f63dc3670895b3fede18588308f04b4db2b429f4b0fa76ad8dcbc64e10965062cffdc996652745c44c218d27cf78dc9a2358b1af18b3a00471e3d1d6a19799f91406255838c8ebbcd94a54ffb56ab22d93ec03a563a8041810a84c7cfe1a44b65b16e63ae386f114064ff6eb4968aae269e2034c762a7cd46c7c369f50e65c327901d2938914e7d3362e688d31e885dbf8d9f21f59cac0b710506f2fe8ec5b108d1"]) You can run QEMU through this qemu-system-x86_64 -m 2048 -smp 2 -net nic,model=e1000 -net user,host=10.0.2.10,hostfwd=tcp::1111-:22 -display none -serial stdio -no-reboot -enable-kvm -cpu host,migratable=off -hda /home/icy/gopath/src/github.com/google/syzkaller/image/wheezy.img -snapshot -kernel /home/icy/gopath/src/github.com/google/syzkaller/linux/arch/x86/boot/bzImage -append "earlyprintk=serial oops=panic nmi_watchdog=panic panic_on_warn=1 panic=1 ftrace_dump_on_oops=orig_cpu rodata=n vsyscall=native net.ifnames=0 biosdevname=0 root=/dev/sda console=ttyS0 kvm-intel.nested=1 kvm-intel.unrestricted_guest=1 kvm-intel.vmm_exclusive=1 kvm-intel.fasteoi=1 kvm-intel.ept=1 kvm-intel.flexpriority=1 kvm-intel.vpid=1 kvm-intel.emulate_invalid_guest_state=1 kvm-intel.eptad=1 kvm-intel.enable_shadow_vmcs=1 kvm-intel.pml=1 kvm-intel.enable_apicv=1 " You can get wheezy.img by this wget https://storage.googleapis.com/syzkaller/wheezy.img From this url:192.168.44.128