From: Christian Brauner <brauner@kernel.org>
To: syzbot <syzbot+3de83a9efcca3f0412ee@syzkaller.appspotmail.com>,
Jens Axboe <axboe@kernel.dk>
Cc: jack@suse.cz, kees@kernel.org, linux-fsdevel@vger.kernel.org,
linux-kernel@vger.kernel.org, linux-mm@kvack.org,
syzkaller-bugs@googlegroups.com, viro@zeniv.linux.org.uk
Subject: Re: [syzbot] [mm?] [fs?] WARNING in path_noexec
Date: Mon, 7 Jul 2025 13:30:40 +0200 [thread overview]
Message-ID: <20250707-tusche-umlaufen-6e96566552d6@brauner> (raw)
In-Reply-To: <686ba948.a00a0220.c7b3.0080.GAE@google.com>
On Mon, Jul 07, 2025 at 04:02:32AM -0700, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 8d6c58332c7a Add linux-next specific files for 20250703
> git tree: linux-next
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=15788582580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=d7dc16394230c170
> dashboard link: https://syzkaller.appspot.com/bug?extid=3de83a9efcca3f0412ee
> compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16ecb3d4580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=153af770580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/ff731adf5dfa/disk-8d6c5833.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/5c7a3c57e0a1/vmlinux-8d6c5833.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/2f90e7c18574/bzImage-8d6c5833.xz
>
> The issue was bisected to:
>
> commit df43ee1b368c791b7042504d2aa90893569b9034
> Author: Christian Brauner <brauner@kernel.org>
> Date: Wed Jul 2 09:23:55 2025 +0000
>
> anon_inode: rework assertions
>
> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=14b373d4580000
> final oops: https://syzkaller.appspot.com/x/report.txt?x=16b373d4580000
> console output: https://syzkaller.appspot.com/x/log.txt?x=12b373d4580000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+3de83a9efcca3f0412ee@syzkaller.appspotmail.com
> Fixes: df43ee1b368c ("anon_inode: rework assertions")
>
> ------------[ cut here ]------------
> WARNING: fs/exec.c:119 at path_noexec+0x1af/0x200 fs/exec.c:118, CPU#1: syz-executor260/5835
> Modules linked in:
> CPU: 1 UID: 0 PID: 5835 Comm: syz-executor260 Not tainted 6.16.0-rc4-next-20250703-syzkaller #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
> RIP: 0010:path_noexec+0x1af/0x200 fs/exec.c:118
And already we have found one offender whose not raising SB_I_NOEXEC but
using anonymous inodes...
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git vfs.fixes
next prev parent reply other threads:[~2025-07-07 11:30 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-07-07 11:02 syzbot
2025-07-07 11:30 ` Christian Brauner [this message]
2025-07-07 12:10 ` syzbot
2025-07-07 12:10 ` [PATCH] secretmem: use SB_I_NOEXEC Christian Brauner
2025-07-07 12:32 ` Mike Rapoport
2025-07-07 17:17 ` Al Viro
2025-07-08 7:38 ` Christian Brauner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250707-tusche-umlaufen-6e96566552d6@brauner \
--to=brauner@kernel.org \
--cc=axboe@kernel.dk \
--cc=jack@suse.cz \
--cc=kees@kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=syzbot+3de83a9efcca3f0412ee@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox