From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7C2F4C433FE for ; Sun, 23 Oct 2022 02:18:52 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id A84B48E0002; Sat, 22 Oct 2022 22:18:51 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id A34AA8E0001; Sat, 22 Oct 2022 22:18:51 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 923CA8E0002; Sat, 22 Oct 2022 22:18:51 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id 82EF08E0001 for ; Sat, 22 Oct 2022 22:18:51 -0400 (EDT) Received: from smtpin17.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id 449C78041A for ; Sun, 23 Oct 2022 02:18:51 +0000 (UTC) X-FDA: 80050606062.17.8E072B5 Received: from www262.sakura.ne.jp (www262.sakura.ne.jp [202.181.97.72]) by imf16.hostedemail.com (Postfix) with ESMTP id CA9F418002B for ; Sun, 23 Oct 2022 02:18:49 +0000 (UTC) Received: from fsav115.sakura.ne.jp (fsav115.sakura.ne.jp [27.133.134.242]) by www262.sakura.ne.jp (8.15.2/8.15.2) with ESMTP id 29N2I4V4009579; Sun, 23 Oct 2022 11:18:04 +0900 (JST) (envelope-from penguin-kernel@I-love.SAKURA.ne.jp) Received: from www262.sakura.ne.jp (202.181.97.72) by fsav115.sakura.ne.jp (F-Secure/fsigk_smtp/550/fsav115.sakura.ne.jp); Sun, 23 Oct 2022 11:18:04 +0900 (JST) X-Virus-Status: clean(F-Secure/fsigk_smtp/550/fsav115.sakura.ne.jp) Received: from [192.168.1.9] (M106072142033.v4.enabler.ne.jp [106.72.142.33]) (authenticated bits=0) by www262.sakura.ne.jp (8.15.2/8.15.2) with ESMTPSA id 29N2I3UB009568 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NO); Sun, 23 Oct 2022 11:18:03 +0900 (JST) (envelope-from penguin-kernel@I-love.SAKURA.ne.jp) Message-ID: Date: Sun, 23 Oct 2022 11:18:00 +0900 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:102.0) Gecko/20100101 Thunderbird/102.3.3 Subject: Re: [syzbot] general protection fault in _parse_integer_fixup_radix Content-Language: en-US To: syzbot , syzkaller-bugs@googlegroups.com, Ian Kent , Andrew Morton References: <0000000000002feb6605eb71458e@google.com> Cc: hughd@google.com, linux-kernel@vger.kernel.org, Al Viro , Carlos Maiolino , David Howells , kernel test robot , Miklos Szeredi , Siddhesh Poyarekar , "Theodore Ts'o" , Hawkins Jiawei From: Tetsuo Handa In-Reply-To: <0000000000002feb6605eb71458e@google.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit ARC-Authentication-Results: i=1; imf16.hostedemail.com; dkim=none; spf=none (imf16.hostedemail.com: domain of penguin-kernel@I-love.SAKURA.ne.jp has no SPF policy when checking 202.181.97.72) smtp.mailfrom=penguin-kernel@I-love.SAKURA.ne.jp; dmarc=none ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1666491530; a=rsa-sha256; cv=none; b=lkzjZt0+/DloBakdhVq+RaR97GWCDOrN3kookzoxGJ14FSkXH4Sp5YsWrMtr4YGcea1ep4 feRL8TJsmdWsqRNxcy73TCWoLbeB5MzI5ibOXOL9jyEgPlu5txZlxSVMUE/QS43ftVhwdP VCtcc/i/hppShF9Xz6JDCFMKoz0Kw/M= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1666491530; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=2PXdSrNZqC6zy8KPv9Rka4QioB/hC6PhTQLLb/9cpCs=; b=wDXR/9ONmxjGhYUf+/chrfiC4QjsR3IJXwLRNdYyijL1u9LerFmL5JV6AkU/6TInZKJBo/ AdDlQ2P1tc7/uY+Agp/0Aywh04vSevIsYDQ90fI70n3+ttyY7RK9+LawChHNyIqKQu7bm2 /Koaw/p2sGQPVEYn+W53U+Lv8nrHipY= Authentication-Results: imf16.hostedemail.com; dkim=none; spf=none (imf16.hostedemail.com: domain of penguin-kernel@I-love.SAKURA.ne.jp has no SPF policy when checking 202.181.97.72) smtp.mailfrom=penguin-kernel@I-love.SAKURA.ne.jp; dmarc=none X-Stat-Signature: siqyaej3c8fpbhwpehcyui1jotfc6zby X-Rspamd-Queue-Id: CA9F418002B X-Rspamd-Server: rspam02 X-Rspam-User: X-HE-Tag: 1666491529-999985 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: syzbot is reporting that "vfs: parse: deal with zero length string value" in linux-next.git broke tmpfs's mount option parsing, for tmpfs is expecting that vfs_parse_fs_string() returning 0 implies that param.string != NULL. The "nr_inodes" parameter for tmpfs is interpreted as "nr_inodes=$integer", but the addition of if (!v_size) { param.string = NULL; param.type = fs_value_is_empty; } else { to vfs_parse_fs_string() and if (param->type == fs_value_is_empty) return 0; to fs_param_is_string() broke expectation by tmpfs. Parsing an fs string that has zero length should result in the parameter being set to NULL so that downstream processing handles it correctly. is wrong and Parsing an fs string that has zero length should result in invalid argument error so that downstream processing does not dereference NULL param.string field. is correct for the "nr_inodes" parameter. How do we want to fix? Should we add param.string != NULL checks into the downstream callers (like Hawkins Jiawei did for https://syzkaller.appspot.com/bug?extid=a3e6acd85ded5c16a709 ) ? Or should we add if (!*param.string) param.string = NULL; rewriting into downstream callers which expect For example, the proc mount table processing should print "(none)" in this case to preserve mount record field count, but if the value points to the NULL string this doesn't happen. behavior? On 2022/10/20 15:16, syzbot wrote: > Hello, > > syzbot found the following issue on: > > HEAD commit: a72b55bc981b Add linux-next specific files for 20221019 > git tree: linux-next > console+strace: https://syzkaller.appspot.com/x/log.txt?x=1728c644880000 > kernel config: https://syzkaller.appspot.com/x/.config?x=200524babbc01b2a > dashboard link: https://syzkaller.appspot.com/bug?extid=db1d2ea936378be0e4ea > compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12afb08c880000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11001c72880000 > > Downloadable assets: > disk image: https://storage.googleapis.com/syzbot-assets/fa24fb5893fd/disk-a72b55bc.raw.xz > vmlinux: https://storage.googleapis.com/syzbot-assets/cf1b7e7b579c/vmlinux-a72b55bc.xz > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+db1d2ea936378be0e4ea@syzkaller.appspotmail.com >