Re: general protection fault in do_move_mount (2)

[Al Viro <viro@xxxxxxxxxxxxxxxxxx>]

On Tue, Jun 18, 2019 at 03:47:10AM -0700, syzbot wrote:
> Hello,
> 
> syzbot found the following crash on:
> 
> HEAD commit:    9e0babf2 Linux 5.2-rc5
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=138b310aa00000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=d16883d6c7f0d717
> dashboard link: https://syzkaller.appspot.com/bug?extid=6004acbaa1893ad013f0
> compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=154e8c2aa00000

IDGI...

mkdir(&(0x7f0000632000)='./file0\x00', 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
r0 = open(&(0x7f0000032ff8)='./file0\x00', 0x0, 0x0)
r1 = memfd_create(&(0x7f00000001c0)='\xb3', 0x0)
write$FUSE_DIRENT(r1, &(0x7f0000000080)=ANY=[], 0x29)
move_mount(r0, &(0x7f0000000040)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x66)

reads as if we'd done mkdir ./file0, opened it and then tried
to feed move_mount(2) "./file0" relative to that descriptor.
How the hell has that avoided an instant -ENOENT?  On the first
pair, that is - the second one (AT_FDCWD, "./file0") is fine...

Confused...  Incidentally, what the hell is
	mount(0x0, 0x0, 0x0, 0x0, 0x0)
about?  *IF* that really refers to mount(2) with
such arguments, all you'll get is -EFAULT.  Way before
it gets to actually doing anything - it won't get past
        /* ... and get the mountpoint */
        retval = user_path(dir_name, &path);
        if (retval)
                return retval;
in do_mount(2)...