Interesting... The test program also causes fuse to oops (see attached) over
without even getting to netfslib. The BUG is in iov_iter_revert():
if (iov_iter_is_xarray(i) || iter_is_ubuf(i)) {
BUG(); /* We should never go beyond the start of the specified
* range since we might then be straying into pages that
* aren't pinned.
*/
I was trying the C reproducer from here:
https://syzkaller.appspot.com/bug?extid=404b4b745080b6210c6c
David
---
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 1
CPU: 3 UID: 0 PID: 5926 Comm: repro-12bc200f9 Not tainted 6.13.0-rc1-build3+ #5189
Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014
Call Trace:
<TASK>
dump_stack_lvl+0x47/0x70
should_fail_ex+0x12e/0x160
should_failslab+0x50/0x60
__kmalloc_noprof+0x9f/0x290
? fuse_get_user_pages+0xad/0x290
? kmem_cache_debug_flags+0xc/0x20
fuse_get_user_pages+0xad/0x290
? fuse_folios_alloc+0x13/0x30
fuse_direct_io+0x220/0x460
fuse_direct_write_iter+0x10f/0x180
vfs_write+0x142/0x1e0
? __pfx_fuse_file_write_iter+0x10/0x10
ksys_write+0x6d/0xc0
do_syscall_64+0x80/0xe0
entry_SYSCALL_64_after_hwframe+0x71/0x79
RIP: 0033:0x7fdd71f0f85d
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d a3 45 0c 00 f7 d8 64 89 01 48
RSP: 002b:00007fdd71df7e68 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fdd71df8cdc RCX: 00007fdd71f0f85d
RDX: 000000000000000f RSI: 0000000020000280 RDI: 0000000000000005
RBP: 00007fdd71df7e90 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdd71df86c0
R13: ffffffffffffff88 R14: 0000000000000002 R15: 00007fffe6090bd0
</TASK>
------------[ cut here ]------------
kernel BUG at lib/iov_iter.c:626!
Oops: invalid opcode: 0000 [#1] SMP PTI
CPU: 3 UID: 0 PID: 5926 Comm: repro-12bc200f9 Not tainted 6.13.0-rc1-build3+ #5189
Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014
RIP: 0010:iov_iter_revert+0x4c/0xf0
Code: 80 f9 06 0f 84 bf 00 00 00 48 8b 47 08 48 39 f0 72 0c 48 29 f0 48 89 47 08 c3 cc cc cc cc 48 29 c6 80 f9 05 74 04 84 c9 75 02 <0f> 0b 80 f9 02 48 8b 47 10 75 15 8b 48 f8 48 83 e8 10 48 ff 42 20
RSP: 0018:ffff88811f16fd00 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888107504900 RCX: 0000000000001600
RDX: ffff88811f16fe60 RSI: 000000000000000f RDI: ffff88811f16fe60
RBP: 0000000000000000 R08: ffff88840fb9fa40 R09: ffff88840fb9fa60
R10: 0000000000000006 R11: 0000000000000020 R12: ffff88810b481400
R13: 00000000fffffff4 R14: ffff88811ce26cc0 R15: ffff88811f16fdb8
FS: 00007fdd71df86c0(0000) GS:ffff88840fb80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000560d9a217710 CR3: 000000010760e003 CR4: 00000000001706f0
Call Trace:
<TASK>
? __die_body+0x1a/0x60
? die+0x30/0x50
? do_trap+0x7a/0x100
? iov_iter_revert+0x4c/0xf0
? iov_iter_revert+0x4c/0xf0
? do_error_trap+0x6e/0xa0
? iov_iter_revert+0x4c/0xf0
? exc_invalid_op+0x49/0x60
? iov_iter_revert+0x4c/0xf0
? asm_exc_invalid_op+0x16/0x20
? iov_iter_revert+0x4c/0xf0
fuse_direct_io+0x398/0x460
fuse_direct_write_iter+0x10f/0x180
vfs_write+0x142/0x1e0
? __pfx_fuse_file_write_iter+0x10/0x10
ksys_write+0x6d/0xc0
do_syscall_64+0x80/0xe0
entry_SYSCALL_64_after_hwframe+0x71/0x79
