On Mon, Aug 24, 2020 at 11:00 PM Ondrej Mosnacek <omosnace@xxxxxxxxxx> wrote: > > On Mon, Aug 24, 2020 at 9:37 PM syzbot > <syzbot+f07cc9be8d1d226947ed@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote: > > syzbot has found a reproducer for the following issue on: > > Looping in fsdevel and OverlayFS maintainers, as this seems to be > FS/OverlayFS related... Hmm, the oopsing code is always something like: All code ======== 0: 1b fe sbb %esi,%edi 2: 49 8d 5e 08 lea 0x8(%r14),%rbx 6: 48 89 d8 mov %rbx,%rax 9: 48 c1 e8 03 shr $0x3,%rax d: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) 12: 74 08 je 0x1c 14: 48 89 df mov %rbx,%rdi 17: e8 bc b4 5b fe callq 0xfffffffffe5bb4d8 1c: 48 8b 1b mov (%rbx),%rbx 1f: 48 83 c3 68 add $0x68,%rbx 23: 48 89 d8 mov %rbx,%rax 26: 48 c1 e8 03 shr $0x3,%rax 2a:* 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 48 89 df mov %rbx,%rdi 34: e8 9f b4 5b fe callq 0xfffffffffe5bb4d8 39: 48 8b 1b mov (%rbx),%rbx 3c: 48 83 c3 0c add $0xc,%rbx And that looks (to me) like the unrolled loop in call_int_hook(). I don't see how that could be related to overlayfs, though it's definitely interesting why it only triggers from overlay->vfs_getattr()->security_inode_getattr()... Thanks, Miklos
