[lkml]   [2019]   [Jul]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: WARNING in ovl_real_fdget_meta
On Thu, Jul 25, 2019 at 7:24 AM syzbot
<> wrote:
> syzbot has bisected this bug to:
> commit 387e3746d01c34457d6a73688acd90428725070b
> Author: Amir Goldstein <>
> Date: Fri Jun 7 14:24:38 2019 +0000
> locks: eliminate false positive conflicts for write lease
> bisection log:
> start commit: c6dd78fc Merge branch 'x86-urgent-for-linus' of git://git...
> git tree: upstream
> final crash:
> console output:
> kernel config:
> dashboard link:
> syz repro:
> C reproducer:
> Reported-by:
> Fixes: 387e3746d01c ("locks: eliminate false positive conflicts for write
> lease")
> For information about bisection process see:

The repro:
mkdir(&(0x7f0000000100)='./file0\x00', 0x0)
&(0x7f0000000000)='./\x00', 0x1ff)
mount$fuse(0x20000000, &(0x7f0000000140)='./file0\x00', 0x0, 0x1004, 0x0)
mount$overlay(0x400000, &(0x7f0000000100)='./file0\x00',
&(0x7f00000001c0)='overlay\x00', 0x0,
r0 = open(&(0x7f0000000500)='./file0\x00', 0x0, 0x0)
r1 = openat$cgroup_procs(r0, &(0x7f00000004c0)='cgroup.procs\x00', 0x48, 0x0)
dup3(r1, r0, 0x0)
fcntl$setlease(r0, 0x400, 0x1)
lseek(r0, 0x4, 0x0)

I though we would stop these family of overlapping layers fuzzers with:
146d62e5a586 ("ovl: detect overlapping layers")

But syzbot got the upper hand, because we do not check for overlapping layers
that cross fs boundary. Not sure if we should (?).

./ is a tmpfs dir and ./file0/ is some kind of fuse mount (?)
then after one cycle, ./file0/ itself is an overlapping overlay mount
and after another cycle, ./file0/ is a nested overlapping overlayfs mount.
Fine. Whatever.

What I don't understand is if dup3 succeeds r0 should not be an overlayfs fd
and even if dup3 fails r0 should be an overlayfs directory fd (./file0/), so how
the hell did we get to ovl_llseek => ... ovl_change_flags() with this repro??

There is not a single regular file in this test.


 \ /
  Last update: 2019-07-26 10:13    [W:0.050 / U:22.328 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site