On Sun, Apr 8, 2018 at 8:01 AM, Matthew Wilcox <wi...@infradead.org> wrote:
> On Fri, Apr 06, 2018 at 03:33:36PM +0200, Dmitry Vyukov wrote:
>> On Fri, Apr 6, 2018 at 3:24 PM, syzbot
>> <syzbot+75397ee3df5c70164...@syzkaller.appspotmail.com> wrote:
>> > Unfortunately, I don't have any reproducer for this crash yet.
>> Interesting type of bug, I think we see this for the first time.
> Can you focus syzbot to try to find a reproducer?  This seems to be
> produced by calling mount() with a pathname that's somewhere between,
> say, 3950 & 4100 bytes long from a compat 32-bit task.

Something in the log definitely triggers a very bad heap corruption.

This can be reproduced following instructions at:

and then running:
./syz-execprog -sandbox=namespace -arch=386 -repeat=0 -procs=10 log.txt

where log.txt comes from "Raw console output" link.

Note that you need to build syzkaller with 'make TARGETARCH=386' and
the use bin/linux_386/syz-executor.

While running it I got:
BUG: KASAN: double-free or invalid-free in free_request_size+0x5b/0x70

Then kernel BUG at mm/slab.c:4407!

And then BUG: unable to handle kernel paging request at ffffebe000000020

One interesting thing is that if I run the log once and it does not
crash, then when I try to start binary again I am getting:
[  456.837870] Invalid argument reading file caps for /root/syz-executor
The binary somehow becomes broken on disk...

I guess syzbot did find a reproducer in this log, but did not
attribute it to this bug as it causes crashes all over the place.

Reply via email to