On Tue, May 13, 2025 at 01:08:58PM +0100, Al Viro wrote: > On Tue, May 13, 2025 at 07:03:14PM +0800, Lai, Yi wrote: > > Hi Al Viro, > > > > Greetings! > > > > I used Syzkaller and found that there is general protection fault in do_move_mount in linux v6.15-rc6. > > > > After bisection and the first bad commit is: > > " > > 267fc3a06a37 do_move_mount(): don't leak MNTNS_PROPAGATING on failures > > " > > > > All detailed into can be found at: > > https://github.com/laifryiee/syzkaller_logs/tree/main/250513_095133_do_move_mount > > Syzkaller repro code: > > https://github.com/laifryiee/syzkaller_logs/tree/main/250513_095133_do_move_mount/repro.c > > Syzkaller repro syscall steps: > > https://github.com/laifryiee/syzkaller_logs/tree/main/250513_095133_do_move_mount/repro.prog > > Syzkaller report: > > https://github.com/laifryiee/syzkaller_logs/tree/main/250513_095133_do_move_mount/repro.report > > Kconfig(make olddefconfig): > > https://github.com/laifryiee/syzkaller_logs/tree/main/250513_095133_do_move_mount/kconfig_origin > > Bisect info: > > https://github.com/laifryiee/syzkaller_logs/tree/main/250513_095133_do_move_mount/bisect_info.log > > bzImage: > > https://github.com/laifryiee/syzkaller_logs/raw/refs/heads/main/250513_095133_do_move_mount/bzImage_82f2b0b97b36ee3fcddf0f0780a9a0825d52fec3 > > Issue dmesg: > > https://github.com/laifryiee/syzkaller_logs/blob/main/250513_095133_do_move_mount/bzImage_82f2b0b97b36ee3fcddf0f0780a9a0825d52fec3 > > Are you sure that stack traces are from the same reproducer? Because they > look nothing like what it's doing... > Yes. The reproducer causes the OOP in do_move_mount(). > I'm pretty sure I see the problem there, but I don't see how it could > fail to oops right in do_move_mount() itself if triggered... > > As a quick check, could you see if the same kernel + diff below still > gives the same report? > After applying the diff, the issue cannot be reproduced. > diff --git a/fs/namespace.c b/fs/namespace.c > index 1b466c54a357..a5983726e51d 100644 > --- a/fs/namespace.c > +++ b/fs/namespace.c > @@ -3722,7 +3722,7 @@ static int do_move_mount(struct path *old_path, > if (attached) > put_mountpoint(old_mp); > out: > - if (is_anon_ns(ns)) > + if (!IS_ERR_OR_NULL(ns) && is_anon_ns(ns)) > ns->mntns_flags &= ~MNTNS_PROPAGATING; > unlock_mount(mp); > if (!err) {
