On Tue, Sep 29, 2020 at 08:38:15AM +0200, Christoph Hellwig wrote: > On Mon, Sep 28, 2020 at 03:14:41PM -0700, Eric Biggers wrote: > > On Sat, Sep 26, 2020 at 01:17:04PM +0000, David Laight wrote: > > > From: David Laight > > > > Sent: 26 September 2020 12:16 > > > > To: 'syzbot' <syzbot+51177e4144d764827...@syzkaller.appspotmail.com>; > > > > linux-fsde...@vger.kernel.org; > > > > linux-kernel@vger.kernel.org; syzkaller-b...@googlegroups.com; > > > > v...@zeniv.linux.org.uk > > > > Subject: RE: WARNING in __kernel_read (2) > > > > > > > > > From: syzbot <syzbot+51177e4144d764827...@syzkaller.appspotmail.com> > > > > > Sent: 26 September 2020 03:58 > > > > > To: linux-fsde...@vger.kernel.org; linux-kernel@vger.kernel.org; > > > > > syzkaller-b...@googlegroups.com; > > > > > v...@zeniv.linux.org.uk > > > > > Subject: WARNING in __kernel_read (2) > > > > > > > > I suspect this is calling finit_module() on an fd > > > > that doesn't have read permissions. > > > > > > Code inspection also seems to imply that the check means > > > the exec() also requires read permissions on the file. > > > > > > This isn't traditionally true. > > > suid #! scripts are particularly odd without 'owner read' > > > (everyone except the owner can run them!). > > > > Christoph, any thoughts here? You added this WARN_ON_ONCE in: > > > > commit 61a707c543e2afe3aa7e88f87267c5dafa4b5afa > > Author: Christoph Hellwig <h...@lst.de> > > Date: Fri May 8 08:54:16 2020 +0200 > > > > fs: add a __kernel_read helper > > Linus asked for it. What is the call chain that we hit it with?
Call Trace: kernel_read+0x52/0x70 fs/read_write.c:471 kernel_read_file fs/exec.c:989 [inline] kernel_read_file+0x2e5/0x620 fs/exec.c:952 kernel_read_file_from_fd+0x56/0xa0 fs/exec.c:1076 __do_sys_finit_module+0xe6/0x190 kernel/module.c:4066 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 See the email from syzbot for the full details: https://lkml.kernel.org/linux-fsdevel/000000000000da992305b02e9...@google.com
