From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on gnuweeb.org X-Spam-Level: X-Spam-Status: No, score=-7.6 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_PASS,SPF_SOFTFAIL,URIBL_BLOCKED, USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.6 Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5D7D7C433EF for ; Tue, 31 May 2022 09:07:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234066AbiEaJHA (ORCPT ); Tue, 31 May 2022 05:07:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41956 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245124AbiEaJFc (ORCPT ); Tue, 31 May 2022 05:05:32 -0400 Received: from mail-lf1-x12a.google.com (mail-lf1-x12a.google.com [IPv6:2a00:1450:4864:20::12a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 51E7F53721 for ; Tue, 31 May 2022 02:05:31 -0700 (PDT) Received: by mail-lf1-x12a.google.com with SMTP id l13so20322321lfp.11 for ; Tue, 31 May 2022 02:05:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=uXvtrwihxvcxSs1Fpbv4pO6ci42Kw2r2BvzhnZ4/XRo=; b=Kbi70PlsR5+i802aBEmHE5kSCiTflqXipOGStTJBs7NP5am4ttQBpDKSC/hOGNlPMy tPACEWG22DC0KB6dkW2WlKLfsmHkNVRPHWbE/zLJJWx5el74LNPkTotrhwwn+jf/+w/Y nI9YCvELVEYgAiGlLYRs9ySgxD2TmI+gHcAUgTPLzQeFscQYoNM7/VjJWdkwzo3NIOcX mzsG42+ToUxlCjQbQuf16n5Bu+kGWDNYuKQh/WS0dmuQ3Jh3mWuU72I03QvymNoF0SyD qAatat4lTj2CUpcFoeDWenrT2jU39J+m2GS7CDjezZpEtxdh2AOXtZj2p6bztXsThp0y swZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=uXvtrwihxvcxSs1Fpbv4pO6ci42Kw2r2BvzhnZ4/XRo=; b=c50KRxhlO31JVzyC0oh/t79ZfZfghoqAmP3+xVRI2ONTzF/YZBNEIFKaqJ6atiyQmx lvkZn2MkSTCiiLl7aYOnUWdGOOjKqGsC480OFRzCVo/OQf6IBFIlBIB24pbSNB8pIO85 4keJfRS20OPmY5vtx/ptI7/q5iCkDkApz+AshA9uHB6Jj6ZaYYZlJg/V613Tz2Y/wCqw pYJ3cPmMi1bWayFsem+h8c/oZ3OADGOVhfCHV3Qx1rw7gbDC/rmP/bEbFawQT9HDyuGA 0p1Vkl0+TBO/zwVT8nDfH9JZ2fEGw9smibyTwUrr8W565Hb4c4sNgz8G01N6zpfWXr0/ XRhg== X-Gm-Message-State: AOAM530aWdmyqv5UZPHUmLw0J2t5f/T9qE09jbojckv5NOpMFRKym5zR pcG2NjeItTSo6aUUgYVwO8aHz4T05AiMj7oPLojT1g== X-Google-Smtp-Source: ABdhPJyz4e5cRckDm7lj2o7+M7mpbQaJQjZ1zy5BPi7XX0n8/aXbBoNj0soqbvW3QipRoCJ+q/B25+ibJO1Blaun0Ys= X-Received: by 2002:a05:6512:1156:b0:478:79b1:583c with SMTP id m22-20020a056512115600b0047879b1583cmr29681645lfg.206.1653987929308; Tue, 31 May 2022 02:05:29 -0700 (PDT) MIME-Version: 1.0 References: <000000000000f0b26205e04a183b@google.com> <3d3c6b5f-84cd-cb25-812e-dac77e02ddbf@kernel.dk> In-Reply-To: From: Dmitry Vyukov Date: Tue, 31 May 2022 11:05:18 +0200 Message-ID: Subject: Re: [syzbot] UBSAN: array-index-out-of-bounds in io_submit_sqes To: Jens Axboe Cc: Hao Xu , syzbot , asml.silence@gmail.com, io-uring@vger.kernel.org, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: io-uring@vger.kernel.org On Tue, 31 May 2022 at 11:01, Jens Axboe wrote: > > On 5/31/22 3:00 AM, Hao Xu wrote: > > On 5/31/22 16:45, Jens Axboe wrote: > >> On 5/31/22 1:55 AM, syzbot wrote: > >>> Hello, > >>> > >>> syzbot found the following issue on: > >>> > >>> HEAD commit: 3b46e4e44180 Add linux-next specific files for 20220531 > >>> git tree: linux-next > >>> console output: https://syzkaller.appspot.com/x/log.txt?x=16e151f5f00000 > >>> kernel config: https://syzkaller.appspot.com/x/.config?x=ccb8d66fc9489ef > >>> dashboard link: https://syzkaller.appspot.com/bug?extid=b6c9b65b6753d333d833 > >>> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 > >>> > >>> Unfortunately, I don't have any reproducer for this issue yet. > >>> > >>> IMPORTANT: if you fix the issue, please add the following tag to the commit: > >>> Reported-by: syzbot+b6c9b65b6753d333d833@syzkaller.appspotmail.com > >>> > >>> ================================================================================ > >>> ================================================================================ > >>> UBSAN: array-index-out-of-bounds in fs/io_uring.c:8860:19 > >>> index 75 is out of range for type 'io_op_def [47]' > >> > >> 'def' is just set here, it's not actually used after 'opcode' has been > >> verified. > >> > > > > Maybe we can move it to be below the opcode check to comfort UBSAN. > > Yeah that's what I did, just rebased it to get rid of it: > > https://git.kernel.dk/cgit/linux-block/commit/?h=io_uring-5.19&id=fcde59feb1affb6d56aecadc3868df4631480da5 If you are rebasing it, please add the following tag so that the bug is closed later: Tested-by: syzbot+b6c9b65b6753d333d833@syzkaller.appspotmail.com