KASAN: null-ptr-deref Write in io_file_get_normal

KASAN: null-ptr-deref Write in io_file_get_normal

[Jiacheng Xu]

Hello,

When using modified Syzkaller to fuzz the Linux kernel-5.15.58, the
following crash was triggered.

HEAD commit: 568035b01cfb Linux-5.15.58
git tree: upstream

console output:
https://drive.google.com/file/d/1lW1tGegMXfLgS1gfyWmZShhX7LOx3vFJ/view?usp=sharing
kernel config: https://drive.google.com/file/d/1wgIUDwP5ho29AM-K7HhysSTfWFpfXYkG/view?usp=sharing
syz repro: https://drive.google.com/file/d/13l2TaalviEK6WBoXjF4tAiYfSUmlzstU/view?usp=sharing
C reproducer: https://drive.google.com/file/d/1iHOn1jRiQs4iKxxRTDZcATyJcZlVFQqR/view?usp=sharing

There is a similar problem: https://www.spinics.net/lists/io-uring/msg13047.html

Environment:
Ubuntu 20.04 on Linux 5.4.0
QEMU 4.2.1:
qemu-system-x86_64 \
  -m 2G \
  -smp 2 \
  -kernel /home/workdir/bzImage \
  -append "console=ttyS0 root=/dev/sda earlyprintk=serial net.ifnames=0" \
  -drive file=/home/workdir/stretch.img,format=raw \
  -net user,host=10.0.2.10,hostfwd=tcp:127.0.0.1:10021-:22 \
  -net nic,model=e1000 \
  -enable-kvm \
  -nographic \
  -pidfile vm.pid \
  2>&1 | tee vm.log

If you fix this issue, please add the following tag to the commit:
Reported-by:  Jiacheng Xu<stitch@zju.edu.cn>

==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read_write
include/linux/instrumented.h:101 [inline]
BUG: KASAN: null-ptr-deref in atomic_inc
include/linux/atomic/atomic-instrumented.h:181 [inline]
BUG: KASAN: null-ptr-deref in io_req_track_inflight fs/io_uring.c:1408 [inline]
BUG: KASAN: null-ptr-deref in io_file_get_normal+0x318/0x340 fs/io_uring.c:6934
Write of size 4 at addr 0000000000000118 by task iou-wrk-13680/13681

CPU: 3 PID: 13681 Comm: iou-wrk-13680 Not tainted 5.15.58 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106
 __kasan_report mm/kasan/report.c:446 [inline]
 kasan_report.cold+0x66/0xdf mm/kasan/report.c:459
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0x14e/0x1b0 mm/kasan/generic.c:189
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 atomic_inc include/linux/atomic/atomic-instrumented.h:181 [inline]
 io_req_track_inflight fs/io_uring.c:1408 [inline]
 io_file_get_normal+0x318/0x340 fs/io_uring.c:6934
 io_file_get fs/io_uring.c:6944 [inline]
 io_tee fs/io_uring.c:4051 [inline]
 io_issue_sqe+0x4ad9/0x7540 fs/io_uring.c:6797
 io_wq_submit_work+0x1bc/0x390 fs/io_uring.c:6863
 io_worker_handle_work+0x97c/0x1710 fs/io-wq.c:576
 io_wqe_worker+0x5b1/0xd30 fs/io-wq.c:630
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
 </TASK>
==================================================================
Kernel panic - not syncing: panic_on_warn set ...
CPU: 2 PID: 13681 Comm: iou-wrk-13680 Tainted: G    B             5.15.58 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106
 panic+0x2b0/0x6dd kernel/panic.c:232
 end_report mm/kasan/report.c:128 [inline]
 end_report.cold+0x63/0x6f mm/kasan/report.c:113
 __kasan_report mm/kasan/report.c:449 [inline]
 kasan_report.cold+0x71/0xdf mm/kasan/report.c:459
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0x14e/0x1b0 mm/kasan/generic.c:189
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 atomic_inc include/linux/atomic/atomic-instrumented.h:181 [inline]
 io_req_track_inflight fs/io_uring.c:1408 [inline]
 io_file_get_normal+0x318/0x340 fs/io_uring.c:6934
 io_file_get fs/io_uring.c:6944 [inline]
 io_tee fs/io_uring.c:4051 [inline]
 io_issue_sqe+0x4ad9/0x7540 fs/io_uring.c:6797
 io_wq_submit_work+0x1bc/0x390 fs/io_uring.c:6863
 io_worker_handle_work+0x97c/0x1710 fs/io-wq.c:576
 io_wqe_worker+0x5b1/0xd30 fs/io-wq.c:630
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
 </TASK>

Re: KASAN: null-ptr-deref Write in io_file_get_normal

[Greg KH]

On Wed, Aug 17, 2022 at 12:10:09AM +0800, Jiacheng Xu wrote:
> Hello,
> 
> When using modified Syzkaller to fuzz the Linux kernel-5.15.58, the
> following crash was triggered.

As you sent this to public lists, there's no need to also cc:
security@k.o as there's nothing we can do about this.

Also, random syzbot submissions are best sent with a fix for them,
otherwise it might be a while before they will be looked at.

good luck!

greg k-h

Re: KASAN: null-ptr-deref Write in io_file_get_normal

[Jens Axboe]

On 8/16/22 10:21 AM, Greg KH wrote:
> On Wed, Aug 17, 2022 at 12:10:09AM +0800, Jiacheng Xu wrote:
>> Hello,
>>
>> When using modified Syzkaller to fuzz the Linux kernel-5.15.58, the
>> following crash was triggered.
> 
> As you sent this to public lists, there's no need to also cc:
> security@k.o as there's nothing we can do about this.

Indeed...

> Also, random syzbot submissions are best sent with a fix for them,
> otherwise it might be a while before they will be looked at.

Greg, can you cherrypick:

commit 386e4fb6962b9f248a80f8870aea0870ca603e89
Author: Jens Axboe <axboe@kernel.dk>
Date:   Thu Jun 23 11:06:43 2022 -0600

    io_uring: use original request task for inflight tracking

into 5.15-stable? It should pick cleanly and also fix this issue.

-- 
Jens Axboe

Re: KASAN: null-ptr-deref Write in io_file_get_normal

[Greg KH]

On Tue, Aug 16, 2022 at 10:57:39AM -0600, Jens Axboe wrote:
> On 8/16/22 10:21 AM, Greg KH wrote:
> > On Wed, Aug 17, 2022 at 12:10:09AM +0800, Jiacheng Xu wrote:
> >> Hello,
> >>
> >> When using modified Syzkaller to fuzz the Linux kernel-5.15.58, the
> >> following crash was triggered.
> > 
> > As you sent this to public lists, there's no need to also cc:
> > security@k.o as there's nothing we can do about this.
> 
> Indeed...
> 
> > Also, random syzbot submissions are best sent with a fix for them,
> > otherwise it might be a while before they will be looked at.
> 
> Greg, can you cherrypick:
> 
> commit 386e4fb6962b9f248a80f8870aea0870ca603e89
> Author: Jens Axboe <axboe@kernel.dk>
> Date:   Thu Jun 23 11:06:43 2022 -0600
> 
>     io_uring: use original request task for inflight tracking
> 
> into 5.15-stable? It should pick cleanly and also fix this issue.
> 
> -- 
> Jens Axboe
> 
> 

Thanks, will do after this next round of releases go out.

greg k-h

Re: KASAN: null-ptr-deref Write in io_file_get_normal

[Jens Axboe]

On 8/17/22 12:49 AM, Greg KH wrote:
> On Tue, Aug 16, 2022 at 10:57:39AM -0600, Jens Axboe wrote:
>> On 8/16/22 10:21 AM, Greg KH wrote:
>>> On Wed, Aug 17, 2022 at 12:10:09AM +0800, Jiacheng Xu wrote:
>>>> Hello,
>>>>
>>>> When using modified Syzkaller to fuzz the Linux kernel-5.15.58, the
>>>> following crash was triggered.
>>>
>>> As you sent this to public lists, there's no need to also cc:
>>> security@k.o as there's nothing we can do about this.
>>
>> Indeed...
>>
>>> Also, random syzbot submissions are best sent with a fix for them,
>>> otherwise it might be a while before they will be looked at.
>>
>> Greg, can you cherrypick:
>>
>> commit 386e4fb6962b9f248a80f8870aea0870ca603e89
>> Author: Jens Axboe <axboe@kernel.dk>
>> Date:   Thu Jun 23 11:06:43 2022 -0600
>>
>>     io_uring: use original request task for inflight tracking
>>
>> into 5.15-stable? It should pick cleanly and also fix this issue.
>>
>> -- 
>> Jens Axboe
>>
>>
> 
> Thanks, will do after this next round of releases go out.

Thanks Greg.

-- 
Jens Axboe