* KASAN: null-ptr-deref Write in io_file_get_normal
@ 2022-08-16 16:10 Jiacheng Xu
2022-08-16 16:21 ` Greg KH
0 siblings, 1 reply; 5+ messages in thread
From: Jiacheng Xu @ 2022-08-16 16:10 UTC (permalink / raw)
To: linux-kernel, axboe, asml.silence; +Cc: io-uring, security
Hello,
When using modified Syzkaller to fuzz the Linux kernel-5.15.58, the
following crash was triggered.
HEAD commit: 568035b01cfb Linux-5.15.58
git tree: upstream
console output:
https://drive.google.com/file/d/1lW1tGegMXfLgS1gfyWmZShhX7LOx3vFJ/view?usp=sharing
kernel config: https://drive.google.com/file/d/1wgIUDwP5ho29AM-K7HhysSTfWFpfXYkG/view?usp=sharing
syz repro: https://drive.google.com/file/d/13l2TaalviEK6WBoXjF4tAiYfSUmlzstU/view?usp=sharing
C reproducer: https://drive.google.com/file/d/1iHOn1jRiQs4iKxxRTDZcATyJcZlVFQqR/view?usp=sharing
There is a similar problem: https://www.spinics.net/lists/io-uring/msg13047.html
Environment:
Ubuntu 20.04 on Linux 5.4.0
QEMU 4.2.1:
qemu-system-x86_64 \
-m 2G \
-smp 2 \
-kernel /home/workdir/bzImage \
-append "console=ttyS0 root=/dev/sda earlyprintk=serial net.ifnames=0" \
-drive file=/home/workdir/stretch.img,format=raw \
-net user,host=10.0.2.10,hostfwd=tcp:127.0.0.1:10021-:22 \
-net nic,model=e1000 \
-enable-kvm \
-nographic \
-pidfile vm.pid \
2>&1 | tee vm.log
If you fix this issue, please add the following tag to the commit:
Reported-by: Jiacheng Xu<[email protected]>
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read_write
include/linux/instrumented.h:101 [inline]
BUG: KASAN: null-ptr-deref in atomic_inc
include/linux/atomic/atomic-instrumented.h:181 [inline]
BUG: KASAN: null-ptr-deref in io_req_track_inflight fs/io_uring.c:1408 [inline]
BUG: KASAN: null-ptr-deref in io_file_get_normal+0x318/0x340 fs/io_uring.c:6934
Write of size 4 at addr 0000000000000118 by task iou-wrk-13680/13681
CPU: 3 PID: 13681 Comm: iou-wrk-13680 Not tainted 5.15.58 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106
__kasan_report mm/kasan/report.c:446 [inline]
kasan_report.cold+0x66/0xdf mm/kasan/report.c:459
check_region_inline mm/kasan/generic.c:183 [inline]
kasan_check_range+0x14e/0x1b0 mm/kasan/generic.c:189
instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
atomic_inc include/linux/atomic/atomic-instrumented.h:181 [inline]
io_req_track_inflight fs/io_uring.c:1408 [inline]
io_file_get_normal+0x318/0x340 fs/io_uring.c:6934
io_file_get fs/io_uring.c:6944 [inline]
io_tee fs/io_uring.c:4051 [inline]
io_issue_sqe+0x4ad9/0x7540 fs/io_uring.c:6797
io_wq_submit_work+0x1bc/0x390 fs/io_uring.c:6863
io_worker_handle_work+0x97c/0x1710 fs/io-wq.c:576
io_wqe_worker+0x5b1/0xd30 fs/io-wq.c:630
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
</TASK>
==================================================================
Kernel panic - not syncing: panic_on_warn set ...
CPU: 2 PID: 13681 Comm: iou-wrk-13680 Tainted: G B 5.15.58 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106
panic+0x2b0/0x6dd kernel/panic.c:232
end_report mm/kasan/report.c:128 [inline]
end_report.cold+0x63/0x6f mm/kasan/report.c:113
__kasan_report mm/kasan/report.c:449 [inline]
kasan_report.cold+0x71/0xdf mm/kasan/report.c:459
check_region_inline mm/kasan/generic.c:183 [inline]
kasan_check_range+0x14e/0x1b0 mm/kasan/generic.c:189
instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
atomic_inc include/linux/atomic/atomic-instrumented.h:181 [inline]
io_req_track_inflight fs/io_uring.c:1408 [inline]
io_file_get_normal+0x318/0x340 fs/io_uring.c:6934
io_file_get fs/io_uring.c:6944 [inline]
io_tee fs/io_uring.c:4051 [inline]
io_issue_sqe+0x4ad9/0x7540 fs/io_uring.c:6797
io_wq_submit_work+0x1bc/0x390 fs/io_uring.c:6863
io_worker_handle_work+0x97c/0x1710 fs/io-wq.c:576
io_wqe_worker+0x5b1/0xd30 fs/io-wq.c:630
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
</TASK>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: KASAN: null-ptr-deref Write in io_file_get_normal
2022-08-16 16:10 KASAN: null-ptr-deref Write in io_file_get_normal Jiacheng Xu
@ 2022-08-16 16:21 ` Greg KH
2022-08-16 16:57 ` Jens Axboe
0 siblings, 1 reply; 5+ messages in thread
From: Greg KH @ 2022-08-16 16:21 UTC (permalink / raw)
To: Jiacheng Xu; +Cc: linux-kernel, axboe, asml.silence, io-uring, security
On Wed, Aug 17, 2022 at 12:10:09AM +0800, Jiacheng Xu wrote:
> Hello,
>
> When using modified Syzkaller to fuzz the Linux kernel-5.15.58, the
> following crash was triggered.
As you sent this to public lists, there's no need to also cc:
[email protected] as there's nothing we can do about this.
Also, random syzbot submissions are best sent with a fix for them,
otherwise it might be a while before they will be looked at.
good luck!
greg k-h
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: KASAN: null-ptr-deref Write in io_file_get_normal
2022-08-16 16:21 ` Greg KH
@ 2022-08-16 16:57 ` Jens Axboe
2022-08-17 6:49 ` Greg KH
0 siblings, 1 reply; 5+ messages in thread
From: Jens Axboe @ 2022-08-16 16:57 UTC (permalink / raw)
To: Greg KH, Jiacheng Xu; +Cc: linux-kernel, asml.silence, io-uring, security
On 8/16/22 10:21 AM, Greg KH wrote:
> On Wed, Aug 17, 2022 at 12:10:09AM +0800, Jiacheng Xu wrote:
>> Hello,
>>
>> When using modified Syzkaller to fuzz the Linux kernel-5.15.58, the
>> following crash was triggered.
>
> As you sent this to public lists, there's no need to also cc:
> [email protected] as there's nothing we can do about this.
Indeed...
> Also, random syzbot submissions are best sent with a fix for them,
> otherwise it might be a while before they will be looked at.
Greg, can you cherrypick:
commit 386e4fb6962b9f248a80f8870aea0870ca603e89
Author: Jens Axboe <[email protected]>
Date: Thu Jun 23 11:06:43 2022 -0600
io_uring: use original request task for inflight tracking
into 5.15-stable? It should pick cleanly and also fix this issue.
--
Jens Axboe
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: KASAN: null-ptr-deref Write in io_file_get_normal
2022-08-16 16:57 ` Jens Axboe
@ 2022-08-17 6:49 ` Greg KH
2022-08-17 14:22 ` Jens Axboe
0 siblings, 1 reply; 5+ messages in thread
From: Greg KH @ 2022-08-17 6:49 UTC (permalink / raw)
To: Jens Axboe; +Cc: Jiacheng Xu, linux-kernel, asml.silence, io-uring, security
On Tue, Aug 16, 2022 at 10:57:39AM -0600, Jens Axboe wrote:
> On 8/16/22 10:21 AM, Greg KH wrote:
> > On Wed, Aug 17, 2022 at 12:10:09AM +0800, Jiacheng Xu wrote:
> >> Hello,
> >>
> >> When using modified Syzkaller to fuzz the Linux kernel-5.15.58, the
> >> following crash was triggered.
> >
> > As you sent this to public lists, there's no need to also cc:
> > [email protected] as there's nothing we can do about this.
>
> Indeed...
>
> > Also, random syzbot submissions are best sent with a fix for them,
> > otherwise it might be a while before they will be looked at.
>
> Greg, can you cherrypick:
>
> commit 386e4fb6962b9f248a80f8870aea0870ca603e89
> Author: Jens Axboe <[email protected]>
> Date: Thu Jun 23 11:06:43 2022 -0600
>
> io_uring: use original request task for inflight tracking
>
> into 5.15-stable? It should pick cleanly and also fix this issue.
>
> --
> Jens Axboe
>
>
Thanks, will do after this next round of releases go out.
greg k-h
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: KASAN: null-ptr-deref Write in io_file_get_normal
2022-08-17 6:49 ` Greg KH
@ 2022-08-17 14:22 ` Jens Axboe
0 siblings, 0 replies; 5+ messages in thread
From: Jens Axboe @ 2022-08-17 14:22 UTC (permalink / raw)
To: Greg KH; +Cc: Jiacheng Xu, linux-kernel, asml.silence, io-uring, security
On 8/17/22 12:49 AM, Greg KH wrote:
> On Tue, Aug 16, 2022 at 10:57:39AM -0600, Jens Axboe wrote:
>> On 8/16/22 10:21 AM, Greg KH wrote:
>>> On Wed, Aug 17, 2022 at 12:10:09AM +0800, Jiacheng Xu wrote:
>>>> Hello,
>>>>
>>>> When using modified Syzkaller to fuzz the Linux kernel-5.15.58, the
>>>> following crash was triggered.
>>>
>>> As you sent this to public lists, there's no need to also cc:
>>> [email protected] as there's nothing we can do about this.
>>
>> Indeed...
>>
>>> Also, random syzbot submissions are best sent with a fix for them,
>>> otherwise it might be a while before they will be looked at.
>>
>> Greg, can you cherrypick:
>>
>> commit 386e4fb6962b9f248a80f8870aea0870ca603e89
>> Author: Jens Axboe <[email protected]>
>> Date: Thu Jun 23 11:06:43 2022 -0600
>>
>> io_uring: use original request task for inflight tracking
>>
>> into 5.15-stable? It should pick cleanly and also fix this issue.
>>
>> --
>> Jens Axboe
>>
>>
>
> Thanks, will do after this next round of releases go out.
Thanks Greg.
--
Jens Axboe
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2022-08-17 14:22 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-08-16 16:10 KASAN: null-ptr-deref Write in io_file_get_normal Jiacheng Xu
2022-08-16 16:21 ` Greg KH
2022-08-16 16:57 ` Jens Axboe
2022-08-17 6:49 ` Greg KH
2022-08-17 14:22 ` Jens Axboe
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox