Re: [syzbot] [io-uring?] KASAN: global-out-of-bounds Read in io_uring_show_fdinfo

[Jens Axboe <axboe@kernel.dk>]

On 10/30/25 4:34 PM, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    f9ba12abc528 Add linux-next specific files for 20251029
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=16493fe2580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=32e95de7031f410d
> dashboard link: https://syzkaller.appspot.com/bug?extid=b883b008a0b1067d5833
> compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15729258580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=10988e14580000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/7b5f5194573e/disk-f9ba12ab.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/83dabfc9c13b/vmlinux-f9ba12ab.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/7e62a1d361f0/bzImage-f9ba12ab.xz
> 
> The issue was bisected to:
> 
> commit 101e596e7404d07a85b38358a392009503aad797
> Author: Jens Axboe <axboe@kernel.dk>
> Date:   Tue Oct 28 01:09:28 2025 +0000
> 
>     io_uring/fdinfo: cap SQ iteration at max SQ entries

Don't think that's right, it's more like:

commit 1cba30bf9fdd6c982708f3587f609a30c370d889
Author: Keith Busch <kbusch@kernel.org>
Date:   Thu Oct 16 11:09:38 2025 -0700

    io_uring: add support for IORING_SETUP_SQE_MIXED

as it looks like 'opcode' is invalid, and hence it's reading beyond the end
of the io_issue_defs[] array.

Something like this should fix it:

diff --git a/io_uring/fdinfo.c b/io_uring/fdinfo.c
index 3f254ae0ad61..bd8251832320 100644
--- a/io_uring/fdinfo.c
+++ b/io_uring/fdinfo.c
@@ -106,6 +106,8 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m)
 
 		sqe = &ctx->sq_sqes[sq_idx << sq_shift];
 		opcode = READ_ONCE(sqe->opcode);
+		if (opcode >= IORING_OP_LAST)
+			continue;
 		if (sq_shift) {
 			sqe128 = true;
 		} else if (io_issue_defs[opcode].is_128) {

-- 
Jens Axboe