linux-kernel - Re: KASAN: use-after-free Read in tctx_task

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <f6566e78-f7c8-d30b-29ad-d60775906017@kernel.dk>
Date:   Sun, 28 Feb 2021 10:00:50 -0700
From:   Jens Axboe <axboe@...nel.dk>
To:     syzbot <syzbot+a157ac7c03a56397f553@...kaller.appspotmail.com>,
        asml.silence@...il.com, io-uring@...r.kernel.org,
        linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: KASAN: use-after-free Read in tctx_task_work

On 2/28/21 2:59 AM, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    29c395c7 Merge tag 'x86-entry-2021-02-24' of git://git.ker..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=11cd05cad00000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=c581c545cb4ffac7
> dashboard link: https://syzkaller.appspot.com/bug?extid=a157ac7c03a56397f553
> compiler:       Debian clang version 11.0.1-2
> 
> Unfortunately, I don't have any reproducer for this issue yet.
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+a157ac7c03a56397f553@...kaller.appspotmail.com
> 
> ==================================================================
> BUG: KASAN: use-after-free in __tctx_task_work fs/io_uring.c:2217 [inline]
> BUG: KASAN: use-after-free in tctx_task_work+0x238/0x280 fs/io_uring.c:2230
> Read of size 4 at addr ffff88802178e3f0 by task syz-executor.2/12656

This should fix it.


commit adc34362605c08e622c0750ae3377ed03637abd1
Author: Jens Axboe <axboe@...nel.dk>
Date:   Sun Feb 28 09:59:26 2021 -0700

    io_uring: don't attempt to re-flush completions
    
    If 'node' is NULL, there are no more completions to flush after doing
    this round. And since the req flushing will put ctx references, it's
    quite possible that the ctx is gone after the flush. Don't dereference
    it unless we know we have more to flush.
    
    Fixes: 65453d1efbd2 ("io_uring: enable req cache for task_work items")
    Reported-by: syzbot+a157ac7c03a56397f553@...kaller.appspotmail.com
    Signed-off-by: Jens Axboe <axboe@...nel.dk>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 87e8e40b566e..9db79d4b0827 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1829,7 +1829,7 @@ static bool __tctx_task_work(struct io_uring_task *tctx)
 			mutex_lock(&ctx->uring_lock);
 			io_submit_flush_completions(&ctx->submit_state.comp, ctx);
 			mutex_unlock(&ctx->uring_lock);
-			ctx = this_ctx;
+			ctx = node ? this_ctx : NULL;
 		}
 	}
 

-- 
Jens Axboe