lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <DM6PR07MB50680D00B48D4ED3C151A2A7AB069@DM6PR07MB5068.namprd07.prod.outlook.com>
Date:   Thu, 17 Nov 2022 22:17:35 +0000
From:   Sanan Hasanov <sanan.hasanov@...ghts.ucf.edu>
To:     "peterz@...radead.org" <peterz@...radead.org>,
        "mingo@...hat.com" <mingo@...hat.com>,
        "will@...nel.org" <will@...nel.org>,
        "longman@...hat.com" <longman@...hat.com>,
        "boqun.feng@...il.com" <boqun.feng@...il.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "akpm@...ux-foundation.org" <akpm@...ux-foundation.org>,
        "glider@...gle.com" <glider@...gle.com>,
        "elver@...gle.com" <elver@...gle.com>,
        "arnd@...db.de" <arnd@...db.de>,
        "linux-arch@...r.kernel.org" <linux-arch@...r.kernel.org>,
        "juri.lelli@...hat.com" <juri.lelli@...hat.com>,
        "vincent.guittot@...aro.org" <vincent.guittot@...aro.org>,
        "dietmar.eggemann@....com" <dietmar.eggemann@....com>,
        "rostedt@...dmis.org" <rostedt@...dmis.org>,
        "bsegall@...gle.com" <bsegall@...gle.com>,
        "mgorman@...e.de" <mgorman@...e.de>,
        "bristot@...hat.com" <bristot@...hat.com>,
        "vschneid@...hat.com" <vschneid@...hat.com>
CC:     "syzkaller@...glegroups.com" <syzkaller@...glegroups.com>,
        Paul Gazzillo <Paul.Gazzillo@....edu>
Subject: Syzkaller found a bug: KASAN: null-ptr-deref Write in prepare_to_wait

Good day, dear maintainers,

We found a bug using a modified kernel configuration file used by syzbot.

We enhanced the coverage of the configuration file using our tool, klocalizer.

Kernel branch: linux-next 5.11.0+ (HEAD detached at 8310b77b48c5)

config file and c reproducer are attached.

Thank you!

==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: null-ptr-deref in atomic_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:705 [inline]
BUG: KASAN: null-ptr-deref in queued_spin_lock include/asm-generic/qspinlock.h:82 [inline]
BUG: KASAN: null-ptr-deref in do_raw_spin_lock_flags include/linux/spinlock.h:195 [inline]
BUG: KASAN: null-ptr-deref in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:119 [inline]
BUG: KASAN: null-ptr-deref in _raw_spin_lock_irqsave+0x6c/0xd0 kernel/locking/spinlock.c:159
Write of size 4 at addr 0000000000000010 by task syz-executor.3/1879

CPU: 1 PID: 1879 Comm: syz-executor.3 Not tainted 5.11.0+ #4
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0xb0/0xf3 lib/dump_stack.c:120
 __kasan_report mm/kasan/report.c:400 [inline]
 kasan_report.cold+0x10c/0x10e mm/kasan/report.c:413
 check_memory_region_inline mm/kasan/generic.c:179 [inline]
 check_memory_region+0x17c/0x1e0 mm/kasan/generic.c:185
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 atomic_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:705 [inline]
 queued_spin_lock include/asm-generic/qspinlock.h:82 [inline]
 do_raw_spin_lock_flags include/linux/spinlock.h:195 [inline]
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:119 [inline]
 _raw_spin_lock_irqsave+0x6c/0xd0 kernel/locking/spinlock.c:159
 prepare_to_wait+0x79/0x3c0 kernel/sched/wait.c:259
 io_uring_cancel_files fs/io_uring.c:9014 [inline]
 io_uring_cancel_task_requests+0x986/0xfa0 fs/io_uring.c:9054
 io_uring_flush+0x311/0x470 fs/io_uring.c:9236
 filp_close+0xad/0x150 fs/open.c:1286
 close_files fs/file.c:403 [inline]
 put_files_struct fs/file.c:418 [inline]
 put_files_struct+0x193/0x280 fs/file.c:415
 exit_files+0xa4/0xd0 fs/file.c:435
 do_exit+0xa35/0x27d0 kernel/exit.c:820
 do_group_exit+0xee/0x310 kernel/exit.c:922
 get_signal+0x3b5/0x1a60 kernel/signal.c:2773
 arch_do_signal_or_restart+0x2eb/0x18e0 arch/x86/kernel/signal.c:811
 handle_signal_work kernel/entry/common.c:147 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
 exit_to_user_mode_prepare+0xba/0x130 kernel/entry/common.c:208
 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline]
 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:301
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f06219f6dcd
Code: Unable to access opcode bytes at RIP 0x7f06219f6da3.
RSP: 002b:00007f0620b66c98 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f0621b23f80 RCX: 00007f06219f6dcd
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f0621b23f88
RBP: 00007f0621b23f88 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0621b23f8c
R13: 00007ffcf7101edf R14: 00007ffcf7102080 R15: 00007f0620b66d80
==================================================================
BUG: kernel NULL pointer dereference, address: 0000000000000010
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 0 P4D 0 
Oops: 0002 [#1] SMP KASAN NOPTI
CPU: 1 PID: 1879 Comm: syz-executor.3 Tainted: G    B             5.11.0+ #4
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:arch_atomic_try_cmpxchg arch/x86/include/asm/atomic.h:202 [inline]
RIP: 0010:atomic_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:707 [inline]
RIP: 0010:queued_spin_lock include/asm-generic/qspinlock.h:82 [inline]
RIP: 0010:do_raw_spin_lock_flags include/linux/spinlock.h:195 [inline]
RIP: 0010:__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:119 [inline]
RIP: 0010:_raw_spin_lock_irqsave+0x84/0xd0 kernel/locking/spinlock.c:159
Code: be 04 00 00 00 c7 44 24 20 00 00 00 00 e8 24 6f ea fd be 04 00 00 00 48 8d 7c 24 20 e8 15 6f ea fd ba 01 00 00 00 8b 44 24 20 <f0> 0f b1 55 00 75 2e 48 b8 00 00 00 00 00 fc ff df 48 c7 04 03 00
RSP: 0018:ffff88810cc577f0 EFLAGS: 00010097
RAX: 0000000000000000 RBX: 1ffff1102198aefe RCX: ffffffff8e31626b
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff88810cc57810
RBP: 0000000000000010 R08: 0000000000000001 R09: ffffed102198af03
R10: 0000000000000003 R11: ffffed102198af02 R12: 0000000000000246
R13: 0000000000000002 R14: ffff88810cc579a8 R15: 0000000000000010
FS:  0000000000000000(0000) GS:ffff88811b240000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000010 CR3: 000000005c210000 CR4: 0000000000350ee0
Call Trace:
 prepare_to_wait+0x79/0x3c0 kernel/sched/wait.c:259
 io_uring_cancel_files fs/io_uring.c:9014 [inline]
 io_uring_cancel_task_requests+0x986/0xfa0 fs/io_uring.c:9054
 io_uring_flush+0x311/0x470 fs/io_uring.c:9236
 filp_close+0xad/0x150 fs/open.c:1286
 close_files fs/file.c:403 [inline]
 put_files_struct fs/file.c:418 [inline]
 put_files_struct+0x193/0x280 fs/file.c:415
 exit_files+0xa4/0xd0 fs/file.c:435
 do_exit+0xa35/0x27d0 kernel/exit.c:820
 do_group_exit+0xee/0x310 kernel/exit.c:922
 get_signal+0x3b5/0x1a60 kernel/signal.c:2773
 arch_do_signal_or_restart+0x2eb/0x18e0 arch/x86/kernel/signal.c:811
 handle_signal_work kernel/entry/common.c:147 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
 exit_to_user_mode_prepare+0xba/0x130 kernel/entry/common.c:208
 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline]
 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:301
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f06219f6dcd
Code: Unable to access opcode bytes at RIP 0x7f06219f6da3.
RSP: 002b:00007f0620b66c98 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f0621b23f80 RCX: 00007f06219f6dcd
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f0621b23f88
RBP: 00007f0621b23f88 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0621b23f8c
R13: 00007ffcf7101edf R14: 00007ffcf7102080 R15: 00007f0620b66d80
Modules linked in:
CR2: 0000000000000010
---[ end trace 4bbedc80934769c4 ]---
RIP: 0010:arch_atomic_try_cmpxchg arch/x86/include/asm/atomic.h:202 [inline]
RIP: 0010:atomic_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:707 [inline]
RIP: 0010:queued_spin_lock include/asm-generic/qspinlock.h:82 [inline]
RIP: 0010:do_raw_spin_lock_flags include/linux/spinlock.h:195 [inline]
RIP: 0010:__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:119 [inline]
RIP: 0010:_raw_spin_lock_irqsave+0x84/0xd0 kernel/locking/spinlock.c:159
Code: be 04 00 00 00 c7 44 24 20 00 00 00 00 e8 24 6f ea fd be 04 00 00 00 48 8d 7c 24 20 e8 15 6f ea fd ba 01 00 00 00 8b 44 24 20 <f0> 0f b1 55 00 75 2e 48 b8 00 00 00 00 00 fc ff df 48 c7 04 03 00
RSP: 0018:ffff88810cc577f0 EFLAGS: 00010097
RAX: 0000000000000000 RBX: 1ffff1102198aefe RCX: ffffffff8e31626b
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff88810cc57810
RBP: 0000000000000010 R08: 0000000000000001 R09: ffffed102198af03
R10: 0000000000000003 R11: ffffed102198af02 R12: 0000000000000246
R13: 0000000000000002 R14: ffff88810cc579a8 R15: 0000000000000010
FS:  0000000000000000(0000) GS:ffff88811b240000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000010 CR3: 000000005c210000 CR4: 0000000000350ee0
Fixing recursive fault but reboot is needed!
----------------
Code disassembly (best guess):
   0:	be 04 00 00 00       	mov    $0x4,%esi
   5:	c7 44 24 20 00 00 00 	movl   $0x0,0x20(%rsp)
   c:	00
   d:	e8 24 6f ea fd       	callq  0xfdea6f36
  12:	be 04 00 00 00       	mov    $0x4,%esi
  17:	48 8d 7c 24 20       	lea    0x20(%rsp),%rdi
  1c:	e8 15 6f ea fd       	callq  0xfdea6f36
  21:	ba 01 00 00 00       	mov    $0x1,%edx
  26:	8b 44 24 20          	mov    0x20(%rsp),%eax
* 2a:	f0 0f b1 55 00       	lock cmpxchg %edx,0x0(%rbp) <-- trapping instruction
  2f:	75 2e                	jne    0x5f
  31:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  38:	fc ff df
  3b:	48                   	rex.W
  3c:	c7                   	.byte 0xc7
  3d:	04 03                	add    $0x3,%al

Download attachment "8310b77b48c5558c140e7a57a702e7819e62f04e.config" of type "application/octet-stream" (221990 bytes)

Download attachment "repro.cprog" of type "application/octet-stream" (10377 bytes)

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ