linux-kernel - Re: Update bisect info and new repro code for "[syzbot] WARNING in _copy_from

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Y7YsWvQaDPm2+pS3@xpf.sh.intel.com>
Date:   Thu, 5 Jan 2023 09:48:10 +0800
From:   Pengfei Xu <pengfei.xu@...el.com>
To:     <viro@...iv.linux.org.uk>
CC:     <heng.su@...el.com>, <linux-kernel@...r.kernel.org>,
        <davem@...emloft.net>, <jmaloy@...hat.com>, <kuba@...nel.org>
Subject: Re: Update bisect info and new repro code for "[syzbot] WARNING in
 _copy_from_iter"

Hi Viro,

It's a soft remind: "_copy_from_iter" WARNING issue was still reproduced
in v6.2-rc2 mainline kernel in guest.
"
[   29.804009] sg_write: data in/out 131036/42 bytes for SCSI command 0xff-- guessing data in;
[   29.804009]    program repro not setting count and/or reply_len properly
[   29.806580] ------------[ cut here ]------------
[   29.807212] WARNING: CPU: 0 PID: 514 at lib/iov_iter.c:629 _copy_from_iter+0x130/0xa60
[   29.808295] Modules linked in:
[   29.808742] CPU: 0 PID: 514 Comm: repro Not tainted 6.2.0-rc2-88603b6dc419 #2
[   29.809931] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[   29.811422] RIP: 0010:_copy_from_iter+0x130/0xa60
[   29.812072] Code: 41 5e 41 5f 5d c3 cc cc cc cc e8 5b 16 58 ff be 79 02 00 00 48 c7 c7 3c 55 94 83 e8 5a 18 7a ff e9 3f ff ff ff e8 40 16 58 ff <0f> 0b 31 db 5
[   29.814474] RSP: 0018:ffffc90000fdf988 EFLAGS: 00010246
[   29.815182] RAX: 0000000000000000 RBX: 0000000000001000 RCX: ffffffff81d40343
[   29.816120] RDX: 0000000000000000 RSI: ffff88800dfe4680 RDI: 0000000000000002
[   29.817224] RBP: ffffc90000fdfa18 R08: ffffc90000fdfa3f R09: 000000000000ffff
[   29.818177] R10: ffffea000049bc00 R11: 0000000000000000 R12: ffffc90000fdfad0
[   29.819119] R13: 0000000000000000 R14: ffffea000049b000 R15: 0000000000000000
[   29.820057] FS:  00007f9207ab6740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000
[   29.821161] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   29.821945] CR2: 0000000020000041 CR3: 000000000dd8a005 CR4: 0000000000770ef0
[   29.822890] PKRU: 55555554
[   29.823270] Call Trace:
[   29.823615]  <TASK>
[   29.823924]  ? __sanitizer_cov_trace_pc+0x25/0x60
[   29.824597]  ? bio_add_hw_page+0x234/0x2e0
[   29.825228]  ? write_comp_data+0x2f/0x90
[   29.825782]  copy_page_from_iter+0x1aa/0x370
[   29.826377]  ? write_comp_data+0x2f/0x90
[   29.826928]  blk_rq_map_user_iov+0x531/0xa70
[   29.827550]  blk_rq_map_user+0x86/0xc0
[   29.828093]  blk_rq_map_user_io+0xbe/0xd0
[   29.828665]  sg_common_write.isra.22+0x5fd/0xb10
[   29.829390]  sg_write+0x43a/0x750
[   29.829894]  ? __lock_acquire+0xa26/0x1d30
[   29.830493]  ? write_comp_data+0x2f/0x90
[   29.831038]  ? __sanitizer_cov_trace_pc+0x25/0x60
[   29.831685]  ? security_file_permission+0x177/0x340
[   29.832365]  ? __sanitizer_cov_trace_pc+0x25/0x60
[   29.833348]  ? write_comp_data+0x2f/0x90
[   29.834039]  vfs_write+0x1b6/0x780
[   29.834533]  ? __pfx_sg_write+0x10/0x10
[   29.835074]  ? __sanitizer_cov_trace_pc+0x25/0x60
[   29.835716]  ? write_comp_data+0x2f/0x90
[   29.836256]  ? write_comp_data+0x2f/0x90
[   29.836816]  ksys_write+0x9f/0x170
[   29.837346]  __x64_sys_write+0x27/0x30
[   29.838001]  do_syscall_64+0x3b/0x90
[   29.838530]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[   29.839266] RIP: 0033:0x7f9207bdb59d
[   29.839766] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 8
[   29.842219] RSP: 002b:00007ffe7ecdd768 EFLAGS: 00000213 ORIG_RAX: 0000000000000001
[   29.843335] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9207bdb59d
[   29.844277] RDX: 0000000000000058 RSI: 0000000020000080 RDI: 0000000000000003
[   29.845273] RBP: 00007ffe7ecdd780 R08: 002367732f766564 R09: 00007ffe7ecdd860
[   29.846288] R10: 000000000000000f R11: 0000000000000213 R12: 00000000004010a0
[   29.847228] R13: 00007ffe7ecdd860 R14: 0000000000000000 R15: 0000000000000000
[   29.848182]  </TASK>
[   29.848516] irq event stamp: 4703
[   29.848970] hardirqs last  enabled at (4711): [<ffffffff811d48a1>] __up_console_sem+0x91/0xb0
[   29.850278] hardirqs last disabled at (4720): [<ffffffff811d4886>] __up_console_sem+0x76/0xb0
[   29.851409] softirqs last  enabled at (4336): [<ffffffff82f9c213>] __do_softirq+0x323/0x48a
[   29.852533] softirqs last disabled at (4213): [<ffffffff81123152>] irq_exit_rcu+0xd2/0x100
[   29.853659] ---[ end trace 0000000000000000 ]---
"
Bisected and found that the bad commit is as below:
a41dad905e5a388f88435a517de102e9b2c8e43d
iov_iter: saner checks for attempt to copy to/from iterator

After revert above commit on top of v6.2-rc2 kernel, this issue was gone.

Reproduced code, bisect logs and kconfig info are in link:
https://github.com/xupengfe/syzkaller_logs/tree/main/221228_010310__copy_from_iter/230103_copy_from_iter_v6.2-rc2

I hope it's helpful.

Thanks!
BR.


On 2022-12-30 at 10:33:02 +0800, Pengfei Xu wrote:
> Hi Viro,
> 
> Related email link:
> https://lore.kernel.org/lkml/Y5WlLoCBcHbfKBD5@ZenIV/
> 
> syzbot link:
> https://syzkaller.appspot.com/bug?id=4694bd1c1c0019f067af5b6e14e8ef02431b6b34
> 
> 
> I reproduced on TGL-H with v6.2-rc1 kernel.
> 
> All reproduced code bisect info are in link:
> https://github.com/xupengfe/syzkaller_logs/tree/main/221228_010310__copy_from_iter
> 
> I hope it's helpful.
> 
> Thanks!
> BR.