lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <fab71bfa-7657-4379-8c79-1f92766a7b17@gmail.com>
Date: Sat, 16 Mar 2024 15:28:57 +0000
From: Pavel Begunkov <asml.silence@...il.com>
To: syzbot <syzbot+f8e9a371388aa62ecab4@...kaller.appspotmail.com>,
 axboe@...nel.dk, io-uring@...r.kernel.org, linux-kernel@...r.kernel.org,
 syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [io-uring?] KMSAN: uninit-value in io_sendrecv_fail

On 3/16/24 13:37, syzbot wrote:
> Hello,
> 
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> KMSAN: uninit-value in io_sendrecv_fail

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 3ae4bb988906..826989e2f601 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -1063,6 +1063,7 @@ static void io_preinit_req(struct io_kiocb *req, struct io_ring_ctx *ctx)
  	/* not necessary, but safer to zero */
  	memset(&req->cqe, 0, sizeof(req->cqe));
  	memset(&req->big_cqe, 0, sizeof(req->big_cqe));
+	memset(&req->cmd, 0, sizeof(req->cmd));
  }

What's the point of testing it? You said it yourself, it hides the
problem under the carpet but doesn't solve it. Do some valid IO first,
then send that failed request. If done_io is aliased with with some
interesting field of a previously completed request you're royally
screwed, but syz would be just happy about it.

It's likely that syz is complaining about is the early fail case
I told about yesterday.


> =====================================================
> BUG: KMSAN: uninit-value in io_sendrecv_fail+0x91/0x1e0 io_uring/net.c:1341
>   io_sendrecv_fail+0x91/0x1e0 io_uring/net.c:1341
>   io_req_defer_failed+0x3bd/0x610 io_uring/io_uring.c:1050
>   io_queue_sqe_fallback+0x1e3/0x280 io_uring/io_uring.c:2126
>   io_submit_fail_init+0x4e1/0x790 io_uring/io_uring.c:2304
>   io_submit_sqes+0x19cd/0x2fb0 io_uring/io_uring.c:2480
>   __do_sys_io_uring_enter io_uring/io_uring.c:3656 [inline]
>   __se_sys_io_uring_enter+0x409/0x4390 io_uring/io_uring.c:3591
>   __x64_sys_io_uring_enter+0x11b/0x1a0 io_uring/io_uring.c:3591
>   do_syscall_x64 arch/x86/entry/common.c:52 [inline]
>   do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
>   entry_SYSCALL_64_after_hwframe+0x63/0x6b
> 
> Uninit was created at:
>   __alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4592
>   __alloc_pages_node include/linux/gfp.h:238 [inline]
>   alloc_pages_node include/linux/gfp.h:261 [inline]
>   alloc_slab_page mm/slub.c:2190 [inline]
>   allocate_slab mm/slub.c:2354 [inline]
>   new_slab+0x2d7/0x1400 mm/slub.c:2407
>   ___slab_alloc+0x16b5/0x3970 mm/slub.c:3540
>   __kmem_cache_alloc_bulk mm/slub.c:4574 [inline]
>   kmem_cache_alloc_bulk+0x52a/0x1440 mm/slub.c:4648
>   __io_alloc_req_refill+0x248/0x780 io_uring/io_uring.c:1101
>   io_alloc_req io_uring/io_uring.h:405 [inline]
>   io_submit_sqes+0xaa1/0x2fb0 io_uring/io_uring.c:2469
>   __do_sys_io_uring_enter io_uring/io_uring.c:3656 [inline]
>   __se_sys_io_uring_enter+0x409/0x4390 io_uring/io_uring.c:3591
>   __x64_sys_io_uring_enter+0x11b/0x1a0 io_uring/io_uring.c:3591
>   do_syscall_x64 arch/x86/entry/common.c:52 [inline]
>   do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
>   entry_SYSCALL_64_after_hwframe+0x63/0x6b
> 
> CPU: 0 PID: 5482 Comm: syz-executor.0 Not tainted 6.8.0-syzkaller-00721-g6c677dd4eac2 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
> =====================================================
> 
> 
> Tested on:
> 
> commit:         6c677dd4 io_uring/net: ensure async prep handlers alwa..
> git tree:       git://git.kernel.dk/linux.git io_uring-6.9
> console output: https://syzkaller.appspot.com/x/log.txt?x=17f26711180000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=a271c5dca0ff14df
> dashboard link: https://syzkaller.appspot.com/bug?extid=f8e9a371388aa62ecab4
> compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> 
> Note: no patches were applied.

-- 
Pavel Begunkov

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ