linux-kernel - KASAN: null-ptr-deref Write in tctx_task_work

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 18 Mar 2024 08:59:09 +0800
From: "Ubisectech Sirius" <bugreport@...sectech.com>
To: "linux-kernel" <linux-kernel@...r.kernel.org>,
  "linux-trace-kernel" <linux-trace-kernel@...r.kernel.org>
Cc: "axboe" <axboe@...nel.dk>
Subject: KASAN: null-ptr-deref Write in tctx_task_work_run

Hello.
We are Ubisectech Sirius Team, the vulnerability lab of China ValiantSec. Recently, our team has discovered a issue in Linux kernel 6.8.0-ge5e038b7ae9d. Attached to the email were a POC file of the issue.

Stack dump:

==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: null-ptr-deref in llist_del_all include/linux/llist.h:266 [inline]
BUG: KASAN: null-ptr-deref in tctx_task_work_run+0x7d/0x330 io_uring/io_uring.c:1267
Write of size 8 at addr 00000000000001c0 by task iou-sqp-215603/215604

CPU: 0 PID: 215604 Comm: iou-sqp-215603 Not tainted 6.8.0-ge5e038b7ae9d #40
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:114
 kasan_report+0xbd/0xf0 mm/kasan/report.c:601
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0xf4/0x1a0 mm/kasan/generic.c:189
 instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
 llist_del_all include/linux/llist.h:266 [inline]
 tctx_task_work_run+0x7d/0x330 io_uring/io_uring.c:1267
 io_sq_tw+0x12a/0x1d0 io_uring/sqpoll.c:245
 io_sq_thread+0x8d7/0x18a0 io_uring/sqpoll.c:308
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
 </TASK>
==================================================================
Kernel panic - not syncing: KASAN: panic_on_warn set ...
CPU: 0 PID: 215604 Comm: iou-sqp-215603 Not tainted 6.8.0-ge5e038b7ae9d #40
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x3d/0x1b0 lib/dump_stack.c:114
 panic+0x6d2/0x780 kernel/panic.c:344
 check_panic_on_warn+0xb1/0xc0 kernel/panic.c:237
 end_report+0x107/0x150 mm/kasan/report.c:226
 kasan_report+0xcd/0xf0 mm/kasan/report.c:603
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0xf4/0x1a0 mm/kasan/generic.c:189
 instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
 llist_del_all include/linux/llist.h:266 [inline]
 tctx_task_work_run+0x7d/0x330 io_uring/io_uring.c:1267
 io_sq_tw+0x12a/0x1d0 io_uring/sqpoll.c:245
 io_sq_thread+0x8d7/0x18a0 io_uring/sqpoll.c:308
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
 </TASK>
Kernel Offset: disabled
Rebooting in 86400 seconds..

Thank you for taking the time to read this email and we look forward to working with you further.

Download attachment "poc.c" of type "application/octet-stream" (7061 bytes)