linux-kernel - BUG: general protection fault in mtree_range

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CALAgD-5dHowM8+UPOWiSHk-YgKmJBp7KuQBSsPZEqx987zP5yg@mail.gmail.com>
Date: Wed, 28 Aug 2024 17:05:58 -0700
From: Xingyu Li <xli399@....edu>
To: Liam.Howlett@...cle.com, akpm@...ux-foundation.org, 
	maple-tree@...ts.infradead.org, linux-mm@...ck.org, 
	linux-kernel@...r.kernel.org, Yu Hao <yhao016@....edu>
Subject: BUG: general protection fault in mtree_range_walk

Hi,

We found a bug in Linux 6.10 using syzkaller. It is possibly a null
pointer dereference  bug.
The bug report is as follows, but unfortunately there is no generated
syzkaller reproducer.

Bug report:

Oops: general protection fault, probably for non-canonical address
0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 PID: 4493 Comm: systemd-journal Not tainted 6.10.0 #13
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:mtree_range_walk+0x2e4/0x890 lib/maple_tree.c:2774
Code: 48 83 f8 01 0f 84 ba 00 00 00 e8 c7 0f a4 f6 49 83 c4 08 49 ff
c6 48 8b 6c 24 10 eb a7 e8 b4 0f a4 f6 45 31 f6 e9 e5 00 00 00 <41> 80
3c 24 00 74 07 31 ff e8 be 1a 07 f7 4c 8b 2c 25 00 00 00 00
RSP: 0000:ffffc90002cc7c38 EFLAGS: 00010297
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000003 RSI: ffffffff8f0c3620 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000005 R09: ffffffff8aed3fbd
R10: 0000000000000003 R11: ffff8880202fbc00 R12: dffffc0000000000
R13: 0000000000000000 R14: ffffc90002cc7da8 R15: 0000000000000001
FS:  00007f9017010900(0000) GS:ffff888063a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9015c26c20 CR3: 00000000201f4000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 mas_state_walk lib/maple_tree.c:3678 [inline]
 mas_walk+0x7e/0x270 lib/maple_tree.c:4909
 lock_vma_under_rcu+0x22b/0x6d0 mm/memory.c:5841
 do_user_addr_fault+0x2ef/0x1190 arch/x86/mm/fault.c:1329
 handle_page_fault arch/x86/mm/fault.c:1481 [inline]
 exc_page_fault+0x7a/0x120 arch/x86/mm/fault.c:1539
 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7f90177c60be
Code: 40 38 00 00 00 00 4c 89 e8 48 f7 f1 48 8b 85 d8 00 00 00 48 c1
e2 04 48 01 d0 49 89 d5 48 8b 50 08 48 85 d2 0f 85 32 03 00 00 <4c> 89
00 48 8b 85 d8 00 00 00 4e 89 44 28 08 48 8b 85 d0 00 00 00
RSP: 002b:00007fffb2ac0810 EFLAGS: 00010246
RAX: 00007f9015c26c20 RBX: 00007fffb2ac0cf0 RCX: 000000000000acf8
RDX: 0000000000000000 RSI: 3833393d4449505f RDI: 00007f9015f76860
RBP: 000055d12aec0690 R08: 0000000000376820 R09: 0000000000376820
R10: 0000000000000002 R11: 7fffffffffffffff R12: 0000000000000009
R13: 0000000000025630 R14: 0000000000000000 R15: 00007fffb2ac0830
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:mtree_range_walk+0x2e4/0x890 lib/maple_tree.c:2774
Code: 48 83 f8 01 0f 84 ba 00 00 00 e8 c7 0f a4 f6 49 83 c4 08 49 ff
c6 48 8b 6c 24 10 eb a7 e8 b4 0f a4 f6 45 31 f6 e9 e5 00 00 00 <41> 80
3c 24 00 74 07 31 ff e8 be 1a 07 f7 4c 8b 2c 25 00 00 00 00
RSP: 0000:ffffc90002cc7c38 EFLAGS: 00010297
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000003 RSI: ffffffff8f0c3620 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000005 R09: ffffffff8aed3fbd
R10: 0000000000000003 R11: ffff8880202fbc00 R12: dffffc0000000000
R13: 0000000000000000 R14: ffffc90002cc7da8 R15: 0000000000000001
FS:  00007f9017010900(0000) GS:ffff888063a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000563c4dcd61e0 CR3: 00000000201f4000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0: 48 83 f8 01           cmp    $0x1,%rax
   4: 0f 84 ba 00 00 00     je     0xc4
   a: e8 c7 0f a4 f6       call   0xf6a40fd6
   f: 49 83 c4 08           add    $0x8,%r12
  13: 49 ff c6             inc    %r14
  16: 48 8b 6c 24 10       mov    0x10(%rsp),%rbp
  1b: eb a7                 jmp    0xffffffc4
  1d: e8 b4 0f a4 f6       call   0xf6a40fd6
  22: 45 31 f6             xor    %r14d,%r14d
  25: e9 e5 00 00 00       jmp    0x10f
* 2a: 41 80 3c 24 00       cmpb   $0x0,(%r12) <-- trapping instruction
  2f: 74 07                 je     0x38
  31: 31 ff                 xor    %edi,%edi
  33: e8 be 1a 07 f7       call   0xf7071af6
  38: 4c 8b 2c 25 00 00 00 mov    0x0,%r13
  3f: 00


-- 
Yours sincerely,
Xingyu