linux-kernel - Re: [io-uring] general protection fault in io_register_clone

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CADZouDRVN0eVMNXDPX9vSGXYbOPSHRgspWz20VO4fzNeFq18ew@mail.gmail.com>
Date: Fri, 13 Dec 2024 10:39:24 +0100
From: chase xd <sl1589472800@...il.com>
To: Jens Axboe <axboe@...nel.dk>
Cc: Pavel Begunkov <asml.silence@...il.com>, io-uring@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Subject: Re: [io-uring] general protection fault in io_register_clone_buffers

Sure, I'm glad I could help. The kernel no longer crashes after this
patch, so it seems to be the right fix.

On Thu, Dec 12, 2024 at 3:58 PM Jens Axboe <axboe@...nel.dk> wrote:
>
> On 12/12/24 3:06 AM, chase xd wrote:
> > Syzkaller hit 'general protection fault in io_register_clone_buffers' bug.
> >
> > Oops: general protection fault, probably for non-canonical address
> > 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN NOPTI
> > KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
> > CPU: 5 UID: 0 PID: 12910 Comm: syz-executor169 Not tainted
> > 6.12.0-rc4-00089-g7eb75ce75271-dirty #7
> > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> > RIP: 0010:io_clone_buffers io_uring/rsrc.c:1039 [inline]
> > RIP: 0010:io_register_clone_buffers+0xbb1/0xf40 io_uring/rsrc.c:1076
> > Code: 48 63 c3 41 89 dd 4c 8d 3c c6 4c 89 fa 48 c1 ea 03 42 80 3c 22
> > 00 0f 85 61 02 00 00 49 8b 17 48 8d 7a 10 48 89 f9 48 c1 e9 03 <42> 80
> > 3c 21 00 0f 85 62 02 00 00 48 8b 72 10 4c 89 f7 e8 b8 93 ff
> > RSP: 0018:ffffc90011047bd8 EFLAGS: 00010212
> > RAX: 0000000000000001 RBX: 0000000000000001 RCX: 0000000000000002
> > RDX: 0000000000000000 RSI: ffff888017acfec0 RDI: 0000000000000010
> > RBP: ffffc90011047d28 R08: 0000000000000000 R09: fffffbfff1dbb731
> > R10: 0000000000000002 R11: 0000000000000000 R12: dffffc0000000000
> > R13: 0000000000000001 R14: ffff888021760000 R15: ffff888017acfec8
> > FS:  00007fcbf80f4640(0000) GS:ffff88823bf00000(0000) knlGS:0000000000000000
> > CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > CR2: 00007fcbf806e658 CR3: 000000002420a000 CR4: 0000000000750ef0
> > PKRU: 55555554
> > Call Trace:
> >  <TASK>
> >  __io_uring_register+0x922/0x2290 io_uring/register.c:804
> >  __do_sys_io_uring_register io_uring/register.c:907 [inline]
> >  __se_sys_io_uring_register io_uring/register.c:884 [inline]
> >  __x64_sys_io_uring_register+0x178/0x2b0 io_uring/register.c:884
> >  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> >  do_syscall_64+0xcb/0x250 arch/x86/entry/common.c:83
> >  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > RIP: 0033:0x7fcbf815322d
> > Code: c3 e8 77 24 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48
> > 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
> > 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
> > RSP: 002b:00007fcbf80f41a8 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab
> > RAX: ffffffffffffffda RBX: 00007fcbf81f5088 RCX: 00007fcbf815322d
> > RDX: 0000000020000600 RSI: 000000000000001e RDI: 0000000000000004
> > RBP: 00007fcbf81f5080 R08: 0000000000000000 R09: 0000000000000000
> > R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000c90
> > R13: 0000000000000003 R14: 00007fcbf811a630 R15: 00007fcbf80d4000
> >  </TASK>
> > Modules linked in:
> > ---[ end trace 0000000000000000 ]---
> > RIP: 0010:io_clone_buffers io_uring/rsrc.c:1039 [inline]
> > RIP: 0010:io_register_clone_buffers+0xbb1/0xf40 io_uring/rsrc.c:1076
>
> I can't run these crazy syzbot reproducers, I do wish they'd be dwindled
> down to the bare minimum rather than have tons of unrelated bits in
> there. That said, can you check with this patch?
>
> diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
> index adaae8630932..077f84684c18 100644
> --- a/io_uring/rsrc.c
> +++ b/io_uring/rsrc.c
> @@ -1036,8 +1036,10 @@ static int io_clone_buffers(struct io_ring_ctx *ctx, struct io_ring_ctx *src_ctx
>  out_put_free:
>         i = data.nr;
>         while (i--) {
> -               io_buffer_unmap(src_ctx, data.nodes[i]);
> -               kfree(data.nodes[i]);
> +               if (data.nodes[i]) {
> +                       io_buffer_unmap(src_ctx, data.nodes[i]);
> +                       kfree(data.nodes[i]);
> +               }
>         }
>  out_unlock:
>         io_rsrc_data_free(ctx, &data);
>
> --
> Jens Axboe