linux-kernel - Re: [syzbot] [kernel?] KASAN: slab-use-after-free Read in thread_group

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ccecc088-087e-48fb-a963-e37b439597d1@gmail.com>
Date: Fri, 10 Jan 2025 14:14:53 +0000
From: Pavel Begunkov <asml.silence@...il.com>
To: Dmitry Vyukov <dvyukov@...gle.com>,
 syzbot <syzbot+3d92cfcfa84070b0a470@...kaller.appspotmail.com>,
 Jens Axboe <axboe@...nel.dk>, io-uring@...r.kernel.org
Cc: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [kernel?] KASAN: slab-use-after-free Read in
 thread_group_cputime

On 1/10/25 13:56, Dmitry Vyukov wrote:
> On Fri, 10 Jan 2025 at 14:51, syzbot
> <syzbot+3d92cfcfa84070b0a470@...kaller.appspotmail.com> wrote:
>>
>> Hello,
>>
>> syzbot found the following issue on:
>>
>> HEAD commit:    ccb98ccef0e5 Merge tag 'platform-drivers-x86-v6.13-4' of g..
>> git tree:       upstream
>> console output: https://syzkaller.appspot.com/x/log.txt?x=1377fac4580000
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=1c541fa8af5c9cc7
>> dashboard link: https://syzkaller.appspot.com/bug?extid=3d92cfcfa84070b0a470
>> compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
>>
>> Unfortunately, I don't have any reproducer for this issue yet.
>>
>> Downloadable assets:
>> disk image: https://storage.googleapis.com/syzbot-assets/6e96673b1b94/disk-ccb98cce.raw.xz
>> vmlinux: https://storage.googleapis.com/syzbot-assets/528385411880/vmlinux-ccb98cce.xz
>> kernel image: https://storage.googleapis.com/syzbot-assets/b061a4d50538/bzImage-ccb98cce.xz
>>
>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> Reported-by: syzbot+3d92cfcfa84070b0a470@...kaller.appspotmail.com
>>
>> ==================================================================
>> BUG: KASAN: slab-use-after-free in thread_group_cputime+0x409/0x700 kernel/sched/cputime.c:341
>> Read of size 8 at addr ffff88803578c510 by task syz.2.3223/27552
>>
>> CPU: 1 UID: 0 PID: 27552 Comm: syz.2.3223 Not tainted 6.13.0-rc5-syzkaller-00004-gccb98ccef0e5 #0
>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
>> Call Trace:
>>   <TASK>
>>   __dump_stack lib/dump_stack.c:94 [inline]
>>   dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
>>   print_address_description mm/kasan/report.c:378 [inline]
>>   print_report+0x169/0x550 mm/kasan/report.c:489
>>   kasan_report+0x143/0x180 mm/kasan/report.c:602
>>   thread_group_cputime+0x409/0x700 kernel/sched/cputime.c:341
>>   thread_group_cputime_adjusted+0xa6/0x340 kernel/sched/cputime.c:639
>>   getrusage+0x1000/0x1340 kernel/sys.c:1863
>>   io_uring_show_fdinfo+0xdfe/0x1770 io_uring/fdinfo.c:197
> 
> This looks to be more likely an io-uring issue rather than cputime.c
> 
> #syz set subsystems: io-uring
> 
> +maintainers


Thanks. It probably needs something like below.

diff --git a/io_uring/sqpoll.c b/io_uring/sqpoll.c
index 6df5e649c413..5768e31e99b1 100644
--- a/io_uring/sqpoll.c
+++ b/io_uring/sqpoll.c
@@ -268,8 +268,12 @@ static int io_sq_thread(void *data)
  	DEFINE_WAIT(wait);
  
  	/* offload context creation failed, just exit */
-	if (!current->io_uring)
+	if (!current->io_uring) {
+		mutex_lock(&sqd->lock);
+		sqd->thread = NULL;
+		mutex_unlock(&sqd->lock);
  		goto err_out;
+	}
  
  	snprintf(buf, sizeof(buf), "iou-sqp-%d", sqd->task_pid);
  	set_task_comm(current, buf);

--
Pavel Begunkov