linux-kernel - Re: [syzbot] [io-uring?] general protection fault in native_tss_update_io

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aace30fd-6cdc-4608-8ca8-0cef74dd1c66@kernel.dk>
Date: Wed, 26 Feb 2025 07:23:34 -0700
From: Jens Axboe <axboe@...nel.dk>
To: syzbot <syzbot+e2b1803445d236442e54@...kaller.appspotmail.com>,
 asml.silence@...il.com, bp@...en8.de, dave.hansen@...ux.intel.com,
 hpa@...or.com, io-uring@...r.kernel.org, linux-kernel@...r.kernel.org,
 mingo@...hat.com, syzkaller-bugs@...glegroups.com, tglx@...utronix.de,
 x86@...nel.org
Subject: Re: [syzbot] [io-uring?] general protection fault in
 native_tss_update_io_bitmap

On 2/25/25 10:56 PM, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    e5d3fd687aac Add linux-next specific files for 20250218
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=13fcd7f8580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=4e945b2fe8e5992f
> dashboard link: https://syzkaller.appspot.com/bug?extid=e2b1803445d236442e54
> compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=149427a4580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11ed06e4580000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/ef079ccd2725/disk-e5d3fd68.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/99f2123d6831/vmlinux-e5d3fd68.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/eadfc9520358/bzImage-e5d3fd68.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+e2b1803445d236442e54@...kaller.appspotmail.com
> 
> Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI
> KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
> CPU: 1 UID: 0 PID: 5891 Comm: iou-sqp-5889 Not tainted 6.14.0-rc3-next-20250218-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
> RIP: 0010:native_tss_update_io_bitmap+0x1f5/0x640 arch/x86/kernel/process.c:471

This doesn't look io_uring related at all, it looks more like something missing
for error injection and early failure handling in the fork path for the x86 io
bitmap handling. Possibly related to PF_IO_WORKER, didn't poke deep enough to
see if it's specific to that or not. Presumably a change slated for 6.15? It's
testing an older linux-next, so also quite possible that this is known and
already fixed, it's a week old.

#syz set subsystems: kernel

-- 
Jens Axboe