linux-kernel - Re: [syzbot] [io-uring?] KASAN: null-ptr-deref Read in io_sqe_buffer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1ebd15f2-b709-483b-ac52-2aa0e963454f@redhat.com>
Date: Fri, 5 Sep 2025 08:34:19 +0200
From: David Hildenbrand <david@...hat.com>
To: Andrew Morton <akpm@...ux-foundation.org>, Jens Axboe <axboe@...nel.dk>
Cc: syzbot <syzbot+1ab243d3eebb2aabf4a4@...kaller.appspotmail.com>,
 io-uring@...r.kernel.org, linux-kernel@...r.kernel.org,
 syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [io-uring?] KASAN: null-ptr-deref Read in
 io_sqe_buffer_register

On 05.09.25 05:25, Andrew Morton wrote:
> On Thu, 4 Sep 2025 17:20:41 -0600 Jens Axboe <axboe@...nel.dk> wrote:
> 
>>> ==================================================================
>>
>> This is from the mm-unstable changes in linux-next, adding David as I
>> ran a quick bisect and it said:
>>
>> da6b34293ff8dbb78f8b9278c9a492925bbf1f87 is the first bad commit
>> commit da6b34293ff8dbb78f8b9278c9a492925bbf1f87
>> Author: David Hildenbrand <david@...hat.com>
>> Date:   Mon Sep 1 17:03:40 2025 +0200
>>
>>      mm/gup: remove record_subpages()
>>      
>>      We can just cleanup the code by calculating the #refs earlier, so we can
>>      just inline what remains of record_subpages().
>>      
>>      Calculate the number of references/pages ahead of times, and record them
>>      only once all our tests passed.
>>      
>>      Link: https://lkml.kernel.org/r/20250901150359.867252-20-david@redhat.com
>>      Signed-off-by: David Hildenbrand <david@...hat.com>
>>      Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
>>
>> I won't personally have time to look into this until after the weekend,
>> but as it's linux-next specific, not a huge deal right now.
>>
>> Note that there's also a similar report, which is the same thing:
>>
>> https://lore.kernel.org/all/68b9d130.a00a0220.eb3d.0008.GAE@google.com/
>>
>> which I marked as dupe of this one.
> 
> Thanks.  Seems i can remove that patch without causing merge or build
> damage, so I'll do that.

Thanks, I shall go and figure out what I messed up there. I'll then 
reply to the v2 of the patch with a fixup.

-- 
Cheers

David / dhildenb