linux-kernel - Re: [syzbot] [io-uring?] KASAN: global-out-of-bounds Read in io_uring_show

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e5e294fd-6874-46b9-9d85-f5fd5fc12f03@kernel.dk>
Date: Thu, 30 Oct 2025 17:02:04 -0600
From: Jens Axboe <axboe@...nel.dk>
To: syzbot <syzbot+b883b008a0b1067d5833@...kaller.appspotmail.com>,
 io-uring@...r.kernel.org, kbusch@...nel.org, linux-kernel@...r.kernel.org,
 syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [io-uring?] KASAN: global-out-of-bounds Read in
 io_uring_show_fdinfo

On 10/30/25 4:34 PM, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    f9ba12abc528 Add linux-next specific files for 20251029
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=16493fe2580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=32e95de7031f410d
> dashboard link: https://syzkaller.appspot.com/bug?extid=b883b008a0b1067d5833
> compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15729258580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=10988e14580000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/7b5f5194573e/disk-f9ba12ab.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/83dabfc9c13b/vmlinux-f9ba12ab.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/7e62a1d361f0/bzImage-f9ba12ab.xz
> 
> The issue was bisected to:
> 
> commit 101e596e7404d07a85b38358a392009503aad797
> Author: Jens Axboe <axboe@...nel.dk>
> Date:   Tue Oct 28 01:09:28 2025 +0000
> 
>     io_uring/fdinfo: cap SQ iteration at max SQ entries

Don't think that's right, it's more like:

commit 1cba30bf9fdd6c982708f3587f609a30c370d889
Author: Keith Busch <kbusch@...nel.org>
Date:   Thu Oct 16 11:09:38 2025 -0700

    io_uring: add support for IORING_SETUP_SQE_MIXED

as it looks like 'opcode' is invalid, and hence it's reading beyond the end
of the io_issue_defs[] array.

Something like this should fix it:

diff --git a/io_uring/fdinfo.c b/io_uring/fdinfo.c
index 3f254ae0ad61..bd8251832320 100644
--- a/io_uring/fdinfo.c
+++ b/io_uring/fdinfo.c
@@ -106,6 +106,8 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m)
 
 		sqe = &ctx->sq_sqes[sq_idx << sq_shift];
 		opcode = READ_ONCE(sqe->opcode);
+		if (opcode >= IORING_OP_LAST)
+			continue;
 		if (sq_shift) {
 			sqe128 = true;
 		} else if (io_issue_defs[opcode].is_128) {

-- 
Jens Axboe