Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
From:   Jiacheng Xu <578001344xu@gmail.com>
Date:   Wed, 17 Aug 2022 00:10:09 +0800
Message-ID: <CAO4S-mdVW5GkODk0+vbQexNAAJZopwzFJ9ACvRCJ989fQ4A6Ow@mail.gmail.com>
Subject: KASAN: null-ptr-deref Write in io_file_get_normal
To:     linux-kernel@vger.kernel.org, axboe@kernel.dk,
        asml.silence@gmail.co
Cc:     io-uring@vger.kernel.org, security@kernel.org
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

Hello,

When using modified Syzkaller to fuzz the Linux kernel-5.15.58, the
following crash was triggered.

HEAD commit: 568035b01cfb Linux-5.15.58
git tree: upstream

console output:
https://drive.google.com/file/d/1lW1tGegMXfLgS1gfyWmZShhX7LOx3vFJ/view?usp=sharing
kernel config: https://drive.google.com/file/d/1wgIUDwP5ho29AM-K7HhysSTfWFpfXYkG/view?usp=sharing
syz repro: https://drive.google.com/file/d/13l2TaalviEK6WBoXjF4tAiYfSUmlzstU/view?usp=sharing
C reproducer: https://drive.google.com/file/d/1iHOn1jRiQs4iKxxRTDZcATyJcZlVFQqR/view?usp=sharing

There is a similar problem: https://www.spinics.net/lists/io-uring/msg13047.html

Environment:
Ubuntu 20.04 on Linux 5.4.0
QEMU 4.2.1:
qemu-system-x86_64 \
  -m 2G \
  -smp 2 \
  -kernel /home/workdir/bzImage \
  -append "console=ttyS0 root=/dev/sda earlyprintk=serial net.ifnames=0" \
  -drive file=/home/workdir/stretch.img,format=raw \
  -net user,host=10.0.2.10,hostfwd=tcp:127.0.0.1:10021-:22 \
  -net nic,model=e1000 \
  -enable-kvm \
  -nographic \
  -pidfile vm.pid \
  2>&1 | tee vm.log

If you fix this issue, please add the following tag to the commit:
Reported-by:  Jiacheng Xu<stitch@zju.edu.cn>

==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read_write
include/linux/instrumented.h:101 [inline]
BUG: KASAN: null-ptr-deref in atomic_inc
include/linux/atomic/atomic-instrumented.h:181 [inline]
BUG: KASAN: null-ptr-deref in io_req_track_inflight fs/io_uring.c:1408 [inline]
BUG: KASAN: null-ptr-deref in io_file_get_normal+0x318/0x340 fs/io_uring.c:6934
Write of size 4 at addr 0000000000000118 by task iou-wrk-13680/13681

CPU: 3 PID: 13681 Comm: iou-wrk-13680 Not tainted 5.15.58 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106
 __kasan_report mm/kasan/report.c:446 [inline]
 kasan_report.cold+0x66/0xdf mm/kasan/report.c:459
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0x14e/0x1b0 mm/kasan/generic.c:189
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 atomic_inc include/linux/atomic/atomic-instrumented.h:181 [inline]
 io_req_track_inflight fs/io_uring.c:1408 [inline]
 io_file_get_normal+0x318/0x340 fs/io_uring.c:6934
 io_file_get fs/io_uring.c:6944 [inline]
 io_tee fs/io_uring.c:4051 [inline]
 io_issue_sqe+0x4ad9/0x7540 fs/io_uring.c:6797
 io_wq_submit_work+0x1bc/0x390 fs/io_uring.c:6863
 io_worker_handle_work+0x97c/0x1710 fs/io-wq.c:576
 io_wqe_worker+0x5b1/0xd30 fs/io-wq.c:630
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
 </TASK>
==================================================================
Kernel panic - not syncing: panic_on_warn set ...
CPU: 2 PID: 13681 Comm: iou-wrk-13680 Tainted: G    B             5.15.58 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106
 panic+0x2b0/0x6dd kernel/panic.c:232
 end_report mm/kasan/report.c:128 [inline]
 end_report.cold+0x63/0x6f mm/kasan/report.c:113
 __kasan_report mm/kasan/report.c:449 [inline]
 kasan_report.cold+0x71/0xdf mm/kasan/report.c:459
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0x14e/0x1b0 mm/kasan/generic.c:189
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 atomic_inc include/linux/atomic/atomic-instrumented.h:181 [inline]
 io_req_track_inflight fs/io_uring.c:1408 [inline]
 io_file_get_normal+0x318/0x340 fs/io_uring.c:6934
 io_file_get fs/io_uring.c:6944 [inline]
 io_tee fs/io_uring.c:4051 [inline]
 io_issue_sqe+0x4ad9/0x7540 fs/io_uring.c:6797
 io_wq_submit_work+0x1bc/0x390 fs/io_uring.c:6863
 io_worker_handle_work+0x97c/0x1710 fs/io-wq.c:576
 io_wqe_worker+0x5b1/0xd30 fs/io-wq.c:630
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
 </TASK>