Date:   Sat, 11 Feb 2023 08:36:50 -0800
From:   Kees Cook <kees@kernel.org>
To:     syzbot <syzbot+cdd9922704fc75e03ffc@syzkaller.appspotmail.com>,
        akpm@linux-foundation.org, keescook@chromium.org,
        linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org,
        linux-mm@kvack.org, syzkaller-bugs@googlegroups.com,
        io-uring@vger.kernel.org
Subject: Re: [syzbot] BUG: bad usercopy in io_openat2_prep
User-Agent: K-9 Mail for Android
In-Reply-To: <00000000000088b3d905f46ed421@google.com>
References: <00000000000088b3d905f46ed421@google.com>
Message-ID: <B83C9F6F-569B-4DCB-9FFE-45D9B1E32B21@kernel.org>
MIME-Version: 1.0
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On February 11, 2023 8:08:52 AM PST, syzbot <syzbot+cdd9922704fc75e03ffc@sy=
zkaller=2Eappspotmail=2Ecom> wrote:
>Hello,
>
>syzbot found the following issue on:
>
>HEAD commit:    ca72d58361ee Merge branch 'for-next/core' into for-kernel=
ci
>git tree:       git://git=2Ekernel=2Eorg/pub/scm/linux/kernel/git/arm64/l=
inux=2Egit for-kernelci
>console output: https://syzkaller=2Eappspot=2Ecom/x/log=2Etxt?x=3D14a882f=
3480000
>kernel config:  https://syzkaller=2Eappspot=2Ecom/x/=2Econfig?x=3Df3e7823=
2c1ed2b43
>dashboard link: https://syzkaller=2Eappspot=2Ecom/bug?extid=3Dcdd9922704f=
c75e03ffc
>compiler:       Debian clang version 15=2E0=2E7, GNU ld (GNU Binutils for=
 Debian) 2=2E35=2E2
>userspace arch: arm64
>syz repro:      https://syzkaller=2Eappspot=2Ecom/x/repro=2Esyz?x=3D12037=
77b480000
>C reproducer:   https://syzkaller=2Eappspot=2Ecom/x/repro=2Ec?x=3D124c1ea=
3480000
>
>Downloadable assets:
>disk image: https://storage=2Egoogleapis=2Ecom/syzbot-assets/e2c91688b4cd=
/disk-ca72d583=2Eraw=2Exz
>vmlinux: https://storage=2Egoogleapis=2Ecom/syzbot-assets/af105438bee6/vm=
linux-ca72d583=2Exz
>kernel image: https://storage=2Egoogleapis=2Ecom/syzbot-assets/4a28ec4f8f=
7e/Image-ca72d583=2Egz=2Exz
>
>IMPORTANT: if you fix the issue, please add the following tag to the comm=
it:
>Reported-by: syzbot+cdd9922704fc75e03ffc@syzkaller=2Eappspotmail=2Ecom
>
>usercopy: Kernel memory overwrite attempt detected to SLUB object 'pid' (=
offset 24, size 24)!

This looks like some serious memory corruption=2E The pid slab is 24 bytes=
 in size, but struct io_open is larger=2E=2E=2E Possible UAF after the memo=
ry being reallocated to a new slab??

-Kees

> [=2E=2E=2E]
>Call trace:
> usercopy_abort+0x90/0x94
> __check_heap_object+0xa8/0x100
> __check_object_size+0x208/0x6b8
> io_openat2_prep+0xcc/0x2b8
> io_submit_sqes+0x338/0xbb8
> __arm64_sys_io_uring_enter+0x168/0x1308
> invoke_syscall+0x64/0x178
> el0_svc_common+0xbc/0x180
> do_el0_svc+0x48/0x110
> el0_svc+0x58/0x14c
> el0t_64_sync_handler+0x84/0xf0
> el0t_64_sync+0x190/0x194


--=20
Kees Cook