Syzkaller hit 'KASAN: stack-out-of-bounds Read in iov_iter_revert seen on linux-next' bug. [ 48.873627] ================================================================== [ 48.874876] BUG: KASAN: stack-out-of-bounds in iov_iter_revert+0x827/0x8f0 [ 48.875872] Read of size 8 at addr ffff88802225f7e0 by task a.out/379 [ 48.876962] CPU: 1 PID: 379 Comm: a.out Not tainted 5.10.52 #1 [ 48.877736] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 48.879298] Call Trace: [ 48.879637] dump_stack+0x107/0x163 [ 48.880112] ? iov_iter_revert+0x827/0x8f0 [ 48.880624] ? iov_iter_revert+0x827/0x8f0 [ 48.881174] print_address_description.constprop.0+0x1c/0x210 [ 48.881923] ? ext4_file_write_iter+0x4f6/0x1890 [ 48.882563] ? vprintk_func+0x93/0x140 [ 48.883072] ? iov_iter_revert+0x827/0x8f0 [ 48.883604] ? iov_iter_revert+0x827/0x8f0 [ 48.884124] kasan_report.cold+0x37/0x7c [ 48.884614] ? iov_iter_revert+0x827/0x8f0 [ 48.885153] iov_iter_revert+0x827/0x8f0 [ 48.885674] io_write+0x651/0xdf0 [ 48.886105] ? ext4_file_read_iter+0x4c0/0x4c0 [ 48.886725] ? io_read+0xe60/0xe60 [ 48.887189] ? lock_chain_count+0x20/0x20 [ 48.887733] ? stack_trace_save+0x8c/0xc0 [ 48.888264] ? trace_hardirqs_on+0x5b/0x180 [ 48.888842] ? find_first_zero_bit+0x94/0xb0 [ 48.889380] ? add_lock_to_list.constprop.0+0x68/0x4f0 [ 48.890006] ? __lock_acquire+0xbc2/0x5b20 [ 48.890564] io_issue_sqe+0x1b40/0x3c40 [ 48.891120] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 48.891872] ? mark_lock+0xf5/0x2df0 [ 48.892376] ? io_connect+0x540/0x540 [ 48.892927] ? find_held_lock+0x2c/0x110 [ 48.893496] __io_queue_sqe+0x204/0xd00 [ 48.894064] ? io_issue_sqe+0x3c40/0x3c40 [ 48.894659] ? __io_splice_prep+0x530/0x530 [ 48.895273] ? __fget_files+0x251/0x410 [ 48.895841] io_queue_sqe+0x5bc/0x1020 [ 48.896398] io_submit_sqes+0x130d/0x2310 [ 48.896995] ? io_queue_sqe+0x1020/0x1020 [ 48.897582] ? __do_sys_io_uring_enter+0x1087/0x1910 [ 48.898279] ? mutex_lock_io_nested+0x10f0/0x10f0 [ 48.898984] ? xa_load+0x158/0x290 [ 48.899482] ? xas_find_conflict+0x9e0/0x9e0 [ 48.900106] __do_sys_io_uring_enter+0x1092/0x1910 [ 48.900820] ? randomize_stack_top+0x100/0x100 [ 48.901455] ? io_sq_thread+0x1640/0x1640 [ 48.902034] ? fput_many+0x2f/0x1a0 [ 48.902574] ? ksys_mmap_pgoff+0xe6/0x570 [ 48.903150] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 [ 48.903895] ? syscall_enter_from_user_mode+0x1d/0x50 [ 48.904617] do_syscall_64+0x33/0x40 [ 48.905155] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 48.905892] RIP: 0033:0x7ff074aca469 [ 48.906399] Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ff 49 2b 00 f7 d8 64 89 01 48 [ 48.909045] RSP: 002b:00007ffff95334f8 EFLAGS: 00000212 ORIG_RAX: 00000000000001aa [ 48.910150] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff074aca469 [ 48.911217] RDX: 0000000000000000 RSI: 00000000000058ab RDI: 0000000000000003 [ 48.912285] RBP: 00007ffff9533520 R08: 0000000000000000 R09: 0000000000000000 [ 48.913292] R10: 0000000000000000 R11: 0000000000000212 R12: 000055f7a3a00f20 [ 48.914276] R13: 00007ffff9533660 R14: 0000000000000000 R15: 0000000000000000 [ 48.915639] The buggy address belongs to the page: [ 48.916392] page:000000006825f5eb refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2225f [ 48.917795] flags: 0x100000000000000() [ 48.918420] raw: 0100000000000000 ffffea00008897c8 ffffea00008897c8 0000000000000000 [ 48.919739] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 48.920940] page dumped because: kasan: bad access detected [ 48.921961] addr ffff88802225f7e0 is located in stack of task a.out/379 at offset 152 in frame: [ 48.923132] io_write+0x0/0xdf0 [ 48.923793] this frame has 3 objects: [ 48.924377] [48, 56) 'iovec' [ 48.924386] [80, 120) '__iter' [ 48.924866] [160, 288) 'inline_vecs' [ 48.926186] Memory state around the buggy address: [ 48.926958] ffff88802225f680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 48.928094] ffff88802225f700: 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 [ 48.929259] >ffff88802225f780: f2 f2 f2 00 00 00 00 00 f2 f2 f2 f2 f2 00 00 00 [ 48.930392] ^ [ 48.931416] ffff88802225f800: 00 00 00 00 00 00 00 00 00 00 00 00 00 f3 f3 f3 [ 48.932441] ffff88802225f880: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 48.933597] ================================================================== Syzkaller reproducer: # {Threaded:false Collide:false Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox:none Fault:false FaultCall:-1 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false UseTmpDir:false HandleSegv:false Repro:false Trace:false} r0 = syz_io_uring_setup(0x4d4f, &(0x7f0000000080)={0x0, 0x0, 0x1}, &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000000)=0x0, &(0x7f0000000140)) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x46e2, 0x0) syz_io_uring_setup(0x1, &(0x7f0000000080), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000100)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r2, 0x0, &(0x7f0000000200)="e2", 0xffffffffffffff98}, 0x200) io_uring_enter(r0, 0x58ab, 0x0, 0x0, 0x0, 0x0) C reproducer: // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static unsigned long long procid; static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } #define SIZEOF_IO_URING_SQE 64 #define SIZEOF_IO_URING_CQE 16 #define SQ_HEAD_OFFSET 0 #define SQ_TAIL_OFFSET 64 #define SQ_RING_MASK_OFFSET 256 #define SQ_RING_ENTRIES_OFFSET 264 #define SQ_FLAGS_OFFSET 276 #define SQ_DROPPED_OFFSET 272 #define CQ_HEAD_OFFSET 128 #define CQ_TAIL_OFFSET 192 #define CQ_RING_MASK_OFFSET 260 #define CQ_RING_ENTRIES_OFFSET 268 #define CQ_RING_OVERFLOW_OFFSET 284 #define CQ_FLAGS_OFFSET 280 #define CQ_CQES_OFFSET 320 struct io_sqring_offsets { uint32_t head; uint32_t tail; uint32_t ring_mask; uint32_t ring_entries; uint32_t flags; uint32_t dropped; uint32_t array; uint32_t resv1; uint64_t resv2; }; struct io_cqring_offsets { uint32_t head; uint32_t tail; uint32_t ring_mask; uint32_t ring_entries; uint32_t overflow; uint32_t cqes; uint64_t resv[2]; }; struct io_uring_params { uint32_t sq_entries; uint32_t cq_entries; uint32_t flags; uint32_t sq_thread_cpu; uint32_t sq_thread_idle; uint32_t features; uint32_t resv[4]; struct io_sqring_offsets sq_off; struct io_cqring_offsets cq_off; }; #define IORING_OFF_SQ_RING 0 #define IORING_OFF_SQES 0x10000000ULL #define sys_io_uring_setup 425 static long syz_io_uring_setup(volatile long a0, volatile long a1, volatile long a2, volatile long a3, volatile long a4, volatile long a5) { uint32_t entries = (uint32_t)a0; struct io_uring_params* setup_params = (struct io_uring_params*)a1; void* vma1 = (void*)a2; void* vma2 = (void*)a3; void** ring_ptr_out = (void**)a4; void** sqes_ptr_out = (void**)a5; uint32_t fd_io_uring = syscall(sys_io_uring_setup, entries, setup_params); uint32_t sq_ring_sz = setup_params->sq_off.array + setup_params->sq_entries * sizeof(uint32_t); uint32_t cq_ring_sz = setup_params->cq_off.cqes + setup_params->cq_entries * SIZEOF_IO_URING_CQE; uint32_t ring_sz = sq_ring_sz > cq_ring_sz ? sq_ring_sz : cq_ring_sz; *ring_ptr_out = mmap(vma1, ring_sz, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring, IORING_OFF_SQ_RING); uint32_t sqes_sz = setup_params->sq_entries * SIZEOF_IO_URING_SQE; *sqes_ptr_out = mmap(vma2, sqes_sz, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring, IORING_OFF_SQES); return fd_io_uring; } static long syz_io_uring_submit(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { char* ring_ptr = (char*)a0; char* sqes_ptr = (char*)a1; char* sqe = (char*)a2; uint32_t sqes_index = (uint32_t)a3; uint32_t sq_ring_entries = *(uint32_t*)(ring_ptr + SQ_RING_ENTRIES_OFFSET); uint32_t cq_ring_entries = *(uint32_t*)(ring_ptr + CQ_RING_ENTRIES_OFFSET); uint32_t sq_array_off = (CQ_CQES_OFFSET + cq_ring_entries * SIZEOF_IO_URING_CQE + 63) & ~63; if (sq_ring_entries) sqes_index %= sq_ring_entries; char* sqe_dest = sqes_ptr + sqes_index * SIZEOF_IO_URING_SQE; memcpy(sqe_dest, sqe, SIZEOF_IO_URING_SQE); uint32_t sq_ring_mask = *(uint32_t*)(ring_ptr + SQ_RING_MASK_OFFSET); uint32_t* sq_tail_ptr = (uint32_t*)(ring_ptr + SQ_TAIL_OFFSET); uint32_t sq_tail = *sq_tail_ptr & sq_ring_mask; uint32_t sq_tail_next = *sq_tail_ptr + 1; uint32_t* sq_array = (uint32_t*)(ring_ptr + sq_array_off); *(sq_array + sq_tail) = sqes_index; __atomic_store_n(sq_tail_ptr, sq_tail_next, __ATOMIC_RELEASE); return 0; } #define MAX_FDS 30 static void setup_common() { if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) { } } static void loop(); static void sandbox_common() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setsid(); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = (200 << 20); setrlimit(RLIMIT_AS, &rlim); rlim.rlim_cur = rlim.rlim_max = 32 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 136 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 0; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); if (unshare(CLONE_NEWNS)) { } if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) { } if (unshare(CLONE_NEWIPC)) { } if (unshare(0x02000000)) { } if (unshare(CLONE_NEWUTS)) { } if (unshare(CLONE_SYSVSEM)) { } typedef struct { const char* name; const char* value; } sysctl_t; static const sysctl_t sysctls[] = { {"/proc/sys/kernel/shmmax", "16777216"}, {"/proc/sys/kernel/shmall", "536870912"}, {"/proc/sys/kernel/shmmni", "1024"}, {"/proc/sys/kernel/msgmax", "8192"}, {"/proc/sys/kernel/msgmni", "1024"}, {"/proc/sys/kernel/msgmnb", "1024"}, {"/proc/sys/kernel/sem", "1024 1048576 500 1024"}, }; unsigned i; for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++) write_file(sysctls[i].name, sysctls[i].value); } static int wait_for_loop(int pid) { if (pid < 0) exit(1); int status = 0; while (waitpid(-1, &status, __WALL) != pid) { } return WEXITSTATUS(status); } static void drop_caps(void) { struct __user_cap_header_struct cap_hdr = {}; struct __user_cap_data_struct cap_data[2] = {}; cap_hdr.version = _LINUX_CAPABILITY_VERSION_3; cap_hdr.pid = getpid(); if (syscall(SYS_capget, &cap_hdr, &cap_data)) exit(1); const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE); cap_data[0].effective &= ~drop; cap_data[0].permitted &= ~drop; cap_data[0].inheritable &= ~drop; if (syscall(SYS_capset, &cap_hdr, &cap_data)) exit(1); } static int do_sandbox_none(void) { if (unshare(CLONE_NEWPID)) { } int pid = fork(); if (pid != 0) return wait_for_loop(pid); setup_common(); sandbox_common(); drop_caps(); if (unshare(CLONE_NEWNET)) { } loop(); exit(1); } static void kill_and_wait(int pid, int* status) { kill(-pid, SIGKILL); kill(pid, SIGKILL); for (int i = 0; i < 100; i++) { if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; usleep(1000); } DIR* dir = opendir("/sys/fs/fuse/connections"); if (dir) { for (;;) { struct dirent* ent = readdir(dir); if (!ent) break; if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) continue; char abort[300]; snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); int fd = open(abort, O_WRONLY); if (fd == -1) { continue; } if (write(fd, abort, 1) < 0) { } close(fd); } closedir(dir); } else { } while (waitpid(-1, status, __WALL) != pid) { } } static void setup_test() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); write_file("/proc/self/oom_score_adj", "1000"); } static void close_fds() { for (int fd = 3; fd < MAX_FDS; fd++) close(fd); } static void execute_one(void); #define WAIT_FLAGS __WALL static void loop(void) { int iter = 0; for (;; iter++) { int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { setup_test(); execute_one(); close_fds(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5000) { continue; } kill_and_wait(pid, &status); break; } } } #ifndef __NR_io_uring_enter #define __NR_io_uring_enter 426 #endif uint64_t r[4] = {0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0}; void execute_one(void) { intptr_t res = 0; *(uint32_t*)0x20000084 = 0; *(uint32_t*)0x20000088 = 1; *(uint32_t*)0x2000008c = 0; *(uint32_t*)0x20000090 = 0; *(uint32_t*)0x20000098 = -1; memset((void*)0x2000009c, 0, 12); res = -1; res = syz_io_uring_setup(0x4d4f, 0x20000080, 0x200a0000, 0x20ffc000, 0x20000000, 0x20000140); if (res != -1) { r[0] = res; r[1] = *(uint64_t*)0x20000000; } memcpy((void*)0x20000040, "./file0\000", 8); res = syscall(__NR_openat, 0xffffff9c, 0x20000040ul, 0x46e2ul, 0ul); if (res != -1) r[2] = res; *(uint32_t*)0x20000084 = 0; *(uint32_t*)0x20000088 = 0; *(uint32_t*)0x2000008c = 0; *(uint32_t*)0x20000090 = 0; *(uint32_t*)0x20000098 = -1; memset((void*)0x2000009c, 0, 12); res = -1; res = syz_io_uring_setup(1, 0x20000080, 0x20ffd000, 0x20ffc000, 0x20000100, 0x20000140); if (res != -1) r[3] = *(uint64_t*)0x20000140; *(uint8_t*)0x20000100 = 0x17; *(uint8_t*)0x20000101 = 0; *(uint16_t*)0x20000102 = 0; *(uint32_t*)0x20000104 = r[2]; *(uint64_t*)0x20000108 = 0; *(uint64_t*)0x20000110 = 0x20000200; memset((void*)0x20000200, 226, 1); *(uint32_t*)0x20000118 = 0xffffff98; *(uint32_t*)0x2000011c = 0; *(uint64_t*)0x20000120 = 0; *(uint16_t*)0x20000128 = 0; *(uint16_t*)0x2000012a = 0; memset((void*)0x2000012c, 0, 20); syz_io_uring_submit(r[1], r[3], 0x20000100, 0x200); syscall(__NR_io_uring_enter, r[0], 0x58ab, 0, 0ul, 0ul, 0ul); } int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); for (procid = 0; procid < 8; procid++) { if (fork() == 0) { do_sandbox_none(); } } sleep(1000000); return 0; }