From: syzbot <syzbot+cdd9922704fc75e03ffc@syzkaller.appspotmail.com>
To: akpm@linux-foundation.org, asml.silence@gmail.com,
io-uring@vger.kernel.org, kees@kernel.org, keescook@chromium.org,
linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-mm@kvack.org, syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] BUG: bad usercopy in io_openat2_prep
Date: Sun, 12 Feb 2023 08:04:26 -0800 [thread overview]
Message-ID: <0000000000007f69b605f482e2ee@google.com> (raw)
In-Reply-To: <9552a45f-6a26-e7fa-aa63-3c74a7d17261@gmail.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
BUG: bad usercopy in io_openat2_prep
usercopy: Kernel memory overwrite attempt detected to SLUB object 'pid' (offset 24, size 24)!
------------[ cut here ]------------
kernel BUG at mm/usercopy.c:102!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4995 Comm: syz-executor.0 Not tainted 6.2.0-rc6-syzkaller-00050-gfbe870a72fd1 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : usercopy_abort+0x90/0x94
lr : usercopy_abort+0x90/0x94
sp : ffff800012dd3be0
x29: ffff800012dd3bf0 x28: 000000000000001c x27: ffff0000d0e13400
x26: 00000000200000c0 x25: ffff80000cf51000 x24: fffffc0000000000
x23: 05ffc00000000200 x22: fffffc0003108280 x21: ffff0000c420a118
x20: 0000000000000000 x19: 0000000000000018 x18: 0000000000000000
x17: 0000000000000000 x16: ffff0000d0e13df8 x15: ffff80000dbd1118
x14: ffff0000d0e13400 x13: 00000000ffffffff x12: ffff0000d0e13400
x11: ff808000081bd5b0 x10: 0000000000000000 x9 : 4c3aa38d2e853f00
x8 : 4c3aa38d2e853f00 x7 : ffff800008162dbc x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : ffff0001fefbff08 x1 : 0000000100000000 x0 : 000000000000005d
Call trace:
usercopy_abort+0x90/0x94
__check_heap_object+0xa8/0x100
__check_object_size+0x208/0x6b8
io_openat2_prep+0xcc/0x2f0
io_submit_sqes+0x330/0xba8
__arm64_sys_io_uring_enter+0x168/0x9b0
invoke_syscall+0x64/0x178
el0_svc_common+0xbc/0x180
do_el0_svc+0x48/0x150
el0_svc+0x58/0x14c
el0t_64_sync_handler+0x84/0xf0
el0t_64_sync+0x190/0x194
Code: 911d2800 aa0903e1 f90003e8 94e6d3da (d4210000)
---[ end trace 0000000000000000 ]---
Tested on:
commit: fbe870a7 io_uring,audit: don't log IORING_OP_MADVISE
git tree: https://git.kernel.dk/linux.git for-6.3/io_uring
console output: https://syzkaller.appspot.com/x/log.txt?x=17241257480000
kernel config: https://syzkaller.appspot.com/x/.config?x=22fc000172595f28
dashboard link: https://syzkaller.appspot.com/bug?extid=cdd9922704fc75e03ffc
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
Note: no patches were applied.
next prev parent reply other threads:[~2023-02-12 16:04 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-11 16:08 [syzbot] BUG: bad usercopy in io_openat2_prep syzbot
2023-02-11 16:36 ` Kees Cook
2023-02-12 15:47 ` Pavel Begunkov
2023-02-12 16:04 ` syzbot [this message]
2023-02-13 11:27 ` Dmitry Vyukov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0000000000007f69b605f482e2ee@google.com \
--to=syzbot+cdd9922704fc75e03ffc@syzkaller.appspotmail.com \
--cc=akpm@linux-foundation.org \
--cc=asml.silence@gmail.com \
--cc=io-uring@vger.kernel.org \
--cc=kees@kernel.org \
--cc=keescook@chromium.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.