Re: [io-uring] general protection fault in io_register_clone_buffers

[Jens Axboe <axboe@kernel.dk>]

On 12/12/24 3:06 AM, chase xd wrote:
> Syzkaller hit 'general protection fault in io_register_clone_buffers' bug.
> 
> Oops: general protection fault, probably for non-canonical address
> 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN NOPTI
> KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
> CPU: 5 UID: 0 PID: 12910 Comm: syz-executor169 Not tainted
> 6.12.0-rc4-00089-g7eb75ce75271-dirty #7
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> RIP: 0010:io_clone_buffers io_uring/rsrc.c:1039 [inline]
> RIP: 0010:io_register_clone_buffers+0xbb1/0xf40 io_uring/rsrc.c:1076
> Code: 48 63 c3 41 89 dd 4c 8d 3c c6 4c 89 fa 48 c1 ea 03 42 80 3c 22
> 00 0f 85 61 02 00 00 49 8b 17 48 8d 7a 10 48 89 f9 48 c1 e9 03 <42> 80
> 3c 21 00 0f 85 62 02 00 00 48 8b 72 10 4c 89 f7 e8 b8 93 ff
> RSP: 0018:ffffc90011047bd8 EFLAGS: 00010212
> RAX: 0000000000000001 RBX: 0000000000000001 RCX: 0000000000000002
> RDX: 0000000000000000 RSI: ffff888017acfec0 RDI: 0000000000000010
> RBP: ffffc90011047d28 R08: 0000000000000000 R09: fffffbfff1dbb731
> R10: 0000000000000002 R11: 0000000000000000 R12: dffffc0000000000
> R13: 0000000000000001 R14: ffff888021760000 R15: ffff888017acfec8
> FS:  00007fcbf80f4640(0000) GS:ffff88823bf00000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007fcbf806e658 CR3: 000000002420a000 CR4: 0000000000750ef0
> PKRU: 55555554
> Call Trace:
>  <TASK>
>  __io_uring_register+0x922/0x2290 io_uring/register.c:804
>  __do_sys_io_uring_register io_uring/register.c:907 [inline]
>  __se_sys_io_uring_register io_uring/register.c:884 [inline]
>  __x64_sys_io_uring_register+0x178/0x2b0 io_uring/register.c:884
>  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
>  do_syscall_64+0xcb/0x250 arch/x86/entry/common.c:83
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7fcbf815322d
> Code: c3 e8 77 24 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48
> 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
> 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007fcbf80f41a8 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab
> RAX: ffffffffffffffda RBX: 00007fcbf81f5088 RCX: 00007fcbf815322d
> RDX: 0000000020000600 RSI: 000000000000001e RDI: 0000000000000004
> RBP: 00007fcbf81f5080 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000c90
> R13: 0000000000000003 R14: 00007fcbf811a630 R15: 00007fcbf80d4000
>  </TASK>
> Modules linked in:
> ---[ end trace 0000000000000000 ]---
> RIP: 0010:io_clone_buffers io_uring/rsrc.c:1039 [inline]
> RIP: 0010:io_register_clone_buffers+0xbb1/0xf40 io_uring/rsrc.c:1076

I can't run these crazy syzbot reproducers, I do wish they'd be dwindled
down to the bare minimum rather than have tons of unrelated bits in
there. That said, can you check with this patch?

diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
index adaae8630932..077f84684c18 100644
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -1036,8 +1036,10 @@ static int io_clone_buffers(struct io_ring_ctx *ctx, struct io_ring_ctx *src_ctx
 out_put_free:
 	i = data.nr;
 	while (i--) {
-		io_buffer_unmap(src_ctx, data.nodes[i]);
-		kfree(data.nodes[i]);
+		if (data.nodes[i]) {
+			io_buffer_unmap(src_ctx, data.nodes[i]);
+			kfree(data.nodes[i]);
+		}
 	}
 out_unlock:
 	io_rsrc_data_free(ctx, &data);

-- 
Jens Axboe