From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id B1E80C636CC for ; Sat, 11 Feb 2023 16:08:57 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id E57D86B0072; Sat, 11 Feb 2023 11:08:56 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id E07D96B0073; Sat, 11 Feb 2023 11:08:56 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id CCF706B0074; Sat, 11 Feb 2023 11:08:56 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id BA0B66B0072 for ; Sat, 11 Feb 2023 11:08:56 -0500 (EST) Received: from smtpin09.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay03.hostedemail.com (Postfix) with ESMTP id 2E677A079F for ; Sat, 11 Feb 2023 16:08:56 +0000 (UTC) X-FDA: 80455494672.09.F93DE59 Received: from mail-il1-f207.google.com (mail-il1-f207.google.com [209.85.166.207]) by imf12.hostedemail.com (Postfix) with ESMTP id 8C6AE4000E for ; Sat, 11 Feb 2023 16:08:53 +0000 (UTC) Authentication-Results: imf12.hostedemail.com; dkim=none; dmarc=fail reason="SPF not aligned (relaxed), No valid DKIM" header.from=appspotmail.com (policy=none); spf=pass (imf12.hostedemail.com: domain of 3lL3nYwkbANMHNO9zAA3GzEE72.5DD5A3JH3G1DCI3CI.1DB@M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com designates 209.85.166.207 as permitted sender) smtp.mailfrom=3lL3nYwkbANMHNO9zAA3GzEE72.5DD5A3JH3G1DCI3CI.1DB@M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1676131733; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding:in-reply-to: references; bh=Hc23FUJSZ8aR6OzhlvIdcqSFxxNfNJFxBa4eo3vhlkc=; b=aaNVbjTt8C3woC6aNdzxvnyxlyuc+xpSFOwspUaDZccpjp7jOvGyZApCl9lx3t1uBadEEj BGxMjvbwgJgbtOyQNj3dflREEpRFoqDNXIKo98OQQO6KJa0vfMj7yzkeA+PVwEgAOJNq/O qFCLoDXvUXt0oKJYmdaI9hqG6q6qzE8= ARC-Authentication-Results: i=1; imf12.hostedemail.com; dkim=none; dmarc=fail reason="SPF not aligned (relaxed), No valid DKIM" header.from=appspotmail.com (policy=none); spf=pass (imf12.hostedemail.com: domain of 3lL3nYwkbANMHNO9zAA3GzEE72.5DD5A3JH3G1DCI3CI.1DB@M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com designates 209.85.166.207 as permitted sender) smtp.mailfrom=3lL3nYwkbANMHNO9zAA3GzEE72.5DD5A3JH3G1DCI3CI.1DB@M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1676131733; a=rsa-sha256; cv=none; b=iKsBBH6olt6m3rKcBO/sXmj8slIfXyID8SU8I+t1p2phrvTvjB/xER59TGcDiguQk8ynvL FG4YWxXV0WKL/KSLO66Cx7TJy8yh6IR/j60mSZ8C4nRcI6MURZ4tKunOe3rVRyjHCv/q5i tkDdyu4/FEWIEUggHlJC6R6LsawYuUo= Received: by mail-il1-f207.google.com with SMTP id z12-20020a92d6cc000000b00310d4433c8cso6423776ilp.6 for ; Sat, 11 Feb 2023 08:08:53 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=to:from:subject:message-id:date:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=Hc23FUJSZ8aR6OzhlvIdcqSFxxNfNJFxBa4eo3vhlkc=; b=q0x4dTFs4PV37/3LHX5g4puhK4C/BDYRpIbjY2g9n56tUUXRdKEyrDcMdHA2rb46ED ITtd9hWxcUgi45cRNt69KJX8Dx6X2bBhX3w2gLZz0l83catqZysRXgBtZlOzWa33txpT ybCLcIKfyLH07l6kz+rVy8/sGyBqk2mRBpQJq5bKhGqe4/B8sYpK1V3Q6AqUEDOFf7UR N6mqNDLpG7TPOCt+085Bt8gtDm3OkQumvLJcxfnI8J9sgCkSQ+xx7W7wmyqVExNp9rWj 0bOKWHGeQkJybq7DAl00eUFd+k+A8KCqQ6v60XOoniLcUPeSQ/y5QXHwDaWooV/z3cBS Zd4Q== X-Gm-Message-State: AO0yUKUnIj5gHLQxLsuR+Dq5cziGSrykYvBQkER/VGCYOBpTEafb1Kbt 0g4StCqFBS+5JzhoxydExJz5qVgljb6jqJQys0tKYM9vOKjR X-Google-Smtp-Source: AK7set+r3wGoWlQkFpfdEAQhpl7nxVexqMNSLilkNHipwws3leieNBL+EFHrQiYpLZG+p++hztcxufneC5s8vtb/Qr4xi94AkahH MIME-Version: 1.0 X-Received: by 2002:a02:c6c4:0:b0:3c4:97a3:255f with SMTP id r4-20020a02c6c4000000b003c497a3255fmr4060690jan.50.1676131732858; Sat, 11 Feb 2023 08:08:52 -0800 (PST) Date: Sat, 11 Feb 2023 08:08:52 -0800 X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <00000000000088b3d905f46ed421@google.com> Subject: [syzbot] BUG: bad usercopy in io_openat2_prep From: syzbot To: akpm@linux-foundation.org, keescook@chromium.org, linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" X-Rspam-User: X-Rspamd-Server: rspam02 X-Rspamd-Queue-Id: 8C6AE4000E X-Stat-Signature: sjfwea5d5wqcg5jbkjh9jgeapqtw3ipn X-HE-Tag: 1676131733-177946 X-HE-Meta: U2FsdGVkX18Gu/CfH/oW55kjHJNFdQdm7h+kwZg0+2kHH4ORcCOXxUKXx/lK2l9GSTG+d07bCzNv8fsotkfM2v6j8WCVnZVXL5KrI62XwaQ4NpAglySho8laOHDGxiJ5vpMBl+RrPLxGDPQQhcIHmNiOgw9iVNITkb9NOzuQIEjtiI8No8RraeZPt1zTwmg9pJ+cB2XK67i5Xe278MAmUSPr4jRNhdEpc8gnXQPfGFFXaVWO3onweMMs/QoGxfCk8+97RXJLjrBpdQyDzz70QQBI7lJlf+tc8PoE1JJZLMj+wwHq4mkrTxjEly6Ny35SGj26UeRToFZ5pAG+J57dv8ktNFBiUYxctvAeM1OCzbdSt7ba41hcOAY0UTCtke6FqeQIBsT+27dLTTotywrpJPJwzT0LXYb1FaCtoGFCwL7icpkWP4GJc4Gnw4wDMRPK1AA0SvDBtXjDEASjXWtIb/kuAJ1/IJlvi12ONn/xaIWVJe6dYE8mOH6WTkV4B7m4xcMVWHzKX/wyoxOLyniGB1dsX8kpXQIfmOwFV4pD99KSfW8qndBlVdm3aER+7ygu/3P6lZ4gq1L2dtpEWDrMghekm8rrN1M6tJpvtYg1mmzicXQQ6byjQujq9slHIL90BGFyu51EBGuvlIdjjuqKHlb+6iDJO3xYCbeCoG9r870ULpPFxIObkBOApt7Ad901Rdm9gy3NyA4O7YZigMc9g3u/0dclOvqsuObNOxLG3b8ZwlzDGfAs5BYUwtIOsjpPQqqN03FcDXzOgfWG4AWl3r8Tt9SEOwBZaoAW3UEjgTTC7L5jfyxNVxdFto0ee501OA+hZbINdT/WO47nfzx0klCYx5GopQCic54zSVUp/2rHEVWVqelIHYVyaPe7nYUF9xgkTcGoGvne+6rVrmIS6PapTolBu/fvijsnp++2DcMsGwpSroIiq3o0IsCvoczQQr9tpScqHIo3ZiL56WN DFnviqOH UBkU9E1gxCTzzi7eHFnLPQ9PCPd+92nKZopkP4wDNb7GehixdJYlno1tu8UER6sFazvZBxM4vikBjgcDByFHDYwes/euUu5OyhMhToCivJNF8crbwry7Ov69bfijXUX7aGXE5r7QSR0GO7hac71M6jw3LBw7PVHiL0IAo1YNXA90KZe0/ZnmnGhh8HLoQZgfTx3kSehIC9SO/4d9zcWIWmJfCAQHUl4LRt1+JoEVO9gXoY0Y4faPsne82p2JicY7M9mmEs7i05VE6Sd4LIvzA3ghRISrsuZJt70NLhufeSAquVm9U64vftgWieejaBtgTQHYYsyI/nEuRKJ3Deg90ikkn///9ZGbBMV/GQgNtzM+/8Qw/nSjq/4djiEHtQGtlWIrrH2MMQ2kNWqy4Z1uATgSDNDYFW9Z4lbIs2q6l4BQCkrP2SBtTEUByQ28BwpLlafXY9n4BWcoCdAKMgdysc3/gnDIcXSYJ3HqQcTP/OonJIk2D2kq9dtjMRvA0FR2ycJnoAkCstN2bStAhNGSnzxa7pVhfZCAWr21gtz+NvT3ZkapEIGy0Asyq4Rzn6yq6IS8/k2vVPb6cSFir1wXkPa9NPqnlnR9J59wTG52BxzHfPR/48CjMWtJMXtDHhUWPGdlzBolp9+8f7LmgiNonFRdcU1cwtJSHEbBouofc5Cnkras2fLjRIA4ZTI+rZvc2MlYIhpjFpSZySPhjn7vjaN4OWrNzQw35b7I05j9Vx+T8QRgmo0VjlTLXvmifSuY+0zhNBRV9Dcu9sZm2qUTVPxLLRftUEa+MFeJRSgwAfTdqThnIOvSXZwyJGEq8LxHrFf94au4LDGjzdLZInkEGAb8KQw9OznlxMf5KXOC20nmzVX3aj3VgGRwrK9Jas2H+kCM+Sftz7PJvBWSWL5XrQW7fOZ6JFxiwMWv2Tall4arGgQHQ1B/M/g57ZP8FUhvwDmB/awkPQERHDjB9IdBlgoBmPhl0 ojWVot3s dy6+j/987obH1qQdbVtt1gl5vs8ljwhATFfSoGTqYkiUUjCrEFtErdqBOOom2YlZuIiIwCPsgrjBbxsx6ZfgkCTxtfS8q5KBijaDSL5ao0ufbOctgOzERvroT9JhAdvcJ2h6vBMRrPOCC30yeDbbjotU/qf0k85TSmmSpz8Wzht8M/+ZTW8b/DFokFO+iVhwDkDigSeX3wLPAR1pT58BMdAzyJrR+yWyxfFEXoIC7sddZWbpWpdqyQTyVkAhc2+768/IugCFZYq0H5hDrnjc9Djc8rc49NzOogI+pmnh7xHlT69rCUtutSsNOQOnNs85wHbcGPjpRGIwhRwi3LgVuol5Wtx3IRsz/b4SPDQkIFMXkbiYKqNnsXHgiksuoXNvP9JsF6AENMg= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Hello, syzbot found the following issue on: HEAD commit: ca72d58361ee Merge branch 'for-next/core' into for-kernelci git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci console output: https://syzkaller.appspot.com/x/log.txt?x=14a882f3480000 kernel config: https://syzkaller.appspot.com/x/.config?x=f3e78232c1ed2b43 dashboard link: https://syzkaller.appspot.com/bug?extid=cdd9922704fc75e03ffc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 userspace arch: arm64 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1203777b480000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=124c1ea3480000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/e2c91688b4cd/disk-ca72d583.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/af105438bee6/vmlinux-ca72d583.xz kernel image: https://storage.googleapis.com/syzbot-assets/4a28ec4f8f7e/Image-ca72d583.gz.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+cdd9922704fc75e03ffc@syzkaller.appspotmail.com usercopy: Kernel memory overwrite attempt detected to SLUB object 'pid' (offset 24, size 24)! ------------[ cut here ]------------ kernel BUG at mm/usercopy.c:102! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 4411 Comm: syz-executor101 Not tainted 6.2.0-rc6-syzkaller-17549-gca72d58361ee #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usercopy_abort+0x90/0x94 lr : usercopy_abort+0x90/0x94 sp : ffff80000fb8bb90 x29: ffff80000fb8bba0 x28: 000000000000001c x27: ffff0000c76d1a00 x26: 00000000200000c0 x25: ffff80000cf42000 x24: fffffc0000000000 x23: 05ffc00000000200 x22: fffffc0003250440 x21: ffff0000c9411618 x20: 0000000000000000 x19: 0000000000000018 x18: 0000000000002bee x17: 63656a626f204255 x16: ffff0000c76d23f8 x15: ffff80000dbc2118 x14: ffff0000c76d1a00 x13: 00000000ffffffff x12: ffff0000c76d1a00 x11: ff808000081bbb4c x10: 0000000000000000 x9 : 295e44a4d7b9f900 x8 : 295e44a4d7b9f900 x7 : ffff80000bf60b80 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000001 x3 : 0000000000000000 x2 : ffff0001fefbef08 x1 : 0000000100000000 x0 : 000000000000005d Call trace: usercopy_abort+0x90/0x94 __check_heap_object+0xa8/0x100 __check_object_size+0x208/0x6b8 io_openat2_prep+0xcc/0x2b8 io_submit_sqes+0x338/0xbb8 __arm64_sys_io_uring_enter+0x168/0x1308 invoke_syscall+0x64/0x178 el0_svc_common+0xbc/0x180 do_el0_svc+0x48/0x110 el0_svc+0x58/0x14c el0t_64_sync_handler+0x84/0xf0 el0t_64_sync+0x190/0x194 Code: 9133a800 aa0903e1 f90003e8 94e6c80f (d4210000) ---[ end trace 0000000000000000 ]--- --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. syzbot can test patches for this issue, for details see: https://goo.gl/tpsmEJ#testing-patches