Re: BUG: unable to handle kernel NULL pointer dereference in posix_get_monotonic_timespec

[Thomas Gleixner <tglx@linutronix.de>]

On Thu, Nov 17 2022 at 22:38, Wei Chen wrote:

> Dear Linux Developer,
>
> Recently when using our tool to fuzz kernel, the following crash was triggered.
>
> HEAD commit: d418a331631b v6.1.0-rc5
> git tree: kmsan
> compiler: gcc 8.4.0
> console output:
> https://drive.google.com/file/d/1F6xY7LF5H9Lki9m769N_9ickBdGwaXIo/view?usp=share_link
> kernel config: https://drive.google.com/file/d/1qltDw7jrn7_DnXvhf7MgsxO08nqGSCDe/view?usp=share_link
>
> Unfortunately, I didn't have a reproducer for this bug.
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: Wei Chen <harperchen1110@gmail.com>
>
> BUG: kernel NULL pointer dereference, address: 0000000000000050
> #PF: supervisor read access in kernel mode
> #PF: error_code(0x0000) - not-present page
> PGD 1a089067 P4D 1a089067 PUD 1a08a067 PMD 0
> Oops: 0000 [#1] PREEMPT SMP
> CPU: 1 PID: 6355 Comm: syz-executor.1 Not tainted
> 6.1.0-rc5-63183-gd418a331631b #1
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
> Ubuntu-1.8.2-1ubuntu1 04/01/2014
> RIP: 0010:timespec64_add include/linux/time64.h:73 [inline]

That's the timespec64_add() in:

> RIP: 0010:timens_add_monotonic include/linux/time_namespace.h:69 [inline]

	struct timens_offsets *ns_offsets = &current->nsproxy->time_ns->offsets;

	*ts = timespec64_add(*ts, ns_offsets->monotonic);

> RIP: 0010:posix_get_monotonic_timespec+0x40/0x80 kernel/time/posix-timers.c:200
> Code: 89 45 f0 31 c0 e8 a0 ce 05 00 48 89 df e8 98 5c ff ff 48 8d 7d
> e0 65 48 8b 04 25 c0 ad 01 00 48 8b 80 d8 07 00 00 48 8b 40 30 <48> 8b
> 50 30 48 8b 70 28 48 03 53 08 48 03 33 e8 9c 89 fe ff 48 8b

   0:	89 45 f0             	mov    %eax,-0x10(%rbp)
   3:	31 c0                	xor    %eax,%eax
   5:	e8 a0 ce 05 00       	callq  0x5ceaa
   a:	48 89 df             	mov    %rbx,%rdi
   d:	e8 98 5c ff ff       	callq  0xffffffffffff5caa
  12:	48 8d 7d e0          	lea    -0x20(%rbp),%rdi
  16:	65 48 8b 04 25 c0 ad 	mov    %gs:0x1adc0,%rax     // rax = current
  1d:	01 00 
  1f:	48 8b 80 d8 07 00 00 	mov    0x7d8(%rax),%rax     // rax = nsproxy
  26:	48 8b 40 30          	mov    0x30(%rax),%rax      // rax = time_ns
  2a:*	48 8b 50 30          	mov    0x30(%rax),%rdx		<-- trapping instruction

> RAX: 0000000000000020 RBX: ffff88800e0d7f00 RCX: ffff888042696480

time_ns == 0x20 !?!?! How can that happen?

Thanks,

        tglx