* BUG: unable to handle kernel NULL pointer dereference in posix_get_monotonic_timespec
@ 2022-11-17 14:38 Wei Chen
2022-12-01 22:04 ` Thomas Gleixner
0 siblings, 1 reply; 2+ messages in thread
From: Wei Chen @ 2022-11-17 14:38 UTC (permalink / raw)
To: tglx, linux-kernel, syzkaller-bugs
Dear Linux Developer,
Recently when using our tool to fuzz kernel, the following crash was triggered.
HEAD commit: d418a331631b v6.1.0-rc5
git tree: kmsan
compiler: gcc 8.4.0
console output:
https://drive.google.com/file/d/1F6xY7LF5H9Lki9m769N_9ickBdGwaXIo/view?usp=share_link
kernel config: https://drive.google.com/file/d/1qltDw7jrn7_DnXvhf7MgsxO08nqGSCDe/view?usp=share_link
Unfortunately, I didn't have a reproducer for this bug.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: Wei Chen <harperchen1110@gmail.com>
BUG: kernel NULL pointer dereference, address: 0000000000000050
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 1a089067 P4D 1a089067 PUD 1a08a067 PMD 0
Oops: 0000 [#1] PREEMPT SMP
CPU: 1 PID: 6355 Comm: syz-executor.1 Not tainted
6.1.0-rc5-63183-gd418a331631b #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
Ubuntu-1.8.2-1ubuntu1 04/01/2014
RIP: 0010:timespec64_add include/linux/time64.h:73 [inline]
RIP: 0010:timens_add_monotonic include/linux/time_namespace.h:69 [inline]
RIP: 0010:posix_get_monotonic_timespec+0x40/0x80 kernel/time/posix-timers.c:200
Code: 89 45 f0 31 c0 e8 a0 ce 05 00 48 89 df e8 98 5c ff ff 48 8d 7d
e0 65 48 8b 04 25 c0 ad 01 00 48 8b 80 d8 07 00 00 48 8b 40 30 <48> 8b
50 30 48 8b 70 28 48 03 53 08 48 03 33 e8 9c 89 fe ff 48 8b
RSP: 0018:ffff88800e0d7ed0 EFLAGS: 00010282
RAX: 0000000000000020 RBX: ffff88800e0d7f00 RCX: ffff888042696480
RDX: 0000000000000000 RSI: ffff888042696480 RDI: ffff88800e0d7ed0
RBP: ffff88800e0d7ef0 R08: ffffffff8124f51a R09: 000000003b9ac9ff
R10: 0000000000000007 R11: 0000000008fa7c6f R12: 0000000000000001
R13: 00007fff9e567f20 R14: 0000000000000000 R15: 0000000000000000
FS: 00000000021ab940(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000050 CR3: 000000001a088000 CR4: 00000000003526e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__do_sys_clock_gettime kernel/time/posix-timers.c:1101 [inline]
__se_sys_clock_gettime kernel/time/posix-timers.c:1091 [inline]
__x64_sys_clock_gettime+0x97/0x140 kernel/time/posix-timers.c:1091
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x34/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x461b5a
Code: 25 18 00 00 00 00 74 01 f0 48 0f b1 3d 0f 9b 25 01 48 39 c2 75
da f3 c3 0f 1f 84 00 00 00 00 00 48 63 ff b8 e4 00 00 00 0f 05 <48> 3d
00 f0 ff ff 77 06 f3 c3 0f 1f 40 00 48 c7 c2 d4 ff ff ff f7
RSP: 002b:00007fff9e567f18 EFLAGS: 00000246 ORIG_RAX: 00000000000000e4
RAX: ffffffffffffffda RBX: 0000000000002ee0 RCX: 0000000000461b5a
RDX: 0000000000002ee0 RSI: 00007fff9e567f20 RDI: 0000000000000001
RBP: 0000000000031cfb R08: 0000000000000000 R09: 00000000021ab940
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000c2a
R13: 0000000000000001 R14: 0000000000000032 R15: 0000000000031cf4
</TASK>
Modules linked in:
CR2: 0000000000000050
---[ end trace 0000000000000000 ]---
RIP: 0010:timespec64_add include/linux/time64.h:73 [inline]
RIP: 0010:timens_add_monotonic include/linux/time_namespace.h:69 [inline]
RIP: 0010:posix_get_monotonic_timespec+0x40/0x80 kernel/time/posix-timers.c:200
Code: 89 45 f0 31 c0 e8 a0 ce 05 00 48 89 df e8 98 5c ff ff 48 8d 7d
e0 65 48 8b 04 25 c0 ad 01 00 48 8b 80 d8 07 00 00 48 8b 40 30 <48> 8b
50 30 48 8b 70 28 48 03 53 08 48 03 33 e8 9c 89 fe ff 48 8b
RSP: 0018:ffff88800e0d7ed0 EFLAGS: 00010282
RAX: 0000000000000020 RBX: ffff88800e0d7f00 RCX: ffff888042696480
RDX: 0000000000000000 RSI: ffff888042696480 RDI: ffff88800e0d7ed0
RBP: ffff88800e0d7ef0 R08: ffffffff8124f51a R09: 000000003b9ac9ff
R10: 0000000000000007 R11: 0000000008fa7c6f R12: 0000000000000001
R13: 00007fff9e567f20 R14: 0000000000000000 R15: 0000000000000000
FS: 00000000021ab940(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000050 CR3: 000000001a088000 CR4: 00000000003526e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 89 45 f0 mov %eax,-0x10(%rbp)
3: 31 c0 xor %eax,%eax
5: e8 a0 ce 05 00 callq 0x5ceaa
a: 48 89 df mov %rbx,%rdi
d: e8 98 5c ff ff callq 0xffff5caa
12: 48 8d 7d e0 lea -0x20(%rbp),%rdi
16: 65 48 8b 04 25 c0 ad mov %gs:0x1adc0,%rax
1d: 01 00
1f: 48 8b 80 d8 07 00 00 mov 0x7d8(%rax),%rax
26: 48 8b 40 30 mov 0x30(%rax),%rax
* 2a: 48 8b 50 30 mov 0x30(%rax),%rdx <-- trapping instruction
2e: 48 8b 70 28 mov 0x28(%rax),%rsi
32: 48 03 53 08 add 0x8(%rbx),%rdx
36: 48 03 33 add (%rbx),%rsi
39: e8 9c 89 fe ff callq 0xfffe89da
3e: 48 rex.W
3f: 8b .byte 0x8b
Best,
Wei
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: BUG: unable to handle kernel NULL pointer dereference in posix_get_monotonic_timespec
2022-11-17 14:38 BUG: unable to handle kernel NULL pointer dereference in posix_get_monotonic_timespec Wei Chen
@ 2022-12-01 22:04 ` Thomas Gleixner
0 siblings, 0 replies; 2+ messages in thread
From: Thomas Gleixner @ 2022-12-01 22:04 UTC (permalink / raw)
To: Wei Chen, linux-kernel, syzkaller-bugs; +Cc: Andrei Vagin
On Thu, Nov 17 2022 at 22:38, Wei Chen wrote:
> Dear Linux Developer,
>
> Recently when using our tool to fuzz kernel, the following crash was triggered.
>
> HEAD commit: d418a331631b v6.1.0-rc5
> git tree: kmsan
> compiler: gcc 8.4.0
> console output:
> https://drive.google.com/file/d/1F6xY7LF5H9Lki9m769N_9ickBdGwaXIo/view?usp=share_link
> kernel config: https://drive.google.com/file/d/1qltDw7jrn7_DnXvhf7MgsxO08nqGSCDe/view?usp=share_link
>
> Unfortunately, I didn't have a reproducer for this bug.
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: Wei Chen <harperchen1110@gmail.com>
>
> BUG: kernel NULL pointer dereference, address: 0000000000000050
> #PF: supervisor read access in kernel mode
> #PF: error_code(0x0000) - not-present page
> PGD 1a089067 P4D 1a089067 PUD 1a08a067 PMD 0
> Oops: 0000 [#1] PREEMPT SMP
> CPU: 1 PID: 6355 Comm: syz-executor.1 Not tainted
> 6.1.0-rc5-63183-gd418a331631b #1
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
> Ubuntu-1.8.2-1ubuntu1 04/01/2014
> RIP: 0010:timespec64_add include/linux/time64.h:73 [inline]
That's the timespec64_add() in:
> RIP: 0010:timens_add_monotonic include/linux/time_namespace.h:69 [inline]
struct timens_offsets *ns_offsets = ¤t->nsproxy->time_ns->offsets;
*ts = timespec64_add(*ts, ns_offsets->monotonic);
> RIP: 0010:posix_get_monotonic_timespec+0x40/0x80 kernel/time/posix-timers.c:200
> Code: 89 45 f0 31 c0 e8 a0 ce 05 00 48 89 df e8 98 5c ff ff 48 8d 7d
> e0 65 48 8b 04 25 c0 ad 01 00 48 8b 80 d8 07 00 00 48 8b 40 30 <48> 8b
> 50 30 48 8b 70 28 48 03 53 08 48 03 33 e8 9c 89 fe ff 48 8b
0: 89 45 f0 mov %eax,-0x10(%rbp)
3: 31 c0 xor %eax,%eax
5: e8 a0 ce 05 00 callq 0x5ceaa
a: 48 89 df mov %rbx,%rdi
d: e8 98 5c ff ff callq 0xffffffffffff5caa
12: 48 8d 7d e0 lea -0x20(%rbp),%rdi
16: 65 48 8b 04 25 c0 ad mov %gs:0x1adc0,%rax // rax = current
1d: 01 00
1f: 48 8b 80 d8 07 00 00 mov 0x7d8(%rax),%rax // rax = nsproxy
26: 48 8b 40 30 mov 0x30(%rax),%rax // rax = time_ns
2a:* 48 8b 50 30 mov 0x30(%rax),%rdx <-- trapping instruction
> RAX: 0000000000000020 RBX: ffff88800e0d7f00 RCX: ffff888042696480
time_ns == 0x20 !?!?! How can that happen?
Thanks,
tglx
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-12-01 22:04 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-11-17 14:38 BUG: unable to handle kernel NULL pointer dereference in posix_get_monotonic_timespec Wei Chen
2022-12-01 22:04 ` Thomas Gleixner
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox