From: Jens Axboe <axboe@kernel.dk>
To: Dmitry Vyukov <dvyukov@google.com>,
syzbot <syzbot+5320383e16029ba057ff@syzkaller.appspotmail.com>,
Al Viro <viro@zeniv.linux.org.uk>,
io-uring@vger.kernel.org,
linux-fsdevel <linux-fsdevel@vger.kernel.org>
Cc: Anna.Schumaker@netapp.com,
Casey Schaufler <casey@schaufler-ca.com>,
David Howells <dhowells@redhat.com>, Jann Horn <jannh@google.com>,
Kees Cook <keescook@chromium.org>,
Kate Stewart <kstewart@linuxfoundation.org>,
LKML <linux-kernel@vger.kernel.org>, NeilBrown <neilb@suse.com>,
syzkaller-bugs <syzkaller-bugs@googlegroups.com>,
Thomas Gleixner <tglx@linutronix.de>
Subject: Re: general protection fault in override_creds
Date: Mon, 2 Dec 2019 08:49:04 -0700 [thread overview]
Message-ID: <7be77044-5390-7df1-33d4-e92166fb927a@kernel.dk> (raw)
In-Reply-To: <39ea5e00-3278-a84f-25ae-c7a93a4b8ab5@kernel.dk>
On 12/2/19 7:40 AM, Jens Axboe wrote:
> On 12/1/19 10:40 PM, Dmitry Vyukov wrote:
>> On Mon, Dec 2, 2019 at 7:35 AM syzbot
>> <syzbot+5320383e16029ba057ff@syzkaller.appspotmail.com> wrote:
>>>
>>> Hello,
>>>
>>> syzbot found the following crash on:
>>>
>>> HEAD commit: b94ae8ad Merge tag 'seccomp-v5.5-rc1' of git://git.kernel...
>>> git tree: upstream
>>> console output: https://syzkaller.appspot.com/x/log.txt?x=10f9ffcee00000
>>> kernel config: https://syzkaller.appspot.com/x/.config?x=ff560c3de405258c
>>> dashboard link: https://syzkaller.appspot.com/bug?extid=5320383e16029ba057ff
>>> compiler: gcc (GCC) 9.0.0 20181231 (experimental)
>>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12dd682ae00000
>>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16290abce00000
>>>
>>> IMPORTANT: if you fix the bug, please add the following tag to the commit:
>>> Reported-by: syzbot+5320383e16029ba057ff@syzkaller.appspotmail.com
>>
>> I think this relates to fs/io_uring.c rather than kernel/cred.c.
>> +io_uring maintainers
>
> Yeah that's my fault, guessing the below will fix it. I'll test and
> queue it up.
This is cleaner, tested fine.
diff --git a/fs/io-wq.c b/fs/io-wq.c
index 91b85df0861e..74b40506c5d9 100644
--- a/fs/io-wq.c
+++ b/fs/io-wq.c
@@ -111,7 +111,7 @@ struct io_wq {
struct task_struct *manager;
struct user_struct *user;
- struct cred *creds;
+ const struct cred *creds;
struct mm_struct *mm;
refcount_t refs;
struct completion done;
diff --git a/fs/io-wq.h b/fs/io-wq.h
index 600e0158cba7..dd0af0d7376c 100644
--- a/fs/io-wq.h
+++ b/fs/io-wq.h
@@ -87,7 +87,7 @@ typedef void (put_work_fn)(struct io_wq_work *);
struct io_wq_data {
struct mm_struct *mm;
struct user_struct *user;
- struct cred *creds;
+ const struct cred *creds;
get_work_fn *get_work;
put_work_fn *put_work;
diff --git a/fs/io_uring.c b/fs/io_uring.c
index ec53aa7cdc94..5cab7a047317 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -238,7 +238,7 @@ struct io_ring_ctx {
struct user_struct *user;
- struct cred *creds;
+ const struct cred *creds;
/* 0 is for ctx quiesce/reinit/free, 1 is for sqo_thread started */
struct completion *completions;
@@ -4759,7 +4759,7 @@ static int io_uring_create(unsigned entries, struct io_uring_params *p)
ctx->compat = in_compat_syscall();
ctx->account_mem = account_mem;
ctx->user = user;
- ctx->creds = prepare_creds();
+ ctx->creds = get_current_cred();
ret = io_allocate_scq_urings(ctx, p);
if (ret)
--
Jens Axboe
next prev parent reply other threads:[~2019-12-02 15:49 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <000000000000da160a0598b2c704@google.com>
2019-12-02 6:40 ` general protection fault in override_creds Dmitry Vyukov
2019-12-02 15:40 ` Jens Axboe
2019-12-02 15:49 ` Jens Axboe [this message]
2019-12-02 15:22 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7be77044-5390-7df1-33d4-e92166fb927a@kernel.dk \
--to=axboe@kernel.dk \
--cc=Anna.Schumaker@netapp.com \
--cc=casey@schaufler-ca.com \
--cc=dhowells@redhat.com \
--cc=dvyukov@google.com \
--cc=io-uring@vger.kernel.org \
--cc=jannh@google.com \
--cc=keescook@chromium.org \
--cc=kstewart@linuxfoundation.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=neilb@suse.com \
--cc=syzbot+5320383e16029ba057ff@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tglx@linutronix.de \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).