* KASAN: stack-out-of-bounds in iov_iter_revert
@ 2021-07-31 18:21 Sudip Mukherjee
2021-08-01 0:10 ` Pavel Begunkov
0 siblings, 1 reply; 9+ messages in thread
From: Sudip Mukherjee @ 2021-07-31 18:21 UTC (permalink / raw)
To: Jens Axboe, Pavel Begunkov; +Cc: io-uring, linux-kernel
Hi Jens, Pavel,
We had been running syzkaller on v5.10.y and a "KASAN:
stack-out-of-bounds in iov_iter_revert" was being reported on it. I
got some time to check that today and have managed to get a syzkaller
reproducer. I dont have a C reproducer which I can share but I can use
the syz-reproducer to reproduce this with v5.14-rc3 and also with
next-20210730.
==================================================================
[ 74.211232] BUG: KASAN: stack-out-of-bounds in iov_iter_revert+0x809/0x900
[ 74.212778] Read of size 8 at addr ffff888025dc78b8 by task
syz-executor.0/828
[ 74.214756] CPU: 0 PID: 828 Comm: syz-executor.0 Not tainted
5.14.0-rc3-next-20210730 #1
[ 74.216525] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[ 74.219033] Call Trace:
[ 74.219683] dump_stack_lvl+0x8b/0xb3
[ 74.220706] print_address_description.constprop.0+0x1f/0x140
[ 74.222272] ? iov_iter_revert+0x809/0x900
[ 74.223285] ? iov_iter_revert+0x809/0x900
[ 74.224226] kasan_report.cold+0x7f/0x11b
[ 74.225147] ? iov_iter_revert+0x809/0x900
[ 74.226085] iov_iter_revert+0x809/0x900
[ 74.227002] ? lock_is_held_type+0x98/0x110
[ 74.227960] io_write+0x57d/0xe40
[ 74.228730] ? io_read+0x10d0/0x10d0
[ 74.229550] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0
[ 74.230746] ? lock_is_held_type+0x98/0x110
[ 74.231699] ? __lock_acquire+0xbb1/0x5b00
[ 74.232647] io_issue_sqe+0x4da/0x6a80
[ 74.233507] ? mark_lock+0xfc/0x2d80
[ 74.234349] ? __is_insn_slot_addr+0x14d/0x250
[ 74.235385] ? lock_chain_count+0x20/0x20
[ 74.236312] ? io_write+0xe40/0xe40
[ 74.237119] ? lock_is_held_type+0x98/0x110
[ 74.238076] ? find_held_lock+0x2c/0x110
[ 74.238992] ? lock_release+0x1dd/0x6b0
[ 74.239874] ? __fget_files+0x21c/0x3e0
[ 74.240757] ? lock_downgrade+0x6d0/0x6d0
[ 74.241672] ? lock_release+0x1dd/0x6b0
[ 74.242578] __io_queue_sqe+0x1ac/0xe60
[ 74.243471] ? io_issue_sqe+0x6a80/0x6a80
[ 74.244402] ? lock_is_held_type+0x98/0x110
[ 74.245358] io_submit_sqes+0x3f6e/0x76a0
[ 74.246281] ? xa_load+0x158/0x290
[ 74.247113] ? __do_sys_io_uring_enter+0x90c/0x1a20
[ 74.248207] __do_sys_io_uring_enter+0x90c/0x1a20
[ 74.249277] ? vm_mmap_pgoff+0xe8/0x280
[ 74.250163] ? io_submit_sqes+0x76a0/0x76a0
[ 74.251149] ? randomize_stack_top+0x100/0x100
[ 74.252178] ? __do_sys_futex+0xf2/0x3d0
[ 74.253074] ? __do_sys_futex+0xfb/0x3d0
[ 74.253980] ? do_futex+0x18c0/0x18c0
[ 74.254852] ? lockdep_hardirqs_on_prepare+0x273/0x3e0
[ 74.256022] ? syscall_enter_from_user_mode+0x1d/0x50
[ 74.257167] do_syscall_64+0x3b/0x90
[ 74.257984] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 74.259125] RIP: 0033:0x466609
[ 74.259830] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40
00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24
08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89
01 48
[ 74.263910] RSP: 002b:00007ffdb23903f8 EFLAGS: 00000246 ORIG_RAX:
00000000000001aa
[ 74.265579] RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 0000000000466609
[ 74.267162] RDX: 0000000000000000 RSI: 00000000000058ab RDI: 0000000000000003
[ 74.268745] RBP: 00000000004bfcb9 R08: 0000000000000000 R09: 0000000000000000
[ 74.270303] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80
[ 74.271899] R13: 00007ffdb2390590 R14: 000000000056bf80 R15: 000000000001215c
[ 74.273856] The buggy address belongs to the page:
[ 74.274948] page:00000000bd0ec836 refcount:0 mapcount:0
mapping:0000000000000000 index:0x0 pfn:0x25dc7
[ 74.277000] flags: 0x100000000000000(node=0|zone=1)
[ 74.278119] raw: 0100000000000000 0000000000000000 ffffea00009771c8
0000000000000000
[ 74.279853] raw: 0000000000000000 0000000000000000 00000000ffffffff
0000000000000000
[ 74.281553] page dumped because: kasan: bad access detected
[ 74.283166] addr ffff888025dc78b8 is located in stack of task
syz-executor.0/828 at offset 152 in frame:
[ 74.285238] io_write+0x0/0xe40
[ 74.286338] this frame has 3 objects:
[ 74.287170] [48, 56) 'iovec'
[ 74.287185] [80, 120) '__iter'
[ 74.287863] [160, 288) 'inline_vecs'
[ 74.289751] Memory state around the buggy address:
[ 74.290825] ffff888025dc7780: 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00
[ 74.292421] ffff888025dc7800: 00 00 00 00 f1 f1 f1 f1 00 00 00 f2
f2 f2 00 00
[ 74.294022] >ffff888025dc7880: 00 00 00 f2 f2 f2 f2 f2 00 00 00 00
00 00 00 00
[ 74.295639] ^
[ 74.296766] ffff888025dc7900: 00 00 00 00 00 00 00 00 f3 f3 f3 f3
00 00 00 00
[ 74.298373] ffff888025dc7980: 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00
[ 74.299959] ==================================================================
Not sure if this has been already reported or not, but I will be happy
to test if you have a fix for this.
--
Regards
Sudip
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: KASAN: stack-out-of-bounds in iov_iter_revert
2021-07-31 18:21 KASAN: stack-out-of-bounds in iov_iter_revert Sudip Mukherjee
@ 2021-08-01 0:10 ` Pavel Begunkov
2021-08-01 8:52 ` Pavel Begunkov
0 siblings, 1 reply; 9+ messages in thread
From: Pavel Begunkov @ 2021-08-01 0:10 UTC (permalink / raw)
To: Sudip Mukherjee, Jens Axboe; +Cc: io-uring, linux-kernel
On 7/31/21 7:21 PM, Sudip Mukherjee wrote:
> Hi Jens, Pavel,
>
> We had been running syzkaller on v5.10.y and a "KASAN:
> stack-out-of-bounds in iov_iter_revert" was being reported on it. I
> got some time to check that today and have managed to get a syzkaller
> reproducer. I dont have a C reproducer which I can share but I can use
> the syz-reproducer to reproduce this with v5.14-rc3 and also with
> next-20210730.
Can you try out the diff below? Not a full-fledged fix, but need to
check a hunch.
If that's important, I was using this branch:
git://git.kernel.dk/linux-block io_uring-5.14
diff --git a/fs/io_uring.c b/fs/io_uring.c
index bf548af0426c..fdcd25eca67d 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -3316,6 +3316,10 @@ static int io_read(struct io_kiocb *req, unsigned int issue_flags)
/* no retry on NONBLOCK nor RWF_NOWAIT */
if (req->flags & REQ_F_NOWAIT)
goto done;
+ if (WARN_ON_ONCE(iter->truncated)) {
+ iov_iter_reexpand(iter, iov_iter_count(iter) + iter->truncated);
+ iter->truncated = 0;
+ }
/* some cases will consume bytes even on error returns */
iov_iter_revert(iter, io_size - iov_iter_count(iter));
ret = 0;
@@ -3455,6 +3459,10 @@ static int io_write(struct io_kiocb *req, unsigned int issue_flags)
kiocb_done(kiocb, ret2, issue_flags);
} else {
copy_iov:
+ if (WARN_ON_ONCE(iter->truncated)) {
+ iov_iter_reexpand(iter, iov_iter_count(iter) + iter->truncated);
+ iter->truncated = 0;
+ }
/* some cases will consume bytes even on error returns */
iov_iter_revert(iter, io_size - iov_iter_count(iter));
ret = io_setup_async_rw(req, iovec, inline_vecs, iter, false);
diff --git a/include/linux/uio.h b/include/linux/uio.h
index 82c3c3e819e0..eff06d139fd4 100644
--- a/include/linux/uio.h
+++ b/include/linux/uio.h
@@ -30,6 +30,7 @@ enum iter_type {
struct iov_iter {
u8 iter_type;
bool data_source;
+ u16 truncated;
size_t iov_offset;
size_t count;
union {
@@ -254,8 +255,10 @@ static inline void iov_iter_truncate(struct iov_iter *i, u64 count)
* conversion in assignement is by definition greater than all
* values of size_t, including old i->count.
*/
- if (i->count > count)
+ if (i->count > count) {
+ i->truncated += i->count - count;
i->count = count;
+ }
}
/*
@@ -264,6 +267,8 @@ static inline void iov_iter_truncate(struct iov_iter *i, u64 count)
*/
static inline void iov_iter_reexpand(struct iov_iter *i, size_t count)
{
+ WARN_ON_ONCE(i->count > count);
+ i->truncated -= count - i->count;
i->count = count;
}
^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: KASAN: stack-out-of-bounds in iov_iter_revert
2021-08-01 0:10 ` Pavel Begunkov
@ 2021-08-01 8:52 ` Pavel Begunkov
2021-08-01 20:28 ` Sudip Mukherjee
0 siblings, 1 reply; 9+ messages in thread
From: Pavel Begunkov @ 2021-08-01 8:52 UTC (permalink / raw)
To: Sudip Mukherjee, Jens Axboe; +Cc: io-uring, linux-kernel
On 8/1/21 1:10 AM, Pavel Begunkov wrote:
> On 7/31/21 7:21 PM, Sudip Mukherjee wrote:
>> Hi Jens, Pavel,
>>
>> We had been running syzkaller on v5.10.y and a "KASAN:
>> stack-out-of-bounds in iov_iter_revert" was being reported on it. I
>> got some time to check that today and have managed to get a syzkaller
>> reproducer. I dont have a C reproducer which I can share but I can use
>> the syz-reproducer to reproduce this with v5.14-rc3 and also with
>> next-20210730.
>
> Can you try out the diff below? Not a full-fledged fix, but need to
> check a hunch.
>
> If that's important, I was using this branch:
> git://git.kernel.dk/linux-block io_uring-5.14
Or better this one, just in case it ooopses on warnings.
diff --git a/fs/io_uring.c b/fs/io_uring.c
index bf548af0426c..12284616854b 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -3316,6 +3316,11 @@ static int io_read(struct io_kiocb *req, unsigned int issue_flags)
/* no retry on NONBLOCK nor RWF_NOWAIT */
if (req->flags & REQ_F_NOWAIT)
goto done;
+ if (iter->truncated) {
+ printk("truncated rd: %i\n", (int)iter->truncated);
+ iov_iter_reexpand(iter, iov_iter_count(iter) + iter->truncated);
+ iter->truncated = 0;
+ }
/* some cases will consume bytes even on error returns */
iov_iter_revert(iter, io_size - iov_iter_count(iter));
ret = 0;
@@ -3455,6 +3460,11 @@ static int io_write(struct io_kiocb *req, unsigned int issue_flags)
kiocb_done(kiocb, ret2, issue_flags);
} else {
copy_iov:
+ if (iter->truncated) {
+ printk("truncated wr: %i\n", (int)iter->truncated);
+ iov_iter_reexpand(iter, iov_iter_count(iter) + iter->truncated);
+ iter->truncated = 0;
+ }
/* some cases will consume bytes even on error returns */
iov_iter_revert(iter, io_size - iov_iter_count(iter));
ret = io_setup_async_rw(req, iovec, inline_vecs, iter, false);
diff --git a/include/linux/uio.h b/include/linux/uio.h
index 82c3c3e819e0..eff06d139fd4 100644
--- a/include/linux/uio.h
+++ b/include/linux/uio.h
@@ -30,6 +30,7 @@ enum iter_type {
struct iov_iter {
u8 iter_type;
bool data_source;
+ u16 truncated;
size_t iov_offset;
size_t count;
union {
@@ -254,8 +255,10 @@ static inline void iov_iter_truncate(struct iov_iter *i, u64 count)
* conversion in assignement is by definition greater than all
* values of size_t, including old i->count.
*/
- if (i->count > count)
+ if (i->count > count) {
+ i->truncated += i->count - count;
i->count = count;
+ }
}
/*
@@ -264,6 +267,8 @@ static inline void iov_iter_truncate(struct iov_iter *i, u64 count)
*/
static inline void iov_iter_reexpand(struct iov_iter *i, size_t count)
{
+ WARN_ON_ONCE(i->count > count);
+ i->truncated -= count - i->count;
i->count = count;
}
^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: KASAN: stack-out-of-bounds in iov_iter_revert
2021-08-01 8:52 ` Pavel Begunkov
@ 2021-08-01 20:28 ` Sudip Mukherjee
2021-08-02 11:55 ` Pavel Begunkov
0 siblings, 1 reply; 9+ messages in thread
From: Sudip Mukherjee @ 2021-08-01 20:28 UTC (permalink / raw)
To: Pavel Begunkov; +Cc: Jens Axboe, io-uring, linux-kernel
Hi Pavel,
On Sun, Aug 1, 2021 at 9:52 AM Pavel Begunkov <asml.silence@gmail.com> wrote:
>
> On 8/1/21 1:10 AM, Pavel Begunkov wrote:
> > On 7/31/21 7:21 PM, Sudip Mukherjee wrote:
> >> Hi Jens, Pavel,
> >>
> >> We had been running syzkaller on v5.10.y and a "KASAN:
> >> stack-out-of-bounds in iov_iter_revert" was being reported on it. I
> >> got some time to check that today and have managed to get a syzkaller
> >> reproducer. I dont have a C reproducer which I can share but I can use
> >> the syz-reproducer to reproduce this with v5.14-rc3 and also with
> >> next-20210730.
> >
> > Can you try out the diff below? Not a full-fledged fix, but need to
> > check a hunch.
> >
> > If that's important, I was using this branch:
> > git://git.kernel.dk/linux-block io_uring-5.14
>
> Or better this one, just in case it ooopses on warnings.
I tested this one on top of "git://git.kernel.dk/linux-block
io_uring-5.14" and the issue was still seen, but after the BUG trace I
got lots of "truncated wr" message. The trace is:
[ 80.722255] BUG: KASAN: stack-out-of-bounds in iov_iter_revert+0x809/0x900
[ 80.723126] Read of size 8 at addr ffff8880246ff8b8 by task
syz-executor.10/7001
[ 80.724070]
[ 80.724274] CPU: 0 PID: 7001 Comm: syz-executor.10 Not tainted 5.14.0-rc1 #1
[ 80.725200] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[ 80.726688] Call Trace:
[ 80.727031] dump_stack_lvl+0x8b/0xb3
[ 80.727520] print_address_description.constprop.0+0x1f/0x140
[ 80.728307] ? iov_iter_revert+0x809/0x900
[ 80.728840] ? iov_iter_revert+0x809/0x900
[ 80.729358] kasan_report.cold+0x7f/0x11b
[ 80.729873] ? iov_iter_revert+0x809/0x900
[ 80.730406] iov_iter_revert+0x809/0x900
[ 80.730908] io_write+0x5c9/0xe90
[ 80.731356] ? io_read+0x1140/0x1140
[ 80.731835] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0
[ 80.732486] ? lock_is_held_type+0x98/0x110
[ 80.733029] ? __lock_acquire+0xbb1/0x5b00
[ 80.733541] io_issue_sqe+0x4da/0x6a80
[ 80.734063] ? mark_lock+0xfc/0x2d80
[ 80.734539] ? __is_insn_slot_addr+0x14d/0x250
[ 80.735169] ? lock_chain_count+0x20/0x20
[ 80.735702] ? io_write+0xe90/0xe90
[ 80.736167] ? lock_is_held_type+0x98/0x110
[ 80.736797] ? find_held_lock+0x2c/0x110
[ 80.737363] ? lock_release+0x1dd/0x6b0
[ 80.737897] ? __fget_files+0x21c/0x3e0
[ 80.738445] ? lock_downgrade+0x6d0/0x6d0
[ 80.738993] ? lock_release+0x1dd/0x6b0
[ 80.739507] __io_queue_sqe+0x1ac/0xe50
[ 80.740017] ? io_issue_sqe+0x6a80/0x6a80
[ 80.740564] ? lock_is_held_type+0x98/0x110
[ 80.741142] io_submit_sqes+0x3f6e/0x76a0
[ 80.741688] ? xa_load+0x158/0x290
[ 80.742173] ? __do_sys_io_uring_enter+0x90c/0x1a20
[ 80.742817] __do_sys_io_uring_enter+0x90c/0x1a20
[ 80.743436] ? vm_mmap_pgoff+0xe8/0x280
[ 80.743981] ? io_submit_sqes+0x76a0/0x76a0
[ 80.744539] ? randomize_stack_top+0x100/0x100
[ 80.745228] ? __do_sys_futex+0xf2/0x3d0
[ 80.745763] ? __do_sys_futex+0xfb/0x3d0
[ 80.746339] ? __restore_fpregs_from_fpstate+0xa0/0xe0
[ 80.747183] ? trace_event_raw_event_x86_fpu+0x3a0/0x3a0
[ 80.747960] ? lockdep_hardirqs_on_prepare+0x273/0x3e0
[ 80.748672] ? syscall_enter_from_user_mode+0x1d/0x50
[ 80.749422] do_syscall_64+0x3b/0x90
[ 80.750030] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 80.750880] RIP: 0033:0x466609
[ 80.751402] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40
00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24
08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89
01 48
[ 80.754298] RSP: 002b:00007f22e8d3a188 EFLAGS: 00000246 ORIG_RAX:
00000000000001aa
[ 80.755441] RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 0000000000466609
[ 80.756510] RDX: 0000000000000000 RSI: 00000000000058ab RDI: 0000000000000003
[ 80.757492] RBP: 00000000004bfcb9 R08: 0000000000000000 R09: 0000000000000000
[ 80.758474] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80
[ 80.759487] R13: 00007ffca119d4ef R14: 00007f22e8d3a300 R15: 0000000000022000
[ 80.760646]
[ 80.760908] The buggy address belongs to the page:
[ 80.761689] page:000000005ec48a9f refcount:0 mapcount:0
mapping:0000000000000000 index:0x0 pfn:0x246ff
[ 80.763184] flags: 0x100000000000000(node=0|zone=1)
[ 80.763966] raw: 0100000000000000 0000000000000000 ffffea000091bfc8
0000000000000000
[ 80.765064] raw: 0000000000000000 0000000000000000 00000000ffffffff
0000000000000000
[ 80.766127] page dumped because: kasan: bad access detected
[ 80.767038]
[ 80.767302] addr ffff8880246ff8b8 is located in stack of task
syz-executor.10/7001 at offset 152 in frame:
[ 80.768587] io_write+0x0/0xe90
[ 80.769039]
[ 80.769283] this frame has 3 objects:
[ 80.769776] [48, 56) 'iovec'
[ 80.769785] [80, 120) '__iter'
[ 80.770195] [160, 288) 'inline_vecs'
[ 80.770642]
[ 80.771323] Memory state around the buggy address:
[ 80.771975] ffff8880246ff780: 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00
[ 80.772970] ffff8880246ff800: 00 00 00 00 f1 f1 f1 f1 00 00 00 f2
f2 f2 00 00
[ 80.774020] >ffff8880246ff880: 00 00 00 f2 f2 f2 f2 f2 00 00 00 00
00 00 00 00
[ 80.775119] ^
[ 80.775963] ffff8880246ff900: 00 00 00 00 00 00 00 00 f3 f3 f3 f3
00 00 00 00
[ 80.777154] ffff8880246ff980: 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00
Lots of "truncated wr: 61440" and others.
[ 82.690641] truncated wr: 36864
[ 82.692929] truncated wr: 4096
[ 82.695404] truncated wr: 61440
[ 82.697840] truncated wr: 45056
[ 82.700011] truncated wr: 61440
[ 82.702401] truncated wr: 28672
[ 82.704855] truncated wr: 12288
[ 82.707070] truncated wr: 12288
[ 82.709388] truncated wr: 36864
[ 82.711758] truncated wr: 36864
[ 82.713977] truncated wr: 28672
[ 82.716176] truncated wr: 28672
and lots more.
--
Regards
Sudip
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: KASAN: stack-out-of-bounds in iov_iter_revert
2021-08-01 20:28 ` Sudip Mukherjee
@ 2021-08-02 11:55 ` Pavel Begunkov
2021-08-03 7:47 ` Sudip Mukherjee
0 siblings, 1 reply; 9+ messages in thread
From: Pavel Begunkov @ 2021-08-02 11:55 UTC (permalink / raw)
To: Sudip Mukherjee; +Cc: Jens Axboe, io-uring, linux-kernel
On 8/1/21 9:28 PM, Sudip Mukherjee wrote:
> Hi Pavel,
>
> On Sun, Aug 1, 2021 at 9:52 AM Pavel Begunkov <asml.silence@gmail.com> wrote:
>>
>> On 8/1/21 1:10 AM, Pavel Begunkov wrote:
>>> On 7/31/21 7:21 PM, Sudip Mukherjee wrote:
>>>> Hi Jens, Pavel,
>>>>
>>>> We had been running syzkaller on v5.10.y and a "KASAN:
>>>> stack-out-of-bounds in iov_iter_revert" was being reported on it. I
>>>> got some time to check that today and have managed to get a syzkaller
>>>> reproducer. I dont have a C reproducer which I can share but I can use
>>>> the syz-reproducer to reproduce this with v5.14-rc3 and also with
>>>> next-20210730.
>>>
>>> Can you try out the diff below? Not a full-fledged fix, but need to
>>> check a hunch.
>>>
>>> If that's important, I was using this branch:
>>> git://git.kernel.dk/linux-block io_uring-5.14
>>
>> Or better this one, just in case it ooopses on warnings.
>
> I tested this one on top of "git://git.kernel.dk/linux-block
> io_uring-5.14" and the issue was still seen, but after the BUG trace I
> got lots of "truncated wr" message. The trace is:
That's interesting, thanks
Can you share the syz reproducer?
> [ 80.722255] BUG: KASAN: stack-out-of-bounds in iov_iter_revert+0x809/0x900
> [ 80.723126] Read of size 8 at addr ffff8880246ff8b8 by task
> syz-executor.10/7001
> [ 80.724070]
> [ 80.724274] CPU: 0 PID: 7001 Comm: syz-executor.10 Not tainted 5.14.0-rc1 #1
> [ 80.725200] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
> BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
> [ 80.726688] Call Trace:
> [ 80.727031] dump_stack_lvl+0x8b/0xb3
> [ 80.727520] print_address_description.constprop.0+0x1f/0x140
> [ 80.728307] ? iov_iter_revert+0x809/0x900
> [ 80.728840] ? iov_iter_revert+0x809/0x900
> [ 80.729358] kasan_report.cold+0x7f/0x11b
> [ 80.729873] ? iov_iter_revert+0x809/0x900
> [ 80.730406] iov_iter_revert+0x809/0x900
> [ 80.730908] io_write+0x5c9/0xe90
> [ 80.731356] ? io_read+0x1140/0x1140
> [ 80.731835] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0
> [ 80.732486] ? lock_is_held_type+0x98/0x110
> [ 80.733029] ? __lock_acquire+0xbb1/0x5b00
> [ 80.733541] io_issue_sqe+0x4da/0x6a80
> [ 80.734063] ? mark_lock+0xfc/0x2d80
> [ 80.734539] ? __is_insn_slot_addr+0x14d/0x250
> [ 80.735169] ? lock_chain_count+0x20/0x20
> [ 80.735702] ? io_write+0xe90/0xe90
> [ 80.736167] ? lock_is_held_type+0x98/0x110
> [ 80.736797] ? find_held_lock+0x2c/0x110
> [ 80.737363] ? lock_release+0x1dd/0x6b0
> [ 80.737897] ? __fget_files+0x21c/0x3e0
> [ 80.738445] ? lock_downgrade+0x6d0/0x6d0
> [ 80.738993] ? lock_release+0x1dd/0x6b0
> [ 80.739507] __io_queue_sqe+0x1ac/0xe50
> [ 80.740017] ? io_issue_sqe+0x6a80/0x6a80
> [ 80.740564] ? lock_is_held_type+0x98/0x110
> [ 80.741142] io_submit_sqes+0x3f6e/0x76a0
> [ 80.741688] ? xa_load+0x158/0x290
> [ 80.742173] ? __do_sys_io_uring_enter+0x90c/0x1a20
> [ 80.742817] __do_sys_io_uring_enter+0x90c/0x1a20
> [ 80.743436] ? vm_mmap_pgoff+0xe8/0x280
> [ 80.743981] ? io_submit_sqes+0x76a0/0x76a0
> [ 80.744539] ? randomize_stack_top+0x100/0x100
> [ 80.745228] ? __do_sys_futex+0xf2/0x3d0
> [ 80.745763] ? __do_sys_futex+0xfb/0x3d0
> [ 80.746339] ? __restore_fpregs_from_fpstate+0xa0/0xe0
> [ 80.747183] ? trace_event_raw_event_x86_fpu+0x3a0/0x3a0
> [ 80.747960] ? lockdep_hardirqs_on_prepare+0x273/0x3e0
> [ 80.748672] ? syscall_enter_from_user_mode+0x1d/0x50
> [ 80.749422] do_syscall_64+0x3b/0x90
> [ 80.750030] entry_SYSCALL_64_after_hwframe+0x44/0xae
> [ 80.750880] RIP: 0033:0x466609
> [ 80.751402] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40
> 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24
> 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89
> 01 48
> [ 80.754298] RSP: 002b:00007f22e8d3a188 EFLAGS: 00000246 ORIG_RAX:
> 00000000000001aa
> [ 80.755441] RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 0000000000466609
> [ 80.756510] RDX: 0000000000000000 RSI: 00000000000058ab RDI: 0000000000000003
> [ 80.757492] RBP: 00000000004bfcb9 R08: 0000000000000000 R09: 0000000000000000
> [ 80.758474] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80
> [ 80.759487] R13: 00007ffca119d4ef R14: 00007f22e8d3a300 R15: 0000000000022000
> [ 80.760646]
> [ 80.760908] The buggy address belongs to the page:
> [ 80.761689] page:000000005ec48a9f refcount:0 mapcount:0
> mapping:0000000000000000 index:0x0 pfn:0x246ff
> [ 80.763184] flags: 0x100000000000000(node=0|zone=1)
> [ 80.763966] raw: 0100000000000000 0000000000000000 ffffea000091bfc8
> 0000000000000000
> [ 80.765064] raw: 0000000000000000 0000000000000000 00000000ffffffff
> 0000000000000000
> [ 80.766127] page dumped because: kasan: bad access detected
> [ 80.767038]
> [ 80.767302] addr ffff8880246ff8b8 is located in stack of task
> syz-executor.10/7001 at offset 152 in frame:
> [ 80.768587] io_write+0x0/0xe90
> [ 80.769039]
> [ 80.769283] this frame has 3 objects:
> [ 80.769776] [48, 56) 'iovec'
> [ 80.769785] [80, 120) '__iter'
> [ 80.770195] [160, 288) 'inline_vecs'
> [ 80.770642]
> [ 80.771323] Memory state around the buggy address:
> [ 80.771975] ffff8880246ff780: 00 00 00 00 00 00 00 00 00 00 00 00
> 00 00 00 00
> [ 80.772970] ffff8880246ff800: 00 00 00 00 f1 f1 f1 f1 00 00 00 f2
> f2 f2 00 00
> [ 80.774020] >ffff8880246ff880: 00 00 00 f2 f2 f2 f2 f2 00 00 00 00
> 00 00 00 00
> [ 80.775119] ^
> [ 80.775963] ffff8880246ff900: 00 00 00 00 00 00 00 00 f3 f3 f3 f3
> 00 00 00 00
> [ 80.777154] ffff8880246ff980: 00 00 00 00 00 00 00 00 00 00 00 00
> 00 00 00 00
>
> Lots of "truncated wr: 61440" and others.
> [ 82.690641] truncated wr: 36864
> [ 82.692929] truncated wr: 4096
> [ 82.695404] truncated wr: 61440
> [ 82.697840] truncated wr: 45056
> [ 82.700011] truncated wr: 61440
> [ 82.702401] truncated wr: 28672
> [ 82.704855] truncated wr: 12288
> [ 82.707070] truncated wr: 12288
> [ 82.709388] truncated wr: 36864
> [ 82.711758] truncated wr: 36864
> [ 82.713977] truncated wr: 28672
> [ 82.716176] truncated wr: 28672
> and lots more.
>
--
Pavel Begunkov
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: KASAN: stack-out-of-bounds in iov_iter_revert
2021-08-02 11:55 ` Pavel Begunkov
@ 2021-08-03 7:47 ` Sudip Mukherjee
2021-08-03 10:34 ` Pavel Begunkov
0 siblings, 1 reply; 9+ messages in thread
From: Sudip Mukherjee @ 2021-08-03 7:47 UTC (permalink / raw)
To: Pavel Begunkov; +Cc: Jens Axboe, io-uring, linux-kernel
On Mon, Aug 2, 2021 at 12:55 PM Pavel Begunkov <asml.silence@gmail.com> wrote:
>
> On 8/1/21 9:28 PM, Sudip Mukherjee wrote:
> > Hi Pavel,
> >
> > On Sun, Aug 1, 2021 at 9:52 AM Pavel Begunkov <asml.silence@gmail.com> wrote:
> >>
> >> On 8/1/21 1:10 AM, Pavel Begunkov wrote:
> >>> On 7/31/21 7:21 PM, Sudip Mukherjee wrote:
> >>>> Hi Jens, Pavel,
> >>>>
> >>>> We had been running syzkaller on v5.10.y and a "KASAN:
> >>>> stack-out-of-bounds in iov_iter_revert" was being reported on it. I
> >>>> got some time to check that today and have managed to get a syzkaller
> >>>> reproducer. I dont have a C reproducer which I can share but I can use
> >>>> the syz-reproducer to reproduce this with v5.14-rc3 and also with
> >>>> next-20210730.
> >>>
> >>> Can you try out the diff below? Not a full-fledged fix, but need to
> >>> check a hunch.
> >>>
> >>> If that's important, I was using this branch:
> >>> git://git.kernel.dk/linux-block io_uring-5.14
> >>
> >> Or better this one, just in case it ooopses on warnings.
> >
> > I tested this one on top of "git://git.kernel.dk/linux-block
> > io_uring-5.14" and the issue was still seen, but after the BUG trace I
> > got lots of "truncated wr" message. The trace is:
>
> That's interesting, thanks
> Can you share the syz reproducer?
Unfortunately I dont have a C reproducer, but this is the reproducer
for syzkaller:
r0 = syz_io_uring_setup(0x4d4f, &(0x7f0000000080)={0x0, 0x0, 0x1},
&(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x1000)=nil,
&(0x7f0000000000)=<r1=>0x0, &(0x7f0000000140))
r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x46e2, 0x0)
syz_io_uring_setup(0x1, &(0x7f0000000080),
&(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil,
&(0x7f0000000100), &(0x7f0000000140)=<r3=>0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000100)=@IORING_OP_WRITE={0x17,
0x0, 0x0, @fd=r2, 0x0, &(0x7f0000000200)="e2", 0xffffffffffffff98},
0x200)
io_uring_enter(r0, 0x58ab, 0x0, 0x0, 0x0, 0x0)
--
Regards
Sudip
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: KASAN: stack-out-of-bounds in iov_iter_revert
2021-08-03 7:47 ` Sudip Mukherjee
@ 2021-08-03 10:34 ` Pavel Begunkov
2021-08-03 13:18 ` Pavel Begunkov
2021-08-03 14:56 ` Sudip Mukherjee
0 siblings, 2 replies; 9+ messages in thread
From: Pavel Begunkov @ 2021-08-03 10:34 UTC (permalink / raw)
To: Sudip Mukherjee; +Cc: Jens Axboe, io-uring, linux-kernel
On 8/3/21 8:47 AM, Sudip Mukherjee wrote:
> On Mon, Aug 2, 2021 at 12:55 PM Pavel Begunkov <asml.silence@gmail.com> wrote:
>>
>> On 8/1/21 9:28 PM, Sudip Mukherjee wrote:
>>> Hi Pavel,
>>>
>>> On Sun, Aug 1, 2021 at 9:52 AM Pavel Begunkov <asml.silence@gmail.com> wrote:
>>>>
>>>> On 8/1/21 1:10 AM, Pavel Begunkov wrote:
>>>>> On 7/31/21 7:21 PM, Sudip Mukherjee wrote:
>>>>>> Hi Jens, Pavel,
>>>>>>
>>>>>> We had been running syzkaller on v5.10.y and a "KASAN:
>>>>>> stack-out-of-bounds in iov_iter_revert" was being reported on it. I
>>>>>> got some time to check that today and have managed to get a syzkaller
>>>>>> reproducer. I dont have a C reproducer which I can share but I can use
>>>>>> the syz-reproducer to reproduce this with v5.14-rc3 and also with
>>>>>> next-20210730.
>>>>>
>>>>> Can you try out the diff below? Not a full-fledged fix, but need to
>>>>> check a hunch.
>>>>>
>>>>> If that's important, I was using this branch:
>>>>> git://git.kernel.dk/linux-block io_uring-5.14
>>>>
>>>> Or better this one, just in case it ooopses on warnings.
>>>
>>> I tested this one on top of "git://git.kernel.dk/linux-block
>>> io_uring-5.14" and the issue was still seen, but after the BUG trace I
>>> got lots of "truncated wr" message. The trace is:
>>
>> That's interesting, thanks
>> Can you share the syz reproducer?
>
> Unfortunately I dont have a C reproducer, but this is the reproducer
> for syzkaller:
Thanks. Maybe I'm not perfectly familiar with syz, but were there
any options? Like threaded, collide, etc.?
>
> r0 = syz_io_uring_setup(0x4d4f, &(0x7f0000000080)={0x0, 0x0, 0x1},
> &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x1000)=nil,
> &(0x7f0000000000)=<r1=>0x0, &(0x7f0000000140))
> r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x46e2, 0x0)
> syz_io_uring_setup(0x1, &(0x7f0000000080),
> &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil,
> &(0x7f0000000100), &(0x7f0000000140)=<r3=>0x0)
> syz_io_uring_submit(r1, r3, &(0x7f0000000100)=@IORING_OP_WRITE={0x17,
> 0x0, 0x0, @fd=r2, 0x0, &(0x7f0000000200)="e2", 0xffffffffffffff98},
> 0x200)
> io_uring_enter(r0, 0x58ab, 0x0, 0x0, 0x0, 0x0)
>
>
--
Pavel Begunkov
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: KASAN: stack-out-of-bounds in iov_iter_revert
2021-08-03 10:34 ` Pavel Begunkov
@ 2021-08-03 13:18 ` Pavel Begunkov
2021-08-03 14:56 ` Sudip Mukherjee
1 sibling, 0 replies; 9+ messages in thread
From: Pavel Begunkov @ 2021-08-03 13:18 UTC (permalink / raw)
To: Sudip Mukherjee; +Cc: Jens Axboe, io-uring, linux-kernel
On 8/3/21 11:34 AM, Pavel Begunkov wrote:
> On 8/3/21 8:47 AM, Sudip Mukherjee wrote:
>> On Mon, Aug 2, 2021 at 12:55 PM Pavel Begunkov <asml.silence@gmail.com> wrote:
>>> On 8/1/21 9:28 PM, Sudip Mukherjee wrote:
>>>> On Sun, Aug 1, 2021 at 9:52 AM Pavel Begunkov <asml.silence@gmail.com> wrote:
>>>>> On 8/1/21 1:10 AM, Pavel Begunkov wrote:
>>>>>> On 7/31/21 7:21 PM, Sudip Mukherjee wrote:
>>>>>>> Hi Jens, Pavel,
>>>>>>>
>>>>>>> We had been running syzkaller on v5.10.y and a "KASAN:
>>>>>>> stack-out-of-bounds in iov_iter_revert" was being reported on it. I
>>>>>>> got some time to check that today and have managed to get a syzkaller
>>>>>>> reproducer. I dont have a C reproducer which I can share but I can use
>>>>>>> the syz-reproducer to reproduce this with v5.14-rc3 and also with
>>>>>>> next-20210730.
>>>>>>
>>>>>> Can you try out the diff below? Not a full-fledged fix, but need to
>>>>>> check a hunch.
>>>>>>
>>>>>> If that's important, I was using this branch:
>>>>>> git://git.kernel.dk/linux-block io_uring-5.14
>>>>>
>>>>> Or better this one, just in case it ooopses on warnings.
>>>>
>>>> I tested this one on top of "git://git.kernel.dk/linux-block
>>>> io_uring-5.14" and the issue was still seen, but after the BUG trace I
>>>> got lots of "truncated wr" message. The trace is:
>>>
>>> That's interesting, thanks
>>> Can you share the syz reproducer?
>>
>> Unfortunately I dont have a C reproducer, but this is the reproducer
>> for syzkaller:
>
> Thanks. Maybe I'm not perfectly familiar with syz, but were there
> any options? Like threaded, collide, etc.?
Never mind, reproduced the issue.
fwiw, I was too optimistic with u16 in the diff, but if
replaced with size_t, it solves the out-of-bounds bug,
but it has another issue.
In any case, need to patch it up, thanks
--
Pavel Begunkov
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: KASAN: stack-out-of-bounds in iov_iter_revert
2021-08-03 10:34 ` Pavel Begunkov
2021-08-03 13:18 ` Pavel Begunkov
@ 2021-08-03 14:56 ` Sudip Mukherjee
1 sibling, 0 replies; 9+ messages in thread
From: Sudip Mukherjee @ 2021-08-03 14:56 UTC (permalink / raw)
To: Pavel Begunkov; +Cc: Jens Axboe, io-uring, linux-kernel
On Tue, Aug 3, 2021 at 11:34 AM Pavel Begunkov <asml.silence@gmail.com> wrote:
>
> On 8/3/21 8:47 AM, Sudip Mukherjee wrote:
> > On Mon, Aug 2, 2021 at 12:55 PM Pavel Begunkov <asml.silence@gmail.com> wrote:
> >>
> >> On 8/1/21 9:28 PM, Sudip Mukherjee wrote:
> >>> Hi Pavel,
> >>>
> >>> On Sun, Aug 1, 2021 at 9:52 AM Pavel Begunkov <asml.silence@gmail.com> wrote:
> >>>>
> >>>> On 8/1/21 1:10 AM, Pavel Begunkov wrote:
> >>>>> On 7/31/21 7:21 PM, Sudip Mukherjee wrote:
> >>>>>> Hi Jens, Pavel,
> >>>>>>
> >>>>>> We had been running syzkaller on v5.10.y and a "KASAN:
> >>>>>> stack-out-of-bounds in iov_iter_revert" was being reported on it. I
> >>>>>> got some time to check that today and have managed to get a syzkaller
> >>>>>> reproducer. I dont have a C reproducer which I can share but I can use
> >>>>>> the syz-reproducer to reproduce this with v5.14-rc3 and also with
> >>>>>> next-20210730.
> >>>>>
> >>>>> Can you try out the diff below? Not a full-fledged fix, but need to
> >>>>> check a hunch.
> >>>>>
> >>>>> If that's important, I was using this branch:
> >>>>> git://git.kernel.dk/linux-block io_uring-5.14
> >>>>
> >>>> Or better this one, just in case it ooopses on warnings.
> >>>
> >>> I tested this one on top of "git://git.kernel.dk/linux-block
> >>> io_uring-5.14" and the issue was still seen, but after the BUG trace I
> >>> got lots of "truncated wr" message. The trace is:
> >>
> >> That's interesting, thanks
> >> Can you share the syz reproducer?
> >
> > Unfortunately I dont have a C reproducer, but this is the reproducer
> > for syzkaller:
>
> Thanks. Maybe I'm not perfectly familiar with syz, but were there
> any options? Like threaded, collide, etc.?
Sorry, my mistake. I am still learning how syzkaller works. And I
should have given the link to the report with my mail.
https://elisa-builder-00.iol.unh.edu/syzkaller/report?id=959057ecd2886ff0c38cc53fa9c8eae46c1d7496
And also, I now have a C reproducer also, if that helps.
--
Regards
Sudip
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2021-08-03 14:57 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-07-31 18:21 KASAN: stack-out-of-bounds in iov_iter_revert Sudip Mukherjee
2021-08-01 0:10 ` Pavel Begunkov
2021-08-01 8:52 ` Pavel Begunkov
2021-08-01 20:28 ` Sudip Mukherjee
2021-08-02 11:55 ` Pavel Begunkov
2021-08-03 7:47 ` Sudip Mukherjee
2021-08-03 10:34 ` Pavel Begunkov
2021-08-03 13:18 ` Pavel Begunkov
2021-08-03 14:56 ` Sudip Mukherjee
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).