Re: KASAN: stack-out-of-bounds Read in iov_iter_revert
From: Pavel Begunkov
Date: Sun May 02 2021 - 06:37:31 EST
On 5/2/21 11:09 AM, Palash Oswal wrote:
> Hello,
>
> My syzkaller instance discovered 'KASAN: stack-out-of-bounds Read in
> iov_iter_revert' bug on the v5.12 kernel (head
> 9f4ad9e425a1d3b6a34617b8ea226d56a119a717)
May be related to
http://mail.spinics.net/lists/io-uring/msg07874.html
Was it raw bdev I/O, or a normal filesystem?
>
> ==================================================================
> Kernel Crash Console Logs:
> BUG: KASAN: stack-out-of-bounds in iov_iter_revert+0x158/0x510
> lib/iov_iter.c:1144
> Read of size 8 at addr ffffc90000d7fa08 by task syz-executor871/333
>
> CPU: 0 PID: 333 Comm: syz-executor871 Not tainted 5.12.0 #16
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
> 1.13.0-1ubuntu1.1 04/01/2014
> Call Trace:
> __dump_stack lib/dump_stack.c:79 [inline]
> dump_stack+0xe9/0x15b lib/dump_stack.c:120
> print_address_description+0x81/0x3d0 mm/kasan/report.c:232
> __kasan_report+0x170/0x1c0 mm/kasan/report.c:399
> kasan_report+0x4f/0x70 mm/kasan/report.c:416
> check_region_inline mm/kasan/generic.c:177 [inline]
> __asan_load8+0x94/0xb0 mm/kasan/generic.c:253
> iov_iter_revert+0x158/0x510 lib/iov_iter.c:1144
> io_write fs/io_uring.c:3457 [inline]
> io_issue_sqe+0x3ce8/0x6050 fs/io_uring.c:6061
> __io_queue_sqe+0xcd/0x3a0 fs/io_uring.c:6322
> io_queue_sqe+0x7a/0x180 fs/io_uring.c:6375
> io_submit_sqe+0x813/0xa10 fs/io_uring.c:6546
> io_submit_sqes+0x61c/0xad0 fs/io_uring.c:6660
> __do_sys_io_uring_enter fs/io_uring.c:9240 [inline]
> __se_sys_io_uring_enter+0x28f/0xce0 fs/io_uring.c:9182
> __x64_sys_io_uring_enter+0x82/0xa0 fs/io_uring.c:9182
> do_syscall_64+0x37/0x80 arch/x86/entry/common.c:46
> entry_SYSCALL_64_after_hwframe+0x44/0xae
> RIP: 0033:0x44a2ed
> Code: 28 c3 e8 06 2a 00 00 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48
> 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
> 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007ffcc8342468 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa
> RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000044a2ed
> RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000003
> RBP: 00007ffcc8342480 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcc8342490
> R13: 0000000000000000 R14: 00000000004c1018 R15: 0000000000000000
>
>
> addr ffffc90000d7fa08 is located in stack of task syz-executor871/333
> at offset 1672 in frame:
> io_issue_sqe+0x0/0x6050 include/linux/refcount.h:283
>
> this frame has 17 objects:
> [32, 48) 'up.i'
> [64, 72) 'file.i667'
> [96, 112) 'data.i6.i'
> [128, 144) 'data.i.i'
> [160, 288) '__io.i'
> [320, 416) 'msg.i424'
> [448, 464) 'iov.i425'
> [480, 848) 'iomsg.i370'
> [912, 1008) 'msg.i'
> [1040, 1056) 'iov.i'
> [1072, 1440) 'iomsg.i'
> [1504, 1536) 'ipt.i'
> [1568, 1576) 'iovec.i182'
> [1600, 1640) '__iter.i183'
> [1680, 1808) 'inline_vecs.i'
> [1840, 1848) 'iovec.i'
> [1872, 1912) '__iter.i'
>
> Memory state around the buggy address:
> ffffc90000d7f900: 00 00 00 00 f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00
> ffffc90000d7f980: f2 f2 f2 f2 00 f2 f2 f2 00 00 00 00 00 f2 f2 f2
>> ffffc90000d7fa00: f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> ^
> ffffc90000d7fa80: 00 00 f2 f2 f2 f2 00 f2 f2 f2 00 00 00 00 00 f3
> ffffc90000d7fb00: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
> ==================================================================
>
> Syzkaller reproducer:
> # {Threaded:false Collide:false Repeat:false RepeatTimes:0 Procs:1
> Slowdown:1 Sandbox:none Fault:false FaultCall:-1 FaultNth:0 Leak:false
> NetInjection:false NetDevices:false NetReset:false Cgroups:false
> BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false
> VhciInjection:false Wifi:false IEEE802154:false Sysctl:false
> UseTmpDir:false HandleSegv:false Repro:false Trace:false}
> r0 = syz_io_uring_setup(0x2, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0,
> 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil,
> &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000240)=<r2=>0x0)
> r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x4541, 0x0)
> syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17,
> 0x0, 0x0, @fd=r3, 0x0, 0x0, 0xfffffffffffffff4}, 0x20)
> io_uring_enter(r0, 0x1, 0x0, 0x0, 0x0, 0x0)
>
> C reproducer:
> #define _GNU_SOURCE
>
> #include <errno.h>
> #include <fcntl.h>
> #include <stdarg.h>
> #include <stdbool.h>
> #include <stdint.h>
> #include <stdio.h>
> #include <stdlib.h>
> #include <string.h>
> #include <sys/mman.h>
> #include <sys/prctl.h>
> #include <sys/resource.h>
> #include <sys/syscall.h>
> #include <sys/wait.h>
> #include <unistd.h>
>
>
> #define SIZEOF_IO_URING_SQE 64
> #define SIZEOF_IO_URING_CQE 16
> #define SQ_TAIL_OFFSET 64
> #define SQ_RING_MASK_OFFSET 256
> #define SQ_RING_ENTRIES_OFFSET 264
> #define CQ_RING_ENTRIES_OFFSET 268
> #define CQ_CQES_OFFSET 320
>
> struct io_sqring_offsets {
> uint32_t head;
> uint32_t tail;
> uint32_t ring_mask;
> uint32_t ring_entries;
> uint32_t flags;
> uint32_t dropped;
> uint32_t array;
> uint32_t resv1;
> uint64_t resv2;
> };
>
> struct io_cqring_offsets {
> uint32_t head;
> uint32_t tail;
> uint32_t ring_mask;
> uint32_t ring_entries;
> uint32_t overflow;
> uint32_t cqes;
> uint64_t resv[2];
> };
>
> struct io_uring_params {
> uint32_t sq_entries;
> uint32_t cq_entries;
> uint32_t flags;
> uint32_t sq_thread_cpu;
> uint32_t sq_thread_idle;
> uint32_t features;
> uint32_t resv[4];
> struct io_sqring_offsets sq_off;
> struct io_cqring_offsets cq_off;
> };
>
> #define IORING_OFF_SQ_RING 0
> #define IORING_OFF_SQES 0x10000000ULL
>
> #define sys_io_uring_setup 425
> static long syz_io_uring_setup(volatile long a0, volatile long a1,
> volatile long a2, volatile long a3,
> volatile long a4, volatile long a5)
> {
> uint32_t entries = (uint32_t)a0;
> struct io_uring_params* setup_params = (struct io_uring_params*)a1;
> void* vma1 = (void*)a2;
> void* vma2 = (void*)a3;
> void** ring_ptr_out = (void**)a4;
> void** sqes_ptr_out = (void**)a5;
> uint32_t fd_io_uring = syscall(sys_io_uring_setup, entries, setup_params);
> uint32_t sq_ring_sz =
> setup_params->sq_off.array + setup_params->sq_entries *
> sizeof(uint32_t);
> uint32_t cq_ring_sz = setup_params->cq_off.cqes +
> setup_params->cq_entries * SIZEOF_IO_URING_CQE;
> uint32_t ring_sz = sq_ring_sz > cq_ring_sz ? sq_ring_sz : cq_ring_sz;
> *ring_ptr_out = mmap(vma1, ring_sz, PROT_READ | PROT_WRITE,
> MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring,
> IORING_OFF_SQ_RING);
> uint32_t sqes_sz = setup_params->sq_entries * SIZEOF_IO_URING_SQE;
> *sqes_ptr_out =
> mmap(vma2, sqes_sz, PROT_READ | PROT_WRITE,
> MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring,
> IORING_OFF_SQES);
> return fd_io_uring;
> }
>
> static long syz_io_uring_submit(volatile long a0, volatile long a1,
> volatile long a2, volatile long a3)
> {
> char* ring_ptr = (char*)a0;
> char* sqes_ptr = (char*)a1;
> char* sqe = (char*)a2;
> uint32_t sqes_index = (uint32_t)a3;
> uint32_t sq_ring_entries = *(uint32_t*)(ring_ptr + SQ_RING_ENTRIES_OFFSET);
> uint32_t cq_ring_entries = *(uint32_t*)(ring_ptr + CQ_RING_ENTRIES_OFFSET);
> uint32_t sq_array_off =
> (CQ_CQES_OFFSET + cq_ring_entries * SIZEOF_IO_URING_CQE + 63) & ~63;
> if (sq_ring_entries)
> sqes_index %= sq_ring_entries;
> char* sqe_dest = sqes_ptr + sqes_index * SIZEOF_IO_URING_SQE;
> memcpy(sqe_dest, sqe, SIZEOF_IO_URING_SQE);
> uint32_t sq_ring_mask = *(uint32_t*)(ring_ptr + SQ_RING_MASK_OFFSET);
> uint32_t* sq_tail_ptr = (uint32_t*)(ring_ptr + SQ_TAIL_OFFSET);
> uint32_t sq_tail = *sq_tail_ptr & sq_ring_mask;
> uint32_t sq_tail_next = *sq_tail_ptr + 1;
> uint32_t* sq_array = (uint32_t*)(ring_ptr + sq_array_off);
> *(sq_array + sq_tail) = sqes_index;
> __atomic_store_n(sq_tail_ptr, sq_tail_next, __ATOMIC_RELEASE);
> return 0;
> }
>
> #ifndef __NR_io_uring_enter
> #define __NR_io_uring_enter 426
> #endif
>
> uint64_t r[4] = {0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff};
>
> void trigger_bug(void)
> {
> intptr_t res = 0;
> *(uint32_t*)0x20000084 = 0;
> *(uint32_t*)0x20000088 = 0;
> *(uint32_t*)0x2000008c = 0;
> *(uint32_t*)0x20000090 = 0;
> *(uint32_t*)0x20000098 = 0;
> memset((void*)0x2000009c, 0, 12);
> res = -1;
> res = syz_io_uring_setup(2, 0x20000080, 0x200a0000, 0x200b0000, 0x20000100,
> 0x20000240);
> // res = 3
> if (res != -1) {
> r[0] = res; //3
> r[1] = *(uint64_t*)0x20000100; // 0x0
> r[2] = *(uint64_t*)0x20000240; // ./file
> }
> memcpy((void*)0x20000040, "./file0\000", 8);
> res = syscall(__NR_openat, 0xffffff9c, 0x20000040ul, 0x4541ul, 0ul);
> if (res != -1)
> r[3] = res;
> *(uint8_t*)0x20000000 = 0x17;
> *(uint8_t*)0x20000001 = 0;
> *(uint16_t*)0x20000002 = 0;
> *(uint32_t*)0x20000004 = r[3];
> *(uint64_t*)0x20000008 = 0;
> *(uint64_t*)0x20000010 = 0;
> *(uint32_t*)0x20000018 = 0xfffffff4;
> *(uint32_t*)0x2000001c = 0;
> *(uint64_t*)0x20000020 = 0;
> *(uint16_t*)0x20000028 = 0;
> *(uint16_t*)0x2000002a = 0;
> syz_io_uring_submit(r[1], r[2], 0x20000000, 0x20);
> syscall(__NR_io_uring_enter, r[0], 1, 0, 0ul, 0ul, 0ul);
> }
> int main(void)
> {
> // Preparatory steps
> struct rlimit rlim;
> rlim.rlim_cur = rlim.rlim_max = 136 << 20;
> setrlimit(RLIMIT_FSIZE, &rlim);
> syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);
> trigger_bug();
> return 0;
>
> }
>
> Kernel build config :
> https://gist.github.com/oswalpalash/18e847d6e24e3452bc811526fd6f76bb
>
> This issue has not yet been discovered by syzbot.
> When rlimit is not set, unroll is set to 0. But when rlimit is set,
> iov_iter_revert gets the input unroll = 2147479542 ( = MAX_RW_COUNT -
> i->count ) and the only warning check implemented in that function is
> if (WARN_ON(unroll > MAX_RW_COUNT))
> return;
>
> I'm still trying to understand this code better, but initially suspect
> the warning check needs to be re-done.
>
--
Pavel Begunkov