Sure, I'm glad I could help. The kernel no longer crashes after this
patch, so it seems to be the right fix.
On Thu, Dec 12, 2024 at 3:58 PM Jens Axboe <axboe@xxxxxxxxx> wrote:
>
> On 12/12/24 3:06 AM, chase xd wrote:
> > Syzkaller hit 'general protection fault in io_register_clone_buffers' bug.
> >
> > Oops: general protection fault, probably for non-canonical address
> > 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN NOPTI
> > KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
> > CPU: 5 UID: 0 PID: 12910 Comm: syz-executor169 Not tainted
> > 6.12.0-rc4-00089-g7eb75ce75271-dirty #7
> > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> > RIP: 0010:io_clone_buffers io_uring/rsrc.c:1039 [inline]
> > RIP: 0010:io_register_clone_buffers+0xbb1/0xf40 io_uring/rsrc.c:1076
> > Code: 48 63 c3 41 89 dd 4c 8d 3c c6 4c 89 fa 48 c1 ea 03 42 80 3c 22
> > 00 0f 85 61 02 00 00 49 8b 17 48 8d 7a 10 48 89 f9 48 c1 e9 03 <42> 80
> > 3c 21 00 0f 85 62 02 00 00 48 8b 72 10 4c 89 f7 e8 b8 93 ff
> > RSP: 0018:ffffc90011047bd8 EFLAGS: 00010212
> > RAX: 0000000000000001 RBX: 0000000000000001 RCX: 0000000000000002
> > RDX: 0000000000000000 RSI: ffff888017acfec0 RDI: 0000000000000010
> > RBP: ffffc90011047d28 R08: 0000000000000000 R09: fffffbfff1dbb731
> > R10: 0000000000000002 R11: 0000000000000000 R12: dffffc0000000000
> > R13: 0000000000000001 R14: ffff888021760000 R15: ffff888017acfec8
> > FS: 00007fcbf80f4640(0000) GS:ffff88823bf00000(0000) knlGS:0000000000000000
> > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > CR2: 00007fcbf806e658 CR3: 000000002420a000 CR4: 0000000000750ef0
> > PKRU: 55555554
> > Call Trace:
> > <TASK>
> > __io_uring_register+0x922/0x2290 io_uring/register.c:804
> > __do_sys_io_uring_register io_uring/register.c:907 [inline]
> > __se_sys_io_uring_register io_uring/register.c:884 [inline]
> > __x64_sys_io_uring_register+0x178/0x2b0 io_uring/register.c:884
> > do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> > do_syscall_64+0xcb/0x250 arch/x86/entry/common.c:83
> > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > RIP: 0033:0x7fcbf815322d
> > Code: c3 e8 77 24 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48
> > 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
> > 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
> > RSP: 002b:00007fcbf80f41a8 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab
> > RAX: ffffffffffffffda RBX: 00007fcbf81f5088 RCX: 00007fcbf815322d
> > RDX: 0000000020000600 RSI: 000000000000001e RDI: 0000000000000004
> > RBP: 00007fcbf81f5080 R08: 0000000000000000 R09: 0000000000000000
> > R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000c90
> > R13: 0000000000000003 R14: 00007fcbf811a630 R15: 00007fcbf80d4000
> > </TASK>
> > Modules linked in:
> > ---[ end trace 0000000000000000 ]---
> > RIP: 0010:io_clone_buffers io_uring/rsrc.c:1039 [inline]
> > RIP: 0010:io_register_clone_buffers+0xbb1/0xf40 io_uring/rsrc.c:1076
>
> I can't run these crazy syzbot reproducers, I do wish they'd be dwindled
> down to the bare minimum rather than have tons of unrelated bits in
> there. That said, can you check with this patch?
>
> diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
> index adaae8630932..077f84684c18 100644
> --- a/io_uring/rsrc.c
> +++ b/io_uring/rsrc.c
> @@ -1036,8 +1036,10 @@ static int io_clone_buffers(struct io_ring_ctx *ctx, struct io_ring_ctx *src_ctx
> out_put_free:
> i = data.nr;
> while (i--) {
> - io_buffer_unmap(src_ctx, data.nodes[i]);
> - kfree(data.nodes[i]);
> + if (data.nodes[i]) {
> + io_buffer_unmap(src_ctx, data.nodes[i]);
> + kfree(data.nodes[i]);
> + }
> }
> out_unlock:
> io_rsrc_data_free(ctx, &data);
>
> --
> Jens Axboe
