On 04/08/2020 15:56, Liu Yong wrote:
> In io_send_recvmsg(), there is no check for the req->file.
> User can change the opcode from IORING_OP_NOP to IORING_OP_SENDMSG
> through competition after the io_req_set_file().
After sqe->opcode is read and copied in io_init_req(), it only uses
in-kernel req->opcode. Also, io_init_req() should check for req->file
NULL, so shouldn't happen after.
Do you have a reproducer? What kernel version did you use?
>
> This vulnerability will leak sensitive kernel information.
>
> [352693.910110] BUG: kernel NULL pointer dereference, address: 0000000000000028
> [352693.910112] #PF: supervisor read access in kernel mode
> [352693.910112] #PF: error_code(0x0000) - not-present page
> [352693.910113] PGD 8000000251396067 P4D 8000000251396067 PUD 1d64ba067 PMD 0
> [352693.910115] Oops: 0000 [#3] SMP PTI
> [352693.910116] CPU: 11 PID: 303132 Comm: test Tainted: G D
> [352693.910117] Hardware name: Dell Inc. OptiPlex 3060/0T0MHW, BIOS 1.4.2 06/11/2019
> [352693.910120] RIP: 0010:sock_from_file+0x9/0x30
> [352693.910122] RSP: 0018:ffffc0a5084cfc50 EFLAGS: 00010246
> [352693.910122] RAX: ffff9f6ee284d000 RBX: ffff9f6bd3675000 RCX: ffffffff8b111340
> [352693.910123] RDX: 0000000000000001 RSI: ffffc0a5084cfc64 RDI: 0000000000000000
> [352693.910124] RBP: ffffc0a5084cfc50 R08: 0000000000000000 R09: ffff9f6ee51a9200
> [352693.910124] R10: ffff9f6ee284d200 R11: 0000000000000000 R12: ffff9f6ee51a9200
> [352693.910125] R13: 0000000000000001 R14: ffffffff8b111340 R15: ffff9f6ee284d000
> [352693.910126] FS: 00000000016d7880(0000) GS:ffff9f6eee2c0000(0000) knlGS:0000000000000000
> [352693.910126] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [352693.910127] CR2: 0000000000000028 CR3: 000000041fb4a005 CR4: 00000000003626e0
> [352693.910127] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [352693.910128] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [352693.910128] Call Trace:
> [352693.910132] io_send_recvmsg+0x49/0x170
> [352693.910134] ? __switch_to_asm+0x34/0x70
> [352693.910135] __io_submit_sqe+0x45e/0x8e0
> [352693.910136] ? __switch_to_asm+0x34/0x70
> [352693.910137] ? __switch_to_asm+0x40/0x70
> [352693.910138] ? __switch_to_asm+0x34/0x70
> [352693.910138] ? __switch_to_asm+0x40/0x70
> [352693.910139] ? __switch_to_asm+0x34/0x70
> [352693.910140] ? __switch_to_asm+0x40/0x70
> [352693.910141] ? __switch_to_asm+0x34/0x70
> [352693.910142] ? __switch_to_asm+0x40/0x70
> [352693.910143] ? __switch_to_asm+0x34/0x70
> [352693.910144] ? __switch_to_asm+0x34/0x70
> [352693.910145] __io_queue_sqe+0x23/0x230
> [352693.910146] io_queue_sqe+0x7a/0x90
> [352693.910148] io_submit_sqe+0x23d/0x330
> [352693.910149] io_ring_submit+0xca/0x200
> [352693.910150] ? do_nanosleep+0xad/0x160
> [352693.910151] ? hrtimer_init_sleeper+0x2c/0x90
> [352693.910152] ? hrtimer_nanosleep+0xc2/0x1a0
> [352693.910154] __x64_sys_io_uring_enter+0x1e4/0x2c0
> [352693.910156] do_syscall_64+0x57/0x190
> [352693.910157] entry_SYSCALL_64_after_hwframe+0x44/0xa9
>
> Signed-off-by: Liu Yong <pkfxxxing@xxxxxxxxx>
> ---
> fs/io_uring.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/fs/io_uring.c b/fs/io_uring.c
> index e0200406765c..0a26100b8260 100644
> --- a/fs/io_uring.c
> +++ b/fs/io_uring.c
> @@ -1675,6 +1675,9 @@ static int io_send_recvmsg(struct io_kiocb *req, const struct io_uring_sqe *sqe,
> if (unlikely(req->ctx->flags & IORING_SETUP_IOPOLL))
> return -EINVAL;
>
> + if (!req->file)
> + return -EBADF;
> +
> sock = sock_from_file(req->file, &ret);
> if (sock) {
> struct user_msghdr __user *msg;
>
--
Pavel Begunkov
