From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3229BC64EC7 for ; Tue, 21 Feb 2023 16:33:53 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id AFC036B0071; Tue, 21 Feb 2023 11:33:52 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id AAC546B0072; Tue, 21 Feb 2023 11:33:52 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 99B5E6B0073; Tue, 21 Feb 2023 11:33:52 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id 895B56B0071 for ; Tue, 21 Feb 2023 11:33:52 -0500 (EST) Received: from smtpin11.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id 47FF11403B1 for ; Tue, 21 Feb 2023 16:33:52 +0000 (UTC) X-FDA: 80491845504.11.C5D14D3 Received: from mail-io1-f80.google.com (mail-io1-f80.google.com [209.85.166.80]) by imf12.hostedemail.com (Postfix) with ESMTP id A840940019 for ; Tue, 21 Feb 2023 16:33:49 +0000 (UTC) Authentication-Results: imf12.hostedemail.com; dkim=none; dmarc=fail reason="SPF not aligned (relaxed), No valid DKIM" header.from=appspotmail.com (policy=none); spf=pass (imf12.hostedemail.com: domain of 3bPL0YwkbAEs5BCxnyyr4n22vq.t11tyr75r4p106r06.p1z@M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com designates 209.85.166.80 as permitted sender) smtp.mailfrom=3bPL0YwkbAEs5BCxnyyr4n22vq.t11tyr75r4p106r06.p1z@M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1676997229; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding:in-reply-to: references; bh=oOhjUoQnskTkMpqfJaB/JbTGXYNinWurKj0BmzQc7Lg=; b=ZypvZX6dU3+gVkchngDDIbRH4tPYZwCA96zzOQfa7ANF1dP6H1V2rgpycenuWWiTZGpsdh I3AFmGS93e2rK0bI7M/zOC6z/V5mdPK2uQLwoBNi9TCNxWbs8hsKS2nSNmY3qaZuGU0GTX TX4cGDS/8Qx3F0gSWpQISwpukBKiwgM= ARC-Authentication-Results: i=1; imf12.hostedemail.com; dkim=none; dmarc=fail reason="SPF not aligned (relaxed), No valid DKIM" header.from=appspotmail.com (policy=none); spf=pass (imf12.hostedemail.com: domain of 3bPL0YwkbAEs5BCxnyyr4n22vq.t11tyr75r4p106r06.p1z@M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com designates 209.85.166.80 as permitted sender) smtp.mailfrom=3bPL0YwkbAEs5BCxnyyr4n22vq.t11tyr75r4p106r06.p1z@M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1676997229; a=rsa-sha256; cv=none; b=zk9+U5tgQdkt9nInmHoyDpV1f29PkOytul1jeD38ceaS4vdIWkVEzbpKPEUoyTmXpxAYvC lXmLrjMa++iX4UtGvt3BIlIcUSbl7WV7He2lFaDjy+Chm8Tim9DRtmtN5G+t17YUyaLr3T TKuQXQgNGuFz7Ic/TUEI6HFJceqmP3c= Received: by mail-io1-f80.google.com with SMTP id s1-20020a6bd301000000b0073e7646594aso2980837iob.8 for ; Tue, 21 Feb 2023 08:33:49 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=to:from:subject:message-id:date:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=oOhjUoQnskTkMpqfJaB/JbTGXYNinWurKj0BmzQc7Lg=; b=dcaQdGmoLZDXG3RvSXb9bPwzkGNziyhvrFzfA4PjOPwgbaoknGlU3OiTZgZnvmLpuQ ONThiun+GkhXE35SLgv7a2zn7coH3SRh3K4xndAMe7x7ajYcpL1n9wxU+s0iJfh/27xb i2UpYXyXyDOXeHCCSUDTyN2gxam9rs1NzqVvIaVz00C0w02gtXQGwq4hlUT4EGdwjkGN g0o5MJzAsplNg3pQazOKRQoFeCIa8C00HEPD91wNDFsS+vcw/ra99rjIpCTDMTYuev6E 8Bs0/chBzZIFxbgSx/AcqmosebhNSoYGFZLTJJbE1lqtd/hzbrNN428umJa6Z0oBye/s hQfg== X-Gm-Message-State: AO0yUKXdLSiRVMZJEln/VVgFzgzZaCzJK0qkPIqoIpyOL25K3rZ0rLMP E3sBB3+JdSI98dVVHQBLCUCiWtp5l7UcgKIn7gmnohgyvrVs X-Google-Smtp-Source: AK7set/PmndAY7N0ZzuZ+dYr5XjX7uymv3DMFsjWh1nTxgmR9l+EOwIp3PofBP7+WrQES5vr8ou/d7+MyZak1XoQdZlz4NHe81ac MIME-Version: 1.0 X-Received: by 2002:a6b:7e48:0:b0:73e:13d6:2552 with SMTP id k8-20020a6b7e48000000b0073e13d62552mr3432769ioq.70.1676997228951; Tue, 21 Feb 2023 08:33:48 -0800 (PST) Date: Tue, 21 Feb 2023 08:33:48 -0800 X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <0000000000001efd4205f53858e1@google.com> Subject: [syzbot] [hardening?] [mm?] BUG: bad usercopy in io_openat2_prep (3) From: syzbot To: akpm@linux-foundation.org, keescook@chromium.org, linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" X-Rspamd-Queue-Id: A840940019 X-Stat-Signature: hyf7xktmojwroqwkccbebkpz69n4adxt X-Rspam-User: X-Rspamd-Server: rspam08 X-HE-Tag: 1676997229-14078 X-HE-Meta: U2FsdGVkX19RppaciDQYqkpUelxaFpbCC4fcQG/ov3RwoZGdmCsk0lW88xyncEBrle0XVqpWWlYjB5ewDu5Kq87qtakLoXlySBRl+ycODBoP4NJnc5X/Cb7Xl/es6+97vQDSWgMdeHZxrh8YPJZWygcfLyAH7M1gUlcAByVxyr3zgpIJ1MXiV0eyBKerH+LoIStbMNJCQ35D9ZVHanF2m8FklTNgvD07nwPONcQ8NJb426kozQZTUxpaUrykeDm6cEd1k22aHKQt+Z7HzElk//aAb0r4nyTotu5ik/jqSGkue9K078KKKL/kCR6qgobpCe2dhPlzs4m6dcQKyI8hl0fq5y3uPIMFxWprH+N8OBgh0qYt9FhyM2IieFWTl5JG92JFDqhJt+f/ydsDYNtnVx53tF4CYSUo6GhfbwTThSBEvBVTY/to8RSW8/u/hvl5GZhhCMvtgMplPJJ+Uye1501zFf9rHnHGdv1GSkzNmXDeyHr3NQQQ/aLZSu+Z9n5391XpG1XMswYj5h9Qq/JQzVDm/oclZ36Rfxldt0cbi3HtbPdtMdOKcpgFnX+jOPwj30G60oC8DXdQzQvYIrtADY54WvsnEJt9AjlKB1il7TlKBSgvatQUPegq9r7XElKh16VdnxC5HkIvjb27BrjJUTjcAJTBXk65/KuSGpnA/kblSrISVuNRpmRmPevvW8kMnJs0CVXrkaLlKyVAsFptmA1zMh6jPDskwD9JB8jhJe/SznDUX15JC2fm6Cax++dcOBpNIKRRnk2Zth+tNcehGaZ4tYSmSknDrp8FAC9saxFO5s6PwjhPakmmGjKa+RSgg5zWD9FpcX0PtN8rFumjm6rS3H2sCuIy8s5nDUWC+V1yfTFegWDOGPK3WW7pCRBeCx8JYfmfq4FB9UF4Oe/m8AOvVIiKaBHxLrNq0EwcZK/VkRlLRI6vcksZlhmZCAVyE4PLKGT/svTiFvPboEF vU3psEGh UT0AA3PFFWaQiAu4xslrilMJMmKlv/XaQYGMk5iYTsmNMU3gm5CNJcNZyfoXSHC1yRMg6uuQDkuPm87CPbmmQtwXnRXLlrYe0Qxo1fw+yQqV8Pywcc1ZpgTlbr8Itf4g135ujgvUmNvp2mkqOdBos8dFVtpBmx0kWKzyv5g9Swa5A3UKuU6LNrla7RgrRXXnTM9pavZQXblG3cIJw1pJcpXFl4hvOUDRSNLmNBJPjqZYEXetJbZAyuWnrg+LRsXT0vH7JV9reJ1AsVEKDqJ2f15xn6DyqfmsCfPK/kfhbLUyaEmnSWbrZ2OuPTtd6BxZr6k7ZQunkNo+aVCwTiRsoGQk5kk1gDagXuuUPjrWu3WyE1j4ljCl+zpNXgDZkho0l+tRy2j24HF3934xGd/kugmBXk6vSJA/XyIGlwtgjgO7wQ3WXs/AUBSPqQYFObgZBpe+0bDsUlbPsX0dDhe/6qczK9iWpdIxWxl898CjKxYxrxQziOqRtTF2zxsZ44iQTE2S3m6gBf6vsxC1ZEq41KWjMG46qWU6WEsaRbOG7W9nJ9bWHUb9/yfRJ9k3X9NMlGSqPgh35HZ0LDc62ZeEUbLIiYNaN94wwaA+s4KEKiHYJaKkqHhWiwfBx2hZ7zgqwOsxxVJdpIu4r3I7vDTe2L6huVIU7GepNBfL7SKWLAmon26uAM46y5kQiqZ7IAREn3CehGfOwlZ3vTd7aHhYPGYooaDQ5Qu/m530nx0Dsp5T1zDAGPFwDBlOj/PPFhkA4cHql9hVkxwHO8hhnavn/GPtAlyCNl9mhaiiIW9bttXxMfx1fy3sCvBA8T/kdbBwsgsu3b6BIgTnPs35pK4uFhZ65mRfrNECHXNMhLI/8JpV75QaTlJC6mE/l1SKuOBRdRkFWcAs5hSTdj96Z3w+ceGIXcCJbOCAgd27pG0LoEsNJL7GsYKvFYSgFoGl449sm52w2tg8giy3+U+5sajOvxX/fuUKd RBFTXKC5 v8OHF8T2mjyCgQ3S+OlHt7Z/RHeOKIZYFD7wjZ4gTtK/5U3O3pvHzV0L5xbphQOYkezrnRMr8FBbrnY5MtEMPLhqbne35nV5Vo3fVladynnCIQ/HsXen4ou4oo3lI7b6bqRdpF+ASj0CGBYnfteMk7/VUTWy5t2MmFjHLD1WzEGqlDNdZmZwXJN0Msul3x83poU21gckD93LZh4p+DY2dlNhzCdfP5hhqBU05zYtoHChYpdv5QdzGrnLXDJh2RUVQDCfKAVpoHE1GUEHfR73vjNPngAmVgfBegX5RJjuDtoF3+Yfqccfktb+4Tb6qPJxMnzqq+9slO3O8mRgeHmGvjaQkks+odagJRoBsrGccJhq8WGfYOXv9HzVI9KyiUsEo1vSw6Q6exUSBjyliz1fv6QgoHwtTQxdWxsx2btPUM+OSUaS5fNOxA== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Hello, syzbot found the following issue on: HEAD commit: 2d3827b3f393 Merge branch 'for-next/core' into for-kernelci git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci console output: https://syzkaller.appspot.com/x/log.txt?x=14eb5abf480000 kernel config: https://syzkaller.appspot.com/x/.config?x=606ed7eeab569393 dashboard link: https://syzkaller.appspot.com/bug?extid=e443ef743ffab8e8bda9 compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 userspace arch: arm64 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13088227480000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1367b358c80000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/fd94d68ff17d/disk-2d3827b3.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/f304fbef0773/vmlinux-2d3827b3.xz kernel image: https://storage.googleapis.com/syzbot-assets/74eb318f51b0/Image-2d3827b3.gz.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+e443ef743ffab8e8bda9@syzkaller.appspotmail.com usercopy: Kernel memory overwrite attempt detected to SLUB object 'pid' (offset 24, size 24)! ------------[ cut here ]------------ kernel BUG at mm/usercopy.c:102! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 4410 Comm: syz-executor832 Not tainted 6.2.0-rc7-syzkaller-17907-g2d3827b3f393 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usercopy_abort+0x90/0x94 mm/usercopy.c:90 lr : usercopy_abort+0x90/0x94 mm/usercopy.c:90 sp : ffff800012ee3b90 x29: ffff800012ee3ba0 x28: 000000000000001c x27: ffff0000c72f8000 x26: 0000000020000000 x25: ffff80000cf52000 x24: fffffc0000000000 x23: 05ffc00000000200 x22: fffffc00030cbe40 x21: ffff0000c32f9f18 x20: 0000000000000000 x19: 0000000000000018 x18: 0000000000002bce x17: 63656a626f204255 x16: ffff0000c72f89f8 x15: ffff80000dbd2118 x14: ffff0000c72f8000 x13: 00000000ffffffff x12: ffff0000c72f8000 x11: ff808000081bbb4c x10: 0000000000000000 x9 : adc5950f6e29d600 x8 : adc5950f6e29d600 x7 : ffff80000bf650d4 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000001 x3 : 0000000000000000 x2 : ffff0001fefbff08 x1 : 0000000100000000 x0 : 000000000000005d Call trace: usercopy_abort+0x90/0x94 mm/usercopy.c:90 __check_heap_object+0xa8/0x100 mm/slub.c:4761 check_heap_object mm/usercopy.c:196 [inline] __check_object_size+0x208/0x6b8 mm/usercopy.c:251 check_object_size include/linux/thread_info.h:199 [inline] check_copy_size include/linux/thread_info.h:235 [inline] copy_from_user include/linux/uaccess.h:160 [inline] copy_struct_from_user include/linux/uaccess.h:341 [inline] io_openat2_prep+0xcc/0x2b8 io_uring/openclose.c:89 io_init_req io_uring/io_uring.c:2194 [inline] io_submit_sqe io_uring/io_uring.c:2241 [inline] io_submit_sqes+0x338/0xbb8 io_uring/io_uring.c:2395 __do_sys_io_uring_enter io_uring/io_uring.c:3343 [inline] __se_sys_io_uring_enter io_uring/io_uring.c:3275 [inline] __arm64_sys_io_uring_enter+0x168/0x1308 io_uring/io_uring.c:3275 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x64/0x178 arch/arm64/kernel/syscall.c:52 el0_svc_common+0xbc/0x180 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x48/0x110 arch/arm64/kernel/syscall.c:193 el0_svc+0x58/0x14c arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591 Code: 91388800 aa0903e1 f90003e8 94e6d752 (d4210000) ---[ end trace 0000000000000000 ]--- --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. syzbot can test patches for this issue, for details see: https://goo.gl/tpsmEJ#testing-patches