KASAN: null-ptr-deref Write in io_file_get_normal

From: Jiacheng Xu
Date: Tue Aug 16 2022 - 12:11:09 EST


Hello,

When using modified Syzkaller to fuzz the Linux kernel-5.15.58, the
following crash was triggered.

HEAD commit: 568035b01cfb Linux-5.15.58
git tree: upstream

console output:
https://drive.google.com/file/d/1lW1tGegMXfLgS1gfyWmZShhX7LOx3vFJ/view?usp=sharing
kernel config: https://drive.google.com/file/d/1wgIUDwP5ho29AM-K7HhysSTfWFpfXYkG/view?usp=sharing
syz repro: https://drive.google.com/file/d/13l2TaalviEK6WBoXjF4tAiYfSUmlzstU/view?usp=sharing
C reproducer: https://drive.google.com/file/d/1iHOn1jRiQs4iKxxRTDZcATyJcZlVFQqR/view?usp=sharing

There is a similar problem: https://www.spinics.net/lists/io-uring/msg13047.html

Environment:
Ubuntu 20.04 on Linux 5.4.0
QEMU 4.2.1:
qemu-system-x86_64 \
-m 2G \
-smp 2 \
-kernel /home/workdir/bzImage \
-append "console=ttyS0 root=/dev/sda earlyprintk=serial net.ifnames=0" \
-drive file=/home/workdir/stretch.img,format=raw \
-net user,host=10.0.2.10,hostfwd=tcp:127.0.0.1:10021-:22 \
-net nic,model=e1000 \
-enable-kvm \
-nographic \
-pidfile vm.pid \
2>&1 | tee vm.log

If you fix this issue, please add the following tag to the commit:
Reported-by: Jiacheng Xu<stitch@xxxxxxxxxx>

==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read_write
include/linux/instrumented.h:101 [inline]
BUG: KASAN: null-ptr-deref in atomic_inc
include/linux/atomic/atomic-instrumented.h:181 [inline]
BUG: KASAN: null-ptr-deref in io_req_track_inflight fs/io_uring.c:1408 [inline]
BUG: KASAN: null-ptr-deref in io_file_get_normal+0x318/0x340 fs/io_uring.c:6934
Write of size 4 at addr 0000000000000118 by task iou-wrk-13680/13681

CPU: 3 PID: 13681 Comm: iou-wrk-13680 Not tainted 5.15.58 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106
__kasan_report mm/kasan/report.c:446 [inline]
kasan_report.cold+0x66/0xdf mm/kasan/report.c:459
check_region_inline mm/kasan/generic.c:183 [inline]
kasan_check_range+0x14e/0x1b0 mm/kasan/generic.c:189
instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
atomic_inc include/linux/atomic/atomic-instrumented.h:181 [inline]
io_req_track_inflight fs/io_uring.c:1408 [inline]
io_file_get_normal+0x318/0x340 fs/io_uring.c:6934
io_file_get fs/io_uring.c:6944 [inline]
io_tee fs/io_uring.c:4051 [inline]
io_issue_sqe+0x4ad9/0x7540 fs/io_uring.c:6797
io_wq_submit_work+0x1bc/0x390 fs/io_uring.c:6863
io_worker_handle_work+0x97c/0x1710 fs/io-wq.c:576
io_wqe_worker+0x5b1/0xd30 fs/io-wq.c:630
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
</TASK>
==================================================================
Kernel panic - not syncing: panic_on_warn set ...
CPU: 2 PID: 13681 Comm: iou-wrk-13680 Tainted: G B 5.15.58 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106
panic+0x2b0/0x6dd kernel/panic.c:232
end_report mm/kasan/report.c:128 [inline]
end_report.cold+0x63/0x6f mm/kasan/report.c:113
__kasan_report mm/kasan/report.c:449 [inline]
kasan_report.cold+0x71/0xdf mm/kasan/report.c:459
check_region_inline mm/kasan/generic.c:183 [inline]
kasan_check_range+0x14e/0x1b0 mm/kasan/generic.c:189
instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
atomic_inc include/linux/atomic/atomic-instrumented.h:181 [inline]
io_req_track_inflight fs/io_uring.c:1408 [inline]
io_file_get_normal+0x318/0x340 fs/io_uring.c:6934
io_file_get fs/io_uring.c:6944 [inline]
io_tee fs/io_uring.c:4051 [inline]
io_issue_sqe+0x4ad9/0x7540 fs/io_uring.c:6797
io_wq_submit_work+0x1bc/0x390 fs/io_uring.c:6863
io_worker_handle_work+0x97c/0x1710 fs/io-wq.c:576
io_wqe_worker+0x5b1/0xd30 fs/io-wq.c:630
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
</TASK>