Re: BUG: unable to handle kernel NULL pointer dereference in posix_get_monotonic_timespec

From: Thomas Gleixner
Date: Thu Dec 01 2022 - 17:04:23 EST


On Thu, Nov 17 2022 at 22:38, Wei Chen wrote:

> Dear Linux Developer,
>
> Recently when using our tool to fuzz kernel, the following crash was triggered.
>
> HEAD commit: d418a331631b v6.1.0-rc5
> git tree: kmsan
> compiler: gcc 8.4.0
> console output:
> https://drive.google.com/file/d/1F6xY7LF5H9Lki9m769N_9ickBdGwaXIo/view?usp=share_link
> kernel config: https://drive.google.com/file/d/1qltDw7jrn7_DnXvhf7MgsxO08nqGSCDe/view?usp=share_link
>
> Unfortunately, I didn't have a reproducer for this bug.
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: Wei Chen <harperchen1110@xxxxxxxxx>
>
> BUG: kernel NULL pointer dereference, address: 0000000000000050
> #PF: supervisor read access in kernel mode
> #PF: error_code(0x0000) - not-present page
> PGD 1a089067 P4D 1a089067 PUD 1a08a067 PMD 0
> Oops: 0000 [#1] PREEMPT SMP
> CPU: 1 PID: 6355 Comm: syz-executor.1 Not tainted
> 6.1.0-rc5-63183-gd418a331631b #1
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
> Ubuntu-1.8.2-1ubuntu1 04/01/2014
> RIP: 0010:timespec64_add include/linux/time64.h:73 [inline]

That's the timespec64_add() in:

> RIP: 0010:timens_add_monotonic include/linux/time_namespace.h:69 [inline]

struct timens_offsets *ns_offsets = &current->nsproxy->time_ns->offsets;

*ts = timespec64_add(*ts, ns_offsets->monotonic);

> RIP: 0010:posix_get_monotonic_timespec+0x40/0x80 kernel/time/posix-timers.c:200
> Code: 89 45 f0 31 c0 e8 a0 ce 05 00 48 89 df e8 98 5c ff ff 48 8d 7d
> e0 65 48 8b 04 25 c0 ad 01 00 48 8b 80 d8 07 00 00 48 8b 40 30 <48> 8b
> 50 30 48 8b 70 28 48 03 53 08 48 03 33 e8 9c 89 fe ff 48 8b

0: 89 45 f0 mov %eax,-0x10(%rbp)
3: 31 c0 xor %eax,%eax
5: e8 a0 ce 05 00 callq 0x5ceaa
a: 48 89 df mov %rbx,%rdi
d: e8 98 5c ff ff callq 0xffffffffffff5caa
12: 48 8d 7d e0 lea -0x20(%rbp),%rdi
16: 65 48 8b 04 25 c0 ad mov %gs:0x1adc0,%rax // rax = current
1d: 01 00
1f: 48 8b 80 d8 07 00 00 mov 0x7d8(%rax),%rax // rax = nsproxy
26: 48 8b 40 30 mov 0x30(%rax),%rax // rax = time_ns
2a:* 48 8b 50 30 mov 0x30(%rax),%rdx <-- trapping instruction

> RAX: 0000000000000020 RBX: ffff88800e0d7f00 RCX: ffff888042696480

time_ns == 0x20 !?!?! How can that happen?

Thanks,

tglx