Re: KASAN: use-after-free Read in __io_uring_files_cancel

[Pavel Begunkov]

On 09/10/2020 11:02, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    e4fb79c7 Add linux-next specific files for 20201008
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=1592ee1b900000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=568d41fe4341ed0f
> dashboard link: https://syzkaller.appspot.com/bug?extid=77efce558b2b9e6b6405
> compiler:       gcc (GCC) 10.1.0-syz 20200507
> 
> Unfortunately, I don't have any reproducer for this issue yet.
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+77efce558b2b9e6b6405@xxxxxxxxxxxxxxxxxxxxxxxxx
> 
> ==================================================================
> BUG: KASAN: use-after-free in xas_next_entry include/linux/xarray.h:1630 [inline]
> BUG: KASAN: use-after-free in __io_uring_files_cancel+0x417/0x440 fs/io_uring.c:8681
> Read of size 1 at addr ffff888033631880 by task syz-executor.1/8477
> 
> CPU: 1 PID: 8477 Comm: syz-executor.1 Not tainted 5.9.0-rc8-next-20201008-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> Call Trace:
>  __dump_stack lib/dump_stack.c:77 [inline]
>  dump_stack+0x198/0x1fb lib/dump_stack.c:118
>  print_address_description.constprop.0.cold+0xae/0x497 mm/kasan/report.c:385
>  __kasan_report mm/kasan/report.c:545 [inline]
>  kasan_report.cold+0x1f/0x37 mm/kasan/report.c:562
>  xas_next_entry include/linux/xarray.h:1630 [inline]
>  __io_uring_files_cancel+0x417/0x440 fs/io_uring.c:8681
>  io_uring_files_cancel include/linux/io_uring.h:35 [inline]
>  exit_files+0xe4/0x170 fs/file.c:456
>  do_exit+0xae9/0x2930 kernel/exit.c:801
>  do_group_exit+0x125/0x310 kernel/exit.c:903
>  get_signal+0x428/0x1f00 kernel/signal.c:2757
>  arch_do_signal+0x82/0x2470 arch/x86/kernel/signal.c:811
>  exit_to_user_mode_loop kernel/entry/common.c:161 [inline]
>  exit_to_user_mode_prepare+0x194/0x1f0 kernel/entry/common.c:192
>  syscall_exit_to_user_mode+0x7a/0x2c0 kernel/entry/common.c:267
>  entry_SYSCALL_64_after_hwframe+0x44/0xa9

It seems this fails on "node->shift" in xas_next_entry(), that would
mean that the node itself was freed while we're iterating on it.

__io_uring_files_cancel() iterates with xas_next_entry() and creates
XA_STATE once by hand, but it also removes entries in the loop with
io_uring_del_task_file() -> xas_store(&xas, NULL); without updating
the iterating XA_STATE. Could it be the problem? See a diff below

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 824ed4e01562..356313c7aec2 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -8617,10 +8617,9 @@ static int io_uring_add_task_file(struct file *file)
 /*
  * Remove this io_uring_file -> task mapping.
  */
-static void io_uring_del_task_file(struct file *file)
+static void io_uring_del_task_file(struct file *file, struct xa_state *xas)
 {
 	struct io_uring_task *tctx = current->io_uring;
-	XA_STATE(xas, &tctx->xa, (unsigned long) file);
 
 	if (tctx->last == file)
 		tctx->last = NULL;
@@ -8643,7 +8642,7 @@ static void __io_uring_attempt_task_drop(struct file *file)
 	rcu_read_unlock();
 
 	if (old == file)
-		io_uring_del_task_file(file);
+		io_uring_del_task_file(file, &xas);
 }
 
 /*
@@ -8687,7 +8686,7 @@ void __io_uring_files_cancel(struct files_struct *files)
 
 		io_uring_cancel_task_requests(ctx, files);
 		if (files)
-			io_uring_del_task_file(file);
+			io_uring_del_task_file(file, &xas);
 	} while (1);
 }

-- 
Pavel Begunkov