Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

sys, executor: incorrect handling of syz_io_uring_setup() #4531

Open
ramosian-glider opened this issue Feb 27, 2024 · 0 comments
Open

sys, executor: incorrect handling of syz_io_uring_setup() #4531

ramosian-glider opened this issue Feb 27, 2024 · 0 comments
Assignees
@ramosian-glider
Labels
bug

Comments

@ramosian-glider
Copy link
Member

The following program:

r0 = syz_open_dev$usbmon(&(0x7f0000000180), 0x0, 0x0)
ioctl$MON_IOCX_MFETCH(r0, 0xc0109207, &(0x7f0000000240)={0x0})
ioctl$MON_IOCH_MFLUSH(r0, 0x9208, 0x8000)
ioctl$MON_IOCH_MFLUSH(r0, 0x9208, 0x0)
syz_io_uring_setup(0x100b7e, &(0x7f0000000280)={0x0, 0x0, 0x1810}, &(0x7f0000000000), &(0x7f00000000c0))

consistently smashes the kcov mapping for me on ARM64 QEMU.

This happens under the following conditions:

  • mappings created by syz_io_uring_setup() (see

    syzkaller/executor/common_linux.h

    Line 1943 in d367cbe

    static long syz_io_uring_setup(volatile long a0, volatile long a1, volatile long a2, volatile long a3)
    ) are placed before the kcov mapping (e.g. no other mappings are created by the executor)
  • IORING_SETUP_CQE32 and/or IORING_SETUP_SQE128 are passed to io_uring_setup(), leading to incorrect calculation of the ring buffer size.

The described problem leads to ci-upstream-gce-arm64 generating tens of thousands of invalid kcov signals, boosting some random programs that happen to set up the uring.
@ramosian-glider ramosian-glider self-assigned this Feb 27, 2024
@ramosian-glider ramosian-glider mentioned this issue Feb 27, 2024
Closed
ramosian-glider added a commit to ramosian-glider/syzkaller that referenced this issue Feb 27, 2024
@ramosian-glider
executor: temporarily disable IORING_SETUP_CQE32 and IORING_SETUP_SQE128
c6125f6 
IORING_SETUP_CQE32 and IORING_SETUP_SQE128 may lead to incorrect
assumptions about the ring buffer size, causing the kernel to write
outside of the mapped memory, smashing whatever follows it.

This is a hotfix for google#4531
that will stop the ci-upstream-gce-arm64 from generating random
coverage.
ramosian-glider added a commit to ramosian-glider/syzkaller that referenced this issue Feb 27, 2024
@ramosian-glider
executor: temporarily disable IORING_SETUP_CQE32 and IORING_SETUP_SQE128
21a6bc4 
IORING_SETUP_CQE32 and IORING_SETUP_SQE128 may lead to incorrect
assumptions about the ring buffer size, causing the kernel to write
outside of the mapped memory, smashing whatever follows it.

This is a hotfix for google#4531
that will stop the ci-upstream-gce-arm64 from generating random
coverage.
ramosian-glider added a commit to ramosian-glider/syzkaller that referenced this issue Feb 27, 2024
@ramosian-glider
executor: temporarily disable IORING_SETUP_CQE32 and IORING_SETUP_SQE128
393f992 
IORING_SETUP_CQE32 and IORING_SETUP_SQE128 may lead to incorrect
assumptions about the ring buffer size, causing the kernel to write
outside of the mapped memory, smashing whatever follows it.

This is a hotfix for google#4531
that will stop the ci-upstream-gce-arm64 from generating random
coverage.
ramosian-glider added a commit to ramosian-glider/syzkaller that referenced this issue Feb 27, 2024
@ramosian-glider
executor: temporarily disable IORING_SETUP_CQE32 and IORING_SETUP_SQE128
fda3685 
IORING_SETUP_CQE32 and IORING_SETUP_SQE128 may lead to incorrect
assumptions about the ring buffer size, causing the kernel to write
outside of the mapped memory, smashing whatever follows it.

This is a hotfix for google#4531
that will stop the ci-upstream-gce-arm64 from generating random
coverage.
github-merge-queue bot pushed a commit that referenced this issue Mar 5, 2024
@ramosian-glider @a-nogikh
executor: temporarily disable IORING_SETUP_CQE32 and IORING_SETUP_SQE128
a22c046 
IORING_SETUP_CQE32 and IORING_SETUP_SQE128 may lead to incorrect
assumptions about the ring buffer size, causing the kernel to write
outside of the mapped memory, smashing whatever follows it.

This is a hotfix for #4531
that will stop the ci-upstream-gce-arm64 from generating random
coverage.
ramosian-glider added a commit to ramosian-glider/syzkaller that referenced this issue Apr 4, 2024
@ramosian-glider
executor: add guard pages around the kcov mapping
27f3db7 
Because the executor may place other mappings next to the buffer used by
kcov, occasional out-of-bound writes to them may corrupt the coverage,
creating garbage PCs (see google#4531).

To prevent those, map two extra pages for the kcov buffer, and protect them,
so that OOB writes cause a segfault.

Fixes google#4532
@ramosian-glider ramosian-glider mentioned this issue Apr 4, 2024
Merged
ramosian-glider added a commit to ramosian-glider/syzkaller that referenced this issue Apr 4, 2024
@ramosian-glider
executor: add guard pages around the kcov mapping
e46ddce 
Because the executor may place other mappings next to the buffer used by
kcov, occasional out-of-bound writes to them may corrupt the coverage,
creating garbage PCs (see google#4531).

To prevent those, map two extra pages for the kcov buffer, and protect them,
so that OOB writes cause a segfault.

Fixes google#4532
github-merge-queue bot pushed a commit that referenced this issue Apr 4, 2024
@ramosian-glider
executor: add guard pages around the kcov mapping
0ee3535 
Because the executor may place other mappings next to the buffer used by
kcov, occasional out-of-bound writes to them may corrupt the coverage,
creating garbage PCs (see #4531).

To prevent those, map two extra pages for the kcov buffer, and protect them,
so that OOB writes cause a segfault.

Fixes #4532
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@ramosian-glider ramosian-glider

Labels
bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@ramosian-glider