From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 883E3C28CF6 for ; Fri, 3 Aug 2018 15:06:31 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 3768221761 for ; Fri, 3 Aug 2018 15:06:31 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 3768221761 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=interlog.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732374AbeHCRDM (ORCPT ); Fri, 3 Aug 2018 13:03:12 -0400 Received: from smtp.infotech.no ([82.134.31.41]:52470 "EHLO smtp.infotech.no" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731362AbeHCRDM (ORCPT ); Fri, 3 Aug 2018 13:03:12 -0400 Received: from localhost (localhost [127.0.0.1]) by smtp.infotech.no (Postfix) with ESMTP id 251DC204237; Fri, 3 Aug 2018 17:06:26 +0200 (CEST) X-Virus-Scanned: by amavisd-new-2.6.6 (20110518) (Debian) at infotech.no Received: from smtp.infotech.no ([127.0.0.1]) by localhost (smtp.infotech.no [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FX3YiiikE22p; Fri, 3 Aug 2018 17:06:18 +0200 (CEST) Received: from [192.168.48.23] (host-45-58-245-67.dyn.295.ca [45.58.245.67]) by smtp.infotech.no (Postfix) with ESMTPA id 57211204165; Fri, 3 Aug 2018 17:06:17 +0200 (CEST) Reply-To: dgilbert@interlog.com Subject: Re: [bug report] memory corruption panic caused by SG_IO ioctl() To: Wanlong Gao , "Martin K. Petersen" , linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org Cc: "wencongyang (A)" , "Wanghui (John)" , guijianfeng , lipengfei58@huawei.com, qiaonuohan References: From: Douglas Gilbert Message-ID: <93359d1a-930f-5279-3ca8-800d5930562d@interlog.com> Date: Fri, 3 Aug 2018 11:06:15 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Language: en-CA Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 2018-08-03 04:46 AM, Wanlong Gao wrote: > Hi Martinand all folks, > > > Recently we find a kernel panic with memory corruption caused by SG_IO ioctl(), > and it can be easily reproduced by running following reproducer about > minutes,any idea? Which kernel? And what are the underlying devices (e.g. does /dev/sg0 refer to a SATA disk, a real SCSI disk (SAS for example), USB mass storage, etc)? Also can you get a copy of the kernel panic? Doug Gilbert > > C reproducer: > > // autogenerated by syzkaller (http://github.com/google/syzkaller) > > #define _GNU_SOURCE > > #include > > #include > > #include > > #include > > #include > > #include > > #include > > #include > > #include > > static uintptr_t syz_open_dev(uintptr_t a0, uintptr_t a1, uintptr_t a2) > > { > > if (a0 == 0xc || a0 == 0xb) { > > char buf[128]; > > sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1, > (uint8_t)a2); > > return open(buf, O_RDWR, 0); > > } else { > > char buf[1024]; > > char* hash; > > strncpy(buf, (char*)a0, sizeof(buf) - 1); > > buf[sizeof(buf) - 1] = 0; > > while ((hash = strchr(buf, '#'))) { > > *hash = '0' + (char)(a1 % 10); > > a1 /= 10; > > } > > return open(buf, a2, 0); > > } > > } > > static void execute_one(); > > extern unsigned long long procid; > > void loop() > > { > > while (1) { > > execute_one(); > > } > > } > > uint64_t r[1] = {0xffffffffffffffff}; > > void execute_one() > > { > > long res = 0; > > memcpy((void*)0x20000040, "/dev/sg#", 9); > > res = syz_open_dev(0x20000040, 0, 0); > > if (res != -1) > > r[0] = res; > > *(uint32_t*)0x200002c0 = 0x53; > > *(uint32_t*)0x200002c4 = 0; > > *(uint8_t*)0x200002c8 = 0xd; > > *(uint8_t*)0x200002c9 = 0; > > *(uint16_t*)0x200002ca = 0; > > *(uint32_t*)0x200002cc = 0x95; > > *(uint64_t*)0x200002d0 = 0x20000080; > > *(uint64_t*)0x200002d8 = 0x20000000; > > memcpy((void*)0x20000000, > "\x08\xf0\xa8\x77\xd3\xbe\x87\x5d\xda\x65\x79\x3f\xc7", 13); > > *(uint64_t*)0x200002e0 = 0x20000180; > > *(uint32_t*)0x200002e8 = 0x8001; > > *(uint32_t*)0x200002ec = 0x10024; > > *(uint32_t*)0x200002f0 = -1; > > *(uint64_t*)0x200002f4 = 0x20000280; > > *(uint8_t*)0x200002fc = 0; > > *(uint8_t*)0x200002fd = 0; > > *(uint8_t*)0x200002fe = 0; > > *(uint8_t*)0x200002ff = 0; > > *(uint16_t*)0x20000300 = 0; > > *(uint16_t*)0x20000302 = 0; > > *(uint32_t*)0x20000304 = 0; > > *(uint32_t*)0x20000308 = 0; > > *(uint32_t*)0x2000030c = 0; > > syscall(__NR_ioctl, r[0], 0x2285, 0x200002c0); > > } > > int main() > > { > > syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); > > for (;;) { > > loop(); > > } > > } >