[BUG] NULL pointer dereference in iov_iter_revert() via netfs_write_collection_worker

[Abagail ren]

Hi maintainers,

During fuzzing with the Linux kernel, 
we encountered a kernel crash (KASAN null-ptr-deref) 

in `iov_iter_revert()` triggered in the `netfs_write_collection_worker` context. 

The bug was reproduced on `v6.12-rc6`.

## Crash Details:

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000023: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f]

CPU: 1 PID: 3000 Comm: kworker/u10:3 Not tainted 6.12.0-rc6 #2 Workqueue: events_unbound netfs_write_collection_worker

RIP: 0010:folioq_folio_order include/linux/folio_queue.h:291 [inline] RIP: 0010:folioq_folio_size include/linux/folio_queue.h:305 [inline] RIP: 0010:iov_iter_folioq_revert lib/iov_iter.c:599 [inline] RIP: 0010:iov_iter_revert lib/iov_iter.c:644 [inline] RIP: 0010:iov_iter_revert+0x2ec/0x5a0 lib/iov_iter.c:611

Call Trace: netfs_retry_write_stream fs/netfs/write_collect.c:181 [inline] 

netfs_retry_writes fs/netfs/write_collect.c:361 [inline] 

netfs_collect_write_results fs/netfs/write_collect.c:529 [inline] netfs_write_collection_worker+0x3c94/0x46f0 fs/netfs/write_collect.c:551 process_one_work+0x99c/0x1b80 kernel/workqueue.c:3229 

worker_thread+0x677/0xe90 kernel/workqueue.c:3391 

kthread+0x2c7/0x3b0 kernel/kthread.c:389

## Summary

The crash happens during a call to `iov_iter_revert()` 

inside a `netfs_write_collection_worker` task. 

The `iov_iter` appears to contain an invalid pointer, 

leading to a general protection fault when dereferencing memory in `folioq_folio_size()`.

Specifically, it crashes at:

movzbl (%rax,%rcx,1),%eax <-- trapping instruction

with:

RAX: 0000000000000023 RCX: dffffc0000000000 RDI: 000000000000011e

This implies an invalid `folio` object is being accessed. 

A check on the validity of the folio (e.g., via `WARN_ON()` or `IS_ERR()`) 

before use in `iov_iter_folioq_revert()` might prevent the crash.

## Environment

- Kernel: `6.12.0-rc6`
- Platform: QEMU
- Trigger: workload involving `netfs` writeback

I checked the dashboard, I think this is highly related to :

https://syzkaller.appspot.com/text?tag=CrashReport&x=1300b618580000

https://syzkaller.appspot.com/bug?id=78d77d1af0176dc57be694578c1ac93e92587191

The config file  and crash report are attached below. 

I hope this can give you more information about the opening bug.

Let me know if you need additional repro information or traces.

Thanks,
Zezhong Ren

[Dmitry Vyukov]

On Sun, 6 Apr 2025 at 11:16, Abagail ren <renzezh...@gmail.com> wrote:
>
> Hi maintainers,

Hi Abagail,

Kernel mailing lists and developers don't accept MIME/HTML emails:
https://www.kernel.org/doc/html/v4.17/process/submitting-patches.html#no-mime-no-links-no-compression-no-attachments-just-plain-text

Your reports may have been bounced from the kernel lists.

> --
> You received this message because you are subscribed to the Google Groups "syzkaller" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller+...@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/syzkaller/CALkECRjJ-zzOq1L6F%3DQULhGmybkBSiQ7yociOzzUgYCkeejEAA%40mail.gmail.com.

[Abagail ren]

Hi maintainers,

In case the previous message was rejected due to attachments, I am
resending this report in plain text format.

[Abagail ren]

Thank you for letting us know! 

Hi maintainers,

During fuzz testing with the Linux kernel, we encountered a kernel crash

(KASAN null-ptr-deref) in `iov_iter_revert()` triggered in the

`netfs_write_collection_worker` context. The crash is reproducible
on kernel version v6.12-rc6.

Crash Details:

Oops: general protection fault, probably for non-canonical address
0xdffffc0000000023: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f]

CPU: 1 PID: 3000 Comm: kworker/u10:3 Not tainted 6.12.0-rc6 #2
Workqueue: events_unbound netfs_write_collection_worker

RIP: 0010:folioq_folio_order include/linux/folio_queue.h:291 [inline]
RIP: 0010:folioq_folio_size include/linux/folio_queue.h:305 [inline]
RIP: 0010:iov_iter_folioq_revert lib/iov_iter.c:599 [inline]
RIP: 0010:iov_iter_revert lib/iov_iter.c:644 [inline]
RIP: 0010:iov_iter_revert+0x2ec/0x5a0 lib/iov_iter.c:611

Call Trace:
 netfs_retry_write_stream       fs/netfs/write_collect.c:181

 netfs_retry_writes             fs/netfs/write_collect.c:361
 netfs_collect_write_results    fs/netfs/write_collect.c:529
 netfs_write_collection_worker  fs/netfs/write_collect.c:551
 process_one_work               kernel/workqueue.c:3229
 worker_thread                  kernel/workqueue.c:3391
 kthread                        kernel/kthread.c:389

Summary:

The crash occurs during a call to `iov_iter_revert()` in the `netfs_write_collection_worker` context. 

The `iov_iter` structure contains an invalid pointer, leading to a general protection fault when memory is accessed via `folioq_folio_size()`.

The faulting instruction is:

    movzbl (%rax,%rcx,1),%eax

with:

    RAX: 0000000000000023
    RCX: dffffc0000000000
    RDI: 000000000000011e

This suggests an invalid `folio` object is being dereferenced. A sanity
check on the folio (e.g., `WARN_ON()` or `IS_ERR()`) in
`iov_iter_folioq_revert()` might prevent this crash.

Environment:
 - Kernel: 6.12.0-rc6
 - Platform: QEMU

 - Trigger: netfs writeback under fuzzing

Possibly related syzkaller reports:
 - https://syzkaller.appspot.com/text?tag=CrashReport&x=1300b618580000
 - https://syzkaller.appspot.com/bug?id=78d77d1af0176dc57be694578c1ac93e92587191

Please let me know if you need additional reproducer information.

Thanks,
Zezhong Ren

Dmitry Vyukov <dvy...@google.com> 于2025年4月7日周一 14:47写道：