* [syzbot] [io-uring?] KMSAN: uninit-value in io_req_cqe_overflow (3)
@ 2024-06-13 19:38 syzbot
2024-06-14 1:28 ` Jens Axboe
` (2 more replies)
0 siblings, 3 replies; 8+ messages in thread
From: syzbot @ 2024-06-13 19:38 UTC (permalink / raw)
To: asml.silence, axboe, io-uring, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 614da38e2f7a Merge tag 'hid-for-linus-2024051401' of git:/..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=12980e41980000
kernel config: https://syzkaller.appspot.com/x/.config?x=f5d2cbf33633f507
dashboard link: https://syzkaller.appspot.com/bug?extid=e6616d0dc8ded5dc56d6
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13526ca2980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=144e5256980000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/89eafb874b71/disk-614da38e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/356000512ad9/vmlinux-614da38e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/839c73939115/bzImage-614da38e.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]
=====================================================
BUG: KMSAN: uninit-value in io_req_cqe_overflow+0x193/0x1c0 io_uring/io_uring.c:810
io_req_cqe_overflow+0x193/0x1c0 io_uring/io_uring.c:810
__io_submit_flush_completions+0x7eb/0x1be0 io_uring/io_uring.c:1464
io_submit_flush_completions io_uring/io_uring.h:148 [inline]
ctx_flush_and_put+0x16c/0x360 io_uring/io_uring.c:1055
io_handle_tw_list+0x58b/0x5c0 io_uring/io_uring.c:1095
tctx_task_work_run+0xf8/0x3d0 io_uring/io_uring.c:1155
tctx_task_work+0x6d/0xc0 io_uring/io_uring.c:1173
task_work_run+0x268/0x310 kernel/task_work.c:180
ptrace_notify+0x304/0x320 kernel/signal.c:2404
ptrace_report_syscall include/linux/ptrace.h:415 [inline]
ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline]
syscall_exit_work+0x14e/0x3e0 kernel/entry/common.c:173
syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline]
syscall_exit_to_user_mode+0x135/0x160 kernel/entry/common.c:218
do_syscall_64+0xdc/0x1e0 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was stored to memory at:
io_req_set_res io_uring/io_uring.h:215 [inline]
io_recv_finish+0xf10/0x1560 io_uring/net.c:861
io_recv+0x12ec/0x1ea0 io_uring/net.c:1175
io_issue_sqe+0x429/0x22c0 io_uring/io_uring.c:1751
io_poll_issue+0x32/0x40 io_uring/io_uring.c:1782
io_poll_check_events io_uring/poll.c:331 [inline]
io_poll_task_func+0x5f9/0x14d0 io_uring/poll.c:357
io_handle_tw_list+0x23a/0x5c0 io_uring/io_uring.c:1083
tctx_task_work_run+0xf8/0x3d0 io_uring/io_uring.c:1155
tctx_task_work+0x6d/0xc0 io_uring/io_uring.c:1173
task_work_run+0x268/0x310 kernel/task_work.c:180
ptrace_notify+0x304/0x320 kernel/signal.c:2404
ptrace_report_syscall include/linux/ptrace.h:415 [inline]
ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline]
syscall_exit_work+0x14e/0x3e0 kernel/entry/common.c:173
syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline]
syscall_exit_to_user_mode+0x135/0x160 kernel/entry/common.c:218
do_syscall_64+0xdc/0x1e0 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was created at:
slab_post_alloc_hook mm/slub.c:3877 [inline]
slab_alloc_node mm/slub.c:3918 [inline]
__do_kmalloc_node mm/slub.c:4038 [inline]
__kmalloc+0x6e4/0x1060 mm/slub.c:4052
kmalloc include/linux/slab.h:632 [inline]
io_alloc_async_data+0xc0/0x220 io_uring/io_uring.c:1662
io_msg_alloc_async io_uring/net.c:166 [inline]
io_recvmsg_prep_setup io_uring/net.c:725 [inline]
io_recvmsg_prep+0xbe8/0x1a20 io_uring/net.c:806
io_init_req io_uring/io_uring.c:2135 [inline]
io_submit_sqe io_uring/io_uring.c:2182 [inline]
io_submit_sqes+0x1135/0x2f10 io_uring/io_uring.c:2335
__do_sys_io_uring_enter io_uring/io_uring.c:3246 [inline]
__se_sys_io_uring_enter+0x40f/0x3c80 io_uring/io_uring.c:3183
__x64_sys_io_uring_enter+0x11f/0x1a0 io_uring/io_uring.c:3183
x64_sys_call+0x2c0/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:427
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
CPU: 1 PID: 5049 Comm: syz-executor107 Not tainted 6.9.0-syzkaller-02707-g614da38e2f7a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
=====================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at [email protected].
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] [io-uring?] KMSAN: uninit-value in io_req_cqe_overflow (3)
2024-06-13 19:38 [syzbot] [io-uring?] KMSAN: uninit-value in io_req_cqe_overflow (3) syzbot
@ 2024-06-14 1:28 ` Jens Axboe
2024-06-14 1:53 ` syzbot
2024-07-25 15:09 ` Jens Axboe
2024-07-25 15:33 ` Jens Axboe
2 siblings, 1 reply; 8+ messages in thread
From: Jens Axboe @ 2024-06-14 1:28 UTC (permalink / raw)
To: syzbot, asml.silence, io-uring, linux-kernel, syzkaller-bugs
On 6/13/24 1:38 PM, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 614da38e2f7a Merge tag 'hid-for-linus-2024051401' of git:/..
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=12980e41980000
> kernel config: https://syzkaller.appspot.com/x/.config?x=f5d2cbf33633f507
> dashboard link: https://syzkaller.appspot.com/bug?extid=e6616d0dc8ded5dc56d6
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13526ca2980000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=144e5256980000
#syz test: git://git.kernel.dk/linux.git io_uring-6.10
--
Jens Axboe
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] [io-uring?] KMSAN: uninit-value in io_req_cqe_overflow (3)
2024-06-14 1:28 ` Jens Axboe
@ 2024-06-14 1:53 ` syzbot
2024-06-14 1:56 ` Jens Axboe
0 siblings, 1 reply; 8+ messages in thread
From: syzbot @ 2024-06-14 1:53 UTC (permalink / raw)
To: asml.silence, axboe, io-uring, linux-kernel, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
: Dummy 1
[ 50.085324][ T1] #1: Loopback 1
[ 50.089179][ T1] #2: Virtual MIDI Card 1
[ 50.099411][ T10] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
[ 50.110715][ T1] md: Waiting for all devices to be available before autodetect
[ 50.110769][ T1] md: If you don't use raid, use raid=noautodetect
[ 50.110836][ T1] md: Autodetecting RAID arrays.
[ 50.110883][ T1] md: autorun ...
[ 50.119809][ T10] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db
[ 50.125316][ T1] md: ... autorun DONE.
[ 50.234241][ T1] EXT4-fs (sda1): mounted filesystem 5941fea2-f5fa-4b4e-b5ef-9af118b27b95 ro with ordered data mode. Quota mode: none.
[ 50.247976][ T1] VFS: Mounted root (ext4 filesystem) readonly on device 8:1.
[ 50.325610][ T1] devtmpfs: mounted
[ 50.579226][ T1] Freeing unused kernel image (initmem) memory: 37032K
[ 50.590992][ T1] Write protecting the kernel read-only data: 262144k
[ 50.636998][ T1] Freeing unused kernel image (rodata/data gap) memory: 1808K
[ 52.297749][ T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[ 52.307966][ T1] x86/mm: Checking user space page tables
[ 53.810797][ T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[ 53.819734][ T1] Failed to set sysctl parameter 'kernel.hung_task_all_cpu_backtrace=1': parameter not found
[ 53.841397][ T1] Failed to set sysctl parameter 'max_rcu_stall_to_panic=1': parameter not found
[ 53.853295][ T1] Run /sbin/init as init process
[ 55.624426][ T4453] mount (4453) used greatest stack depth: 8144 bytes left
[ 55.700932][ T4454] EXT4-fs (sda1): re-mounted 5941fea2-f5fa-4b4e-b5ef-9af118b27b95 r/w. Quota mode: none.
mount: mounting smackfs on /sys/fs/smackfs failed: No such file or directory
mount: mounting selinuxfs on /sys/fs/selinux failed: No such file or directory
[ 56.048626][ T4457] mount (4457) used greatest stack depth: 5568 bytes left
Starting syslogd: OK
Starting acpid: OK
Starting klogd: OK
Running sysctl: OK
Populating /dev using udev: [ 59.882175][ T4487] udevd[4487]: starting version 3.2.11
[ 63.461760][ T4488] udevd[4488]: starting eudev-3.2.11
[ 63.474018][ T4487] udevd (4487) used greatest stack depth: 5288 bytes left
[ 96.328335][ T1216] net_ratelimit: 2 callbacks suppressed
[ 96.328413][ T1216] aoe: packet could not be sent on lo. consider increasing tx_queue_len
[ 96.343724][ T1216] aoe: packet could not be sent on bond0. consider increasing tx_queue_len
[ 96.352822][ T1216] aoe: packet could not be sent on dummy0. consider increasing tx_queue_len
[ 96.362365][ T1216] aoe: packet could not be sent on eql. consider increasing tx_queue_len
[ 96.371420][ T1216] aoe: packet could not be sent on ifb0. consider increasing tx_queue_len
[ 96.380617][ T1216] aoe: packet could not be sent on ifb1. consider increasing tx_queue_len
[ 96.390232][ T1216] aoe: packet could not be sent on eth0. consider increasing tx_queue_len
[ 96.399307][ T1216] aoe: packet could not be sent on wlan0. consider increasing tx_queue_len
[ 96.408742][ T1216] aoe: packet could not be sent on wlan1. consider increasing tx_queue_len
[ 96.417980][ T1216] aoe: packet could not be sent on hwsim0. consider increasing tx_queue_len
done
Starting system message bus: done
Starting iptables: OK
Starting network: OK
Starting dhcpcd...
dhcpcd-9.4.1 starting
dev: loaded udev
DUID 00:04:98:24:4c:28:99:7c:d9:70:fe:51:ca:fe:56:33:2c:7d
forked to background, child pid 4700
[ 111.646112][ T4701] 8021q: adding VLAN 0 to HW filter on device bond0
[ 111.665731][ T4701] eql: remember to turn off Van-Jacobson compression on your slave devices
[ 111.739327][ T10] cfg80211: failed to load regulatory.db
Starting sshd: [ 114.013627][ C0] =====================================================
[ 114.021043][ C0] BUG: KMSAN: uninit-value in receive_buf+0x25e3/0x5fd0
[ 114.028525][ C0] receive_buf+0x25e3/0x5fd0
[ 114.033381][ C0] virtnet_poll+0xd1c/0x23c0
[ 114.038271][ C0] __napi_poll+0xe7/0x980
[ 114.042818][ C0] net_rx_action+0x82a/0x1850
[ 114.047892][ C0] handle_softirqs+0x1ce/0x800
[ 114.052877][ C0] __irq_exit_rcu+0x68/0x120
[ 114.057788][ C0] irq_exit_rcu+0x12/0x20
[ 114.062305][ C0] common_interrupt+0x94/0xa0
[ 114.067214][ C0] asm_common_interrupt+0x2b/0x40
[ 114.072524][ C0] unmap_page_range+0x437/0x8670
[ 114.077770][ C0] unmap_single_vma+0x380/0x490
[ 114.082992][ C0] unmap_vmas+0x34a/0x610
[ 114.087600][ C0] exit_mmap+0x236/0xe60
[ 114.091998][ C0] __mmput+0x147/0x5d0
[ 114.096258][ C0] mmput+0x8a/0xa0
[ 114.100278][ C0] exec_mmap+0x80a/0x9b0
[ 114.104689][ C0] begin_new_exec+0x1ac4/0x2bd0
[ 114.109838][ C0] load_elf_binary+0x1412/0x4e10
[ 114.114974][ C0] bprm_execve+0xc57/0x21c0
[ 114.119763][ C0] do_execveat_common+0xceb/0xd70
[ 114.124999][ C0] __x64_sys_execve+0xf4/0x130
[ 114.130048][ C0] x64_sys_call+0x164f/0x3b90
[ 114.135028][ C0] do_syscall_64+0xcd/0x1e0
[ 114.139822][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 114.145930][ C0]
[ 114.148491][ C0] Uninit was created at:
[ 114.152960][ C0] __alloc_pages_noprof+0x9d6/0xe70
[ 114.158456][ C0] alloc_pages_mpol_noprof+0x299/0x990
[ 114.164147][ C0] alloc_pages_noprof+0x1bf/0x1e0
[ 114.169493][ C0] skb_page_frag_refill+0x2bf/0x7c0
[ 114.175099][ C0] virtnet_rq_alloc+0x43/0xbb0
[ 114.180136][ C0] try_fill_recv+0x3f0/0x2f50
[ 114.184984][ C0] virtnet_open+0x1cc/0xb00
[ 114.189780][ C0] __dev_open+0x546/0x6f0
[ 114.194331][ C0] __dev_change_flags+0x309/0x9a0
[ 114.199804][ C0] dev_change_flags+0x8e/0x1d0
[ 114.204763][ C0] devinet_ioctl+0x13ec/0x22c0
[ 114.209866][ C0] inet_ioctl+0x4bd/0x6d0
[ 114.214386][ C0] sock_do_ioctl+0xb7/0x540
[ 114.219190][ C0] sock_ioctl+0x727/0xd70
[ 114.223697][ C0] __se_sys_ioctl+0x261/0x450
[ 114.228714][ C0] __x64_sys_ioctl+0x96/0xe0
[ 114.233472][ C0] x64_sys_call+0x18c0/0x3b90
[ 114.238517][ C0] do_syscall_64+0xcd/0x1e0
[ 114.243222][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 114.249490][ C0]
[ 114.251937][ C0] CPU: 0 PID: 4799 Comm: S50sshd Not tainted 6.10.0-rc1-syzkaller-00009-gf4a1254f2a07 #0
[ 114.262178][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[ 114.272668][ C0] =====================================================
[ 114.279876][ C0] Disabling lock debugging due to kernel taint
[ 114.286162][ C0] Kernel panic - not syncing: kmsan.panic set ...
[ 114.292711][ C0] CPU: 0 PID: 4799 Comm: S50sshd Tainted: G B 6.10.0-rc1-syzkaller-00009-gf4a1254f2a07 #0
[ 114.304458][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[ 114.314789][ C0] Call Trace:
[ 114.318203][ C0] <IRQ>
[ 114.321156][ C0] dump_stack_lvl+0x216/0x2d0
[ 114.326043][ C0] ? kmsan_get_shadow_origin_ptr+0x4d/0xb0
[ 114.332094][ C0] dump_stack+0x1e/0x30
[ 114.336442][ C0] panic+0x4e2/0xcd0
[ 114.340533][ C0] ? kmsan_get_metadata+0x111/0x1d0
[ 114.345974][ C0] kmsan_report+0x2d5/0x2e0
[ 114.350698][ C0] ? kmsan_alloc_page+0x182/0x220
[ 114.355934][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 114.361337][ C0] ? __msan_warning+0x95/0x120
[ 114.366312][ C0] ? receive_buf+0x25e3/0x5fd0
[ 114.371293][ C0] ? virtnet_poll+0xd1c/0x23c0
[ 114.376247][ C0] ? __napi_poll+0xe7/0x980
[ 114.380957][ C0] ? net_rx_action+0x82a/0x1850
[ 114.386121][ C0] ? handle_softirqs+0x1ce/0x800
[ 114.391359][ C0] ? __irq_exit_rcu+0x68/0x120
[ 114.396339][ C0] ? irq_exit_rcu+0x12/0x20
[ 114.401043][ C0] ? common_interrupt+0x94/0xa0
[ 114.406205][ C0] ? asm_common_interrupt+0x2b/0x40
[ 114.411631][ C0] ? unmap_page_range+0x437/0x8670
[ 114.417009][ C0] ? unmap_single_vma+0x380/0x490
[ 114.422335][ C0] ? unmap_vmas+0x34a/0x610
[ 114.427043][ C0] ? exit_mmap+0x236/0xe60
[ 114.431644][ C0] ? __mmput+0x147/0x5d0
[ 114.436101][ C0] ? mmput+0x8a/0xa0
[ 114.440190][ C0] ? exec_mmap+0x80a/0x9b0
[ 114.444795][ C0] ? begin_new_exec+0x1ac4/0x2bd0
[ 114.450011][ C0] ? load_elf_binary+0x1412/0x4e10
[ 114.455320][ C0] ? bprm_execve+0xc57/0x21c0
[ 114.460196][ C0] ? do_execveat_common+0xceb/0xd70
[ 114.465599][ C0] ? __x64_sys_execve+0xf4/0x130
[ 114.470719][ C0] ? x64_sys_call+0x164f/0x3b90
[ 114.475779][ C0] ? do_syscall_64+0xcd/0x1e0
[ 114.480647][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 114.486933][ C0] ? kmsan_internal_memmove_metadata+0x17b/0x230
[ 114.493494][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 114.498917][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 114.504332][ C0] ? page_to_skb+0xdae/0x1620
[ 114.509232][ C0] __msan_warning+0x95/0x120
[ 114.514026][ C0] receive_buf+0x25e3/0x5fd0
[ 114.518819][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 114.524319][ C0] ? kmsan_get_shadow_origin_ptr+0x4d/0xb0
[ 114.530382][ C0] virtnet_poll+0xd1c/0x23c0
[ 114.535205][ C0] ? __pfx_virtnet_poll+0x10/0x10
[ 114.540952][ C0] __napi_poll+0xe7/0x980
[ 114.545495][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 114.550961][ C0] net_rx_action+0x82a/0x1850
[ 114.555904][ C0] ? sched_clock_cpu+0x55/0x870
[ 114.560969][ C0] ? __pfx_net_rx_action+0x10/0x10
[ 114.566314][ C0] handle_softirqs+0x1ce/0x800
[ 114.571324][ C0] __irq_exit_rcu+0x68/0x120
[ 114.576116][ C0] irq_exit_rcu+0x12/0x20
[ 114.580642][ C0] common_interrupt+0x94/0xa0
[ 114.585603][ C0] </IRQ>
[ 114.588665][ C0] <TASK>
[ 114.591713][ C0] asm_common_interrupt+0x2b/0x40
[ 114.596959][ C0] RIP: 0010:unmap_page_range+0x437/0x8670
[ 114.602895][ C0] Code: 01 00 00 48 83 bc 24 38 02 00 00 00 0f 85 a2 79 00 00 48 8b bc 24 f8 01 00 00 48 8b 1f 48 89 5c 24 20 e8 4c 22 26 00 4c 8b 30 <44> 8b 22 48 83 e3 9f 49 c7 45 00 00 00 00 00 4c 89 f0 48 83 e0 9f
[ 114.622720][ C0] RSP: 0018:ffff8881178032f0 EFLAGS: 00000286
[ 114.628967][ C0] RAX: ffff88811a3767f8 RBX: 800000011786d067 RCX: 000000011a7767f8
[ 114.637129][ C0] RDX: ffff88811a7767f8 RSI: ffff88813fff9230 RDI: ffff88811ab767f8
[ 114.645292][ C0] RBP: ffff888117803578 R08: ffffea000000000f R09: 0000000000000000
[ 114.653453][ C0] R10: ffff888117003698 R11: 0000000000000004 R12: 0000000000000000
[ 114.661696][ C0] R13: ffff888117a1ac00 R14: 0000000000000000 R15: 00007fef966eafff
[ 114.669872][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 114.675323][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 114.680765][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 114.686196][ C0] ? kmsan_get_shadow_origin_ptr+0x4d/0xb0
[ 114.692245][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 114.697670][ C0] ? kmsan_get_shadow_origin_ptr+0x4d/0xb0
[ 114.703716][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 114.709137][ C0] ? kmsan_get_shadow_origin_ptr+0x4d/0xb0
[ 114.715203][ C0] unmap_single_vma+0x380/0x490
[ 114.720293][ C0] unmap_vmas+0x34a/0x610
[ 114.724956][ C0] exit_mmap+0x236/0xe60
[ 114.729417][ C0] ? kmsan_get_shadow_origin_ptr+0x4d/0xb0
[ 114.735450][ C0] __mmput+0x147/0x5d0
[ 114.739725][ C0] ? kmsan_internal_unpoison_memory+0x14/0x20
[ 114.746005][ C0] mmput+0x8a/0xa0
[ 114.749934][ C0] exec_mmap+0x80a/0x9b0
[ 114.754382][ C0] begin_new_exec+0x1ac4/0x2bd0
[ 114.759451][ C0] load_elf_binary+0x1412/0x4e10
[ 114.764594][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 114.770014][ C0] ? kmsan_internal_set_shadow_origin+0x66/0xe0
[ 114.776491][ C0] ? kmsan_internal_unpoison_memory+0x14/0x20
[ 114.782774][ C0] ? load_elf_binary+0x1341/0x4e10
[ 114.788101][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 114.793557][ C0] ? __pfx_load_elf_binary+0x10/0x10
[ 114.799058][ C0] bprm_execve+0xc57/0x21c0
[ 114.803804][ C0] do_execveat_common+0xceb/0xd70
[ 114.809069][ C0] __x64_sys_execve+0xf4/0x130
[ 114.814046][ C0] x64_sys_call+0x164f/0x3b90
[ 114.818961][ C0] do_syscall_64+0xcd/0x1e0
[ 114.823690][ C0] ? clear_bhb_loop+0x25/0x80
[ 114.828613][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 114.834753][ C0] RIP: 0033:0x7fef96824ef7
[ 114.839364][ C0] Code: Unable to access opcode bytes at 0x7fef96824ecd.
[ 114.846558][ C0] RSP: 002b:00007ffee5058098 EFLAGS: 00000246 ORIG_RAX: 000000000000003b
[ 114.855184][ C0] RAX: ffffffffffffffda RBX: 0000556bd3625190 RCX: 00007fef96824ef7
[ 114.863430][ C0] RDX: 0000556bd36251a8 RSI: 0000556bd3625190 RDI: 0000556bd3625210
[ 114.871579][ C0] RBP: 0000556bd3625210 R08: 0000556bd3625215 R09: 00007ffee5059fa2
[ 114.879814][ C0] R10: 0000000000000008 R11: 0000000000000246 R12: 0000556bd36251a8
[ 114.887957][ C0] R13: 00007fef969d2904 R14: 0000556bd36251a8 R15: 0000000000000000
[ 114.896125][ C0] </TASK>
[ 114.899544][ C0] Kernel Offset: disabled
[ 114.903930][ C0] Rebooting in 86400 seconds..
syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.21.4'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build827277809=/tmp/go-build -gno-record-gcc-switches'
git status (err=<nil>)
HEAD detached at 2aa5052fed
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
go fmt ./sys/... >/dev/null
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=2aa5052fed5f8993afacfce02174322df0f03ec4 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240612-135002'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=2aa5052fed5f8993afacfce02174322df0f03ec4 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240612-135002'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"2aa5052fed5f8993afacfce02174322df0f03ec4\"
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=12f14736980000
Tested on:
commit: f4a1254f io_uring: fix cancellation overwriting req->f..
git tree: git://git.kernel.dk/linux.git io_uring-6.10
kernel config: https://syzkaller.appspot.com/x/.config?x=54d66e52f38a45d8
dashboard link: https://syzkaller.appspot.com/bug?extid=e6616d0dc8ded5dc56d6
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Note: no patches were applied.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] [io-uring?] KMSAN: uninit-value in io_req_cqe_overflow (3)
2024-06-14 1:53 ` syzbot
@ 2024-06-14 1:56 ` Jens Axboe
2024-06-14 2:20 ` syzbot
0 siblings, 1 reply; 8+ messages in thread
From: Jens Axboe @ 2024-06-14 1:56 UTC (permalink / raw)
To: syzbot, asml.silence, io-uring, linux-kernel, syzkaller-bugs
#syz test: git://git.kernel.dk/linux.git syz-test
--
Jens Axboe
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] [io-uring?] KMSAN: uninit-value in io_req_cqe_overflow (3)
2024-06-14 1:56 ` Jens Axboe
@ 2024-06-14 2:20 ` syzbot
0 siblings, 0 replies; 8+ messages in thread
From: syzbot @ 2024-06-14 2:20 UTC (permalink / raw)
To: asml.silence, axboe, io-uring, linux-kernel, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
6.343044][ T1] openvswitch: Open vSwitch switching datapath
[ 46.363888][ T1] NET: Registered PF_VSOCK protocol family
[ 46.372367][ T1] mpls_gso: MPLS GSO support
[ 46.524387][ T1] IPI shorthand broadcast: enabled
[ 48.017346][ T1] sched_clock: Marking stable (47990050167, 17795964)->(48016243838, -8397707)
[ 49.133874][ T1] Timer migration: 1 hierarchy levels; 8 children per group; 0 crossnode level
[ 49.302883][ T1] registered taskstats version 1
[ 49.367583][ T1] Loading compiled-in X.509 certificates
[ 49.405812][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: ef5392d16e2343e2e997a1a8439f31430dca794f'
[ 49.643401][ T1] zswap: loaded using pool lzo/zsmalloc
[ 49.652895][ T1] Demotion targets for Node 0: null
[ 49.658483][ T1] Demotion targets for Node 1: null
[ 49.665807][ T1] Key type .fscrypt registered
[ 49.672365][ T1] Key type fscrypt-provisioning registered
[ 49.679915][ T1] kAFS: Red Hat AFS client v0.1 registering.
[ 49.713149][ T1] Btrfs loaded, assert=on, ref-verify=on, zoned=yes, fsverity=yes
[ 49.740050][ T1] Key type encrypted registered
[ 49.745095][ T1] AppArmor: AppArmor sha256 policy hashing enabled
[ 49.753397][ T1] ima: No TPM chip found, activating TPM-bypass!
[ 49.759983][ T1] Loading compiled-in module X.509 certificates
[ 49.802303][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: ef5392d16e2343e2e997a1a8439f31430dca794f'
[ 49.813515][ T1] ima: Allocated hash algorithm: sha256
[ 49.819655][ T1] ima: No architecture policies found
[ 49.826134][ T1] evm: Initialising EVM extended attributes:
[ 49.832247][ T1] evm: security.selinux (disabled)
[ 49.837410][ T1] evm: security.SMACK64 (disabled)
[ 49.842758][ T1] evm: security.SMACK64EXEC (disabled)
[ 49.848460][ T1] evm: security.SMACK64TRANSMUTE (disabled)
[ 49.854407][ T1] evm: security.SMACK64MMAP (disabled)
[ 49.860131][ T1] evm: security.apparmor
[ 49.864545][ T1] evm: security.ima
[ 49.868491][ T1] evm: security.capability
[ 49.872958][ T1] evm: HMAC attrs: 0x1
[ 49.882187][ T1] PM: Magic number: 12:875:156
[ 49.888285][ T1] usb usb36-port7: hash matches
[ 49.894166][ T1] bdi 1:8: hash matches
[ 49.900642][ T1] printk: legacy console [netcon0] enabled
[ 49.906787][ T1] netconsole: network logging started
[ 49.913765][ T1] gtp: GTP module loaded (pdp ctx size 128 bytes)
[ 49.922755][ T1] rdma_rxe: loaded
[ 49.928813][ T1] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[ 49.950799][ T1] Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[ 49.969818][ T1] Loaded X.509 cert 'wens: 61c038651aabdcf94bd0ac7ff06c7248db18c600'
[ 49.978593][ T1] clk: Disabling unused clocks
[ 49.983531][ T1] ALSA device list:
[ 49.987431][ T1] #0: Dummy 1
[ 49.991050][ T1] #1: Loopback 1
[ 49.994878][ T1] #2: Virtual MIDI Card 1
[ 50.005050][ T10] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
[ 50.014970][ T10] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db
[ 50.024723][ T1] md: Waiting for all devices to be available before autodetect
[ 50.032705][ T1] md: If you don't use raid, use raid=noautodetect
[ 50.039465][ T1] md: Autodetecting RAID arrays.
[ 50.044595][ T1] md: autorun ...
[ 50.048512][ T1] md: ... autorun DONE.
[ 50.117733][ T1] EXT4-fs (sda1): mounted filesystem 5941fea2-f5fa-4b4e-b5ef-9af118b27b95 ro with ordered data mode. Quota mode: none.
[ 50.131603][ T1] VFS: Mounted root (ext4 filesystem) readonly on device 8:1.
[ 50.144403][ T1] devtmpfs: mounted
[ 50.408360][ T1] Freeing unused kernel image (initmem) memory: 37036K
[ 50.420188][ T1] Write protecting the kernel read-only data: 262144k
[ 50.467096][ T1] Freeing unused kernel image (rodata/data gap) memory: 1804K
[ 52.119267][ T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[ 52.129621][ T1] x86/mm: Checking user space page tables
[ 53.636226][ T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[ 53.645529][ T1] Failed to set sysctl parameter 'kernel.hung_task_all_cpu_backtrace=1': parameter not found
[ 53.666750][ T1] Failed to set sysctl parameter 'max_rcu_stall_to_panic=1': parameter not found
[ 53.678915][ T1] Run /sbin/init as init process
[ 55.261831][ T4447] mount (4447) used greatest stack depth: 7808 bytes left
[ 55.340544][ T4448] EXT4-fs (sda1): re-mounted 5941fea2-f5fa-4b4e-b5ef-9af118b27b95 r/w. Quota mode: none.
mount: mounting smackfs on /sys/fs/smackfs failed: No such file or directory
mount: mounting selinuxfs on /sys/fs/selinux failed: No such file or directory
[ 55.675477][ T4451] mount (4451) used greatest stack depth: 5568 bytes left
Starting syslogd: OK
Starting acpid: OK
Starting klogd: OK
Running sysctl: OK
Populating /dev using udev: [ 59.510303][ T4481] udevd[4481]: starting version 3.2.11
[ 63.097528][ T4482] udevd[4482]: starting eudev-3.2.11
[ 63.110491][ T4481] udevd (4481) used greatest stack depth: 5232 bytes left
done
Starting system message bus: done
Starting iptables: OK
Starting network: OK
Starting dhcpcd...
dhcpcd-9.4.1 starting
dev: loaded udev
DUID 00:04:c7:fd:4a:df:9d:a6:e9:60:55:7b:b4:5b:1f:77:00:5c
forked to background, child pid 4695
[ 110.977706][ T4696] 8021q: adding VLAN 0 to HW filter on device bond0
[ 111.031404][ T4696] eql: remember to turn off Van-Jacobson compression on your slave devices
[ 111.650739][ T10] cfg80211: failed to load regulatory.db
Starting sshd: OK
syzkaller
syzkaller login: [ 114.063784][ C0] =====================================================
[ 114.071021][ C0] BUG: KMSAN: uninit-value in receive_buf+0x25e3/0x5fd0
[ 114.078922][ C0] receive_buf+0x25e3/0x5fd0
[ 114.083796][ C0] virtnet_poll+0xd1c/0x23c0
[ 114.088752][ C0] __napi_poll+0xe7/0x980
[ 114.093517][ C0] net_rx_action+0x82a/0x1850
[ 114.098512][ C0] handle_softirqs+0x1ce/0x800
[ 114.103581][ C0] __irq_exit_rcu+0x68/0x120
[ 114.108412][ C0] irq_exit_rcu+0x12/0x20
[ 114.112996][ C0] common_interrupt+0x94/0xa0
[ 114.118086][ C0] asm_common_interrupt+0x2b/0x40
[ 114.123480][ C0] __msan_metadata_ptr_for_load_8+0x18/0x40
[ 114.129797][ C0] filemap_map_pages+0xe81/0x2e30
[ 114.135034][ C0] handle_mm_fault+0x6f36/0xe610
[ 114.140206][ C0] exc_page_fault+0x41b/0x700
[ 114.145072][ C0] asm_exc_page_fault+0x2b/0x30
[ 114.150167][ C0]
[ 114.152572][ C0] Uninit was created at:
[ 114.156953][ C0] __alloc_pages_noprof+0x9d6/0xe70
[ 114.162368][ C0] alloc_pages_mpol_noprof+0x299/0x990
[ 114.168132][ C0] alloc_pages_noprof+0x1bf/0x1e0
[ 114.173274][ C0] skb_page_frag_refill+0x2bf/0x7c0
[ 114.178692][ C0] virtnet_rq_alloc+0x43/0xbb0
[ 114.183610][ C0] try_fill_recv+0x3f0/0x2f50
[ 114.188492][ C0] virtnet_open+0x1cc/0xb00
[ 114.193392][ C0] __dev_open+0x546/0x6f0
[ 114.197955][ C0] __dev_change_flags+0x309/0x9a0
[ 114.203263][ C0] dev_change_flags+0x8e/0x1d0
[ 114.208266][ C0] devinet_ioctl+0x13ec/0x22c0
[ 114.213265][ C0] inet_ioctl+0x4bd/0x6d0
[ 114.217709][ C0] sock_do_ioctl+0xb7/0x540
[ 114.222474][ C0] sock_ioctl+0x727/0xd70
[ 114.226915][ C0] __se_sys_ioctl+0x261/0x450
[ 114.231888][ C0] __x64_sys_ioctl+0x96/0xe0
[ 114.236624][ C0] x64_sys_call+0x18c0/0x3b90
[ 114.241782][ C0] do_syscall_64+0xcd/0x1e0
[ 114.246586][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 114.252971][ C0]
[ 114.255409][ C0] CPU: 0 PID: 4803 Comm: rm Not tainted 6.10.0-rc3-syzkaller-00102-ga3027fbd92ad #0
[ 114.265197][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[ 114.275517][ C0] =====================================================
[ 114.282666][ C0] Disabling lock debugging due to kernel taint
[ 114.289094][ C0] Kernel panic - not syncing: kmsan.panic set ...
[ 114.295774][ C0] CPU: 0 PID: 4803 Comm: rm Tainted: G B 6.10.0-rc3-syzkaller-00102-ga3027fbd92ad #0
[ 114.307012][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[ 114.317158][ C0] Call Trace:
[ 114.320500][ C0] <IRQ>
[ 114.323392][ C0] dump_stack_lvl+0x216/0x2d0
[ 114.328201][ C0] ? kmsan_get_shadow_origin_ptr+0x4d/0xb0
[ 114.334149][ C0] dump_stack+0x1e/0x30
[ 114.338426][ C0] panic+0x4e2/0xcd0
[ 114.342445][ C0] ? kmsan_get_metadata+0xb1/0x1d0
[ 114.348148][ C0] kmsan_report+0x2d5/0x2e0
[ 114.352948][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 114.358285][ C0] ? __msan_warning+0x95/0x120
[ 114.363159][ C0] ? receive_buf+0x25e3/0x5fd0
[ 114.368024][ C0] ? virtnet_poll+0xd1c/0x23c0
[ 114.372882][ C0] ? __napi_poll+0xe7/0x980
[ 114.377788][ C0] ? net_rx_action+0x82a/0x1850
[ 114.382798][ C0] ? handle_softirqs+0x1ce/0x800
[ 114.387868][ C0] ? __irq_exit_rcu+0x68/0x120
[ 114.392766][ C0] ? irq_exit_rcu+0x12/0x20
[ 114.397357][ C0] ? common_interrupt+0x94/0xa0
[ 114.402324][ C0] ? asm_common_interrupt+0x2b/0x40
[ 114.407634][ C0] ? __msan_metadata_ptr_for_load_8+0x18/0x40
[ 114.413807][ C0] ? filemap_map_pages+0xe81/0x2e30
[ 114.419117][ C0] ? handle_mm_fault+0x6f36/0xe610
[ 114.424461][ C0] ? exc_page_fault+0x41b/0x700
[ 114.429619][ C0] ? asm_exc_page_fault+0x2b/0x30
[ 114.434797][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 114.440132][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 114.445631][ C0] ? kmsan_internal_memmove_metadata+0x17b/0x230
[ 114.452123][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 114.457453][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 114.462794][ C0] ? page_to_skb+0xdae/0x1620
[ 114.467694][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 114.473057][ C0] __msan_warning+0x95/0x120
[ 114.477746][ C0] receive_buf+0x25e3/0x5fd0
[ 114.482558][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 114.488004][ C0] ? kmsan_get_shadow_origin_ptr+0x4d/0xb0
[ 114.493964][ C0] virtnet_poll+0xd1c/0x23c0
[ 114.498684][ C0] ? __pfx_virtnet_poll+0x10/0x10
[ 114.503816][ C0] __napi_poll+0xe7/0x980
[ 114.508269][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 114.513605][ C0] net_rx_action+0x82a/0x1850
[ 114.518407][ C0] ? sched_clock_cpu+0x55/0x870
[ 114.523437][ C0] ? __pfx_net_rx_action+0x10/0x10
[ 114.528662][ C0] handle_softirqs+0x1ce/0x800
[ 114.533665][ C0] __irq_exit_rcu+0x68/0x120
[ 114.538379][ C0] irq_exit_rcu+0x12/0x20
[ 114.542838][ C0] common_interrupt+0x94/0xa0
[ 114.547656][ C0] </IRQ>
[ 114.550894][ C0] <TASK>
[ 114.553890][ C0] asm_common_interrupt+0x2b/0x40
[ 114.559040][ C0] RIP: 0010:__msan_metadata_ptr_for_load_8+0x18/0x40
[ 114.565833][ C0] Code: 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 48 89 e5 53 48 83 ec 10 9c 8f 45 e8 0f 01 ca 48 8b 5d e8 <be> 08 00 00 00 31 d2 e8 9c 25 00 00 48 89 5d f0 ff 75 f0 9d 48 83
[ 114.585747][ C0] RSP: 0000:ffff88811852fa60 EFLAGS: 00000286
[ 114.591926][ C0] RAX: 0000000000000000 RBX: 0000000000000286 RCX: ffff888116094180
[ 114.600091][ C0] RDX: 0000000000000000 RSI: 0000000000000036 RDI: ffff88811852fa90
[ 114.608158][ C0] RBP: ffff88811852fa78 R08: ffffffff8203f34a R09: ffffffff8203e5a8
[ 114.616220][ C0] R10: 0000000000000002 R11: ffff888116094180 R12: 0000000002b000d1
[ 114.624272][ C0] R13: 000000000000000c R14: 000000000000000b R15: 0000000000000000
[ 114.632317][ C0] ? next_uptodate_folio+0x4c8/0x1730
[ 114.637792][ C0] ? next_uptodate_folio+0x126a/0x1730
[ 114.643393][ C0] filemap_map_pages+0xe81/0x2e30
[ 114.648516][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 114.653822][ C0] ? kmsan_get_shadow_origin_ptr+0x4d/0xb0
[ 114.659840][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 114.665189][ C0] handle_mm_fault+0x6f36/0xe610
[ 114.670266][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 114.675574][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 114.681161][ C0] ? __pfx_filemap_map_pages+0x10/0x10
[ 114.686733][ C0] exc_page_fault+0x41b/0x700
[ 114.691535][ C0] asm_exc_page_fault+0x2b/0x30
[ 114.696492][ C0] RIP: 0033:0x7fc22a8cdd20
[ 114.701001][ C0] Code: Unable to access opcode bytes at 0x7fc22a8cdcf6.
[ 114.708193][ C0] RSP: 002b:00007ffd152fccc0 EFLAGS: 00010202
[ 114.714661][ C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 114.722723][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 114.730785][ C0] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 114.738829][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[ 114.747002][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 114.755163][ C0] </TASK>
[ 114.758494][ C0] Kernel Offset: disabled
[ 114.762888][ C0] Rebooting in 86400 seconds..
syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.21.4'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2855798142=/tmp/go-build -gno-record-gcc-switches'
git status (err=<nil>)
HEAD detached at 2aa5052fed
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
go fmt ./sys/... >/dev/null
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=2aa5052fed5f8993afacfce02174322df0f03ec4 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240612-135002'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=2aa5052fed5f8993afacfce02174322df0f03ec4 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240612-135002'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"2aa5052fed5f8993afacfce02174322df0f03ec4\"
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=12e30256980000
Tested on:
commit: a3027fbd Merge branch 'master' into syz-test
git tree: git://git.kernel.dk/linux.git syz-test
kernel config: https://syzkaller.appspot.com/x/.config?x=3486f1660f47f855
dashboard link: https://syzkaller.appspot.com/bug?extid=e6616d0dc8ded5dc56d6
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Note: no patches were applied.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] [io-uring?] KMSAN: uninit-value in io_req_cqe_overflow (3)
2024-06-13 19:38 [syzbot] [io-uring?] KMSAN: uninit-value in io_req_cqe_overflow (3) syzbot
2024-06-14 1:28 ` Jens Axboe
@ 2024-07-25 15:09 ` Jens Axboe
2024-07-25 17:58 ` syzbot
2024-07-25 15:33 ` Jens Axboe
2 siblings, 1 reply; 8+ messages in thread
From: Jens Axboe @ 2024-07-25 15:09 UTC (permalink / raw)
To: syzbot, asml.silence, io-uring, linux-kernel, syzkaller-bugs
#syz test: git://git.kernel.dk/linux io_uring-6.11
--
Jens Axboe
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] [io-uring?] KMSAN: uninit-value in io_req_cqe_overflow (3)
2024-06-13 19:38 [syzbot] [io-uring?] KMSAN: uninit-value in io_req_cqe_overflow (3) syzbot
2024-06-14 1:28 ` Jens Axboe
2024-07-25 15:09 ` Jens Axboe
@ 2024-07-25 15:33 ` Jens Axboe
2 siblings, 0 replies; 8+ messages in thread
From: Jens Axboe @ 2024-07-25 15:33 UTC (permalink / raw)
To: syzbot, asml.silence, io-uring, linux-kernel, syzkaller-bugs
#syz fix: io_uring/net: assign kmsg inq/flags before buffer selection
--
Jens Axboe
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] [io-uring?] KMSAN: uninit-value in io_req_cqe_overflow (3)
2024-07-25 15:09 ` Jens Axboe
@ 2024-07-25 17:58 ` syzbot
0 siblings, 0 replies; 8+ messages in thread
From: syzbot @ 2024-07-25 17:58 UTC (permalink / raw)
To: asml.silence, axboe, io-uring, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: [email protected]
Tested-by: [email protected]
Tested on:
commit: 0db4618e io_uring/msg_ring: fix uninitialized use of t..
git tree: git://git.kernel.dk/linux io_uring-6.11
console output: https://syzkaller.appspot.com/x/log.txt?x=124e0dad980000
kernel config: https://syzkaller.appspot.com/x/.config?x=bf984d38d0f9fb49
dashboard link: https://syzkaller.appspot.com/bug?extid=e6616d0dc8ded5dc56d6
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2024-07-25 17:58 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-06-13 19:38 [syzbot] [io-uring?] KMSAN: uninit-value in io_req_cqe_overflow (3) syzbot
2024-06-14 1:28 ` Jens Axboe
2024-06-14 1:53 ` syzbot
2024-06-14 1:56 ` Jens Axboe
2024-06-14 2:20 ` syzbot
2024-07-25 15:09 ` Jens Axboe
2024-07-25 17:58 ` syzbot
2024-07-25 15:33 ` Jens Axboe
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox