Re: [syzbot] [io-uring?] KMSAN: uninit-value in io_nop

[Jens Axboe <axboe@kernel.dk>]

On 11/21/24 7:08 AM, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    43fb83c17ba2 Merge tag 'soc-arm-6.13' of git://git.kernel...
> git tree:       upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=134feb78580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=9f17942989df952c
> dashboard link: https://syzkaller.appspot.com/bug?extid=9a8500a45c2cabdf9577
> compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=16f767f7980000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12f50ec0580000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/e1e82262b7ac/disk-43fb83c1.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/7ca6e1c46dc5/vmlinux-43fb83c1.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/63aaea837532/bzImage-43fb83c1.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+9a8500a45c2cabdf9577@syzkaller.appspotmail.com
> 
> =====================================================
> BUG: KMSAN: uninit-value in io_nop+0x549/0x8a0 io_uring/nop.c:55
>  io_nop+0x549/0x8a0 io_uring/nop.c:55
>  io_issue_sqe+0x420/0x2130 io_uring/io_uring.c:1712
>  io_queue_sqe io_uring/io_uring.c:1922 [inline]
>  io_submit_sqe io_uring/io_uring.c:2177 [inline]
>  io_submit_sqes+0x11bc/0x2f80 io_uring/io_uring.c:2294
>  __do_sys_io_uring_enter io_uring/io_uring.c:3365 [inline]
>  __se_sys_io_uring_enter+0x423/0x4aa0 io_uring/io_uring.c:3300
>  __x64_sys_io_uring_enter+0x11f/0x1a0 io_uring/io_uring.c:3300
>  x64_sys_call+0xce5/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:427
>  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
>  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> Uninit was created at:
>  __alloc_pages_noprof+0x9a7/0xe00 mm/page_alloc.c:4774
>  alloc_pages_mpol_noprof+0x299/0x990 mm/mempolicy.c:2265
>  alloc_pages_noprof+0x1bf/0x1e0 mm/mempolicy.c:2345
>  alloc_slab_page mm/slub.c:2412 [inline]
>  allocate_slab+0x320/0x12e0 mm/slub.c:2578
>  new_slab mm/slub.c:2631 [inline]
>  ___slab_alloc+0x12ef/0x35e0 mm/slub.c:3818
>  __kmem_cache_alloc_bulk mm/slub.c:4895 [inline]
>  kmem_cache_alloc_bulk_noprof+0x486/0x1330 mm/slub.c:4967
>  __io_alloc_req_refill+0x84/0x5b0 io_uring/io_uring.c:958
>  io_alloc_req io_uring/io_uring.h:411 [inline]
>  io_submit_sqes+0x9a2/0x2f80 io_uring/io_uring.c:2283
>  __do_sys_io_uring_enter io_uring/io_uring.c:3365 [inline]
>  __se_sys_io_uring_enter+0x423/0x4aa0 io_uring/io_uring.c:3300
>  __x64_sys_io_uring_enter+0x11f/0x1a0 io_uring/io_uring.c:3300
>  x64_sys_call+0xce5/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:427
>  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
>  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f

Yep that's a bug introduced in this merge window, the below should
fix it:

commit ee116574de8415b0673c466e6cd28ba5f70c41a2
Author: Jens Axboe <axboe@kernel.dk>
Date:   Thu Nov 21 07:12:17 2024 -0700

    io_uring/nop: ensure nop->fd is always initialized
    
    A previous commit added file support for nop, but it only initializes
    nop->fd if IORING_NOP_FIXED_FILE is set. That check should be
    IORING_NOP_FILE. Fix up the condition in nop preparation, and initialize
    it to a sane value even if we're not going to be directly using it.
    
    While in there, do the same thing for the nop->buffer field.
    
    Reported-by: syzbot+9a8500a45c2cabdf9577@syzkaller.appspotmail.com
    Fixes: a85f31052bce ("io_uring/nop: add support for testing registered files and buffers")
    Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/nop.c b/io_uring/nop.c
index 6d470d4251ee..5e5196df650a 100644
--- a/io_uring/nop.c
+++ b/io_uring/nop.c
@@ -35,10 +35,14 @@ int io_nop_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 		nop->result = READ_ONCE(sqe->len);
 	else
 		nop->result = 0;
-	if (nop->flags & IORING_NOP_FIXED_FILE)
+	if (nop->flags & IORING_NOP_FILE)
 		nop->fd = READ_ONCE(sqe->fd);
+	else
+		nop->fd = -1;
 	if (nop->flags & IORING_NOP_FIXED_BUFFER)
 		nop->buffer = READ_ONCE(sqe->buf_index);
+	else
+		nop->buffer = -1;
 	return 0;
 }
 
-- 
Jens Axboe