Re: [syzbot] [io-uring?] KMSAN: uninit-value in io_sendrecv_fail

[Pavel Begunkov <asml.silence@gmail.com>]

On 3/16/24 13:37, syzbot wrote:
> Hello,
> 
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> KMSAN: uninit-value in io_sendrecv_fail

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 3ae4bb988906..826989e2f601 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -1063,6 +1063,7 @@ static void io_preinit_req(struct io_kiocb *req, struct io_ring_ctx *ctx)
  	/* not necessary, but safer to zero */
  	memset(&req->cqe, 0, sizeof(req->cqe));
  	memset(&req->big_cqe, 0, sizeof(req->big_cqe));
+	memset(&req->cmd, 0, sizeof(req->cmd));
  }

What's the point of testing it? You said it yourself, it hides the
problem under the carpet but doesn't solve it. Do some valid IO first,
then send that failed request. If done_io is aliased with with some
interesting field of a previously completed request you're royally
screwed, but syz would be just happy about it.

It's likely that syz is complaining about is the early fail case
I told about yesterday.


> =====================================================
> BUG: KMSAN: uninit-value in io_sendrecv_fail+0x91/0x1e0 io_uring/net.c:1341
>   io_sendrecv_fail+0x91/0x1e0 io_uring/net.c:1341
>   io_req_defer_failed+0x3bd/0x610 io_uring/io_uring.c:1050
>   io_queue_sqe_fallback+0x1e3/0x280 io_uring/io_uring.c:2126
>   io_submit_fail_init+0x4e1/0x790 io_uring/io_uring.c:2304
>   io_submit_sqes+0x19cd/0x2fb0 io_uring/io_uring.c:2480
>   __do_sys_io_uring_enter io_uring/io_uring.c:3656 [inline]
>   __se_sys_io_uring_enter+0x409/0x4390 io_uring/io_uring.c:3591
>   __x64_sys_io_uring_enter+0x11b/0x1a0 io_uring/io_uring.c:3591
>   do_syscall_x64 arch/x86/entry/common.c:52 [inline]
>   do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
>   entry_SYSCALL_64_after_hwframe+0x63/0x6b
> 
> Uninit was created at:
>   __alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4592
>   __alloc_pages_node include/linux/gfp.h:238 [inline]
>   alloc_pages_node include/linux/gfp.h:261 [inline]
>   alloc_slab_page mm/slub.c:2190 [inline]
>   allocate_slab mm/slub.c:2354 [inline]
>   new_slab+0x2d7/0x1400 mm/slub.c:2407
>   ___slab_alloc+0x16b5/0x3970 mm/slub.c:3540
>   __kmem_cache_alloc_bulk mm/slub.c:4574 [inline]
>   kmem_cache_alloc_bulk+0x52a/0x1440 mm/slub.c:4648
>   __io_alloc_req_refill+0x248/0x780 io_uring/io_uring.c:1101
>   io_alloc_req io_uring/io_uring.h:405 [inline]
>   io_submit_sqes+0xaa1/0x2fb0 io_uring/io_uring.c:2469
>   __do_sys_io_uring_enter io_uring/io_uring.c:3656 [inline]
>   __se_sys_io_uring_enter+0x409/0x4390 io_uring/io_uring.c:3591
>   __x64_sys_io_uring_enter+0x11b/0x1a0 io_uring/io_uring.c:3591
>   do_syscall_x64 arch/x86/entry/common.c:52 [inline]
>   do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
>   entry_SYSCALL_64_after_hwframe+0x63/0x6b
> 
> CPU: 0 PID: 5482 Comm: syz-executor.0 Not tainted 6.8.0-syzkaller-00721-g6c677dd4eac2 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
> =====================================================
> 
> 
> Tested on:
> 
> commit:         6c677dd4 io_uring/net: ensure async prep handlers alwa..
> git tree:       git://git.kernel.dk/linux.git io_uring-6.9
> console output: https://syzkaller.appspot.com/x/log.txt?x=17f26711180000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=a271c5dca0ff14df
> dashboard link: https://syzkaller.appspot.com/bug?extid=f8e9a371388aa62ecab4
> compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> 
> Note: no patches were applied.

-- 
Pavel Begunkov