syzbot


KMSAN: uninit-value in htab_percpu_map_lookup_elem

Status: upstream: reported C repro on 2024/04/14 11:10
Subsystems: bpf
[Documentation on labels]
Reported-by: syzbot+0a079d6ef3831217a230@syzkaller.appspotmail.com
First crash: 41d, last: 15d
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [bpf?] KMSAN: uninit-value in htab_percpu_map_lookup_elem 0 (1) 2024/04/14 11:10
Last patch testing requests (1)
Created Duration User Patch Repo Result
2024/05/06 05:34 24m retest repro upstream report log

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in __htab_map_lookup_elem kernel/bpf/hashtab.c:691 [inline]
BUG: KMSAN: uninit-value in htab_percpu_map_lookup_elem+0x3eb/0x4f0 kernel/bpf/hashtab.c:2302
 __htab_map_lookup_elem kernel/bpf/hashtab.c:691 [inline]
 htab_percpu_map_lookup_elem+0x3eb/0x4f0 kernel/bpf/hashtab.c:2302
 ____bpf_map_lookup_elem kernel/bpf/helpers.c:42 [inline]
 bpf_map_lookup_elem+0x5c/0x80 kernel/bpf/helpers.c:38
 ___bpf_prog_run+0x13fe/0xe0f0 kernel/bpf/core.c:1997
 __bpf_prog_run32+0xb2/0xe0 kernel/bpf/core.c:2236
 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]
 __bpf_prog_run include/linux/filter.h:657 [inline]
 bpf_prog_run include/linux/filter.h:664 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline]
 bpf_trace_run4+0x150/0x340 kernel/trace/bpf_trace.c:2422
 __bpf_trace_mm_page_alloc+0x37/0x50 include/trace/events/kmem.h:177
 trace_mm_page_alloc include/trace/events/kmem.h:177 [inline]
 __alloc_pages+0xdc0/0xe70 mm/page_alloc.c:4597
 alloc_pages_mpol+0x299/0x990 mm/mempolicy.c:2264
 vma_alloc_folio+0x418/0x680 mm/mempolicy.c:2303
 wp_page_copy mm/memory.c:3263 [inline]
 do_wp_page+0x196c/0x66e0 mm/memory.c:3660
 handle_pte_fault mm/memory.c:5316 [inline]
 __handle_mm_fault mm/memory.c:5441 [inline]
 handle_mm_fault+0x5b76/0xce00 mm/memory.c:5606
 do_user_addr_fault arch/x86/mm/fault.c:1362 [inline]
 handle_page_fault arch/x86/mm/fault.c:1505 [inline]
 exc_page_fault+0x419/0x730 arch/x86/mm/fault.c:1563
 asm_exc_page_fault+0x2b/0x30 arch/x86/include/asm/idtentry.h:623

Local variable stack created at:
 __bpf_prog_run32+0x43/0xe0 kernel/bpf/core.c:2236
 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]
 __bpf_prog_run include/linux/filter.h:657 [inline]
 bpf_prog_run include/linux/filter.h:664 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline]
 bpf_trace_run4+0x150/0x340 kernel/trace/bpf_trace.c:2422

CPU: 0 PID: 5021 Comm: syz-executor180 Not tainted 6.9.0-rc3-syzkaller-00023-g2c71fdf02a95 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
=====================================================

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/04/10 12:17 upstream 2c71fdf02a95 56086b24 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in htab_percpu_map_lookup_elem
2024/04/22 05:26 upstream 3b68086599f8 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in htab_percpu_map_lookup_elem
2024/04/18 23:57 upstream 8cd26fd90c1a af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in htab_percpu_map_lookup_elem
2024/04/10 11:01 upstream 2c71fdf02a95 56086b24 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in htab_percpu_map_lookup_elem
2024/04/22 05:31 upstream 48cf398f15fc af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in htab_percpu_map_lookup_elem
2024/04/10 11:21 upstream 2c71fdf02a95 56086b24 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in htab_percpu_map_lookup_elem
* Struck through repros no longer work on HEAD.