syzbot

 sign-in | mailing list | source | docs
🐞 Open [993] ≡ Subsystems 🐞 Fixed [5244] 🐞 Invalid [12515] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KMSAN: uninit-value in dev_map_lookup_elem

Status: upstream: reported C repro on 2024/03/25 09:36
Subsystems: bpf net
[Documentation on labels]
Reported-by: syzbot+1a3cf6f08d68868f9db3@syzkaller.appspotmail.com
Fix commit: bpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode
Patched on: [ci-upstream-bpf-next-kasan-gce ci-upstream-linux-next-kasan-gce-root], missing on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-upstream-bpf-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-net-next-test-gce ci2-upstream-usb]
First crash: 33d, last: 26d
▶ ▼ Duplicate bugs (7)
duplicates (7):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
KMSAN: uninit-value in bpf_bprintf_prepare bpf C 4 29d 65d 0/26 closed as dup on 2024/04/09 05:35
KMSAN: uninit-value in strnchr bpf C 45 8h25m 50d 0/26 closed as dup on 2024/04/09 05:30
KMSAN: uninit-value in bstr_printf bpf 1 69d 65d 0/26 closed as dup on 2024/04/09 05:33
KMSAN: uninit-value in percpu_array_map_lookup_elem bpf C 11 25d 38d 0/26 closed as dup on 2024/04/09 05:37
KMSAN: uninit-value in percpu_array_map_lookup_percpu_elem bpf C 5 23d 24d 0/26 closed as dup on 2024/04/03 17:55
KMSAN: uninit-value in htab_lru_map_delete_elem bpf C 2 24d 20d 0/26 closed as dup on 2024/04/08 22:13
KMSAN: uninit-value in htab_lru_percpu_map_lookup_elem bpf C 5 18d 20d 0/26 closed as dup on 2024/04/08 22:12
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[PATCH bpf-next] bpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode 2 (2) 2024/03/29 02:10
[syzbot] [bpf?] [net?] KMSAN: uninit-value in dev_map_lookup_elem 5 (9) 2024/03/28 18:23
▶ ▼ Last patch testing requests (3)
Created Duration User Patch Repo Result
2024/03/27 23:41 1h14m martin.lau@linux.dev git://git.kernel.org/pub/scm/linux/kernel/git/martin.lau/bpf-next.git d8889e866be3 OK log
2024/03/27 22:18 7h42m martin.lau@linux.dev git://git.kernel.org/pub/scm/linux/kernel/git/martin.lau/bpf-next.git interpreter.kmsan OK log
2024/03/27 18:46 10h53m martin.lau@linux.dev git://git.kernel.org/pub/scm/linux/kernel/git/martin.lau/bpf-next.git interpreter.kmsan error OK

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in __dev_map_lookup_elem kernel/bpf/devmap.c:441 [inline]
BUG: KMSAN: uninit-value in dev_map_lookup_elem+0xf3/0x170 kernel/bpf/devmap.c:796
 __dev_map_lookup_elem kernel/bpf/devmap.c:441 [inline]
 dev_map_lookup_elem+0xf3/0x170 kernel/bpf/devmap.c:796
 ____bpf_map_lookup_elem kernel/bpf/helpers.c:42 [inline]
 bpf_map_lookup_elem+0x5c/0x80 kernel/bpf/helpers.c:38
 ___bpf_prog_run+0x13fe/0xe0f0 kernel/bpf/core.c:1997
 __bpf_prog_run256+0xb5/0xe0 kernel/bpf/core.c:2237
 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]
 __bpf_prog_run include/linux/filter.h:657 [inline]
 bpf_prog_run include/linux/filter.h:664 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline]
 bpf_trace_run5+0x16f/0x350 kernel/trace/bpf_trace.c:2423
 __bpf_trace_ext4_remove_blocks+0x45/0x60 include/trace/events/ext4.h:1984
 __traceiter_ext4_remove_blocks+0xb5/0x170 include/trace/events/ext4.h:1984
 trace_ext4_remove_blocks include/trace/events/ext4.h:1984 [inline]
 ext4_remove_blocks fs/ext4/extents.c:2463 [inline]
 ext4_ext_rm_leaf fs/ext4/extents.c:2686 [inline]
 ext4_ext_remove_space+0x4e30/0x7e00 fs/ext4/extents.c:2934
 ext4_ext_truncate+0x1e3/0x390 fs/ext4/extents.c:4440
 ext4_truncate+0x14c6/0x1e10 fs/ext4/inode.c:4146
 ext4_evict_inode+0x1886/0x24d0 fs/ext4/inode.c:258
 evict+0x3ae/0xa60 fs/inode.c:667
 iput_final fs/inode.c:1741 [inline]
 iput+0x9ca/0xe10 fs/inode.c:1767
 d_delete_notify include/linux/fsnotify.h:307 [inline]
 vfs_rmdir+0x53c/0x790 fs/namei.c:4222
 do_rmdir+0x630/0x8b0 fs/namei.c:4268
 __do_sys_rmdir fs/namei.c:4287 [inline]
 __se_sys_rmdir fs/namei.c:4285 [inline]
 __x64_sys_rmdir+0x78/0xb0 fs/namei.c:4285
 do_syscall_64+0xd5/0x1f0
 entry_SYSCALL_64_after_hwframe+0x6d/0x75

Local variable stack created at:
 __bpf_prog_run256+0x45/0xe0 kernel/bpf/core.c:2237
 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]
 __bpf_prog_run include/linux/filter.h:657 [inline]
 bpf_prog_run include/linux/filter.h:664 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline]
 bpf_trace_run5+0x16f/0x350 kernel/trace/bpf_trace.c:2423

CPU: 0 PID: 5017 Comm: syz-executor365 Not tainted 6.8.0-syzkaller-13236-g5e74df2f8f15 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
=====================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/03/25 04:23 upstream 5e74df2f8f15 0ea90952 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dev_map_lookup_elem
2024/04/01 03:18 upstream 18737353cca0 6baf5069 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dev_map_lookup_elem
2024/03/25 02:07 upstream 5e74df2f8f15 0ea90952 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dev_map_lookup_elem
* Struck through repros no longer work on HEAD.