syzbot


KMSAN: uninit-value in vsock_assign_transport (2)

Status: fixed on 2024/08/14 03:44
Subsystems: net virt
[Documentation on labels]
Reported-by: syzbot+6c21aeb59d0e82eb2782@syzkaller.appspotmail.com
Fix commit: 1e1fdcbdde3b vhost/vsock: always initialize seqpacket_allow
First crash: 238d, last: 182d
Discussions (4)
Title Replies (including bot) Last reply
[GIT PULL] virtio: features, fixes, cleanups 6 (6) 2024/07/19 19:38
[PATCH] vhost/vsock: always initialize seqpacket_allow 6 (6) 2024/06/27 03:37
[PATCH virt] virt: fix uninit-value in vhost_vsock_dev_open 6 (6) 2024/05/05 19:53
[syzbot] [virt?] [net?] KMSAN: uninit-value in vsock_assign_transport (2) 3 (7) 2024/04/23 01:31
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in vsock_assign_transport net virt C 2 376d 391d 0/28 auto-obsoleted due to no activity on 2024/03/01 07:31
Last patch testing requests (4)
Created Duration User Patch Repo Result
2024/05/17 04:36 22m retest repro upstream error
2024/04/22 14:18 6h50m mst@redhat.com https://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost.git bcc17a060d93b198d8a17a9b87b593f41337ee28 OK log
2024/04/19 14:56 27m aha310510@gmail.com patch upstream OK log
2024/04/19 12:40 7m aha310510@gmail.com patch upstream error

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in vsock_assign_transport+0xb2a/0xb90 net/vmw_vsock/af_vsock.c:500
 vsock_assign_transport+0xb2a/0xb90 net/vmw_vsock/af_vsock.c:500
 vsock_connect+0x544/0x1560 net/vmw_vsock/af_vsock.c:1393
 __sys_connect_file net/socket.c:2048 [inline]
 __sys_connect+0x606/0x690 net/socket.c:2065
 __do_sys_connect net/socket.c:2075 [inline]
 __se_sys_connect net/socket.c:2072 [inline]
 __x64_sys_connect+0x91/0xe0 net/socket.c:2072
 x64_sys_call+0x3356/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:43
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 __kmalloc_large_node+0x231/0x370 mm/slub.c:3921
 __do_kmalloc_node mm/slub.c:3954 [inline]
 __kmalloc_node+0xb07/0x1060 mm/slub.c:3973
 kmalloc_node include/linux/slab.h:648 [inline]
 kvmalloc_node+0xc0/0x2d0 mm/util.c:634
 kvmalloc include/linux/slab.h:766 [inline]
 vhost_vsock_dev_open+0x44/0x510 drivers/vhost/vsock.c:659
 misc_open+0x66b/0x760 drivers/char/misc.c:165
 chrdev_open+0xa5f/0xb80 fs/char_dev.c:414
 do_dentry_open+0x11f1/0x2120 fs/open.c:955
 vfs_open+0x7e/0xa0 fs/open.c:1089
 do_open fs/namei.c:3642 [inline]
 path_openat+0x4a3c/0x5b00 fs/namei.c:3799
 do_filp_open+0x20e/0x590 fs/namei.c:3826
 do_sys_openat2+0x1bf/0x2f0 fs/open.c:1406
 do_sys_open fs/open.c:1421 [inline]
 __do_sys_openat fs/open.c:1437 [inline]
 __se_sys_openat fs/open.c:1432 [inline]
 __x64_sys_openat+0x2a1/0x310 fs/open.c:1432
 x64_sys_call+0x3a64/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 1 PID: 5021 Comm: syz-executor390 Not tainted 6.9.0-rc4-syzkaller-00038-g8cd26fd90c1a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
=====================================================

Crashes (14):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/04/19 01:41 upstream 8cd26fd90c1a af24b050 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in vsock_assign_transport
2024/06/13 12:13 upstream 614da38e2f7a 2aa5052f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in vsock_assign_transport
2024/06/13 12:13 upstream 614da38e2f7a 2aa5052f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in vsock_assign_transport
2024/06/13 09:42 upstream 614da38e2f7a 2aa5052f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in vsock_assign_transport
2024/06/13 09:42 upstream 614da38e2f7a 2aa5052f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in vsock_assign_transport
2024/05/03 04:22 upstream 49a73b1652c5 ddfc15a1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in vsock_assign_transport
2024/05/02 17:28 upstream 0106679839f7 3ba885bc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in vsock_assign_transport
2024/04/18 19:58 upstream 8cd26fd90c1a af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in vsock_assign_transport
2024/06/13 14:28 upstream 101b7a97143a 2aa5052f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in vsock_assign_transport
2024/06/13 14:28 upstream 101b7a97143a 2aa5052f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in vsock_assign_transport
2024/06/13 13:07 upstream 101b7a97143a 2aa5052f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in vsock_assign_transport
2024/06/13 13:07 upstream 101b7a97143a 2aa5052f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in vsock_assign_transport
2024/05/02 17:32 upstream 0106679839f7 3ba885bc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in vsock_assign_transport
2024/04/19 14:23 upstream 2668e3ae2ef3 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in vsock_assign_transport
* Struck through repros no longer work on HEAD.