KMSAN: uninit-value in isofs

KMSAN: uninit-value in isofs_readdir

Status: upstream: reported C repro on 2025/02/09 05:48
Subsystems: isofs
[Documentation on labels]
Reported-by: syzbot+812641c6c3d7586a1613@syzkaller.appspotmail.com
Fix commit: isofs: fix KMSAN uninit-value bug in do_isofs_readdir()
Patched on: [ci-upstream-linux-next-kasan-gce-root], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 17d, last: 16d

▶ ▼ Discussions (2)

Title	Replies (including bot)	Last reply
[PATCH] isofs: fix KMSAN uninit-value bug in do_isofs_readdir()	2 (2)	2025/02/12 13:26
[syzbot] [isofs?] KMSAN: uninit-value in isofs_readdir	0 (3)	2025/02/11 01:00

▶ ▼ Last patch testing requests (2)


Created	Duration	User	Patch	Repo	Result
2025/02/11 01:00	28m	qasdev00@gmail.com	patch	upstream	OK log
2025/02/09 23:50	28m	qasdev00@gmail.com	patch	upstream	OK log

Sample crash report:

loop0: detected capacity change from 1764 to 1763
=====================================================
BUG: KMSAN: uninit-value in do_isofs_readdir fs/isofs/dir.c:150 [inline]
BUG: KMSAN: uninit-value in isofs_readdir+0xa33/0x2610 fs/isofs/dir.c:262
 do_isofs_readdir fs/isofs/dir.c:150 [inline]
 isofs_readdir+0xa33/0x2610 fs/isofs/dir.c:262
 iterate_dir+0x740/0x930 fs/readdir.c:108
 __do_sys_getdents64 fs/readdir.c:403 [inline]
 __se_sys_getdents64+0x170/0x540 fs/readdir.c:389
 __x64_sys_getdents64+0x96/0xe0 fs/readdir.c:389
 x64_sys_call+0x3b0f/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:218
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 __alloc_frozen_pages_noprof+0x9a7/0xe00 mm/page_alloc.c:4762
 alloc_pages_mpol+0x4cd/0x890 mm/mempolicy.c:2270
 alloc_frozen_pages_noprof mm/mempolicy.c:2341 [inline]
 alloc_pages_noprof+0x1b5/0x250 mm/mempolicy.c:2361
 get_free_pages_noprof+0x34/0xc0 mm/page_alloc.c:4798
 isofs_readdir+0x74/0x2610 fs/isofs/dir.c:256
 iterate_dir+0x740/0x930 fs/readdir.c:108
 __do_sys_getdents64 fs/readdir.c:403 [inline]
 __se_sys_getdents64+0x170/0x540 fs/readdir.c:389
 __x64_sys_getdents64+0x96/0xe0 fs/readdir.c:389
 x64_sys_call+0x3b0f/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:218
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 5784 Comm: syz-executor207 Not tainted 6.14.0-rc1-syzkaller-00028-g5c8c229261f1 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
=====================================================

Crashes (2):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2025/02/05 19:06	upstream	5c8c229261f1	5896748e	.config	strace log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro]	ci-upstream-kmsan-gce-root	KMSAN: uninit-value in isofs_readdir
2025/02/05 05:42	upstream	d009de7d5428	4baca3d6	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kmsan-gce-root	KMSAN: uninit-value in isofs_readdir

* ~~Struck through~~ repros no longer work on HEAD.