syzbot


KMSAN: uninit-value in io_req_task_work_add_remote

Status: fixed on 2024/08/23 02:59
Subsystems: io-uring
[Documentation on labels]
Reported-by: syzbot+82609b8937a4458106ca@syzkaller.appspotmail.com
Fix commit: 0db4618e8fab io_uring/msg_ring: fix uninitialized use of target_req->flags
First crash: 135d, last: 129d
Discussions (2)
Title Replies (including bot) Last reply
[syzbot] [io-uring?] KMSAN: uninit-value in io_req_task_work_add_remote 7 (13) 2024/07/25 17:32
[PATCH] io_uring/msg_ring: fix uninitialized use of target_req->flags 1 (1) 2024/07/25 14:47
Last patch testing requests (5)
Created Duration User Patch Repo Result
2024/07/25 14:46 27m axboe@kernel.dk git://git.kernel.dk/linux io_uring-6.11 OK log
2024/07/24 20:34 27m axboe@kernel.dk patch upstream OK log
2024/07/24 18:37 21m axboe@kernel.dk patch upstream report log
2024/07/24 12:11 2h56m eadavis@qq.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 2c9b3512402e report log
2024/07/24 11:13 24m eadavis@qq.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 2c9b3512402e report log

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in io_req_local_work_add io_uring/io_uring.c:1192 [inline]
BUG: KMSAN: uninit-value in io_req_task_work_add_remote+0x588/0x5d0 io_uring/io_uring.c:1240
 io_req_local_work_add io_uring/io_uring.c:1192 [inline]
 io_req_task_work_add_remote+0x588/0x5d0 io_uring/io_uring.c:1240
 io_msg_remote_post io_uring/msg_ring.c:102 [inline]
 io_msg_data_remote io_uring/msg_ring.c:133 [inline]
 io_msg_ring_data io_uring/msg_ring.c:152 [inline]
 io_msg_ring+0x1c38/0x1ef0 io_uring/msg_ring.c:305
 io_issue_sqe+0x383/0x22c0 io_uring/io_uring.c:1710
 io_queue_sqe io_uring/io_uring.c:1924 [inline]
 io_submit_sqe io_uring/io_uring.c:2180 [inline]
 io_submit_sqes+0x1259/0x2f20 io_uring/io_uring.c:2295
 __do_sys_io_uring_enter io_uring/io_uring.c:3205 [inline]
 __se_sys_io_uring_enter+0x40c/0x3ca0 io_uring/io_uring.c:3142
 __x64_sys_io_uring_enter+0x11f/0x1a0 io_uring/io_uring.c:3142
 x64_sys_call+0x2d82/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:427
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 __alloc_pages_noprof+0x9d6/0xe70 mm/page_alloc.c:4719
 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
 alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
 alloc_slab_page mm/slub.c:2321 [inline]
 allocate_slab+0x203/0x1220 mm/slub.c:2484
 new_slab mm/slub.c:2537 [inline]
 ___slab_alloc+0x12ef/0x35e0 mm/slub.c:3723
 __kmem_cache_alloc_bulk mm/slub.c:4759 [inline]
 kmem_cache_alloc_bulk_noprof+0x486/0x1330 mm/slub.c:4831
 __io_alloc_req_refill+0x84/0x560 io_uring/io_uring.c:940
 io_alloc_req io_uring/io_uring.h:393 [inline]
 io_submit_sqes+0x171b/0x2f20 io_uring/io_uring.c:2284
 __do_sys_io_uring_enter io_uring/io_uring.c:3205 [inline]
 __se_sys_io_uring_enter+0x40c/0x3ca0 io_uring/io_uring.c:3142
 __x64_sys_io_uring_enter+0x11f/0x1a0 io_uring/io_uring.c:3142
 x64_sys_call+0x2d82/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:427
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 1 UID: 0 PID: 5053 Comm: syz-executor367 Not tainted 6.10.0-syzkaller-11840-g933069701c1b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
=====================================================

Crashes (10):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/07/23 01:40 upstream 933069701c1b f063dfd9 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in io_req_task_work_add_remote
2024/07/26 02:23 upstream c33ffdb70cc6 32fcf98f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in io_req_task_work_add_remote
2024/07/26 02:23 upstream c33ffdb70cc6 32fcf98f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in io_req_task_work_add_remote
2024/07/22 08:25 upstream 7846b618e0a4 b88348e9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in io_req_task_work_add_remote
2024/07/21 12:38 upstream 2c9b3512402e b88348e9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in io_req_task_work_add_remote
2024/07/21 12:38 upstream 2c9b3512402e b88348e9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in io_req_task_work_add_remote
2024/07/20 21:40 upstream 3c3ff7be9729 b88348e9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in io_req_task_work_add_remote
2024/07/20 21:39 upstream 3c3ff7be9729 b88348e9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in io_req_task_work_add_remote
2024/07/20 10:47 upstream a4f928552058 b88348e9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in io_req_task_work_add_remote
2024/07/20 10:46 upstream a4f928552058 b88348e9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in io_req_task_work_add_remote
* Struck through repros no longer work on HEAD.